[STATEMENT]
lemma psubst_fml:
fixes I::"('sf, 'sc, 'sz) interp"
assumes good_interp:"is_interp I"
shows "(PPadmit \<sigma> \<alpha>  \<longrightarrow> hpsafe \<alpha> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall> \<nu> \<omega>. (\<nu>,\<omega>) \<in> prog_sem I (PPsubst \<alpha> \<sigma>) = ((\<nu>,\<omega>) \<in> prog_sem (PFadjoint I \<sigma>) \<alpha>))) \<and>
  (PFadmit \<sigma> \<phi> \<longrightarrow> fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall> \<nu>. \<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (PPadmit \<sigma> \<alpha> \<longrightarrow> hpsafe \<alpha> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst \<alpha> \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) \<alpha>))) \<and> (PFadmit \<sigma> \<phi> \<longrightarrow> fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)))
[PROOF STEP]
proof (induction rule: PPadmit_PFadmit.induct)
[PROOF STATE]
proof (state)
goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> \<phi> ODE. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 6. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 7. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
case (PPadmit_ODE \<sigma> \<phi> ODE)
[PROOF STATE]
proof (state)
this:
PFadmit \<sigma> \<phi>
PFUadmit \<sigma> \<phi> (BVO ODE)
fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))

goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> \<phi> ODE. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 6. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 7. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
assume PF:"PFadmit \<sigma> \<phi>"
[PROOF STATE]
proof (state)
this:
PFadmit \<sigma> \<phi>

goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> \<phi> ODE. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 6. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 7. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
assume PFU:"PFUadmit \<sigma> \<phi> (BVO ODE)"
[PROOF STATE]
proof (state)
this:
PFUadmit \<sigma> \<phi> (BVO ODE)

goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> \<phi> ODE. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 6. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 7. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
assume IH:"fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))"
[PROOF STATE]
proof (state)
this:
fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))

goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> \<phi> ODE. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 6. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 7. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
have "hpsafe (EvolveODE ODE \<phi>) \<Longrightarrow>
  (\<forall>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
assume safe:"hpsafe (EvolveODE ODE \<phi>)"
[PROOF STATE]
proof (state)
this:
hpsafe (EvolveODE ODE \<phi>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (EvolveODE ODE \<phi>)
[PROOF STEP]
have fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
hpsafe (EvolveODE ODE \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
assume ssafe:"(\<forall>i. fsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
\<forall>i. fsafe (\<sigma> i)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
have fml_eq:"\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)
[PROOF STEP]
using IH ssafe fsafe
[PROOF STATE]
proof (prove)
using this:
fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))
\<forall>i. fsafe (\<sigma> i)
fsafe \<phi>

goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(?\<nu>7 \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
fix b sol t
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
assume eq1:"\<nu> = (sol 0, b)"
        and eq2:"\<omega> = mk_v I ODE (sol 0, b) (sol t)"
        and t:"0 \<le> t"
        and sol:"(sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}"
[PROOF STATE]
proof (state)
this:
\<nu> = (sol 0, b)
\<omega> = mk_v I ODE (sol 0, b) (sol t)
0 \<le> t
(sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have var:"ODE_vars I ODE =  ODE_vars (PFadjoint I \<sigma>) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_vars I ODE = ODE_vars (PFadjoint I \<sigma>) ODE
[PROOF STEP]
by(induction ODE, auto simp add: PFadjoint_def)
[PROOF STATE]
proof (state)
this:
ODE_vars I ODE = ODE_vars (PFadjoint I \<sigma>) ODE

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have mkv_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol s) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol s) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)
[PROOF STEP]
apply(rule agree_UNIV_eq)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I ODE (sol 0, b) (sol s)) (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) UNIV
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> UNIV \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> UNIV \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>s i. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
 2. \<And>s i. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
subgoal for s i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using mk_v_agree[of I ODE "(sol 0, b)" "sol s"] mk_v_agree[of "PFadjoint I \<sigma>" ODE "(sol 0, b)" "sol s"]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV I ODE) \<and> Vagree (mk_v I ODE (sol 0, b) (sol s)) (mk_xode I ODE (sol s)) (semBV I ODE)
Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV (PFadjoint I \<sigma>) ODE) \<and> Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) (semBV (PFadjoint I \<sigma>) ODE)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
unfolding Vagree_def var
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_xode I ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_xode I ODE (sol s)) $ i)
((\<forall>i. Inl i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
apply (cases "Inl i \<in> Inl ` ODE_vars I ODE", auto simp add: var)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t; Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
by force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s i. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
subgoal for s i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using mk_v_agree[of I ODE "(sol 0, b)" "sol s"] mk_v_agree[of "PFadjoint I \<sigma>" ODE "(sol 0, b)" "sol s"]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV I ODE) \<and> Vagree (mk_v I ODE (sol 0, b) (sol s)) (mk_xode I ODE (sol s)) (semBV I ODE)
Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV (PFadjoint I \<sigma>) ODE) \<and> Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) (semBV (PFadjoint I \<sigma>) ODE)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
unfolding Vagree_def var
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_xode I ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_xode I ODE (sol s)) $ i)
((\<forall>i. Inl i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
apply (cases "Inr i \<in> Inr ` ODE_vars I ODE", auto simp add: var psubst_ode)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> s; s \<le> t; i \<in> ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> ODE_sem I ODE (sol s) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i
 2. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using psubst_ode[OF good_interp, of ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE

goal (2 subgoals):
 1. \<lbrakk>0 \<le> s; s \<le> t; i \<in> ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> ODE_sem I ODE (sol s) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i
 2. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using psubst_ode[OF good_interp, of ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
by force
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol ?s7) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol ?s7)

