[STATEMENT]
lemma nsubst_hp_fml:
  fixes I::"('sf, 'sc, 'sz) interp"
  assumes good_interp:"is_interp I"
  shows " (NPadmit \<sigma> \<alpha> \<longrightarrow> (hpsafe \<alpha> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall> \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO \<alpha> \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) \<alpha>)))) \<and>
    (NFadmit \<sigma> \<phi> \<longrightarrow> (fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall> \<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (NPadmit \<sigma> \<alpha> \<longrightarrow> hpsafe \<alpha> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO \<alpha> \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) \<alpha>))) \<and> (NFadmit \<sigma> \<phi> \<longrightarrow> fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)))
[PROOF STEP]
proof (induction rule: NPadmit_NFadmit.induct)
[PROOF STATE]
proof (state)
goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 4. \<And>\<sigma> ODE \<phi>. \<lbrakk>OadmitFO \<sigma> ODE (BVO ODE); NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> (BVO ODE); fsafe (FsubstFO \<phi> \<sigma>); osafe (OsubstFO ODE \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 6. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 7. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
case (NPadmit_Pvar \<sigma> a)
[PROOF STATE]
proof (state)
this:

goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 4. \<And>\<sigma> ODE \<phi>. \<lbrakk>OadmitFO \<sigma> ODE (BVO ODE); NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> (BVO ODE); fsafe (FsubstFO \<phi> \<sigma>); osafe (OsubstFO ODE \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 6. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 7. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> a)))
[PROOF STEP]
unfolding adjointFO_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> ($\<alpha> a)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> a)))

goal (14 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>OadmitFO \<sigma> ODE (BVO ODE); NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> (BVO ODE); fsafe (FsubstFO \<phi> \<sigma>); osafe (OsubstFO ODE \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (14 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>OadmitFO \<sigma> ODE (BVO ODE); NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> (BVO ODE); fsafe (FsubstFO \<phi> \<sigma>); osafe (OsubstFO ODE \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
case (NPadmit_ODE \<sigma> ODE \<phi>)
[PROOF STATE]
proof (state)
this:
OadmitFO \<sigma> ODE (BVO ODE)
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> (BVO ODE)
fsafe (FsubstFO \<phi> \<sigma>)
osafe (OsubstFO ODE \<sigma>)
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))

goal (14 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>OadmitFO \<sigma> ODE (BVO ODE); NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> (BVO ODE); fsafe (FsubstFO \<phi> \<sigma>); osafe (OsubstFO ODE \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
OadmitFO \<sigma> ODE (BVO ODE)
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> (BVO ODE)
fsafe (FsubstFO \<phi> \<sigma>)
osafe (OsubstFO ODE \<sigma>)
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have  NOU:"OadmitFO \<sigma> ODE (BVO ODE)"
    and NFA:"NFadmit \<sigma> \<phi>"
    and NFU:"FUadmitFO \<sigma> \<phi> (BVO ODE)"
    and fsafe:"fsafe (FsubstFO \<phi> \<sigma>)"
    and IH:"fsafe \<phi> \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))"
    and osafe':"osafe (OsubstFO ODE \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> (BVO ODE)
fsafe (FsubstFO \<phi> \<sigma>)
osafe (OsubstFO ODE \<sigma>)
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. (OadmitFO \<sigma> ODE (BVO ODE) &&& NFadmit \<sigma> \<phi> &&& FUadmitFO \<sigma> \<phi> (BVO ODE)) &&& fsafe (FsubstFO \<phi> \<sigma>) &&& (\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))) &&& osafe (OsubstFO ODE \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
OadmitFO \<sigma> ODE (BVO ODE)
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> (BVO ODE)
fsafe (FsubstFO \<phi> \<sigma>)
\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)
osafe (OsubstFO ODE \<sigma>)

goal (14 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>OadmitFO \<sigma> ODE (BVO ODE); NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> (BVO ODE); fsafe (FsubstFO \<phi> \<sigma>); osafe (OsubstFO ODE \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
have "hpsafe (EvolveODE ODE \<phi>) \<Longrightarrow>  (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
assume safe:"hpsafe (EvolveODE ODE \<phi>)"
[PROOF STATE]
proof (state)
this:
hpsafe (EvolveODE ODE \<phi>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe (EvolveODE ODE \<phi>)
[PROOF STEP]
have osafe:"osafe ODE" and fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
hpsafe (EvolveODE ODE \<phi>)

goal (1 subgoal):
 1. osafe ODE &&& fsafe \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
osafe ODE
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
assume frees:"(\<And>i. dsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
dsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>))
[PROOF STEP]
proof (auto)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
fix b
        and sol :: "real \<Rightarrow>(real, 'sz) vec"
        and t :: real
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume eq1:"\<nu> = (sol 0, b)"
[PROOF STATE]
proof (state)
this:
\<nu> = (sol 0, b)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume eq2:"\<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)"
[PROOF STATE]
proof (state)
this:
\<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume t:"0 \<le> t"
[PROOF STATE]
proof (state)
this:
0 \<le> t

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume sol:"(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t}
         {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}"
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have agree_sem:"\<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))
[PROOF STEP]
using mk_v_agree[of I "OsubstFO ODE \<sigma>" "(sol 0, b)" "sol t"]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- semBV I (OsubstFO ODE \<sigma>)) \<and> Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (mk_xode I (OsubstFO ODE \<sigma>) (sol t)) (semBV I (OsubstFO ODE \<sigma>))

goal (1 subgoal):
 1. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> fst (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> snd (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> fst (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = fst (mk_xode I (OsubstFO ODE \<sigma>) (sol t)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> snd (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = snd (mk_xode I (OsubstFO ODE \<sigma>) (sol t)) $ i)

goal (1 subgoal):
 1. (\<forall>i. Inl i \<in> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)) \<longrightarrow> fst (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)) \<longrightarrow> snd (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = snd (sol 0, b) $ i)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have bv_sub:"(-BVO ODE) \<subseteq> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - BVO ODE \<subseteq> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>))
[PROOF STEP]
by(induction ODE, auto)
[PROOF STATE]
proof (state)
this:
- BVO ODE \<subseteq> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>))

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have agree:"\<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- BVO ODE)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- BVO ODE)
[PROOF STEP]
using agree_sub[OF bv_sub agree_sem]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t8)) (sol 0, b) (- BVO ODE)

goal (1 subgoal):
 1. \<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- BVO ODE)
[PROOF STEP]
by auto
      \<comment> \<open>Necessary\<close>
[PROOF STATE]
proof (state)
this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7)) (sol 0, b) (- BVO ODE)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have mkv:"\<And>t. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol t, b)) ODE (sol 0, b) (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol t, b)) ODE (sol 0, b) (sol t)
[PROOF STEP]
using nsubst_mkv[OF good_interp NOU osafe frees]
[PROOF STATE]
proof (prove)
using this:
mk_v I (OsubstFO ODE \<sigma>) ?\<nu> (fst ?\<nu>') = mk_v (adjointFO I \<sigma> ?\<nu>') ODE ?\<nu> (fst ?\<nu>')

