[STATEMENT]
lemma uadmit_prog_fml_adjoint':
  fixes \<sigma> I
  assumes ssafe:"ssafe \<sigma>"
  assumes good_interp:"is_interp I"
  shows "\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>x\<in>SDom \<sigma> \<inter> SIGP \<alpha>. SFV \<sigma> x) \<Longrightarrow> hpsafe \<alpha> \<Longrightarrow> prog_sem (adjoint I \<sigma> \<nu>) \<alpha> = prog_sem (adjoint I \<sigma> \<omega>) \<alpha>"
  and "\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>x\<in>SDom \<sigma> \<inter> SIGF \<phi>. SFV \<sigma> x) \<Longrightarrow> fsafe \<phi> \<Longrightarrow> fml_sem (adjoint I \<sigma> \<nu>) \<phi> = fml_sem (adjoint I \<sigma> \<omega>) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP \<alpha>))); hpsafe \<alpha>\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) \<alpha> = prog_sem (local.adjoint I \<sigma> \<omega>) \<alpha>) &&& (\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF \<phi>))); fsafe \<phi>\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
proof (induct "\<alpha>" and "\<phi>")
[PROOF STATE]
proof (state)
goal (15 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP ($\<alpha> x)))); hpsafe ($\<alpha> x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (local.adjoint I \<sigma> \<omega>) ($\<alpha> x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
A total of 15 subgoals...
[PROOF STEP]
case (Pvar x)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP ($\<alpha> x))))
hpsafe ($\<alpha> x)

goal (15 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP ($\<alpha> x)))); hpsafe ($\<alpha> x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (local.adjoint I \<sigma> \<omega>) ($\<alpha> x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
A total of 15 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP ($\<alpha> x))))
hpsafe ($\<alpha> x)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP ($\<alpha> x))))
hpsafe ($\<alpha> x)

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (local.adjoint I \<sigma> \<omega>) ($\<alpha> x)
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP ($\<alpha> x))))
hpsafe ($\<alpha> x)

goal (1 subgoal):
 1. prog_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<alpha> x) = prog_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<omega>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<omega> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<alpha> x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (local.adjoint I \<sigma> \<omega>) ($\<alpha> x)

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
case (Assign x e)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x := e))))
hpsafe (x := e)

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x := e). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x := e))))

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
assume safe:"hpsafe (x := e)"
[PROOF STATE]
proof (state)
this:
hpsafe (x := e)

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x := e)
[PROOF STEP]
have dsafe:"dsafe e"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x := e)

goal (1 subgoal):
 1. dsafe e
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe e

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
have sub:"(\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of Some x \<Rightarrow> FVT x | None \<Rightarrow> {}) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x := e). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x := e)))
[PROOF STEP]
using adj_sub_assign[of \<sigma> e x]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x := e)))

goal (1 subgoal):
 1. (\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x := e)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x := e)))

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
have "dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e
[PROOF STEP]
by (rule uadmit_dterm_adjointS[OF ssafe good_interp agree_sub[OF sub VA] dsafe])
[PROOF STATE]
proof (state)
this:
dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 := x2)))); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 := x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (x := e) = prog_sem (local.adjoint I \<sigma> \<omega>) (x := e)
[PROOF STEP]
by (auto simp add: vec_eq_iff)
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) (x := e) = prog_sem (local.adjoint I \<sigma> \<omega>) (x := e)

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
case (DiffAssign x e)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x e))))
hpsafe (DiffAssign x e)

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (DiffAssign x e). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x e))))

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
assume safe:"hpsafe (DiffAssign x e)"
[PROOF STATE]
proof (state)
this:
hpsafe (DiffAssign x e)

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (DiffAssign x e)
[PROOF STEP]
have dsafe:"dsafe e"
[PROOF STATE]
proof (prove)
using this:
hpsafe (DiffAssign x e)

goal (1 subgoal):
 1. dsafe e
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe e