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol':"(sol solves_ode (\<lambda>_. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t}
       {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>_. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
apply (rule solves_ode_congI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. (?x solves_ode ?f) ?T ?X
 2. \<And>t. t \<in> ?T \<Longrightarrow> ?x t = sol t
 3. \<And>t. t \<in> ?T \<Longrightarrow> ?f t (?x t) = ODE_sem (PFadjoint I \<sigma>) ODE (?x t)
 4. ?T = {0..t}
 5. ?X = {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
apply (rule sol)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem I ODE (sol ta) = ODE_sem (PFadjoint I \<sigma>) ODE (sol ta)
 3. {0..t} = {0..t}
 4. {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)} = {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem I ODE (sol ta) = ODE_sem (PFadjoint I \<sigma>) ODE (sol ta)
 2. {0..t} = {0..t}
 3. {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)} = {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem I ODE (sol ta) = ODE_sem (PFadjoint I \<sigma>) ODE (sol ta)
[PROOF STEP]
using psubst_ode[OF good_interp, of ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE

goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem I ODE (sol ta) = ODE_sem (PFadjoint I \<sigma>) ODE (sol ta)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. {0..t} = {0..t}
 2. {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)} = {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..t} = {0..t}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)} = {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)} = {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>_. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have sub:"\<And>s. s \<in> {0..t}
              \<Longrightarrow> sol s \<in> {x. (mk_v (PFadjoint I \<sigma> ) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma> ) \<phi>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
using solves_ode_domainD[OF sol, of s] mkv_eq[of s] fml_eq[of "mk_v (PFadjoint I \<sigma> ) ODE (sol 0, b) (sol s)"]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
s \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol s) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)
(mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s) \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s) \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol'':"(sol solves_ode (\<lambda>c. ODE_sem (PFadjoint I \<sigma> ) ODE)) {0..t}
        {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma> ) \<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>c. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply (rule solves_odeI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (PFadjoint I \<sigma>) ODE (sol t))) {0..t}
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (PFadjoint I \<sigma>) ODE (sol t))) {0..t}
[PROOF STEP]
using sol' solves_ode_vderivD
[PROOF STATE]
proof (prove)
using this:
(sol solves_ode (\<lambda>_. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
(?y solves_ode ?f) ?T ?X \<Longrightarrow> (?y has_vderiv_on (\<lambda>t. ?f t (?y t))) ?T

goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (PFadjoint I \<sigma>) ODE (sol t))) {0..t}
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
using sub
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}

goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>c. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}

goal (2 subgoals):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v I ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
 2. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
show"\<exists>sola. sol 0 = sola 0 \<and>
          (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and>
                0 \<le> ta \<and>
                (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta}
               {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
[PROOF STEP]
apply(rule exI[where x=sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sol 0 = sol 0
 2. \<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply(rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t)
 2. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t)
[PROOF STEP]
using mkv_eq t
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol ?s7) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol ?s7)
0 \<le> t

goal (1 subgoal):
 1. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 0 \<le> t
 2. (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply(rule t)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply(rule sol'')
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I ODE (sol 0, b) (sol t) = mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..ta} {x. mk_v (PFadjoint I \<sigma>) ODE (sola 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>})

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
fix b sol t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
assume eq1:"\<nu> = (sol 0, b)"
        and eq2:"\<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t)"
        and t:"0 \<le> t"
        and sol:"(sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}"
[PROOF STATE]
proof (state)
this:
\<nu> = (sol 0, b)
\<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t)
0 \<le> t
(sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have var:"ODE_vars I ODE =  ODE_vars (PFadjoint I \<sigma>) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_vars I ODE = ODE_vars (PFadjoint I \<sigma>) ODE
[PROOF STEP]
by(induction ODE, auto simp add: PFadjoint_def)
[PROOF STATE]
proof (state)
this:
ODE_vars I ODE = ODE_vars (PFadjoint I \<sigma>) ODE