goal (1 subgoal):
 1. \<And>t. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol t, b)) ODE (sol 0, b) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7) = mk_v (adjointFO I \<sigma> (sol ?t7, b)) ODE (sol 0, b) (sol ?t7)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have hmm:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,b) (sol s, b) (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (- BVO ODE)
[PROOF STEP]
using ODE_bound_effect sol
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?s \<in> {0..?t}; (?sol solves_ode (\<lambda>_. ODE_sem ?I ?ODE)) {0..?t} ?X\<rbrakk> \<Longrightarrow> Vagree (?sol 0, ?b) (?sol ?s, ?b) (- BVO ?ODE)
(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (- BVO ODE)
[PROOF STEP]
by (metis osubst_preserves_BVO)
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol ?s7, b) (- BVO ODE)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have FVT_sub:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> - BVO ODE
[PROOF STEP]
using NOU NO_to_NOU OUadmitFO_def
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
OadmitFO ?\<sigma> ?ODE ?S \<Longrightarrow> OUadmitFO ?\<sigma> ?ODE ?S
OUadmitFO ?\<sigma> ?\<theta> ?U = ((\<Union>i\<in>{i. Inl (Inr i) \<in> SIGO ?\<theta>}. FVT (?\<sigma> i)) \<inter> ?U = {})

goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> - BVO ODE
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> - BVO ODE

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have agrees:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
[PROOF STEP]
using agree_sub[OF FVT_sub hmm[of s]]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol ?s7, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have "\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE  = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE
[PROOF STEP]
apply (rule uadmit_mkv_ntadjoint)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> Vagree (sol s, b) (sol 0, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol s, b) (sol 0, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
 2. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using NOU hmm[of s] NO_to_NOU
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (- BVO ODE)
OadmitFO ?\<sigma> ?ODE ?S \<Longrightarrow> OUadmitFO ?\<sigma> ?ODE ?S

goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol s, b) (sol 0, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
 2. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
unfolding OUadmitFO_def Vagree_def
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, b) $ i = fst (sol s, b) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, b) $ i = snd (sol s, b) $ i)
OadmitFO ?\<sigma> ?ODE ?S \<Longrightarrow> (\<Union>i\<in>{i. Inl (Inr i) \<in> SIGO ?ODE}. FVT (?\<sigma> i)) \<inter> ?S = {}

goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<longrightarrow> fst (sol s, b) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<longrightarrow> snd (sol s, b) $ i = snd (sol 0, b) $ i)
 2. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using frees good_interp osafe
[PROOF STATE]
proof (prove)
using this:
dsafe (\<sigma> ?i7)
is_interp I
osafe ODE

goal (3 subgoals):
 1. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE
[PROOF STEP]
have mkva:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)"
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have main_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow>  mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)
[PROOF STEP]
using mkv mkva
[PROOF STATE]
proof (prove)
using this:
mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7) = mk_v (adjointFO I \<sigma> (sol ?t7, b)) ODE (sol 0, b) (sol ?t7)
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
note mkvt = main_eq[of t]
[PROOF STATE]
proof (state)
this:
t \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq1:"\<And>s. s \<in> {0..t} \<Longrightarrow>
          (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
        = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)
[PROOF STEP]
using IH[OF fsafe frees]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq2:"\<And>s. s \<in> {0..t} \<Longrightarrow>
        ((mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)
        =(mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
using NFU frees fsafe good_interp mk_v_agree osubst_preserves_ODE_vars uadmit_fml_ntadjoint
[PROOF STATE]
proof (prove)
using this:
FUadmitFO \<sigma> \<phi> (BVO ODE)
dsafe (\<sigma> ?i7)
fsafe \<phi>
is_interp I
Vagree (mk_v ?I ?ODE ?\<nu> ?sol) ?\<nu> (- semBV ?I ?ODE) \<and> Vagree (mk_v ?I ?ODE ?\<nu> ?sol) (mk_xode ?I ?ODE ?sol) (semBV ?I ?ODE)
ODE_vars ?I (OsubstFO ?ODE ?\<sigma>) = ODE_vars (adjointFO ?I ?\<sigma> ?\<nu>) ?ODE
\<lbrakk>FUadmitFO ?\<sigma> ?\<phi> ?U; Vagree ?\<nu> ?\<omega> (- ?U); \<And>i. dsafe (?\<sigma> i); fsafe ?\<phi>; is_interp ?I\<rbrakk> \<Longrightarrow> fml_sem (adjointFO ?I ?\<sigma> ?\<nu>) ?\<phi> = fml_sem (adjointFO ?I ?\<sigma> ?\<omega>) ?\<phi>

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
using agree
[PROOF STATE]
proof (prove)
using this:
FUadmitFO \<sigma> \<phi> (BVO ODE)
dsafe (\<sigma> ?i7)
fsafe \<phi>
is_interp I
Vagree (mk_v ?I ?ODE ?\<nu> ?sol) ?\<nu> (- semBV ?I ?ODE) \<and> Vagree (mk_v ?I ?ODE ?\<nu> ?sol) (mk_xode ?I ?ODE ?sol) (semBV ?I ?ODE)
ODE_vars ?I (OsubstFO ?ODE ?\<sigma>) = ODE_vars (adjointFO ?I ?\<sigma> ?\<nu>) ?ODE
\<lbrakk>FUadmitFO ?\<sigma> ?\<phi> ?U; Vagree ?\<nu> ?\<omega> (- ?U); \<And>i. dsafe (?\<sigma> i); fsafe ?\<phi>; is_interp ?I\<rbrakk> \<Longrightarrow> fml_sem (adjointFO ?I ?\<sigma> ?\<nu>) ?\<phi> = fml_sem (adjointFO ?I ?\<sigma> ?\<omega>) ?\<phi>
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7)) (sol 0, b) (- BVO ODE)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq3:"\<And>s. s \<in> {0..t} \<Longrightarrow>
        (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0,b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
using main_eq
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq: "\<And>s. s \<in> {0..t} \<Longrightarrow>
         (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
          =  (mk_v (adjointFO I \<sigma> (sol 0,b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
using fml_eq1 fml_eq2 fml_eq3
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>)
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sem_eq:"\<And>t. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)
[PROOF STEP]
using nsubst_ode[OF good_interp osafe NOU frees, of "(sol t,b)"]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (OsubstFO ODE \<sigma>) (fst (sol t, b)) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (fst (sol t, b))

goal (1 subgoal):
 1. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
ODE_sem I (OsubstFO ODE \<sigma>) (sol ?t7) = ODE_sem (adjointFO I \<sigma> (sol ?t7, b)) ODE (sol ?t7)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sem_fact:"\<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)
[PROOF STEP]
using nsubst_ode[OF good_interp osafe NOU frees, of "(sol s, b)"]
          uadmit_ode_ntadjoint'[OF frees good_interp agrees[of s] osafe]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (OsubstFO ODE \<sigma>) (fst (sol s, b)) = ODE_sem (adjointFO I \<sigma> (sol s, b)) ODE (fst (sol s, b))
s \<in> {0..t} \<Longrightarrow> ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE = ODE_sem (adjointFO I \<sigma> (sol s, b)) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol ?s7) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ?s7)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sol':"(sol solves_ode (\<lambda>_. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t}
         {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>_. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
apply (rule solves_ode_congI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. (?x solves_ode ?f) ?T ?X
 2. \<And>t. t \<in> ?T \<Longrightarrow> ?x t = sol t
 3. \<And>t. t \<in> ?T \<Longrightarrow> ?f t (?x t) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (?x t)
 4. ?T = {0..t}
 5. ?X = {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
apply (rule sol)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol ta) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta)
 3. {0..t} = {0..t}
 4. {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)} = {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol ta) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta)
 2. {0..t} = {0..t}
 3. {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)} = {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol ta) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta)
[PROOF STEP]
by (rule sem_fact[of ta])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. {0..t} = {0..t}
 2. {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)} = {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..t} = {0..t}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)} = {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)} = {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>_. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sub:"\<And>s. s \<in> {0..t}
              \<Longrightarrow> sol s \<in> {x. (mk_v (adjointFO I \<sigma> (sol 0,b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
using fml_eq rangeI t sol solves_ode_domainD
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
?f ?x \<in> range ?f
0 \<le> t
(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
\<lbrakk>(?y solves_ode ?f) ?T ?X; ?t \<in> ?T\<rbrakk> \<Longrightarrow> ?y ?t \<in> ?X