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
have sub:"(\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of Some x \<Rightarrow> FVT x | None \<Rightarrow> {}) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (DiffAssign x e). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x e)))
[PROOF STEP]
using adj_sub_diff_assign[of \<sigma> e]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign ?x e)))

goal (1 subgoal):
 1. (\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x e)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>SIGT e. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x e)))

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
have "dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e
[PROOF STEP]
by (rule uadmit_dterm_adjointS[OF ssafe good_interp agree_sub[OF sub VA] dsafe])
[PROOF STATE]
proof (state)
this:
dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (DiffAssign x1 x2)))); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
dterm_sem (local.adjoint I \<sigma> \<nu>) e = dterm_sem (local.adjoint I \<sigma> \<omega>) e

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x e) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x e)
[PROOF STEP]
by (auto simp add: vec_eq_iff)
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x e) = prog_sem (local.adjoint I \<sigma> \<omega>) (DiffAssign x e)

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
case (Test x)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x))))
hpsafe (? x)

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x. SFV \<sigma> a) \<Longrightarrow> fsafe x \<Longrightarrow> fml_sem (adjoint I \<sigma> \<nu>) x = fml_sem (adjoint I \<sigma> \<omega>) x"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (? x). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x))))

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
assume hpsafe:"hpsafe (? x)"
[PROOF STATE]
proof (state)
this:
hpsafe (? x)

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe (? x)
[PROOF STEP]
have fsafe:"fsafe x"
[PROOF STATE]
proof (prove)
using this:
hpsafe (? x)

goal (1 subgoal):
 1. fsafe x
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
have sub:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (? x). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
have "fml_sem (adjoint I \<sigma> \<nu>) x = fml_sem (adjoint I \<sigma> \<omega>) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x
[PROOF STEP]
using IH[OF agree_sub[OF sub VA] fsafe]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (? x)))); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) (? x) = prog_sem (local.adjoint I \<sigma> \<omega>) (? x)

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
case (EvolveODE x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2))))
hpsafe (EvolveODE x1 x2)

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2))))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
assume safe:"hpsafe (EvolveODE x1 x2)"
[PROOF STATE]
proof (state)
this:
hpsafe (EvolveODE x1 x2)

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe (EvolveODE x1 x2)
[PROOF STEP]
have osafe:"osafe x1" and fsafe:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
hpsafe (EvolveODE x1 x2)

goal (1 subgoal):
 1. osafe x1 &&& fsafe x2
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
osafe x1
fsafe x2

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have sub1:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))
[PROOF STEP]
have VAF:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
using this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)))
[PROOF STEP]
using agree_sub[OF sub1 VA]
[PROOF STATE]
proof (prove)
using this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
note IH' = IH[OF VAF fsafe]
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have sub:"(\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))
[PROOF STEP]
using adj_sub_ode[of \<sigma> x1 x2]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))

goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have IH2:"ODE_sem (local.adjoint I \<sigma> \<nu>) x1 = ODE_sem (local.adjoint I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_sem (local.adjoint I \<sigma> \<nu>) x1 = ODE_sem (local.adjoint I \<sigma> \<omega>) x1
[PROOF STEP]
apply (rule uadmit_ode_adjoint')
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ssafe \<sigma>
 2. is_interp I
 3. Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 4. osafe x1
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ssafe \<sigma>
[PROOF STEP]
by (rule ssafe)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. is_interp I
 2. Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 3. osafe x1
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_interp I
[PROOF STEP]
by (rule good_interp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 2. osafe x1
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
using agree_sub[OF sub VA]
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. osafe x1
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. osafe x1
[PROOF STEP]
by (rule osafe)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
ODE_sem (local.adjoint I \<sigma> \<nu>) x1 = ODE_sem (local.adjoint I \<sigma> \<omega>) x1