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have mkv_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol s) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol s) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)
[PROOF STEP]
apply(rule agree_UNIV_eq)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I ODE (sol 0, b) (sol s)) (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) UNIV
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> UNIV \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> UNIV \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>s i. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
 2. \<And>s i. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
subgoal for s i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using mk_v_agree[of I ODE "(sol 0, b)" "sol s"] mk_v_agree[of "PFadjoint I \<sigma>" ODE "(sol 0, b)" "sol s"]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV I ODE) \<and> Vagree (mk_v I ODE (sol 0, b) (sol s)) (mk_xode I ODE (sol s)) (semBV I ODE)
Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV (PFadjoint I \<sigma>) ODE) \<and> Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) (semBV (PFadjoint I \<sigma>) ODE)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
unfolding Vagree_def var
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_xode I ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_xode I ODE (sol s)) $ i)
((\<forall>i. Inl i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
apply (cases "Inl i \<in> Inl ` ODE_vars I ODE", auto simp add: var)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t; Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
by force
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s i. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
subgoal for s i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using mk_v_agree[of I ODE "(sol 0, b)" "sol s"] mk_v_agree[of "PFadjoint I \<sigma>" ODE "(sol 0, b)" "sol s"]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV I ODE) \<and> Vagree (mk_v I ODE (sol 0, b) (sol s)) (mk_xode I ODE (sol s)) (semBV I ODE)
Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (sol 0, b) (- semBV (PFadjoint I \<sigma>) ODE) \<and> Vagree (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) (semBV (PFadjoint I \<sigma>) ODE)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
unfolding Vagree_def var
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = fst (mk_xode I ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_xode I ODE (sol s)) $ i)
((\<forall>i. Inl i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (sol 0, b) $ i) \<and> (\<forall>i. Inr i \<in> - semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (sol 0, b) $ i)) \<and> (\<forall>i. Inl i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = fst (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = snd (mk_xode (PFadjoint I \<sigma>) ODE (sol s)) $ i)

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
apply (cases "Inr i \<in> Inr ` ODE_vars I ODE", auto simp add: var psubst_ode)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> s; s \<le> t; i \<in> ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> ODE_sem I ODE (sol s) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i
 2. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using psubst_ode[OF good_interp, of ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE

goal (2 subgoals):
 1. \<lbrakk>0 \<le> s; s \<le> t; i \<in> ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> ODE_sem I ODE (sol s) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i
 2. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem I ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i)\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
using psubst_ode[OF good_interp, of ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE

goal (1 subgoal):
 1. \<lbrakk>0 \<le> s; s \<le> t; Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inl i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inl i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol 0 $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. Inr i \<notin> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<and> Inr i \<notin> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = b $ i; \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v I ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); \<forall>i. (Inl i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i) \<and> (Inl i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> fst (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = sol s $ i); \<forall>i. (Inr i \<in> Inl ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i) \<and> (Inr i \<in> Inr ` ODE_vars (PFadjoint I \<sigma>) ODE \<longrightarrow> snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i = ODE_sem (PFadjoint I \<sigma>) ODE (sol s) $ i); ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE\<rbrakk> \<Longrightarrow> snd (mk_v I ODE (sol 0, b) (sol s)) $ i = snd (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)) $ i
[PROOF STEP]
by force
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol ?s7) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol ?s7)

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol':"(sol solves_ode (\<lambda>_. ODE_sem I ODE)) {0..t}
         {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>_. ODE_sem I ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply (rule solves_ode_congI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. (?x solves_ode ?f) ?T ?X
 2. \<And>t. t \<in> ?T \<Longrightarrow> ?x t = sol t
 3. \<And>t. t \<in> ?T \<Longrightarrow> ?f t (?x t) = ODE_sem I ODE (?x t)
 4. ?T = {0..t}
 5. ?X = {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
apply (rule sol)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem (PFadjoint I \<sigma>) ODE (sol ta) = ODE_sem I ODE (sol ta)
 3. {0..t} = {0..t}
 4. {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>} = {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem (PFadjoint I \<sigma>) ODE (sol ta) = ODE_sem I ODE (sol ta)
 2. {0..t} = {0..t}
 3. {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>} = {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem (PFadjoint I \<sigma>) ODE (sol ta) = ODE_sem I ODE (sol ta)
[PROOF STEP]
using psubst_ode[OF good_interp, of ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I ODE = ODE_sem (PFadjoint I \<sigma>) ODE

goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem (PFadjoint I \<sigma>) ODE (sol ta) = ODE_sem I ODE (sol ta)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. {0..t} = {0..t}
 2. {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>} = {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..t} = {0..t}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>} = {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>} = {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>_. ODE_sem I ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have sub:"\<And>s. s \<in> {0..t}
              \<Longrightarrow> sol s \<in> {x. (mk_v  I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>))}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
using solves_ode_domainD[OF sol, of s] mkv_eq[of s] fml_eq[of "mk_v (PFadjoint I \<sigma> ) ODE (sol 0, b) (sol s)"]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
s \<in> {0..t} \<Longrightarrow> mk_v I ODE (sol 0, b) (sol s) = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s)
(mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s) \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol s) \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol'':"(sol solves_ode (\<lambda>c. ODE_sem I ODE)) {0..t}
        {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>c. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
apply (rule solves_odeI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I ODE (sol t))) {0..t}
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I ODE (sol t))) {0..t}
[PROOF STEP]
using sol' solves_ode_vderivD
[PROOF STATE]
proof (prove)
using this:
(sol solves_ode (\<lambda>_. ODE_sem I ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}
(?y solves_ode ?f) ?T ?X \<Longrightarrow> (?y has_vderiv_on (\<lambda>t. ?f t (?y t))) ?T

goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I ODE (sol t))) {0..t}
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
using sub
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> sol ?s7 \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}

goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>c. ODE_sem I ODE)) {0..t} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)}

goal (1 subgoal):
 1. \<And>b sol t. \<lbrakk>\<nu> = (sol 0, b); \<omega> = mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (PFadjoint I \<sigma>) ODE)) {0..t} {x. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) x \<in> fml_sem (PFadjoint I \<sigma>) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
show "\<exists>sola. sol 0 = sola 0 \<and>
          (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and>
                0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
apply(rule exI[where x=sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sol 0, b) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sol 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})
[PROOF STEP]
by (metis dual_order.refl intervalE mkv_eq sol'' t)
[PROOF STATE]
proof (state)
this:
\<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (PFadjoint I \<sigma>) ODE (sol 0, b) (sol t) = mk_v I ODE (sola 0, b) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I ODE)) {0..ta} {x. mk_v I ODE (sola 0, b) x \<in> fml_sem I (PFsubst \<phi> \<sigma>)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>))

goal (15 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> \<phi> ODE. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 6. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 7. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
A total of 15 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>))

goal (1 subgoal):
 1. hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (EvolveODE ODE \<phi>)))

goal (14 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 6. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (14 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 6. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
case (PPadmit_Assign \<sigma> x \<theta>)
[PROOF STATE]
proof (state)
this:

goal (14 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 6. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
have "hpsafe (x := \<theta>) \<Longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<forall> \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
assume safe:"hpsafe (x := \<theta>)"
[PROOF STATE]
proof (state)
this:
hpsafe (x := \<theta>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x := \<theta>)
[PROOF STEP]
have dsafe:"dsafe \<theta>"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x := \<theta>)

goal (1 subgoal):
 1. dsafe \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe \<theta>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
assume safes:"(\<forall>i. fsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
\<forall>i. fsafe (\<sigma> i)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
show "?thesis"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
using psubst_dterm[OF good_interp dsafe, of \<sigma>]
[PROOF STATE]
proof (prove)
using this:
dterm_sem I \<theta> = dterm_sem (PFadjoint I \<sigma>) \<theta>

goal (1 subgoal):
 1. \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))

goal (14 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
 6. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
A total of 14 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))
[PROOF STEP]
show "?case"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (x := \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>))

goal (1 subgoal):
 1. hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (x := \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (x := \<theta>)))

goal (13 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
A total of 13 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (13 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
A total of 13 subgoals...
[PROOF STEP]
case (PPadmit_DiffAssign \<sigma> x \<theta>)
[PROOF STATE]
proof (state)
this:

goal (13 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
A total of 13 subgoals...
[PROOF STEP]
have "hpsafe (DiffAssign x \<theta>) \<Longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<forall> \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = (((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
assume safe:"hpsafe (DiffAssign x \<theta>)"
[PROOF STATE]
proof (state)
this:
hpsafe (DiffAssign x \<theta>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe (DiffAssign x \<theta>)
[PROOF STEP]
have dsafe:"dsafe \<theta>"
[PROOF STATE]
proof (prove)
using this:
hpsafe (DiffAssign x \<theta>)

goal (1 subgoal):
 1. dsafe \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe \<theta>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
assume safes:"(\<forall>i. fsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
\<forall>i. fsafe (\<sigma> i)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
show "?thesis"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
using psubst_dterm[OF good_interp dsafe, of \<sigma>]
[PROOF STATE]
proof (prove)
using this:
dterm_sem I \<theta> = dterm_sem (PFadjoint I \<sigma>) \<theta>

goal (1 subgoal):
 1. \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))

goal (13 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> x \<theta>. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
A total of 13 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (DiffAssign x \<theta>); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>))

goal (1 subgoal):
 1. hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (DiffAssign x \<theta>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (DiffAssign x \<theta>)))

goal (12 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
case (PFadmit_Geq \<sigma> \<theta>1 \<theta>2)
[PROOF STATE]
proof (state)
this:

goal (12 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
have "fsafe (Geq \<theta>1 \<theta>2) \<Longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<forall> \<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
assume safe:"fsafe (Geq \<theta>1 \<theta>2)"
[PROOF STATE]
proof (state)
this:
fsafe (Geq \<theta>1 \<theta>2)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe (Geq \<theta>1 \<theta>2)
[PROOF STEP]
have safe1:"dsafe \<theta>1"
      and safe2:"dsafe \<theta>2"
[PROOF STATE]
proof (prove)
using this:
fsafe (Geq \<theta>1 \<theta>2)

goal (1 subgoal):
 1. dsafe \<theta>1 &&& dsafe \<theta>2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe \<theta>1
dsafe \<theta>2

goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
assume safes:"(\<forall>i. fsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
\<forall>i. fsafe (\<sigma> i)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
show "?thesis"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
using psubst_dterm[OF good_interp safe1, of \<sigma>] psubst_dterm[OF good_interp safe2, of \<sigma>]
[PROOF STATE]
proof (prove)
using this:
dterm_sem I \<theta>1 = dterm_sem (PFadjoint I \<sigma>) \<theta>1
dterm_sem I \<theta>2 = dterm_sem (PFadjoint I \<sigma>) \<theta>2

goal (1 subgoal):
 1. \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
by  auto
[PROOF STATE]
proof (state)
this:
\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))

goal (12 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (Geq \<theta>1 \<theta>2); \<forall>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2))

goal (1 subgoal):
 1. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Geq \<theta>1 \<theta>2)))

goal (11 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
case (PFadmit_Prop \<sigma> p args)
[PROOF STATE]
proof (state)
this:

goal (11 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
have "fsafe (Prop p args) \<Longrightarrow> (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>.(\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
assume safe:"fsafe (Prop p args)" and ssafe:" (\<And>i. fsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> p args)
fsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe ($\<phi> p args)
[PROOF STEP]
have safes:"\<And>i. dsafe (args i)"
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
using dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
have Ieq:"Predicates I p = Predicates (PFadjoint I \<sigma>) p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Predicates I p = Predicates (PFadjoint I \<sigma>) p
[PROOF STEP]
unfolding PFadjoint_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Predicates I p = Predicates \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Predicates I p = Predicates (PFadjoint I \<sigma>) p

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
have vec:"(\<chi> i. dterm_sem I (args i) \<nu>) = (\<chi> i. dterm_sem (PFadjoint I \<sigma>) (args i) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<chi>i. dterm_sem I (args i) \<nu>) = (\<chi>i. dterm_sem (PFadjoint I \<sigma>) (args i) \<nu>)
[PROOF STEP]
apply(auto simp add: vec_eq_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. dterm_sem I (args i) \<nu> = dterm_sem (PFadjoint I \<sigma>) (args i) \<nu>
[PROOF STEP]
subgoal for i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem I (args i) \<nu> = dterm_sem (PFadjoint I \<sigma>) (args i) \<nu>
[PROOF STEP]
using safes[of i]
[PROOF STATE]
proof (prove)
using this:
dsafe (args i)

goal (1 subgoal):
 1. dterm_sem I (args i) \<nu> = dterm_sem (PFadjoint I \<sigma>) (args i) \<nu>
[PROOF STEP]
by (metis good_interp psubst_dterm)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<chi>i. dterm_sem I (args i) \<nu>) = (\<chi>i. dterm_sem (PFadjoint I \<sigma>) (args i) \<nu>)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args))
[PROOF STEP]
using  Ieq vec
[PROOF STATE]
proof (prove)
using this:
Predicates I p = Predicates (PFadjoint I \<sigma>) p
(\<chi>i. dterm_sem I (args i) \<nu>) = (\<chi>i. dterm_sem (PFadjoint I \<sigma>) (args i) \<nu>)

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args))

goal (11 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> f args. fsafe ($\<phi> f args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> f args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> f args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args))
[PROOF STEP]
show "?case"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe ($\<phi> p args); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args))

goal (1 subgoal):
 1. fsafe ($\<phi> p args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> p args) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) ($\<phi> p args)))

goal (10 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
case (PPadmit_Sequence \<sigma> a b)
[PROOF STATE]
proof (state)
this:
PPadmit \<sigma> a
PPadmit \<sigma> b
PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>))
hpsafe (PPsubst a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))
hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))

goal (10 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
PPadmit \<sigma> a
PPadmit \<sigma> b
PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>))
hpsafe (PPsubst a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))
hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))
[PROOF STEP]
have PUA:"PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>))"
    and PA:"PPadmit \<sigma> a"
    and IH1:"hpsafe a \<Longrightarrow> (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<forall> \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))"
    and IH2:"hpsafe b \<Longrightarrow> (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<forall> \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))"
    and substSafe:"hpsafe (PPsubst a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
PPadmit \<sigma> a
PPadmit \<sigma> b
PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>))
hpsafe (PPsubst a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))
hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))

goal (1 subgoal):
 1. (PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)) &&& PPadmit \<sigma> a) &&& (\<lbrakk>hpsafe a; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)) &&& (\<lbrakk>hpsafe b; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)) &&& hpsafe (PPsubst a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>))
PPadmit \<sigma> a
\<lbrakk>hpsafe a; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)
\<lbrakk>hpsafe b; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> \<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
hpsafe (PPsubst a \<sigma>)

goal (10 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
have "hpsafe (a ;; b) \<Longrightarrow> (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<And> \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
assume hpsafe:"hpsafe (a ;; b)"
[PROOF STATE]
proof (state)
this:
hpsafe (a ;; b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
assume ssafe:"(\<And>i. fsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
fsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
from hpsafe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (a ;; b)
[PROOF STEP]
have safe1:"hpsafe a" and safe2:"hpsafe b"
[PROOF STATE]
proof (prove)
using this:
hpsafe (a ;; b)

goal (1 subgoal):
 1. hpsafe a &&& hpsafe b
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe a
hpsafe b