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sol'':"(sol solves_ode (\<lambda>c. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t}
 {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>c. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
apply (rule solves_odeI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol t))) {0..t}
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol t))) {0..t}
[PROOF STEP]
using sol' solves_ode_vderivD
[PROOF STATE]
proof (prove)
using this:
(sol solves_ode (\<lambda>_. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
(?y solves_ode ?f) ?T ?X \<Longrightarrow> (?y has_vderiv_on (\<lambda>t. ?f t (?y t))) ?T

goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol t))) {0..t}
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
using sub
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}

goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>c. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
show "\<exists>sola. sol 0 = sola 0 \<and>
          (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and>
                0 \<le> ta \<and>
                (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta}
                 {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
[PROOF STEP]
apply(rule exI[where x=sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sol 0 = sol 0
 2. \<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)
 2. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)
[PROOF STEP]
using  mkvt t
[PROOF STATE]
proof (prove)
using this:
t \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)
0 \<le> t

goal (1 subgoal):
 1. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 0 \<le> t
 2. (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t
[PROOF STEP]
by (rule t)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
by (rule sol'')
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..ta} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sola 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>})

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
fix b
      and sol::"real \<Rightarrow> (real, 'sz) vec"
      and t::real
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume eq1:"\<nu> = (sol 0, b)"
[PROOF STATE]
proof (state)
this:
\<nu> = (sol 0, b)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume eq2:"\<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)"
[PROOF STATE]
proof (state)
this:
\<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume t:"0 \<le> t"
[PROOF STATE]
proof (state)
this:
0 \<le> t

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
assume sol:"(sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t}
     {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}"
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have agree_sem:"\<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))
[PROOF STEP]
using mk_v_agree[of I "OsubstFO ODE \<sigma>" "(sol 0, b)" "sol t"]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- semBV I (OsubstFO ODE \<sigma>)) \<and> Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (mk_xode I (OsubstFO ODE \<sigma>) (sol t)) (semBV I (OsubstFO ODE \<sigma>))

goal (1 subgoal):
 1. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> fst (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> snd (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> fst (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = fst (mk_xode I (OsubstFO ODE \<sigma>) (sol t)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I (OsubstFO ODE \<sigma>) \<longrightarrow> snd (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = snd (mk_xode I (OsubstFO ODE \<sigma>) (sol t)) $ i)

goal (1 subgoal):
 1. (\<forall>i. Inl i \<in> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)) \<longrightarrow> fst (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)) \<longrightarrow> snd (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) $ i = snd (sol 0, b) $ i)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7)) (sol 0, b) (- (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>)))

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have bv_sub:"(-BVO ODE) \<subseteq> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - BVO ODE \<subseteq> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>))
[PROOF STEP]
by(induction ODE, auto)
[PROOF STATE]
proof (state)
this:
- BVO ODE \<subseteq> - (Inl ` ODE_vars I (OsubstFO ODE \<sigma>) \<union> Inr ` ODE_vars I (OsubstFO ODE \<sigma>))

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have agree:"\<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- BVO ODE)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- BVO ODE)
[PROOF STEP]
using agree_sub[OF bv_sub agree_sem]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t8)) (sol 0, b) (- BVO ODE)

goal (1 subgoal):
 1. \<And>t. Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)) (sol 0, b) (- BVO ODE)
[PROOF STEP]
by auto
    \<comment> \<open>Necessary\<close>
[PROOF STATE]
proof (state)
this:
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7)) (sol 0, b) (- BVO ODE)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have mkv:"\<And>t. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol t, b)) ODE (sol 0, b) (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol t, b)) ODE (sol 0, b) (sol t)
[PROOF STEP]
using nsubst_mkv[OF good_interp NOU osafe frees]
[PROOF STATE]
proof (prove)
using this:
mk_v I (OsubstFO ODE \<sigma>) ?\<nu> (fst ?\<nu>') = mk_v (adjointFO I \<sigma> ?\<nu>') ODE ?\<nu> (fst ?\<nu>')

goal (1 subgoal):
 1. \<And>t. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol t, b)) ODE (sol 0, b) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7) = mk_v (adjointFO I \<sigma> (sol ?t7, b)) ODE (sol 0, b) (sol ?t7)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have hmm:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,b) (sol s, b) (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (- BVO ODE)
[PROOF STEP]
using ODE_bound_effect sol
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?s \<in> {0..?t}; (?sol solves_ode (\<lambda>_. ODE_sem ?I ?ODE)) {0..?t} ?X\<rbrakk> \<Longrightarrow> Vagree (?sol 0, ?b) (?sol ?s, ?b) (- BVO ?ODE)
(sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (- BVO ODE)
[PROOF STEP]
by (metis osubst_preserves_ODE_vars)
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol ?s7, b) (- BVO ODE)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have FVT_sub:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> - BVO ODE
[PROOF STEP]
using NOU NO_to_NOU
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
OadmitFO ?\<sigma> ?ODE ?S \<Longrightarrow> OUadmitFO ?\<sigma> ?ODE ?S

goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> - BVO ODE
[PROOF STEP]
unfolding OUadmitFO_def
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
OadmitFO ?\<sigma> ?ODE ?S \<Longrightarrow> (\<Union>i\<in>{i. Inl (Inr i) \<in> SIGO ?ODE}. FVT (?\<sigma> i)) \<inter> ?S = {}

goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> - BVO ODE
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<subseteq> - BVO ODE