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have mkv:"mk_v (adjoint I \<sigma> \<nu>) x1 = mk_v (adjoint I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v (local.adjoint I \<sigma> \<nu>) x1 = mk_v (local.adjoint I \<sigma> \<omega>) x1
[PROOF STEP]
apply (rule uadmit_mkv_adjoint)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. ssafe \<sigma>
 2. is_interp I
 3. Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 4. osafe x1
[PROOF STEP]
using ssafe good_interp osafe agree_sub[OF sub VA]
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>
is_interp I
osafe x1
Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (4 subgoals):
 1. ssafe \<sigma>
 2. is_interp I
 3. Vagree \<nu> \<omega> (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 4. osafe x1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
mk_v (local.adjoint I \<sigma> \<nu>) x1 = mk_v (local.adjoint I \<sigma> \<omega>) x1

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2})
 2. \<And>aa ba bb sol t. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2})
[PROOF STEP]
subgoal for aa ba bb sol t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2})
[PROOF STEP]
apply(rule exI[where x = sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
using mkv
[PROOF STATE]
proof (prove)
using this:
mk_v (local.adjoint I \<sigma> \<nu>) x1 = mk_v (local.adjoint I \<sigma> \<omega>) x1

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
using IH2 mkv IH'
[PROOF STATE]
proof (prove)
using this:
ODE_sem (local.adjoint I \<sigma> \<nu>) x1 = ODE_sem (local.adjoint I \<sigma> \<omega>) x1
mk_v (local.adjoint I \<sigma> \<nu>) x1 = mk_v (local.adjoint I \<sigma> \<omega>) x1
fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2})
[PROOF STEP]
subgoal for aa ba bb sol t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2})
[PROOF STEP]
apply(rule exI[where x = sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
using mkv
[PROOF STATE]
proof (prove)
using this:
mk_v (local.adjoint I \<sigma> \<nu>) x1 = mk_v (local.adjoint I \<sigma> \<omega>) x1

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
using IH2 mkv IH'
[PROOF STATE]
proof (prove)
using this:
ODE_sem (local.adjoint I \<sigma> \<nu>) x1 = ODE_sem (local.adjoint I \<sigma> \<omega>) x1
mk_v (local.adjoint I \<sigma> \<nu>) x1 = mk_v (local.adjoint I \<sigma> \<omega>) x1
fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (local.adjoint I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (local.adjoint I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> \<nu>) x2}
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (EvolveODE x1 x2)

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Choice x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2))))
hpsafe (x1 \<union>\<union> x2)

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP x1. SFV \<sigma> a) \<Longrightarrow> hpsafe x1 \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x1

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP x2. SFV \<sigma> a) \<Longrightarrow> hpsafe x2 \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x2

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2))))

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"hpsafe (x1 \<union>\<union> x2)"
[PROOF STATE]
proof (state)
this:
hpsafe (x1 \<union>\<union> x2)

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x1 \<union>\<union> x2)
[PROOF STEP]
have
    safe1:"hpsafe x1"
    and safe2:"hpsafe x2"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x1 \<union>\<union> x2)

goal (1 subgoal):
 1. hpsafe x1 &&& hpsafe x2
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x1
hpsafe x2

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGP x1. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGP x2. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 \<union>\<union> x2)))
prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1
prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 \<union>\<union> x2)

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Sequence x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2))))
hpsafe (x1 ;; x2)

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP x1. SFV \<sigma> a) \<Longrightarrow> hpsafe x1 \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x1

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP x2. SFV \<sigma> a) \<Longrightarrow> hpsafe x2 \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x2

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x1 ;; x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2))))

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"hpsafe (x1 ;; x2)"
[PROOF STATE]
proof (state)
this:
hpsafe (x1 ;; x2)

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x1 ;; x2)
[PROOF STEP]
have
    safe1:"hpsafe x1"
    and safe2:"hpsafe x2"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x1 ;; x2)

goal (1 subgoal):
 1. hpsafe x1 &&& hpsafe x2
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x1
hpsafe x2

