[STATEMENT]
lemma uadmit_prog_fml_ntadjoint':
  fixes \<sigma> I
  assumes ssafe:"\<And>i. dsafe (\<sigma> i)"
  assumes good_interp:"is_interp I"
  shows "\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP \<alpha>}. FVT (\<sigma> x)) \<Longrightarrow> hpsafe \<alpha> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) \<alpha> = prog_sem (adjointFO I \<sigma> \<omega>) \<alpha>"
  and "\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF \<phi>}. FVT (\<sigma> x)) \<Longrightarrow> fsafe \<phi> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> \<omega>) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP \<alpha>}. FVT (\<sigma> x)); hpsafe \<alpha>\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) \<alpha> = prog_sem (adjointFO I \<sigma> \<omega>) \<alpha>) &&& (\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF \<phi>}. FVT (\<sigma> x)); fsafe \<phi>\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) \<phi> = fml_sem (adjointFO I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
proof (induct "\<alpha>" and "\<phi>")
[PROOF STATE]
proof (state)
goal (15 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP ($\<alpha> x)}. FVT (\<sigma> x)); hpsafe ($\<alpha> x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (adjointFO I \<sigma> \<omega>) ($\<alpha> x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
A total of 15 subgoals...
[PROOF STEP]
case (Pvar x)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP ($\<alpha> x)}. FVT (\<sigma> x))
hpsafe ($\<alpha> x)

goal (15 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP ($\<alpha> x)}. FVT (\<sigma> x)); hpsafe ($\<alpha> x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (adjointFO I \<sigma> \<omega>) ($\<alpha> x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
A total of 15 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP ($\<alpha> x)}. FVT (\<sigma> x))
hpsafe ($\<alpha> x)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP ($\<alpha> x)}. FVT (\<sigma> x))
hpsafe ($\<alpha> x)

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (adjointFO I \<sigma> \<omega>) ($\<alpha> x)
[PROOF STEP]
unfolding adjointFO_def
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP ($\<alpha> x)}. FVT (\<sigma> x))
hpsafe ($\<alpha> x)

goal (1 subgoal):
 1. prog_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> ($\<alpha> x) = prog_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<omega>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> ($\<alpha> x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) ($\<alpha> x) = prog_sem (adjointFO I \<sigma> \<omega>) ($\<alpha> x)

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
case (Assign x e)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (x := e)}. FVT (\<sigma> x))
hpsafe (x := e)

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (Assign x e)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x := e)}. FVT (\<sigma> y))

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
assume safe:"hpsafe (x := e)"
[PROOF STATE]
proof (state)
this:
hpsafe (x := e)

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x := e)
[PROOF STEP]
have dsafe:"dsafe e"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x := e)

goal (1 subgoal):
 1. dsafe e
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe e

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
have sub:"(\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (Assign x e)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x := e)}. FVT (\<sigma> y))
[PROOF STEP]
using ntadj_sub_assign[of \<sigma> e x]
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x := e)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x := e)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x := e)}. FVT (\<sigma> y))

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
have VA':"(Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i))
[PROOF STEP]
using agree_sub[OF sub VA]
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i))

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
have "dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
[PROOF STEP]
using uadmit_dterm_ntadjoint'[of \<sigma> I \<nu> \<omega> e] ssafe good_interp agree_sub[OF sub VA] dsafe
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i. dsafe (\<sigma> i); is_interp I; Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i)); dsafe e\<rbrakk> \<Longrightarrow> dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
dsafe (\<sigma> ?i7)
is_interp I
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y))
dsafe e

goal (1 subgoal):
 1. dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e

goal (14 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 := x2)}. FVT (\<sigma> x)); hpsafe (x1 := x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 := x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 := x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 10. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
A total of 14 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (x := e) = prog_sem (adjointFO I \<sigma> \<omega>) (x := e)
[PROOF STEP]
by (auto simp add: vec_eq_iff)
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) (x := e) = prog_sem (adjointFO I \<sigma> \<omega>) (x := e)

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
case (DiffAssign x e)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (DiffAssign x e)}. FVT (\<sigma> x))
hpsafe (DiffAssign x e)