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
have agree:"\<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (-BVP(PPsubst a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PPsubst a \<sigma>))
[PROOF STEP]
subgoal for \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PPsubst a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(PPsubst a \<sigma>)" \<nu>, OF substSafe]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (PPsubst a \<sigma>))

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PPsubst a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<mu>7 (- BVP (PPsubst a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
have sem_eq:"\<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow>
        ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) =
        ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
subgoal for \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
assume assm:"(\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>)"
[PROOF STATE]
proof (state)
this:
(\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>)

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
show "((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
using PUA agree[OF assm] safe2 ssafe good_interp
[PROOF STATE]
proof (prove)
using this:
PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>))
Vagree \<nu> \<mu> (- BVP (PPsubst a \<sigma>))
hpsafe b
fsafe (\<sigma> ?i7)
is_interp I

goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> ((?\<mu>7, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((?\<mu>7, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
have "((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
using IH2[OF safe2 ssafe]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
using IH1[OF safe1 ssafe] sem_eq
[PROOF STATE]
proof (prove)
using this:
\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)
(\<nu>, ?\<mu>7) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> ((?\<mu>7, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = ((?\<mu>7, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>))
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b))"
[PROOF STATE]
proof (prove)
using this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>))
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b))

goal (10 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b)); PPUadmit \<sigma> b (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 4. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (a ;; b); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b))

goal (1 subgoal):
 1. hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (a ;; b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a ;; b)))

goal (9 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
case (PPadmit_Loop \<sigma> a)
[PROOF STATE]
proof (state)
this:
PPadmit \<sigma> a
PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>))
hpsafe (PPsubst a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))

goal (9 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
PPadmit \<sigma> a
PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>))
hpsafe (PPsubst a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))
[PROOF STEP]
have PA:"PPadmit \<sigma> a"
  and PUA:"PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>))"
  and IH:"hpsafe a \<Longrightarrow> (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))"
  and substSafe:"hpsafe (PPsubst a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
PPadmit \<sigma> a
PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>))
hpsafe (PPsubst a \<sigma>)
hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))

goal (1 subgoal):
 1. (PPadmit \<sigma> a &&& PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>))) &&& (\<lbrakk>hpsafe a; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a))) &&& hpsafe (PPsubst a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
PPadmit \<sigma> a
PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>))
\<lbrakk>hpsafe a; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) a)
hpsafe (PPsubst a \<sigma>)

goal (9 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
have "hpsafe (a**) \<Longrightarrow> (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a**)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
assume "hpsafe (a**)"
[PROOF STATE]
proof (state)
this:
hpsafe a**

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe a**
[PROOF STEP]
have hpsafe:"hpsafe a"
[PROOF STATE]
proof (prove)
using this:
hpsafe a**

goal (1 subgoal):
 1. hpsafe a
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe a

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
assume ssafe:"\<And>i. fsafe (\<sigma> i)"
[PROOF STATE]
proof (state)
this:
fsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
have agree:"\<And>\<nu> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (-BVP(PPsubst a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PPsubst a \<sigma>))
[PROOF STEP]
subgoal for \<nu> \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PPsubst a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(PPsubst a \<sigma>)" \<nu>, OF substSafe]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (PPsubst a \<sigma>))

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (PPsubst a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(?\<nu>7, ?\<mu>7) \<in> prog_sem I (PPsubst a \<sigma>) \<Longrightarrow> Vagree ?\<nu>7 ?\<mu>7 (- BVP (PPsubst a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
have UN_rule:"\<And> a S S'. (\<And>n b. (a,b) \<in> S n \<longleftrightarrow> (a,b) \<in> S' n) \<Longrightarrow> (\<And>b. (a,b) \<in> (\<Union>n. S n) \<longleftrightarrow> (a,b) \<in> (\<Union>n. S' n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a S S'. (\<And>n b. ((a, b) \<in> S n) = ((a, b) \<in> S' n)) \<Longrightarrow> (\<And>b. ((a, b) \<in> \<Union> (range S)) = ((a, b) \<in> \<Union> (range S')))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<And>n b. ((?a7, b) \<in> ?S7 n) = ((?a7, b) \<in> ?S'7 n)) \<Longrightarrow> ((?a7, ?b7) \<in> \<Union> (range ?S7)) = ((?a7, ?b7) \<in> \<Union> (range ?S'7))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
have eqL:"((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem I (PPsubst a \<sigma>)) ^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>)))))
[PROOF STEP]
using rtrancl_is_UN_relpow
[PROOF STATE]
proof (prove)
using this:
?R\<^sup>* = \<Union> (range ((^^) ?R))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>)))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>)))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>)))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
have eachEq:"\<And>n. ((\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> (prog_sem I (PPsubst a \<sigma>)) ^^ n) = ((\<nu>, \<omega>) \<in> (prog_sem (PFadjoint I \<sigma>) a)^^ n)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
fix n
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
show "((\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> (prog_sem I (PPsubst a \<sigma>)) ^^ n) = ((\<nu>, \<omega>) \<in> (prog_sem (PFadjoint I \<sigma>) a)^^ n)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
proof (induct n)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ 0)
 2. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ 0)
 2. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ 0)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ 0)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
case (Suc n)
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
have IH2:"\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)"
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)