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGP x1. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x1 ;; x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGP x2. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x1 ;; x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2))); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (x1 ;; x2)))
prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1
prog_sem (local.adjoint I \<sigma> \<nu>) x2 = prog_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (local.adjoint I \<sigma> \<omega>) (x1 ;; x2)

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Loop x)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**)))
hpsafe x**

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP x. SFV \<sigma> a) \<Longrightarrow> hpsafe x \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x**). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**)))

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"hpsafe (x**)"
[PROOF STATE]
proof (state)
this:
hpsafe x**

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe x**
[PROOF STEP]
have
    safe:"hpsafe x"
[PROOF STATE]
proof (prove)
using this:
hpsafe x**

goal (1 subgoal):
 1. hpsafe x
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGP x. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (x**). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x))); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x**))); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
[PROOF STEP]
using IH[OF agree_sub[OF sub VA] safe]
[PROOF STATE]
proof (prove)
using this:
prog_sem (local.adjoint I \<sigma> \<nu>) x = prog_sem (local.adjoint I \<sigma> \<omega>) x

goal (1 subgoal):
 1. prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (local.adjoint I \<sigma> \<nu>) x** = prog_sem (local.adjoint I \<sigma> \<omega>) x**

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Geq x1 x2)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2))))
fsafe (Geq x1 x2)

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Geq x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2))))

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Geq x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (Geq x1 x2)

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe (Geq x1 x2)
[PROOF STEP]
have dsafe1:"dsafe x1" and dsafe2:"dsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (Geq x1 x2)

goal (1 subgoal):
 1. dsafe x1 &&& dsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe x1
dsafe x2

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>i\<in>SIGT x1. case SFunctions \<sigma> i of Some x \<Rightarrow> FVT x | None \<Rightarrow> {}) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Geq x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>SIGT x1. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))
[PROOF STEP]
using adj_sub_geq1[of \<sigma> x1 x2]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>SIGT x1. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))

goal (1 subgoal):
 1. (\<Union>i\<in>SIGT x1. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>SIGT x1. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>i\<in>SIGT x2. case SFunctions \<sigma> i of Some x \<Rightarrow> FVT x | None \<Rightarrow> {}) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Geq x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>SIGT x2. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))
[PROOF STEP]
using adj_sub_geq2[of \<sigma> x2 x1]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>SIGT x2. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))

goal (1 subgoal):
 1. (\<Union>i\<in>SIGT x2. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>SIGT x2. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have "dterm_sem (local.adjoint I \<sigma> \<nu>) x1 = dterm_sem (local.adjoint I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (local.adjoint I \<sigma> \<nu>) x1 = dterm_sem (local.adjoint I \<sigma> \<omega>) x1
[PROOF STEP]
by (rule uadmit_dterm_adjointS[OF ssafe good_interp agree_sub[OF sub1 VA] dsafe1])
[PROOF STATE]
proof (state)
this:
dterm_sem (local.adjoint I \<sigma> \<nu>) x1 = dterm_sem (local.adjoint I \<sigma> \<omega>) x1

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dterm_sem (local.adjoint I \<sigma> \<nu>) x1 = dterm_sem (local.adjoint I \<sigma> \<omega>) x1

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have "dterm_sem (local.adjoint I \<sigma> \<nu>) x2 = dterm_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (local.adjoint I \<sigma> \<nu>) x2 = dterm_sem (local.adjoint I \<sigma> \<omega>) x2
[PROOF STEP]
by (rule uadmit_dterm_adjointS[OF ssafe good_interp agree_sub[OF sub2 VA] dsafe2])
[PROOF STATE]
proof (state)
this:
dterm_sem (local.adjoint I \<sigma> \<nu>) x2 = dterm_sem (local.adjoint I \<sigma> \<omega>) x2