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (DiffAssign x e)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (DiffAssign x e)}. FVT (\<sigma> y))

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
assume safe:"hpsafe (DiffAssign x e)"
[PROOF STATE]
proof (state)
this:
hpsafe (DiffAssign x e)

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (DiffAssign x e)
[PROOF STEP]
have dsafe:"dsafe e"
[PROOF STATE]
proof (prove)
using this:
hpsafe (DiffAssign x e)

goal (1 subgoal):
 1. dsafe e
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe e

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
have sub:"(\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (DiffAssign x e)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (DiffAssign x e)}. FVT (\<sigma> y))
[PROOF STEP]
using ntadj_sub_assign[of \<sigma> e x]
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x := e)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (DiffAssign x e)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (DiffAssign x e)}. FVT (\<sigma> y))

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
have VA':"(Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i))
[PROOF STEP]
using agree_sub[OF sub VA]
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i))

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
have "dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
[PROOF STEP]
using uadmit_dterm_ntadjoint'[of \<sigma> I \<nu> \<omega> e] ssafe good_interp agree_sub[OF sub VA] dsafe
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i. dsafe (\<sigma> i); is_interp I; Vagree \<nu> \<omega> (\<Union>i\<in>{i. Inr i \<in> SIGT e}. FVT (\<sigma> i)); dsafe e\<rbrakk> \<Longrightarrow> dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
dsafe (\<sigma> ?i7)
is_interp I
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT e}. FVT (\<sigma> y))
dsafe e

goal (1 subgoal):
 1. dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e

goal (13 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (DiffAssign x1 x2)}. FVT (\<sigma> x)); hpsafe (DiffAssign x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 9. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
A total of 13 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
dterm_sem (adjointFO I \<sigma> \<nu>) e = dterm_sem (adjointFO I \<sigma> \<omega>) e

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x e) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x e)
[PROOF STEP]
by (auto simp add: vec_eq_iff)
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) (DiffAssign x e) = prog_sem (adjointFO I \<sigma> \<omega>) (DiffAssign x e)

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
case (Test x)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x = fml_sem (adjointFO I \<sigma> ?\<omega>7) x
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x))
hpsafe (? x)

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x = fml_sem (adjointFO I \<sigma> ?\<omega>7) x

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (? x)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (? x)}. FVT (\<sigma> y))

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
assume hpsafe:"hpsafe (? x)"
[PROOF STATE]
proof (state)
this:
hpsafe (? x)

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe (? x)
[PROOF STEP]
have fsafe:"fsafe x"
[PROOF STATE]
proof (prove)
using this:
hpsafe (? x)

goal (1 subgoal):
 1. fsafe x
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
have sub:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (? x)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (? x)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (? x)}. FVT (\<sigma> y))

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
have "fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x
[PROOF STEP]
using IH[OF agree_sub[OF sub VA] fsafe]
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x

goal (12 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP (? x)}. FVT (\<sigma> x)); hpsafe (? x)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 8. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) (? x) = prog_sem (adjointFO I \<sigma> \<omega>) (? x)

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
case (EvolveODE x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x))
hpsafe (EvolveODE x1 x2)

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
assume safe:"hpsafe (EvolveODE x1 x2)"
[PROOF STATE]
proof (state)
this:
hpsafe (EvolveODE x1 x2)

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe (EvolveODE x1 x2)
[PROOF STEP]
have osafe:"osafe x1" and fsafe:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
hpsafe (EvolveODE x1 x2)

goal (1 subgoal):
 1. osafe x1 &&& fsafe x2
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
osafe x1
fsafe x2

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have sub1:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
have VAF:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y))
[PROOF STEP]
using agree_sub[OF sub1 VA]
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
note IH' = IH[OF VAF fsafe]
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have sub:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> y))

