safe_formula_induct: fixes \<phi> :: "formula"   and P :: "formula \<Rightarrow> bool" assumes "safe_formula \<phi>"   and "\<And>c d. P (formula.Eq (Const c) (Const d))"   and "\<And>c x. P (formula.Eq (Const c) (Var x))"   and "\<And>c x. P (formula.Eq (Var x) (Const c))"   and "\<And>x. P (Neg (formula.Eq (Var x) (Var x)))"   and "\<And>e ts. \<forall>t\<in>set ts. is_Var t \<or> is_Const t \<Longrightarrow> P (Pred e ts)"   and "\<And>p \<phi> \<psi>. \<lbrakk>{0..<nfv \<phi>} \<subseteq> fv \<phi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.Let p \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; safe_assignment (fv \<phi>) \<psi>; P \<phi>\<rbrakk> \<Longrightarrow> P (And \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; \<not> safe_assignment (fv \<phi>) \<psi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (And \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; \<not> safe_assignment (fv \<phi>) \<psi>; \<not> safe_formula \<psi>; fv \<psi> \<subseteq> fv \<phi>; is_constraint \<psi>; P \<phi>\<rbrakk> \<Longrightarrow> P (And \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; \<not> safe_assignment (fv \<phi>) (Neg \<psi>); \<not> safe_formula (Neg \<psi>); fv (Neg \<psi>) \<subseteq> fv \<phi>; \<not> is_constraint (Neg \<psi>); safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (And \<phi> (Neg \<psi>))"   and "\<And>l pos neg. \<lbrakk>(pos, neg) = partition safe_formula l; pos \<noteq> []; list_all safe_formula pos; list_all safe_formula (map remove_neg neg); \<Union> (fv ` set neg) \<subseteq> \<Union> (fv ` set pos); list_all P pos; list_all P (map remove_neg neg)\<rbrakk> \<Longrightarrow> P (Ands l)"   and "\<And>\<phi>. \<lbrakk>fv \<phi> = {}; safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (Neg \<phi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>fv \<psi> = fv \<phi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (Or \<phi> \<psi>)"   and "\<And>\<phi>. \<lbrakk>safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (Exists \<phi>)"   and "\<And>y \<omega> b f \<phi>. \<lbrakk>y + b \<notin> fv \<phi>; {0..<b} \<subseteq> fv \<phi>; fv_trm f \<subseteq> fv \<phi>; safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (Agg y \<omega> b f \<phi>)"   and "\<And>I \<phi>. \<lbrakk>safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (Prev I \<phi>)"   and "\<And>I \<phi>. \<lbrakk>safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (Next I \<phi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv \<phi> \<subseteq> fv \<psi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (Since \<phi> I \<psi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv (Neg \<phi>) \<subseteq> fv \<psi>; safe_formula \<phi>; \<not> safe_formula (Neg \<phi>); safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (Since (Neg \<phi>) I \<psi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv \<phi> \<subseteq> fv \<psi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (Until \<phi> I \<psi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv (Neg \<phi>) \<subseteq> fv \<psi>; safe_formula \<phi>; \<not> safe_formula (Neg \<phi>); safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (Until (Neg \<phi>) I \<psi>)"   and "\<And>I r. \<lbrakk>safe_regex Past Strict r; \<forall>\<phi>\<in>atms r. P \<phi>\<rbrakk> \<Longrightarrow> P (MatchP I r)"   and "\<And>I r. \<lbrakk>safe_regex Futu Strict r; \<forall>\<phi>\<in>atms r. P \<phi>\<rbrakk> \<Longrightarrow> P (MatchF I r)" shows "P \<phi>"