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Geq x1 x2)))); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (local.adjoint I \<sigma> \<nu>) x1 = dterm_sem (local.adjoint I \<sigma> \<omega>) x1
dterm_sem (local.adjoint I \<sigma> \<nu>) x2 = dterm_sem (local.adjoint I \<sigma> \<omega>) x2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
dterm_sem (local.adjoint I \<sigma> \<nu>) x1 = dterm_sem (local.adjoint I \<sigma> \<omega>) x1
dterm_sem (local.adjoint I \<sigma> \<nu>) x2 = dterm_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Geq x1 x2)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Prop x1 x2 \<nu> \<omega>)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))))
fsafe ($\<phi> x1 x2)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))))

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe ($\<phi> x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> x1 x2)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe ($\<phi> x1 x2)
[PROOF STEP]
have safes:"\<And>i. dsafe (x2 i)"
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> x1 x2)

goal (1 subgoal):
 1. \<And>i. dsafe (x2 i)
[PROOF STEP]
using dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> x1 x2)
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>i. dsafe (x2 i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (x2 ?i8)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have subs:"\<And>j. (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of Some x \<Rightarrow> FVT x | None \<Rightarrow> {}) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>j. (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))
[PROOF STEP]
subgoal for j
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))
[PROOF STEP]
using adj_sub_prop[of \<sigma> x2 j x1]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))

goal (1 subgoal):
 1. (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>SIGT (x2 ?j8). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have "\<And>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) = dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) = dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i)
[PROOF STEP]
by (rule uadmit_dterm_adjointS[OF ssafe good_interp agree_sub[OF subs VA] safes])
[PROOF STATE]
proof (state)
this:
dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 ?i8) = dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 ?i8)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 ?i8) = dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 ?i8)
[PROOF STEP]
have vec_eq:"\<And>R. (\<chi> i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) R) = (\<chi> i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) R)"
[PROOF STATE]
proof (prove)
using this:
dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 ?i8) = dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 ?i8)

goal (1 subgoal):
 1. \<And>R. (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) R) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) R)
[PROOF STEP]
by (auto simp add: vec_eq_iff)
[PROOF STATE]
proof (state)
this:
(\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) ?R8) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) ?R8)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from VA
[PROOF STATE]
proof (chain)
picking this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))))
[PROOF STEP]
have VAs:"\<And>j. Vagree \<nu> \<omega> (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of Some a \<Rightarrow> FVT a | None \<Rightarrow> {})"
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))))

goal (1 subgoal):
 1. \<And>j. Vagree \<nu> \<omega> (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a)
[PROOF STEP]
unfolding Vagree_def SIGT.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>i. Inl i \<in> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))) \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))) \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)

goal (1 subgoal):
 1. \<And>j. (\<forall>i. Inl i \<in> (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)
[PROOF STEP]
using rangeI
[PROOF STATE]
proof (prove)
using this:
(\<forall>i. Inl i \<in> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))) \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2))) \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)
?f ?x \<in> range ?f

goal (1 subgoal):
 1. \<And>j. (\<forall>i. Inl i \<in> (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> (\<Union>i\<in>SIGT (x2 j). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)
[PROOF STEP]
by (metis (no_types, lifting) subsetD subs)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>i\<in>SIGT (x2 ?j8). case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have SIGF:"\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Inr (Inr x1) \<in> SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Inr (Inr x1) \<in> SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)
[PROOF STEP]
unfolding SDom_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Inr (Inr x1) \<in> ({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> SIGF ($\<phi> x1 x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SPredicates \<sigma> x1 = Some ?a8 \<Longrightarrow> Inr (Inr x1) \<in> SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have VAsub:"\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> (FVF a) \<subseteq> (\<Union>i\<in>SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2). SFV \<sigma> i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> FVF a \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))
[PROOF STEP]
using SIGF
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> x1 = Some ?a8 \<Longrightarrow> Inr (Inr x1) \<in> SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)