goal (1 subgoal):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
have relpow:"\<And>R n. R ^^ Suc n = R O R ^^ n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>R n. R ^^ Suc n = R O R ^^ n
[PROOF STEP]
using relpow.simps(2) relpow_commute
[PROOF STATE]
proof (prove)
using this:
?R ^^ Suc ?n = ?R ^^ ?n O ?R
?R O ?R ^^ ?n = ?R ^^ ?n O ?R

goal (1 subgoal):
 1. \<And>R n. R ^^ Suc n = R O R ^^ n
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
?R8 ^^ Suc ?n8 = ?R8 O ?R8 ^^ ?n8

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)
[PROOF STEP]
apply (simp only: relpow[of n "prog_sem I (PPsubst a \<sigma>)"] relpow[of n "prog_sem (PFadjoint I \<sigma>) a"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) O prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a O prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
apply(unfold relcomp_unfold)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> {(x, z). \<exists>y. (x, y) \<in> prog_sem I (PPsubst a \<sigma>) \<and> (y, z) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n}) = ((\<nu>, \<omega>) \<in> {(x, z). \<exists>y. (x, y) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> (y, z) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n})
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem I (PPsubst a \<sigma>); ((aa, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> ((aa, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n
 2. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem (PFadjoint I \<sigma>) a; ((aa, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (PPsubst a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n
[PROOF STEP]
subgoal for ab b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PPsubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> ((aa, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n
[PROOF STEP]
apply(rule exI[where x=ab])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PPsubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>b. (\<nu>, ab, b) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n
[PROOF STEP]
apply(rule exI[where x=b])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PPsubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n
[PROOF STEP]
using IH2 IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (PPsubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem (PFadjoint I \<sigma>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem (PFadjoint I \<sigma>) a; ((aa, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (PPsubst a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n
[PROOF STEP]
subgoal for ab b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (PFadjoint I \<sigma>) a; ((ab, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (PPsubst a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n
[PROOF STEP]
apply(rule exI[where x=ab])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (PFadjoint I \<sigma>) a; ((ab, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>b. (\<nu>, ab, b) \<in> prog_sem I (PPsubst a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n
[PROOF STEP]
apply(rule exI[where x=b])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (PFadjoint I \<sigma>) a; ((ab, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem I (PPsubst a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n
[PROOF STEP]
using IH2 IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (PFadjoint I \<sigma>) a; ((ab, b), \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem I (PPsubst a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ Suc n)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ ?n8)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ ?n8)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
have "((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem I (PPsubst a \<sigma>)) ^^ n)) = ((\<nu>, \<omega>) \<in> (\<Union> n.(prog_sem (PFadjoint I \<sigma>) a)^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))
[PROOF STEP]
apply(rule UN_rule)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n b. ((\<nu>, b) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, b) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
using eachEq
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ ?n8)

goal (1 subgoal):
 1. \<And>n b. ((\<nu>, b) \<in> prog_sem I (PPsubst a \<sigma>) ^^ n) = ((\<nu>, b) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ n)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
have eqR:"((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a**)) = ((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem (PFadjoint I \<sigma>) a) ^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))
[PROOF STEP]
using rtrancl_is_UN_relpow
[PROOF STATE]
proof (prove)
using this:
?R\<^sup>* = \<Union> (range ((^^) ?R))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>)))))
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ ?n8)
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))
((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a**))"
[PROOF STATE]
proof (prove)
using this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>)))))
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (PPsubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (PFadjoint I \<sigma>) a ^^ ?n8)
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (PPsubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))
((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (PFadjoint I \<sigma>) a))))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) a**)

goal (9 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPUadmit \<sigma> a (BVP (PPsubst a \<sigma>)); hpsafe (PPsubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
 3. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) a**)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe a**; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (PFadjoint I \<sigma>) a**)

goal (1 subgoal):
 1. hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe a** \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a**))

goal (8 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
case (PFadmit_Context \<sigma> \<phi> C)
[PROOF STATE]
proof (state)
this:
PFadmit \<sigma> \<phi>
PFUadmit \<sigma> \<phi> UNIV
fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))

goal (8 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
PFadmit \<sigma> \<phi>
PFUadmit \<sigma> \<phi> UNIV
fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))
[PROOF STEP]
have FA:"PFadmit \<sigma> \<phi>"
    and FUA:"PFUadmit \<sigma> \<phi> UNIV"
    and IH:"fsafe \<phi> \<Longrightarrow> (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))"
[PROOF STATE]
proof (prove)
using this:
PFadmit \<sigma> \<phi>
PFUadmit \<sigma> \<phi> UNIV
fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))