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have IH2:"ODE_sem (adjointFO I \<sigma> \<nu>) x1 = ODE_sem (adjointFO I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_sem (adjointFO I \<sigma> \<nu>) x1 = ODE_sem (adjointFO I \<sigma> \<omega>) x1
[PROOF STEP]
apply (rule uadmit_ode_ntadjoint')
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>i. dsafe (\<sigma> i)
 2. is_interp I
 3. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
 4. osafe x1
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dsafe (\<sigma> i_)
[PROOF STEP]
by (rule ssafe)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. is_interp I
 2. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
 3. osafe x1
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_interp I
[PROOF STEP]
by (rule good_interp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
 2. osafe x1
[PROOF STEP]
defer
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. osafe x1
 2. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. osafe x1
[PROOF STEP]
by (rule osafe)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
[PROOF STEP]
using agree_sub[OF sub VA]
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ODE_sem (adjointFO I \<sigma> \<nu>) x1 = ODE_sem (adjointFO I \<sigma> \<omega>) x1

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
have mkv:"mk_v (adjointFO I \<sigma> \<nu>) x1 = mk_v (adjointFO I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v (adjointFO I \<sigma> \<nu>) x1 = mk_v (adjointFO I \<sigma> \<omega>) x1
[PROOF STEP]
apply (rule uadmit_mkv_ntadjoint)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>i. dsafe (\<sigma> i)
 2. is_interp I
 3. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
 4. osafe x1
[PROOF STEP]
using ssafe good_interp osafe agree_sub[OF sub VA]
[PROOF STATE]
proof (prove)
using this:
dsafe (\<sigma> ?i7)
is_interp I
osafe x1
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))

goal (4 subgoals):
 1. \<And>i. dsafe (\<sigma> i)
 2. is_interp I
 3. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGO x1}. FVT (\<sigma> y))
 4. osafe x1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
mk_v (adjointFO I \<sigma> \<nu>) x1 = mk_v (adjointFO I \<sigma> \<omega>) x1

goal (11 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (EvolveODE x1 x2)}. FVT (\<sigma> x)); hpsafe (EvolveODE x1 x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 7. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
A total of 11 subgoals...
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sola 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2})
 2. \<And>aa ba bb sol t. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sola 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2})
[PROOF STEP]
subgoal for aa ba bb sol t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sola 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2})
[PROOF STEP]
apply(rule exI[where x = sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
using mkv
[PROOF STATE]
proof (prove)
using this:
mk_v (adjointFO I \<sigma> \<nu>) x1 = mk_v (adjointFO I \<sigma> \<omega>) x1

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
using IH2 mkv IH'
[PROOF STATE]
proof (prove)
using this:
ODE_sem (adjointFO I \<sigma> \<nu>) x1 = ODE_sem (adjointFO I \<sigma> \<omega>) x1
mk_v (adjointFO I \<sigma> \<nu>) x1 = mk_v (adjointFO I \<sigma> \<omega>) x1
fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sola 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2})
[PROOF STEP]
subgoal for aa ba bb sol t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sola 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2})
[PROOF STEP]
apply(rule exI[where x = sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0 \<and> (\<exists>ta. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> sol 0 = sol 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> \<exists>ta. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..ta} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
using mkv
[PROOF STATE]
proof (prove)
using this:
mk_v (adjointFO I \<sigma> \<nu>) x1 = mk_v (adjointFO I \<sigma> \<omega>) x1

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t) = mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
 2. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> 0 \<le> t
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
using IH2 mkv IH'
[PROOF STATE]
proof (prove)
using this:
ODE_sem (adjointFO I \<sigma> \<nu>) x1 = ODE_sem (adjointFO I \<sigma> \<omega>) x1
mk_v (adjointFO I \<sigma> \<nu>) x1 = mk_v (adjointFO I \<sigma> \<omega>) x1
fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. \<lbrakk>0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<omega>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<omega>) x2}; (aa, ba) = mk_v (adjointFO I \<sigma> \<omega>) x1 (sol 0, bb) (sol t)\<rbrakk> \<Longrightarrow> (sol solves_ode (\<lambda>a. ODE_sem (adjointFO I \<sigma> \<nu>) x1)) {0..t} {x. mk_v (adjointFO I \<sigma> \<nu>) x1 (sol 0, bb) x \<in> fml_sem (adjointFO I \<sigma> \<nu>) x2}
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) (EvolveODE x1 x2) = prog_sem (adjointFO I \<sigma> \<omega>) (EvolveODE x1 x2)