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have agrees:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
[PROOF STEP]
using agree_sub[OF FVT_sub hmm[of s]]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol ?s7, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have "\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE  = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE
[PROOF STEP]
apply (rule uadmit_mkv_ntadjoint)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> Vagree (sol s, b) (sol 0, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol s, b) (sol 0, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
 2. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using NOU hmm[of s] NO_to_NOU
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, b) (sol s, b) (- BVO ODE)
OadmitFO ?\<sigma> ?ODE ?S \<Longrightarrow> OUadmitFO ?\<sigma> ?ODE ?S

goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol s, b) (sol 0, b) (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y))
 2. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
unfolding OUadmitFO_def Vagree_def
[PROOF STATE]
proof (prove)
using this:
OadmitFO \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, b) $ i = fst (sol s, b) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, b) $ i = snd (sol s, b) $ i)
OadmitFO ?\<sigma> ?ODE ?S \<Longrightarrow> (\<Union>i\<in>{i. Inl (Inr i) \<in> SIGO ?ODE}. FVT (?\<sigma> i)) \<inter> ?S = {}

goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<longrightarrow> fst (sol s, b) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO ODE}. FVT (\<sigma> y)) \<longrightarrow> snd (sol s, b) $ i = snd (sol 0, b) $ i)
 2. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using frees good_interp osafe
[PROOF STATE]
proof (prove)
using this:
dsafe (\<sigma> ?i7)
is_interp I
osafe ODE

goal (3 subgoals):
 1. \<And>i. s \<in> {0..t} \<Longrightarrow> dsafe (\<sigma> i)
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE
[PROOF STEP]
have mkva:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)"
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol s, b)) ODE (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have main_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow>  mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)
[PROOF STEP]
using mkv mkva
[PROOF STATE]
proof (prove)
using this:
mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7) = mk_v (adjointFO I \<sigma> (sol ?t7, b)) ODE (sol 0, b) (sol ?t7)
?s7 \<in> {0..t} \<Longrightarrow> mk_v (adjointFO I \<sigma> (sol ?s7, b)) ODE (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
note mkvt = main_eq[of t]
[PROOF STATE]
proof (state)
this:
t \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq1:"\<And>s. s \<in> {0..t} \<Longrightarrow>
        (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
      = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)
[PROOF STEP]
using IH[OF fsafe frees]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq2:"\<And>s. s \<in> {0..t} \<Longrightarrow>
      ((mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>)
      =(mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
using  NFU frees fsafe good_interp mk_v_agree osubst_preserves_ODE_vars uadmit_fml_ntadjoint agree
[PROOF STATE]
proof (prove)
using this:
FUadmitFO \<sigma> \<phi> (BVO ODE)
dsafe (\<sigma> ?i7)
fsafe \<phi>
is_interp I
Vagree (mk_v ?I ?ODE ?\<nu> ?sol) ?\<nu> (- semBV ?I ?ODE) \<and> Vagree (mk_v ?I ?ODE ?\<nu> ?sol) (mk_xode ?I ?ODE ?sol) (semBV ?I ?ODE)
ODE_vars ?I (OsubstFO ?ODE ?\<sigma>) = ODE_vars (adjointFO ?I ?\<sigma> ?\<nu>) ?ODE
\<lbrakk>FUadmitFO ?\<sigma> ?\<phi> ?U; Vagree ?\<nu> ?\<omega> (- ?U); \<And>i. dsafe (?\<sigma> i); fsafe ?\<phi>; is_interp ?I\<rbrakk> \<Longrightarrow> fml_sem (adjointFO ?I ?\<sigma> ?\<nu>) ?\<phi> = fml_sem (adjointFO ?I ?\<sigma> ?\<omega>) ?\<phi>
Vagree (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?t7)) (sol 0, b) (- BVO ODE)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq3:"\<And>s. s \<in> {0..t} \<Longrightarrow>
     (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0,b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
using main_eq
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq: "\<And>s. s \<in> {0..t} \<Longrightarrow>
      (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
       =  (mk_v (adjointFO I \<sigma> (sol 0,b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
using fml_eq1 fml_eq2 fml_eq3
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>)
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7))) \<phi>) = (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol s) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol s) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sem_eq:"\<And>t. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)
[PROOF STEP]
using nsubst_ode[OF good_interp osafe NOU frees, of "(sol t,b)"]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (OsubstFO ODE \<sigma>) (fst (sol t, b)) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (fst (sol t, b))

goal (1 subgoal):
 1. ODE_sem I (OsubstFO ODE \<sigma>) (sol t) = ODE_sem (adjointFO I \<sigma> (sol t, b)) ODE (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
ODE_sem I (OsubstFO ODE \<sigma>) (sol ?t7) = ODE_sem (adjointFO I \<sigma> (sol ?t7, b)) ODE (sol ?t7)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sem_fact:"\<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)
[PROOF STEP]
using nsubst_ode[OF good_interp osafe NOU frees, of "(sol s, b)"]
        uadmit_ode_ntadjoint'[OF frees good_interp agrees[of s] osafe]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (OsubstFO ODE \<sigma>) (fst (sol s, b)) = ODE_sem (adjointFO I \<sigma> (sol s, b)) ODE (fst (sol s, b))
s \<in> {0..t} \<Longrightarrow> ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE = ODE_sem (adjointFO I \<sigma> (sol s, b)) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol s) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol ?s7) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ?s7)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sol':"
      (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t}  {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
apply (rule solves_ode_congI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. (?x solves_ode ?f) ?T ?X
 2. \<And>t. t \<in> ?T \<Longrightarrow> ?x t = sol t
 3. \<And>t. t \<in> ?T \<Longrightarrow> ?f t (?x t) = ODE_sem I (OsubstFO ODE \<sigma>) (?x t)
 4. ?T = {0..t}
 5. ?X = {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
apply (rule sol)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta) = ODE_sem I (OsubstFO ODE \<sigma>) (sol ta)
 3. {0..t} = {0..t}
 4. {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>} = {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta) = ODE_sem I (OsubstFO ODE \<sigma>) (sol ta)
 2. {0..t} = {0..t}
 3. {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>} = {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta) = ODE_sem I (OsubstFO ODE \<sigma>) (sol ta)
[PROOF STEP]
using sem_fact[of ta]
[PROOF STATE]
proof (prove)
using this:
ta \<in> {0..t} \<Longrightarrow> ODE_sem I (OsubstFO ODE \<sigma>) (sol ta) = ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta)

goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE (sol ta) = ODE_sem I (OsubstFO ODE \<sigma>) (sol ta)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. {0..t} = {0..t}
 2. {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>} = {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..t} = {0..t}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>} = {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>} = {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sub:"\<And>s. s \<in> {0..t}
            \<Longrightarrow> sol s \<in> {x. (mk_v (adjointFO I \<sigma> (sol 0,b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
using fml_eq rangeI t sol solves_ode_domainD
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)
?f ?x \<in> range ?f
0 \<le> t
(sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
\<lbrakk>(?y solves_ode ?f) ?T ?X; ?t \<in> ?T\<rbrakk> \<Longrightarrow> ?y ?t \<in> ?X