goal (1 subgoal):
 1. PFadmit \<sigma> \<phi> &&& PFUadmit \<sigma> \<phi> UNIV &&& (\<lbrakk>fsafe \<phi>; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
PFadmit \<sigma> \<phi>
PFUadmit \<sigma> \<phi> UNIV
\<lbrakk>fsafe \<phi>; \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)

goal (8 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (InContext C \<phi>) \<Longrightarrow>
           (\<And>i. fsafe (\<sigma> i)) \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
assume safe:"fsafe (InContext C \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe (InContext C \<phi>)
[PROOF STEP]
have fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
assume ssafe:"(\<And>i. fsafe (\<sigma> i))"
[PROOF STATE]
proof (state)
this:
fsafe (\<sigma> ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
fix \<nu> :: "(real, 'sz) vec \<times> (real, 'sz) vec"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
have IH':"\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)
[PROOF STEP]
using IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)

goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(?\<nu>7 \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
have agree:"\<And>\<omega>. Vagree \<nu> \<omega> (-UNIV)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. Vagree \<nu> \<omega> (- UNIV)
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<forall>i. Inl i \<in> - UNIV \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> - UNIV \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> ?\<omega>7 (- UNIV)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Vagree \<nu> ?\<omega>7 (- UNIV)
[PROOF STEP]
have sem:"fml_sem I (PFsubst \<phi> \<sigma>) =  fml_sem (PFadjoint I \<sigma>) \<phi>"
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> ?\<omega>7 (- UNIV)

goal (1 subgoal):
 1. fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>
[PROOF STEP]
using IH' agree
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> ?\<omega>7 (- UNIV)
(?\<nu>7 \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)
Vagree \<nu> ?\<omega>7 (- UNIV)

goal (1 subgoal):
 1. fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>))
[PROOF STEP]
using sem
[PROOF STATE]
proof (prove)
using this:
fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>; \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x)\<rbrakk> \<Longrightarrow> \<nu> \<in> Contexts (PFadjoint I \<sigma>) C (fml_sem (PFadjoint I \<sigma>) \<phi>)
 2. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>; \<nu> \<in> Contexts (PFadjoint I \<sigma>) C (fml_sem (PFadjoint I \<sigma>) \<phi>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x)
[PROOF STEP]
apply(cases C)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>; \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x); C = Inl a\<rbrakk> \<Longrightarrow> \<nu> \<in> Contexts (PFadjoint I \<sigma>) C (fml_sem (PFadjoint I \<sigma>) \<phi>)
 2. \<And>b. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>; \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x); C = Inr b\<rbrakk> \<Longrightarrow> \<nu> \<in> Contexts (PFadjoint I \<sigma>) C (fml_sem (PFadjoint I \<sigma>) \<phi>)
 3. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem (PFadjoint I \<sigma>) \<phi>; \<nu> \<in> Contexts (PFadjoint I \<sigma>) C (fml_sem (PFadjoint I \<sigma>) \<phi>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x)
[PROOF STEP]
unfolding PFadjoint_def
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>; \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x); C = Inl a\<rbrakk> \<Longrightarrow> \<nu> \<in> Contexts \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C (fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>)
 2. \<And>b. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>; \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x); C = Inr b\<rbrakk> \<Longrightarrow> \<nu> \<in> Contexts \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C (fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>)
 3. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>; \<nu> \<in> Contexts \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C (fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>; \<nu> \<in> (case C of Inl x \<Rightarrow> Contexts I x | Inr f' \<Rightarrow> \<lambda>_. fml_sem I (\<sigma> f')) (fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x)
[PROOF STEP]
apply(cases C)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>; \<nu> \<in> (case C of Inl x \<Rightarrow> Contexts I x | Inr f' \<Rightarrow> \<lambda>_. fml_sem I (\<sigma> f')) (fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>); C = Inl a\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x)
 2. \<And>b. \<lbrakk>fml_sem I (PFsubst \<phi> \<sigma>) = fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>; \<nu> \<in> (case C of Inl x \<Rightarrow> Contexts I x | Inr f' \<Rightarrow> \<lambda>_. fml_sem I (\<sigma> f')) (fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (\<sigma> f')), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> \<phi>); C = Inr b\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem I (case C of Inl C' \<Rightarrow> InContext C' (PFsubst \<phi> \<sigma>) | Inr x \<Rightarrow> \<sigma> x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>))

goal (8 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> UNIV\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (InContext C \<phi>); \<And>i. fsafe (\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>))

goal (1 subgoal):
 1. fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (InContext C \<phi>)))

goal (7 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PPadmit \<sigma> b; hpsafe b \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) (? \<phi>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PFUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>PFadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) \<phi>)); PPadmit \<sigma> a; hpsafe a \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (PPsubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint I \<sigma>) a)); PFUadmit \<sigma> \<phi> (BVP (PPsubst a \<sigma>))\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> (\<forall>i. fsafe (\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (PFsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint I \<sigma>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
qed (auto simp add: PFadjoint_def)