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Choice x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x1 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x2 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x))
hpsafe (x1 \<union>\<union> x2)

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<Longrightarrow> hpsafe x1 \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x1 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x1

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<Longrightarrow> hpsafe x2 \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x2 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x2

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"hpsafe (x1 \<union>\<union> x2)"
[PROOF STATE]
proof (state)
this:
hpsafe (x1 \<union>\<union> x2)

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x1 \<union>\<union> x2)
[PROOF STEP]
have
    safe1:"hpsafe x1"
    and safe2:"hpsafe x2"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x1 \<union>\<union> x2)

goal (1 subgoal):
 1. hpsafe x1 &&& hpsafe x2
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x1
hpsafe x2

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1)}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x2)}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))

goal (10 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> x)); hpsafe (x1 \<union>\<union> x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 6. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 10. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 \<union>\<union> x2)}. FVT (\<sigma> y))
prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1
prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) (x1 \<union>\<union> x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 \<union>\<union> x2)

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Sequence x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x1 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x2 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x))
hpsafe (x1 ;; x2)

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<Longrightarrow> hpsafe x1 \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x1 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x1

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<Longrightarrow> hpsafe x2 \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x2 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x2

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"hpsafe (x1 ;; x2)"
[PROOF STATE]
proof (state)
this:
hpsafe (x1 ;; x2)

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x1 ;; x2)
[PROOF STEP]
have
    safe1:"hpsafe x1"
    and safe2:"hpsafe x2"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x1 ;; x2)

goal (1 subgoal):
 1. hpsafe x1 &&& hpsafe x2
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x1
hpsafe x2

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))

goal (9 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x2}. FVT (\<sigma> x)); hpsafe x2\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> x)); hpsafe (x1 ;; x2)\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 5. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 9. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x1 ;; x2)}. FVT (\<sigma> y))
prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1
prog_sem (adjointFO I \<sigma> \<nu>) x2 = prog_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) (x1 ;; x2) = prog_sem (adjointFO I \<sigma> \<omega>) (x1 ;; x2)

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Loop x)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x = prog_sem (adjointFO I \<sigma> ?\<omega>7) x
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x))
hpsafe x**

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x}. FVT (\<sigma> y)) \<Longrightarrow> hpsafe x \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x}. FVT (\<sigma> y)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x = prog_sem (adjointFO I \<sigma> ?\<omega>7) x

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x** )}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x**}. FVT (\<sigma> y))

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"hpsafe (x** )"
[PROOF STATE]
proof (state)
this:
hpsafe x**

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
hpsafe x**
[PROOF STEP]
have
    safe:"hpsafe x"
[PROOF STATE]
proof (prove)
using this:
hpsafe x**

goal (1 subgoal):
 1. hpsafe x
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x )}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP (x** )}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x**}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x**}. FVT (\<sigma> y))

goal (8 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x}. FVT (\<sigma> x)); hpsafe x\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGP x**}. FVT (\<sigma> x)); hpsafe x**\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 4. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 8. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
[PROOF STEP]
using IH[OF agree_sub[OF sub VA] safe]
[PROOF STATE]
proof (prove)
using this:
prog_sem (adjointFO I \<sigma> \<nu>) x = prog_sem (adjointFO I \<sigma> \<omega>) x

goal (1 subgoal):
 1. prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prog_sem (adjointFO I \<sigma> \<nu>) x** = prog_sem (adjointFO I \<sigma> \<omega>) x**

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Geq x1 x2)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x))
fsafe (Geq x1 x2)

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Geq x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (Geq x1 x2)

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe (Geq x1 x2)
[PROOF STEP]
have dsafe1:"dsafe x1" and dsafe2:"dsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (Geq x1 x2)

goal (1 subgoal):
 1. dsafe x1 &&& dsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe x1
dsafe x2

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>y\<in>{y. Inr y \<in> SIGT x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inr y \<in> SIGT x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inr y \<in> SIGT x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>y\<in>{y. Inr y \<in> SIGT x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inr y \<in> SIGT x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inr y \<in> SIGT x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> y))