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
have sol'':"(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
apply (rule solves_odeI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I (OsubstFO ODE \<sigma>) (sol t))) {0..t}
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I (OsubstFO ODE \<sigma>) (sol t))) {0..t}
[PROOF STEP]
using sol' solves_ode_vderivD
[PROOF STATE]
proof (prove)
using this:
(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
(?y solves_ode ?f) ?T ?X \<Longrightarrow> (?y has_vderiv_on (\<lambda>t. ?f t (?y t))) ?T

goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I (OsubstFO ODE \<sigma>) (sol t))) {0..t}
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
using sub fml_eq
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}
?s7 \<in> {0..t} \<Longrightarrow> (mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ?s7) \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol ?s7) \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>)

goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> (sol 0, b)) ODE)) {0..t} {x. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) x \<in> fml_sem (adjointFO I \<sigma> (sol 0, b)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
show "\<exists>sola. sol 0 = sola 0 \<and>
          (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and>
                0 \<le> ta \<and>
                (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
apply(rule exI[where x=sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sol 0 = sol 0
 2. \<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)
 2. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)
[PROOF STEP]
using t mkvt
[PROOF STATE]
proof (prove)
using this:
0 \<le> t
t \<in> {0..t} \<Longrightarrow> mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t) = mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t)

goal (1 subgoal):
 1. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 0 \<le> t
 2. (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t
[PROOF STEP]
by (rule t)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..t} {x. mk_v I (OsubstFO ODE \<sigma>) (sol 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)}
[PROOF STEP]
by (rule sol'')
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> (sol 0, b)) ODE (sol 0, b) (sol t) = mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (OsubstFO ODE \<sigma>))) {0..ta} {x. mk_v I (OsubstFO ODE \<sigma>) (sola 0, b) x \<in> fml_sem I (FsubstFO \<phi> \<sigma>)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) (EvolveODE ODE \<phi>))

goal (14 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>OadmitFO \<sigma> ODE (BVO ODE); NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> (BVO ODE); fsafe (FsubstFO \<phi> \<sigma>); osafe (OsubstFO ODE \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) (EvolveODE ODE \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) (EvolveODE ODE \<phi>))

goal (1 subgoal):
 1. hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))

goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 13 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 13 subgoals...
[PROOF STEP]
case (NPadmit_Assign \<sigma> \<theta> x)
[PROOF STATE]
proof (state)
this:
TadmitFO \<sigma> \<theta>

goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 13 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TadmitFO \<sigma> \<theta>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
TadmitFO \<sigma> \<theta>

goal (1 subgoal):
 1. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
using nsubst_dterm[OF good_interp, of \<sigma> \<theta>]
[PROOF STATE]
proof (prove)
using this:
TadmitFO \<sigma> \<theta>
\<lbrakk>TadmitFO \<sigma> \<theta>; dsafe \<theta>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> dterm_sem I (TsubstFO \<theta> \<sigma>) ?\<nu> = dterm_sem (adjointFO I \<sigma> ?\<nu>) \<theta> ?\<nu>

goal (1 subgoal):
 1. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (x := \<theta>)))

goal (12 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
case (NPadmit_DiffAssign \<sigma> \<theta> x)
[PROOF STATE]
proof (state)
this:
TadmitFO \<sigma> \<theta>

goal (12 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. TadmitFO \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TadmitFO \<sigma> \<theta>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
TadmitFO \<sigma> \<theta>

goal (1 subgoal):
 1. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
using nsubst_dterm[OF good_interp, of \<sigma> \<theta>]
[PROOF STATE]
proof (prove)
using this:
TadmitFO \<sigma> \<theta>
\<lbrakk>TadmitFO \<sigma> \<theta>; dsafe \<theta>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> dterm_sem I (TsubstFO \<theta> \<sigma>) ?\<nu> = dterm_sem (adjointFO I \<sigma> ?\<nu>) \<theta> ?\<nu>

goal (1 subgoal):
 1. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x \<theta>)))

goal (11 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
case (NFadmit_Geq \<sigma> \<theta>1 \<theta>2)
[PROOF STATE]
proof (state)
this:
TadmitFO \<sigma> \<theta>1
TadmitFO \<sigma> \<theta>2

goal (11 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>TadmitFO \<sigma> \<theta>1; TadmitFO \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
TadmitFO \<sigma> \<theta>1
TadmitFO \<sigma> \<theta>2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
TadmitFO \<sigma> \<theta>1
TadmitFO \<sigma> \<theta>2

goal (1 subgoal):
 1. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
using nsubst_dterm[OF good_interp, of \<sigma> \<theta>1]
[PROOF STATE]
proof (prove)
using this:
TadmitFO \<sigma> \<theta>1
TadmitFO \<sigma> \<theta>2
\<lbrakk>TadmitFO \<sigma> \<theta>1; dsafe \<theta>1; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> dterm_sem I (TsubstFO \<theta>1 \<sigma>) ?\<nu> = dterm_sem (adjointFO I \<sigma> ?\<nu>) \<theta>1 ?\<nu>

goal (1 subgoal):
 1. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
using nsubst_dterm[OF good_interp, of \<sigma> \<theta>2]
[PROOF STATE]
proof (prove)
using this:
TadmitFO \<sigma> \<theta>1
TadmitFO \<sigma> \<theta>2
\<lbrakk>TadmitFO \<sigma> \<theta>1; dsafe \<theta>1; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> dterm_sem I (TsubstFO \<theta>1 \<sigma>) ?\<nu> = dterm_sem (adjointFO I \<sigma> ?\<nu>) \<theta>1 ?\<nu>
\<lbrakk>TadmitFO \<sigma> \<theta>2; dsafe \<theta>2; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> dterm_sem I (TsubstFO \<theta>2 \<sigma>) ?\<nu> = dterm_sem (adjointFO I \<sigma> ?\<nu>) \<theta>2 ?\<nu>

goal (1 subgoal):
 1. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))

goal (10 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (NFadmit_Prop \<sigma> args f)
[PROOF STATE]
proof (state)
this:
TadmitFO \<sigma> (args ?i7)

goal (10 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
assume NTA:"\<And>i. TadmitFO \<sigma> (args i)"
[PROOF STATE]
proof (state)
this:
TadmitFO \<sigma> (args ?i7)

goal (10 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "\<And>\<nu>.  fsafe ($\<phi> f args) \<Longrightarrow>  (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>. \<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<nu>. \<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<nu>. \<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
assume safe:"fsafe ($\<phi> f args)"
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> f args)

goal (1 subgoal):
 1. \<And>\<nu>. \<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe ($\<phi> f args)
[PROOF STEP]
have safes:"\<And>i. dsafe (args i)"
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> f args)

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
using dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> f args)
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i8)

goal (1 subgoal):
 1. \<And>\<nu>. \<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
assume subFree:"(\<And>i. dsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
dsafe (\<sigma> ?i8)

goal (1 subgoal):
 1. \<And>\<nu>. \<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
have vec_eq:"(\<chi> i. dterm_sem (adjointFO I \<sigma> \<nu>) (args i) \<nu>) = (\<chi> i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (args i) \<nu>) = (\<chi>i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>)
[PROOF STEP]
apply(rule vec_extensionality)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. (\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (args i) \<nu>) $ i = (\<chi>i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>) $ i
[PROOF STEP]
using nsubst_dterm[OF good_interp NTA safes subFree]
[PROOF STATE]
proof (prove)
using this:
dterm_sem I (TsubstFO (args ?i18) \<sigma>) ?\<nu> = dterm_sem (adjointFO I \<sigma> ?\<nu>) (args ?i18) ?\<nu>

goal (1 subgoal):
 1. \<And>i. (\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (args i) \<nu>) $ i = (\<chi>i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>) $ i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (args i) \<nu>) = (\<chi>i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>)

goal (1 subgoal):
 1. \<And>\<nu>. \<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (args i) \<nu>) = (\<chi>i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>)
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
using this:
(\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (args i) \<nu>) = (\<chi>i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>)

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))
[PROOF STEP]
unfolding adjointFO_def
[PROOF STATE]
proof (prove)
using this:
(\<chi>i. dterm_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> (args i) \<nu>) = (\<chi>i. dterm_sem I (TsubstFO (args i) \<sigma>) \<nu>)