goal (1 subgoal):
 1. \<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> FVF a \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SPredicates \<sigma> x1 = Some ?a8 \<Longrightarrow> FVF ?a8 \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have VAf:"\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a)
[PROOF STEP]
using agree_sub[OF VAsub VA]
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> x1 = Some ?a9 \<Longrightarrow> Vagree \<nu> \<omega> (FVF ?a9)

goal (1 subgoal):
 1. \<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SPredicates \<sigma> x1 = Some ?a8 \<Longrightarrow> Vagree \<nu> \<omega> (FVF ?a8)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF ($\<phi> x1 x2)))); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
SPredicates \<sigma> x1 = Some ?a8 \<Longrightarrow> Vagree \<nu> \<omega> (FVF ?a8)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> x1 = Some ?a8 \<Longrightarrow> Vagree \<nu> \<omega> (FVF ?a8)

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
apply(cases "SPredicates \<sigma> x1")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = None\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>a. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
defer
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = None\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
subgoal for a
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
assume some:"SPredicates \<sigma> x1 = Some a"
[PROOF STATE]
proof (state)
this:
SPredicates \<sigma> x1 = Some a

goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
note FVF = VAf[OF some]
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (FVF a)

goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
have dsafe:"\<And>f f'. SFunctions \<sigma> f = Some f' \<Longrightarrow> dsafe f'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f f'. SFunctions \<sigma> f = Some f' \<Longrightarrow> dsafe f'
[PROOF STEP]
using ssafe dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>f f'. SFunctions \<sigma> f = Some f' \<Longrightarrow> dsafe f'
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>f f'. SFunctions \<sigma> f = Some f' \<Longrightarrow> dsafe f'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> ?f8 = Some ?f'8 \<Longrightarrow> dsafe ?f'8

goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
have dsem:"\<And>R . (\<nu> \<in> fml_sem (extendf I R) a) = (\<omega> \<in> fml_sem (extendf I R) a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>R. (\<nu> \<in> fml_sem (extendf I R) a) = (\<omega> \<in> fml_sem (extendf I R) a)
[PROOF STEP]
subgoal for R
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (extendf I R) a) = (\<omega> \<in> fml_sem (extendf I R) a)
[PROOF STEP]
apply (rule coincidence_formula)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. fsafe a
 2. Iagree (extendf I R) (extendf I R) (SIGF a)
 3. Vagree \<nu> \<omega> (FVF a)
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe a
[PROOF STEP]
using ssafe
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>

goal (1 subgoal):
 1. fsafe a
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')

goal (1 subgoal):
 1. fsafe a
[PROOF STEP]
using some
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')
SPredicates \<sigma> x1 = Some a

goal (1 subgoal):
 1. fsafe a
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. Iagree (extendf I R) (extendf I R) (SIGF a)
 2. Vagree \<nu> \<omega> (FVF a)
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Iagree (extendf I R) (extendf I R) (SIGF a)
[PROOF STEP]
unfolding Iagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>i\<in>SIGF a. (\<forall>x. i = Inl x \<longrightarrow> Functions (extendf I R) x = Functions (extendf I R) x) \<and> (\<forall>x. i = Inr (Inl x) \<longrightarrow> Contexts (extendf I R) x = Contexts (extendf I R) x) \<and> (\<forall>x. i = Inr (Inr x) \<longrightarrow> Predicates (extendf I R) x = Predicates (extendf I R) x) \<and> (\<forall>x. i = Inr (Inr x) \<longrightarrow> Programs (extendf I R) x = Programs (extendf I R) x) \<and> (\<forall>x. i = Inr (Inr x) \<longrightarrow> ODEs (extendf I R) x = ODEs (extendf I R) x) \<and> (\<forall>x. i = Inr (Inr x) \<longrightarrow> ODEBV (extendf I R) x = ODEBV (extendf I R) x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree \<nu> \<omega> (FVF a)
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree \<nu> \<omega> (FVF a)
[PROOF STEP]
by (rule FVF)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem (extendf I ?R8) a) = (\<omega> \<in> fml_sem (extendf I ?R8) a)

goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
have pred_eq:"\<And>R. Predicates (local.adjoint I \<sigma> \<nu>) x1 R = Predicates (local.adjoint I \<sigma> \<omega>) x1 R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>R. Predicates (local.adjoint I \<sigma> \<nu>) x1 R = Predicates (local.adjoint I \<sigma> \<omega>) x1 R
[PROOF STEP]
using dsem some
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem (extendf I ?R8) a) = (\<omega> \<in> fml_sem (extendf I ?R8) a)
SPredicates \<sigma> x1 = Some a

goal (1 subgoal):
 1. \<And>R. Predicates (local.adjoint I \<sigma> \<nu>) x1 R = Predicates (local.adjoint I \<sigma> \<omega>) x1 R
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem (extendf I ?R8) a) = (\<omega> \<in> fml_sem (extendf I ?R8) a)
SPredicates \<sigma> x1 = Some a

goal (1 subgoal):
 1. \<And>R. Predicates \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> x1 R = Predicates \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<omega>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<omega> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> x1 R
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Predicates (local.adjoint I \<sigma> \<nu>) x1 ?R8 = Predicates (local.adjoint I \<sigma> \<omega>) x1 ?R8

goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = Some a\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
show "fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b)) \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) (a, b))
 2. \<And>a b. Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) (a, b)) \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))
[PROOF STEP]
subgoal for a b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b)) \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) (a, b))
[PROOF STEP]
using pred_eq[of "(\<chi> i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))"] vec_eq
[PROOF STATE]
proof (prove)
using this:
Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b)) = Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))
(\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) ?R8) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) ?R8)

goal (1 subgoal):
 1. Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b)) \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) (a, b))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b. Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) (a, b)) \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))
[PROOF STEP]
subgoal for a b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) (a, b)) \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))
[PROOF STEP]
using pred_eq[of "(\<chi> i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))"] vec_eq
[PROOF STATE]
proof (prove)
using this:
Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b)) = Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))
(\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) ?R8) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) ?R8)

goal (1 subgoal):
 1. Predicates (local.adjoint I \<sigma> \<omega>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) (a, b)) \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) x1 (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) (a, b))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = None\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = None\<rbrakk> \<Longrightarrow> fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<phi> x1 x2) = fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<omega>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<omega> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<phi> x1 x2)
[PROOF STEP]
using local.adjoint_def local.vec_eq
[PROOF STATE]
proof (prove)
using this:
local.adjoint ?I ?\<sigma> ?\<nu> = \<lparr>Functions = \<lambda>f. case SFunctions ?\<sigma> f of None \<Rightarrow> Functions ?I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf ?I R) f' ?\<nu>, Predicates = \<lambda>p. case SPredicates ?\<sigma> p of None \<Rightarrow> Predicates ?I p | Some p' \<Rightarrow> \<lambda>R. ?\<nu> \<in> fml_sem (extendf ?I R) p', Contexts = \<lambda>c. case SContexts ?\<sigma> c of None \<Rightarrow> Contexts ?I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc ?I R) c', Programs = \<lambda>a. case SPrograms ?\<sigma> a of None \<Rightarrow> Programs ?I a | Some a' \<Rightarrow> prog_sem ?I a', ODEs = \<lambda>ode. case SODEs ?\<sigma> ode of None \<Rightarrow> ODEs ?I ode | Some ode' \<Rightarrow> ODE_sem ?I ode', ODEBV = \<lambda>ode. case SODEs ?\<sigma> ode of None \<Rightarrow> ODEBV ?I ode | Some ode' \<Rightarrow> ODE_vars ?I ode'\<rparr>
(\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (x2 i) ?R8) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<omega>) (x2 i) ?R8)

goal (1 subgoal):
 1. \<lbrakk>\<And>a. SPredicates \<sigma> x1 = Some a \<Longrightarrow> Vagree \<nu> \<omega> (FVF a); SPredicates \<sigma> x1 = None\<rbrakk> \<Longrightarrow> fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<phi> x1 x2) = fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<omega>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<omega> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<phi> x1 x2)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) ($\<phi> x1 x2)