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have "dterm_sem (adjointFO I \<sigma> \<nu>) x1 = dterm_sem (adjointFO I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (adjointFO I \<sigma> \<nu>) x1 = dterm_sem (adjointFO I \<sigma> \<omega>) x1
[PROOF STEP]
by (rule uadmit_dterm_ntadjoint'[OF ssafe good_interp agree_sub[OF sub1 VA] dsafe1])
[PROOF STATE]
proof (state)
this:
dterm_sem (adjointFO I \<sigma> \<nu>) x1 = dterm_sem (adjointFO I \<sigma> \<omega>) x1

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dterm_sem (adjointFO I \<sigma> \<nu>) x1 = dterm_sem (adjointFO I \<sigma> \<omega>) x1

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have "dterm_sem (adjointFO I \<sigma> \<nu>) x2 = dterm_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem (adjointFO I \<sigma> \<nu>) x2 = dterm_sem (adjointFO I \<sigma> \<omega>) x2
[PROOF STEP]
by (rule uadmit_dterm_ntadjoint'[OF ssafe good_interp agree_sub[OF sub2 VA] dsafe2])
[PROOF STATE]
proof (state)
this:
dterm_sem (adjointFO I \<sigma> \<nu>) x2 = dterm_sem (adjointFO I \<sigma> \<omega>) x2

goal (7 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Geq x1 x2)}. FVT (\<sigma> x)); fsafe (Geq x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 3. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 7. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (adjointFO I \<sigma> \<nu>) x1 = dterm_sem (adjointFO I \<sigma> \<omega>) x1
dterm_sem (adjointFO I \<sigma> \<nu>) x2 = dterm_sem (adjointFO I \<sigma> \<omega>) x2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
dterm_sem (adjointFO I \<sigma> \<nu>) x1 = dterm_sem (adjointFO I \<sigma> \<omega>) x1
dterm_sem (adjointFO I \<sigma> \<nu>) x2 = dterm_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) (Geq x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Geq x1 x2)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Prop x1 x2 \<nu> \<omega>)
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x))
fsafe ($\<phi> x1 x2)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe ($\<phi> x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> x1 x2)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe ($\<phi> x1 x2)
[PROOF STEP]
have safes:"\<And>i. dsafe (x2 i)"
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> x1 x2)

goal (1 subgoal):
 1. \<And>i. dsafe (x2 i)
[PROOF STEP]
using dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> x1 x2)
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>i. dsafe (x2 i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (x2 ?i9)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have subs:"\<And>j. (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>j. (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
subgoal for j
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inr y \<in> SIGT (x2 ?j9)}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have "\<And>i. dterm_sem (adjointFO I \<sigma> \<nu>) (x2 i) = dterm_sem (adjointFO I \<sigma> \<omega>) (x2 i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. dterm_sem (adjointFO I \<sigma> \<nu>) (x2 i) = dterm_sem (adjointFO I \<sigma> \<omega>) (x2 i)
[PROOF STEP]
by (rule uadmit_dterm_ntadjoint'[OF ssafe good_interp agree_sub[OF subs VA] safes])
[PROOF STATE]
proof (state)
this:
dterm_sem (adjointFO I \<sigma> \<nu>) (x2 ?i10) = dterm_sem (adjointFO I \<sigma> \<omega>) (x2 ?i10)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dterm_sem (adjointFO I \<sigma> \<nu>) (x2 ?i10) = dterm_sem (adjointFO I \<sigma> \<omega>) (x2 ?i10)
[PROOF STEP]
have vec_eq:"\<And>R. (\<chi> i. dterm_sem (adjointFO I \<sigma> \<nu>) (x2 i) R) = (\<chi> i. dterm_sem (adjointFO I \<sigma> \<omega>) (x2 i) R)"
[PROOF STATE]
proof (prove)
using this:
dterm_sem (adjointFO I \<sigma> \<nu>) (x2 ?i10) = dterm_sem (adjointFO I \<sigma> \<omega>) (x2 ?i10)

goal (1 subgoal):
 1. \<And>R. (\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (x2 i) R) = (\<chi>i. dterm_sem (adjointFO I \<sigma> \<omega>) (x2 i) R)
[PROOF STEP]
by (auto simp add: vec_eq_iff)
[PROOF STATE]
proof (state)
this:
(\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (x2 i) ?R10) = (\<chi>i. dterm_sem (adjointFO I \<sigma> \<omega>) (x2 i) ?R10)