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> ($\<phi> f args))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) ($\<phi> f args))

goal (10 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> args f. (\<And>i. TadmitFO \<sigma> (args i)) \<Longrightarrow> fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) ($\<phi> f args))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe ($\<phi> f args); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) ($\<phi> f args))

goal (1 subgoal):
 1. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> f args)))

goal (9 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (NPadmit_Sequence \<sigma> a b)
[PROOF STATE]
proof (state)
this:
NPadmit \<sigma> a
NPadmit \<sigma> b
PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))

goal (9 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
NPadmit \<sigma> a
NPadmit \<sigma> b
PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))
[PROOF STEP]
have PUA:"PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>))"
    and PA:"NPadmit \<sigma> a"
    and IH1:"hpsafe a \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))"
    and IH2:"hpsafe b \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))"
    and hpsafeS:"hpsafe (PsubstFO a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
NPadmit \<sigma> a
NPadmit \<sigma> b
PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))

goal (1 subgoal):
 1. (PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)) &&& NPadmit \<sigma> a) &&& (\<lbrakk>hpsafe a; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))) &&& (\<lbrakk>hpsafe b; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))) &&& hpsafe (PsubstFO a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>))
NPadmit \<sigma> a
\<lbrakk>hpsafe a; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)
\<lbrakk>hpsafe b; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) b)
hpsafe (PsubstFO a \<sigma>)

goal (9 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "hpsafe (a ;; b) \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
assume hpsafe:"hpsafe (a ;; b)"
[PROOF STATE]
proof (state)
this:
hpsafe (a ;; b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
assume ssafe:"(\<And>i. dsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
dsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
from hpsafe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (a ;; b)
[PROOF STEP]
have safe1:"hpsafe a" and safe2:"hpsafe b"
[PROOF STATE]
proof (prove)
using this:
hpsafe (a ;; b)

goal (1 subgoal):
 1. hpsafe a &&& hpsafe b
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe a
hpsafe b

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have agree:"\<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (-BVP(PsubstFO a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
subgoal for \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(PsubstFO a \<sigma>)" \<nu> , OF hpsafeS]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (PsubstFO a \<sigma>))

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<mu>7 (- BVP (PsubstFO a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have sem_eq:"\<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow>
        ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) =
        ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
subgoal for \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
assume assm:"(\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>)"
[PROOF STATE]
proof (state)
this:
(\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>)

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
show "((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
using uadmit_prog_ntadjoint [OF PUA agree[OF assm] ssafe safe2 good_interp]
[PROOF STATE]
proof (prove)
using this:
prog_sem (adjointFO I \<sigma> \<nu>) b = prog_sem (adjointFO I \<sigma> \<mu>) b

goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((?\<mu>7, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((?\<mu>7, \<omega>) \<in> prog_sem (adjointFO I \<sigma> ?\<mu>7) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
using IH2[OF safe2 ssafe]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) b)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)
[PROOF STEP]
using sem_eq
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((?\<mu>7, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = ((?\<mu>7, \<omega>) \<in> prog_sem (adjointFO I \<sigma> ?\<mu>7) b)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)
[PROOF STEP]
using IH1[OF safe1 ssafe]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>))
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b))"
[PROOF STATE]
proof (prove)
using this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>))
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) (a ;; b))

goal (9 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b)); PUadmitFO \<sigma> b (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) (a ;; b))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (a ;; b); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) (a ;; b))

goal (1 subgoal):
 1. hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (a ;; b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a ;; b)))

goal (8 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (NPadmit_Loop \<sigma> a)
[PROOF STATE]
proof (state)
this:
NPadmit \<sigma> a
PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))

goal (8 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
NPadmit \<sigma> a
PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))
[PROOF STEP]
have PA:"NPadmit \<sigma> a"
    and PUA:"PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>))"
    and IH:"hpsafe a \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))"
    and hpsafeS:"hpsafe (PsubstFO a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
NPadmit \<sigma> a
PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))

goal (1 subgoal):
 1. (NPadmit \<sigma> a &&& PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>))) &&& (\<lbrakk>hpsafe a; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))) &&& hpsafe (PsubstFO a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
NPadmit \<sigma> a
PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>))
\<lbrakk>hpsafe a; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)
hpsafe (PsubstFO a \<sigma>)

goal (8 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "hpsafe (a**) \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a**)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
assume "hpsafe (a**)"
[PROOF STATE]
proof (state)
this:
hpsafe a**

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe a**
[PROOF STEP]
have hpsafe:"hpsafe a"
[PROOF STATE]
proof (prove)
using this:
hpsafe a**

goal (1 subgoal):
 1. hpsafe a
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe a

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
assume ssafe:"(\<And>i. dsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
dsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
have agree:"\<And>\<nu> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (-BVP(PsubstFO a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
subgoal for \<nu> \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(PsubstFO a \<sigma>)" \<nu>, OF hpsafeS]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (PsubstFO a \<sigma>))

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(?\<nu>7, ?\<mu>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree ?\<nu>7 ?\<mu>7 (- BVP (PsubstFO a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
have sem_eq:"\<And>\<nu> \<mu> \<omega>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow>
        ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) =
        ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<mu> \<omega>. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)
[PROOF STEP]
subgoal for \<nu> \<mu> \<omega>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)
[PROOF STEP]
assume assm:"(\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>)"
[PROOF STATE]
proof (state)
this:
(\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>)

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)
[PROOF STEP]
show "((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)
[PROOF STEP]
using uadmit_prog_ntadjoint[OF PUA agree[OF assm] ssafe hpsafe  good_interp]
[PROOF STATE]
proof (prove)
using this:
prog_sem (adjointFO I \<sigma> \<nu>) a = prog_sem (adjointFO I \<sigma> \<mu>) a

goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<mu>) a)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(?\<nu>7, ?\<mu>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> ((?\<mu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a) = ((?\<mu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<mu>7) a)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
have UN_rule:"\<And> a S S'. (\<And>n b. (a,b) \<in> S n \<longleftrightarrow> (a,b) \<in> S' n) \<Longrightarrow> (\<And>b. (a,b) \<in> (\<Union>n. S n) \<longleftrightarrow> (a,b) \<in> (\<Union>n. S' n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a S S'. (\<And>n b. ((a, b) \<in> S n) = ((a, b) \<in> S' n)) \<Longrightarrow> (\<And>b. ((a, b) \<in> \<Union> (range S)) = ((a, b) \<in> \<Union> (range S')))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<And>n b. ((?a7, b) \<in> ?S7 n) = ((?a7, b) \<in> ?S'7 n)) \<Longrightarrow> ((?a7, ?b7) \<in> \<Union> (range ?S7)) = ((?a7, ?b7) \<in> \<Union> (range ?S'7))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
have eqL:"((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem I (PsubstFO a \<sigma>)) ^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>)))))
[PROOF STEP]
using rtrancl_is_UN_relpow
[PROOF STATE]
proof (prove)
using this:
?R\<^sup>* = \<Union> (range ((^^) ?R))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>)))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>)))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>)))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
have eachEq:"\<And>n. ((\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> (prog_sem I (PsubstFO a \<sigma>)) ^^ n) = ((\<nu>, \<omega>) \<in> (prog_sem (adjointFO I \<sigma> \<nu>) a)^^ n)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
fix n
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
show "((\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> (prog_sem I (PsubstFO a \<sigma>)) ^^ n) = ((\<nu>, \<omega>) \<in> (prog_sem (adjointFO I \<sigma> \<nu>) a)^^ n)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
proof (induct n)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ 0)
 2. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ 0)
 2. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ 0)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ 0)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
case (Suc n)
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ n)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ n)
[PROOF STEP]
have IH2:"\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)"
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ n)

goal (1 subgoal):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ n)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
have relpow:"\<And>R n. R ^^ Suc n = R O R ^^ n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>R n. R ^^ Suc n = R O R ^^ n
[PROOF STEP]
using relpow.simps(2) relpow_commute
[PROOF STATE]
proof (prove)
using this:
?R ^^ Suc ?n = ?R ^^ ?n O ?R
?R O ?R ^^ ?n = ?R ^^ ?n O ?R

goal (1 subgoal):
 1. \<And>R n. R ^^ Suc n = R O R ^^ n
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
?R8 ^^ Suc ?n8 = ?R8 O ?R8 ^^ ?n8