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Not x)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x))))
fsafe (! x)

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x. SFV \<sigma> a) \<Longrightarrow> fsafe x \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Not x). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x))))

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Not x)"
[PROOF STATE]
proof (state)
this:
fsafe (! x)

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (! x)
[PROOF STEP]
have
    safe:"fsafe x"
[PROOF STATE]
proof (prove)
using this:
fsafe (! x)

goal (1 subgoal):
 1. fsafe x
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Not x). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x))); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (! x)))); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
[PROOF STEP]
using IH[OF agree_sub[OF sub VA] safe]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) x = fml_sem (local.adjoint I \<sigma> \<omega>) x

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) (! x) = fml_sem (local.adjoint I \<sigma> \<omega>) (! x)

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (And x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2))))
fsafe (x1 && x2)

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x1. SFV \<sigma> a) \<Longrightarrow> fsafe x1 \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x1

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (And x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2))))

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (And x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (x1 && x2)

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (x1 && x2)
[PROOF STEP]
have
    safe1:"fsafe x1"
    and safe2:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (x1 && x2)

goal (1 subgoal):
 1. fsafe x1 &&& fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x1
fsafe x2

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x1. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (And x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (And x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x1))); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (x1 && x2)))); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) x1 = fml_sem (local.adjoint I \<sigma> \<omega>) x1
fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) (x1 && x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (x1 && x2)

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Exists x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2))))
fsafe (Exists x1 x2)

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Exists x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2))))

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Exists x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (Exists x1 x2)

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (Exists x1 x2)
[PROOF STEP]
have safe1:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (Exists x1 x2)

goal (1 subgoal):
 1. fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x2

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Exists x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (Exists x1 x2)))); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (Exists x1 x2)

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Diamond x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2))))
fsafe (\<langle> x1 \<rangle> x2)

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP x1. SFV \<sigma> a) \<Longrightarrow> hpsafe x1 \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>7) x1 = prog_sem (local.adjoint I \<sigma> ?\<omega>7) x1

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Diamond x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2))))

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Diamond x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (\<langle> x1 \<rangle> x2)

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (\<langle> x1 \<rangle> x2)
[PROOF STEP]
have
    safe1:"hpsafe x1"
    and safe2:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (\<langle> x1 \<rangle> x2)

goal (1 subgoal):
 1. hpsafe x1 &&& fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x1
fsafe x2

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGP x1. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Diamond x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (Diamond x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP x1))); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (\<langle> x1 \<rangle> x2)))); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
prog_sem (local.adjoint I \<sigma> \<nu>) x1 = prog_sem (local.adjoint I \<sigma> \<omega>) x1
fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (InContext x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2))))
fsafe (InContext x1 x2)

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> ?\<nu>7) x2 = fml_sem (local.adjoint I \<sigma> ?\<omega>7) x2

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (InContext x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2))))

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (InContext x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (InContext x1 x2)

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (InContext x1 x2)
[PROOF STEP]
have  safe1:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (InContext x1 x2)

goal (1 subgoal):
 1. fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x2

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub:"(\<Union>a\<in>SDom \<sigma> \<inter> SIGF x2. SFV \<sigma> a) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGF (InContext x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2)) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF x2))); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGF (InContext x1 x2)))); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub VA] safe1]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) x2 = fml_sem (local.adjoint I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
using this:
fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> x2 = fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<omega>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<omega> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> x2

goal (1 subgoal):
 1. fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (InContext x1 x2) = fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<omega>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<omega> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (InContext x1 x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (local.adjoint I \<sigma> \<omega>) (InContext x1 x2)

goal:
No subgoals!
[PROOF STEP]
qed