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from VA
[PROOF STATE]
proof (chain)
picking this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
have VAs:"\<And>j. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. \<And>j. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y))
[PROOF STEP]
subgoal for j
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y))
[PROOF STEP]
using agree_sub[OF subs[of j] VA]
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> y))
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 j)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 ?j10)}. FVT (\<sigma> y))

goal (6 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF ($\<phi> x1 x2)}. FVT (\<sigma> x)); fsafe ($\<phi> x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
 2. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 6. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 ?j10)}. FVT (\<sigma> y))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 ?j10)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
using vec_eq
[PROOF STATE]
proof (prove)
using this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inr y \<in> SIGT (x2 ?j10)}. FVT (\<sigma> y))
(\<chi>i. dterm_sem (adjointFO I \<sigma> \<nu>) (x2 i) ?R10) = (\<chi>i. dterm_sem (adjointFO I \<sigma> \<omega>) (x2 i) ?R10)

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)
[PROOF STEP]
by (auto simp add: adjointFO_def)
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) ($\<phi> x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) ($\<phi> x1 x2)

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Not x)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x = fml_sem (adjointFO I \<sigma> ?\<omega>7) x
Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x))
fsafe (! x)

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x = fml_sem (adjointFO I \<sigma> ?\<omega>7) x

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Not x)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (! x)}. FVT (\<sigma> y))

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Not x)"
[PROOF STATE]
proof (state)
this:
fsafe (! x)

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (! x)
[PROOF STEP]
have
    safe:"fsafe x"
[PROOF STATE]
proof (prove)
using this:
fsafe (! x)

goal (1 subgoal):
 1. fsafe x
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Not x)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (! x)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (! x)}. FVT (\<sigma> y))

goal (5 subgoals):
 1. \<And>x \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF x}. FVT (\<sigma> x)); fsafe x\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x; Vagree \<nu> \<omega> (\<Union>x\<in>{xa. Inl (Inr xa) \<in> SIGF (! x)}. FVT (\<sigma> x)); fsafe (! x)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 5. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
[PROOF STEP]
using IH[OF agree_sub[OF sub VA] safe]
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) x = fml_sem (adjointFO I \<sigma> \<omega>) x

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) (! x) = fml_sem (adjointFO I \<sigma> \<omega>) (! x)

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (And x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x1 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x))
fsafe (x1 && x2)

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x1}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x1 \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x1}. FVT (\<sigma> y)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x1 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x1

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (And x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (x1 && x2)}. FVT (\<sigma> y))

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (And x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (x1 && x2)

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (x1 && x2)
[PROOF STEP]
have
    safe1:"fsafe x1"
and safe2:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (x1 && x2)

goal (1 subgoal):
 1. fsafe x1 &&& fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x1
fsafe x2

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x1}. FVT (\<sigma> y))  \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (And x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (x1 && x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (x1 && x2)}. FVT (\<sigma> y))

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y))  \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (And x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (x1 && x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (x1 && x2)}. FVT (\<sigma> y))

goal (4 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x1}. FVT (\<sigma> x)); fsafe x1\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (x1 && x2)}. FVT (\<sigma> x)); fsafe (x1 && x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 4. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) x1 = fml_sem (adjointFO I \<sigma> \<omega>) x1
fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) (x1 && x2) = fml_sem (adjointFO I \<sigma> \<omega>) (x1 && x2)

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Exists x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x))
fsafe (Exists x1 x2)

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> y))

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Exists x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (Exists x1 x2)