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
apply (simp only: relpow[of n "prog_sem I (PsubstFO a \<sigma>)"] relpow[of n "prog_sem (adjointFO I \<sigma> \<nu>) a"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) O prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a O prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
apply(unfold relcomp_unfold)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> {(x, z). \<exists>y. (x, y) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> (y, z) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n}) = ((\<nu>, \<omega>) \<in> {(x, z). \<exists>y. (x, y) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> (y, z) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n})
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem I (PsubstFO a \<sigma>); ((aa, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> ((aa, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
 2. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((aa, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n
[PROOF STEP]
subgoal for ab b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> ((aa, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply(rule exI[where x=ab])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>b. (\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply(rule exI[where x=b])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
using IH2 IH[OF hpsafe ssafe] sem_eq[of \<nu> "(ab,b)" \<omega>]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ n)
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)
(\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> (((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = (((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
using uadmit_prog_ntadjoint[OF PUA agree ssafe hpsafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>) a = prog_sem (adjointFO I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)

goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
using uadmit_prog_ntadjoint[OF PUA agree ssafe hpsafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>) a = prog_sem (adjointFO I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((aa, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n
[PROOF STEP]
subgoal for ab b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n
[PROOF STEP]
apply(rule exI[where x=ab])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>b. (\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n
[PROOF STEP]
apply(rule exI[where x=b])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n
[PROOF STEP]
using IH2 IH[OF hpsafe ssafe] sem_eq[of \<nu> "(ab,b)" \<omega>]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ n)
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)
(\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> (((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a) = (((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
using uadmit_prog_ntadjoint[OF PUA agree ssafe hpsafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>) a = prog_sem (adjointFO I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)

goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
using uadmit_prog_ntadjoint[OF PUA agree ssafe hpsafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>) a = prog_sem (adjointFO I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (PsubstFO a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (adjointFO I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (adjointFO I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (adjointFO I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ Suc n)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ n)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ ?n8)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ ?n8)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
have "((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem I (PsubstFO a \<sigma>)) ^^ n)) = ((\<nu>, \<omega>) \<in> (\<Union> n.(prog_sem (adjointFO I \<sigma> \<nu>) a)^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))
[PROOF STEP]
apply(rule UN_rule)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n b. ((\<nu>, b) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
using eachEq
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ ?n8)

goal (1 subgoal):
 1. \<And>n b. ((\<nu>, b) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ n) = ((\<nu>, b) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
have eqR:"((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a**)) = ((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem (adjointFO I \<sigma> \<nu>) a) ^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))
[PROOF STEP]
using rtrancl_is_UN_relpow
[PROOF STATE]
proof (prove)
using this:
?R\<^sup>* = \<Union> (range ((^^) ?R))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>)))))
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ ?n8)
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))
((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a**))"
[PROOF STATE]
proof (prove)
using this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>)))))
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PsubstFO a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>8) a ^^ ?n8)
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PsubstFO a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))
((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (adjointFO I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a**)

goal (8 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); PUadmitFO \<sigma> a (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a**)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe a**; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a**)

goal (1 subgoal):
 1. hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe a** \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a**))

goal (7 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (NFadmit_Exists \<sigma> \<phi> x)
[PROOF STATE]
proof (state)
this:
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> {Inl x}
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))

goal (7 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> {Inl x}
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have IH:"fsafe \<phi> \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))"
    and FUA:"FUadmitFO \<sigma> \<phi> {Inl x}"
[PROOF STATE]
proof (prove)
using this:
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> {Inl x}
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. (\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))) &&& FUadmitFO \<sigma> \<phi> {Inl x}
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)
FUadmitFO \<sigma> \<phi> {Inl x}

goal (7 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have fsafe:"fsafe (Exists x \<phi>) \<Longrightarrow> fsafe \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe (Exists x \<phi>) \<Longrightarrow> fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe (Exists x \<phi>) \<Longrightarrow> fsafe \<phi>

goal (7 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have eq:"fsafe (Exists x \<phi>) \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>)  (Exists x \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
assume fsafe:"fsafe (Exists x \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (Exists x \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
from fsafe
[PROOF STATE]
proof (chain)
picking this:
fsafe (Exists x \<phi>)
[PROOF STEP]
have fsafe':"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
fsafe (Exists x \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
assume ssafe:"(\<And>i. dsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
dsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have agree:"\<And>r. Vagree \<nu> (repv \<nu> x r) (- {Inl x})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>r. Vagree \<nu> (repv \<nu> x r) (- {Inl x})
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>r. (\<forall>i. Inl i \<in> - {Inl x} \<longrightarrow> fst \<nu> $ i = fst (repv \<nu> x r) $ i) \<and> (\<forall>i. Inr i \<in> - {Inl x} \<longrightarrow> snd \<nu> $ i = snd (repv \<nu> x r) $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> (repv \<nu> x ?r7) (- {Inl x})

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have sem_eq:"\<And>r. ((repv \<nu> x r) \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) =
                      ((repv \<nu> x r) \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>r. (repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using uadmit_fml_ntadjoint[OF FUA agree ssafe fsafe' good_interp]
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> (repv \<nu> x ?r16)) \<phi>

goal (1 subgoal):
 1. \<And>r. (repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(repv \<nu> x ?r7 \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x ?r7)) \<phi>) = (repv \<nu> x ?r7 \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "(\<nu> \<in> fml_sem I (FsubstFO  (Exists x \<phi>) \<sigma>)) = (\<exists>r. (repv \<nu> x r) \<in> fml_sem I (FsubstFO \<phi> \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "... = (\<exists>r. (repv \<nu> x r) \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>)
[PROOF STEP]
using IH[OF fsafe' ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "... = (\<exists>r. (repv \<nu> x r) \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using sem_eq
[PROOF STATE]
proof (prove)
using this:
(repv \<nu> x ?r7 \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x ?r7)) \<phi>) = (repv \<nu> x ?r7 \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
(\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))
[PROOF STEP]
show "(\<nu> \<in> fml_sem I (FsubstFO  (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))"
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
(\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (Exists x \<phi>))

goal (7 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (Exists x \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (Exists x \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (Exists x \<phi>))

goal (1 subgoal):
 1. fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x \<phi>)))