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (Exists x1 x2)
[PROOF STEP]
have safe1:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (Exists x1 x2)

goal (1 subgoal):
 1. fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x2

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> y))

goal (3 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (Exists x1 x2)}. FVT (\<sigma> x)); fsafe (Exists x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 3. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1]
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) (Exists x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (Exists x1 x2)

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (Diamond x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x1 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x1
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x))
fsafe (\<langle> x1 \<rangle> x2)

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<Longrightarrow> hpsafe x1 \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> ?\<nu>7) x1 = prog_sem (adjointFO I \<sigma> ?\<omega>7) x1

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH2:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Diamond x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> y))

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (Diamond x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (\<langle> x1 \<rangle> x2)

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (\<langle> x1 \<rangle> x2)
[PROOF STEP]
have
    safe1:"hpsafe x1"
and safe2:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (\<langle> x1 \<rangle> x2)

goal (1 subgoal):
 1. hpsafe x1 &&& fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe x1
fsafe x2

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub1:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Diamond x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGP x1}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> y))

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub2:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (Diamond x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> y))

goal (2 subgoals):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGP x1}. FVT (\<sigma> x)); hpsafe x1\<rbrakk> \<Longrightarrow> prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1; \<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (\<langle> x1 \<rangle> x2)}. FVT (\<sigma> x)); fsafe (\<langle> x1 \<rangle> x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
 2. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub1 VA] safe1] IH2[OF agree_sub[OF sub2 VA] safe2]
[PROOF STATE]
proof (prove)
using this:
prog_sem (adjointFO I \<sigma> \<nu>) x1 = prog_sem (adjointFO I \<sigma> \<omega>) x1
fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) (\<langle> x1 \<rangle> x2) = fml_sem (adjointFO I \<sigma> \<omega>) (\<langle> x1 \<rangle> x2)

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
case (InContext x1 x2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2
Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x))
fsafe (InContext x1 x2)

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume IH1:"\<And>\<nu> \<omega>. Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<Longrightarrow> fsafe x2 \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2"
[PROOF STATE]
proof (state)
this:
\<lbrakk>Vagree ?\<nu>7 ?\<omega>7 (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> ?\<nu>7) x2 = fml_sem (adjointFO I \<sigma> ?\<omega>7) x2

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume VA:"Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (state)
this:
Vagree \<nu> \<omega> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
assume safe:"fsafe (InContext x1 x2)"
[PROOF STATE]
proof (state)
this:
fsafe (InContext x1 x2)

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (InContext x1 x2)
[PROOF STEP]
have  safe1:"fsafe x2"
[PROOF STATE]
proof (prove)
using this:
fsafe (InContext x1 x2)

goal (1 subgoal):
 1. fsafe x2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe x2

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
have sub:"(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> y))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF x2}. FVT (\<sigma> y)) \<subseteq> (\<Union>y\<in>{y. Inl (Inr y) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> y))

goal (1 subgoal):
 1. \<And>x1 x2 \<nu> \<omega>. \<lbrakk>\<And>\<nu> \<omega>. \<lbrakk>Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF x2}. FVT (\<sigma> x)); fsafe x2\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2; Vagree \<nu> \<omega> (\<Union>x\<in>{x. Inl (Inr x) \<in> SIGF (InContext x1 x2)}. FVT (\<sigma> x)); fsafe (InContext x1 x2)\<rbrakk> \<Longrightarrow> fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
using IH1[OF agree_sub[OF sub VA] safe1]
[PROOF STATE]
proof (prove)
using this:
fml_sem (adjointFO I \<sigma> \<nu>) x2 = fml_sem (adjointFO I \<sigma> \<omega>) x2

goal (1 subgoal):
 1. fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)
[PROOF STEP]
unfolding adjointFO_def
[PROOF STATE]
proof (prove)
using this:
fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> x2 = fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<omega>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> x2

goal (1 subgoal):
 1. fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> (InContext x1 x2) = fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (\<sigma> f') \<omega>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> (InContext x1 x2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (adjointFO I \<sigma> \<nu>) (InContext x1 x2) = fml_sem (adjointFO I \<sigma> \<omega>) (InContext x1 x2)

goal:
No subgoals!
[PROOF STEP]
qed