goal (6 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (NFadmit_Diamond \<sigma> \<phi> a)
[PROOF STATE]
proof (state)
this:
NFadmit \<sigma> \<phi>
NPadmit \<sigma> a
FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))

goal (6 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
NFadmit \<sigma> \<phi>
NPadmit \<sigma> a
FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))
[PROOF STEP]
have PA:"NPadmit \<sigma> a"
    and FUA:"FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>))"
    and IH1:"fsafe \<phi> \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))"
    and IH2:"hpsafe a \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))"
    and hpsafeF:"hpsafe (PsubstFO a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
NFadmit \<sigma> \<phi>
NPadmit \<sigma> a
FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>))
hpsafe (PsubstFO a \<sigma>)
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))
hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))

goal (1 subgoal):
 1. (NPadmit \<sigma> a &&& FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>))) &&& (\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))) &&& (\<lbrakk>hpsafe a; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a))) &&& hpsafe (PsubstFO a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
NPadmit \<sigma> a
FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>))
\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)
\<lbrakk>hpsafe a; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)
hpsafe (PsubstFO a \<sigma>)

goal (6 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (\<langle> a \<rangle> \<phi>) \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
assume fsafe:"fsafe (\<langle> a \<rangle> \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (\<langle> a \<rangle> \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
assume ssafe:"(\<And>i. dsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
dsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
from fsafe
[PROOF STATE]
proof (chain)
picking this:
fsafe (\<langle> a \<rangle> \<phi>)
[PROOF STEP]
have fsafe':"fsafe \<phi>" and hpsafe:"hpsafe a"
[PROOF STATE]
proof (prove)
using this:
fsafe (\<langle> a \<rangle> \<phi>)

goal (1 subgoal):
 1. fsafe \<phi> &&& hpsafe a
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>
hpsafe a

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have agree:"\<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<omega> (-BVP(PsubstFO a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<omega> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(PsubstFO a \<sigma>)" \<nu>, OF hpsafeF]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (PsubstFO a \<sigma>))

goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> \<omega> (- BVP (PsubstFO a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega>7 (- BVP (PsubstFO a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have sem_eq:"\<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow>
        (\<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) =
        (\<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> (\<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
using uadmit_fml_ntadjoint [OF FUA agree ssafe fsafe' good_interp]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> ?\<omega>) \<phi>

goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> (\<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> (?\<omega>7 \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (?\<omega>7 \<in> fml_sem (adjointFO I \<sigma> ?\<omega>7) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "(\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists> \<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "... = (\<exists> \<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
using IH1[OF fsafe' ssafe] IH2[OF hpsafe ssafe, of \<nu>]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)
((\<nu>, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)

goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "... = (\<exists> \<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using sem_eq IH2 hpsafe ssafe
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>) \<Longrightarrow> (?\<omega>7 \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (?\<omega>7 \<in> fml_sem (adjointFO I \<sigma> ?\<omega>7) \<phi>)
\<lbrakk>hpsafe a; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (adjointFO I \<sigma> ?\<nu>7) a)
hpsafe a
dsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>))
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>) \<and> \<omega> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (\<langle> a \<rangle> \<phi>))

goal (6 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); FUadmitFO \<sigma> \<phi> (BVP (PsubstFO a \<sigma>)); hpsafe (PsubstFO a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (\<langle> a \<rangle> \<phi>))

goal (1 subgoal):
 1. fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))

goal (5 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (NFadmit_Context \<sigma> \<phi> C)
[PROOF STATE]
proof (state)
this:
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> UNIV
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))

goal (5 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> UNIV
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have FA:"NFadmit \<sigma> \<phi>"
    and FUA:"FUadmitFO \<sigma> \<phi> UNIV"
    and IH:"fsafe \<phi> \<Longrightarrow> (\<And>i. dsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))"
[PROOF STATE]
proof (prove)
using this:
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> UNIV
fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. NFadmit \<sigma> \<phi> &&& FUadmitFO \<sigma> \<phi> UNIV &&& (\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
NFadmit \<sigma> \<phi>
FUadmitFO \<sigma> \<phi> UNIV
\<lbrakk>fsafe \<phi>; \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)

goal (5 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (InContext C \<phi>) \<Longrightarrow>
           (\<And>i. dsafe (\<sigma> i))\<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
assume safe:"fsafe (InContext C \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe (InContext C \<phi>)
[PROOF STEP]
have fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
assume ssafe:"\<And>i. dsafe (\<sigma> i)"
[PROOF STATE]
proof (state)
this:
dsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have Ieq:" Contexts (adjointFO I \<sigma> \<nu>) C = Contexts I C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Contexts (adjointFO I \<sigma> \<nu>) C = Contexts I C
[PROOF STEP]
unfolding adjointFO_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Contexts \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C = Contexts I C
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Contexts (adjointFO I \<sigma> \<nu>) C = Contexts I C

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have IH':"\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have agree:"\<And>\<omega>. Vagree \<nu> \<omega> (-UNIV)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. Vagree \<nu> \<omega> (- UNIV)
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<forall>i. Inl i \<in> - UNIV \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> - UNIV \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> ?\<omega>7 (- UNIV)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have adj_eq:"\<And>\<omega>. fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> \<omega>) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> \<omega>) \<phi>
[PROOF STEP]
using uadmit_fml_ntadjoint[OF FUA agree ssafe fsafe good_interp]
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> ?\<omega>) \<phi>

goal (1 subgoal):
 1. \<And>\<omega>. fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> \<omega>) \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> ?\<omega>7) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> ?\<omega>7) \<phi>
[PROOF STEP]
have sem:"fml_sem I (FsubstFO \<phi> \<sigma>) =  fml_sem (adjointFO I \<sigma> \<nu>) \<phi>"
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> ?\<omega>7) \<phi>

goal (1 subgoal):
 1. fml_sem I (FsubstFO \<phi> \<sigma>) = fml_sem (adjointFO I \<sigma> \<nu>) \<phi>
[PROOF STEP]
using IH' agree adj_eq
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> ?\<omega>7) \<phi>
(?\<nu>7 \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) \<phi>)
Vagree \<nu> ?\<omega>7 (- UNIV)
fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> ?\<omega>7) \<phi>

goal (1 subgoal):
 1. fml_sem I (FsubstFO \<phi> \<sigma>) = fml_sem (adjointFO I \<sigma> \<nu>) \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem I (FsubstFO \<phi> \<sigma>) = fml_sem (adjointFO I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>))
[PROOF STEP]
using Ieq sem
[PROOF STATE]
proof (prove)
using this:
Contexts (adjointFO I \<sigma> \<nu>) C = Contexts I C
fml_sem I (FsubstFO \<phi> \<sigma>) = fml_sem (adjointFO I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (InContext C \<phi>))

goal (5 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); FUadmitFO \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (InContext C \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (InContext C \<phi>); \<And>i. dsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (adjointFO I \<sigma> ?\<nu>7) (InContext C \<phi>))

goal (1 subgoal):
 1. fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (InContext C \<phi>)))

goal (4 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>NPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) a)); NPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PsubstFO (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjointFO I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>NFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<phi>)); NFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. dsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (FsubstFO (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (adjointFO I \<sigma> \<nu>) (\<phi> && \<psi>)))
[PROOF STEP]
qed (auto)