safe_formula_induct: fixes \<phi> :: "Formula.formula"   and P :: "Formula.formula \<Rightarrow> bool" assumes "safe_formula \<phi>"   and "\<And>c d. P (formula.Eq (trm.Const c) (trm.Const d))"   and "\<And>c x. P (formula.Eq (trm.Const c) (trm.Var x))"   and "\<And>c x. P (formula.Eq (trm.Var x) (trm.Const c))"   and "\<And>x. P (formula.Neg (formula.Eq (trm.Var x) (trm.Var x)))"   and "\<And>e ts. \<forall>t\<in>set ts. trm.is_Var t \<or> trm.is_Const t \<Longrightarrow> P (formula.Pred e ts)"   and "\<And>p \<phi> \<psi>. \<lbrakk>{0..<Formula.nfv \<phi>} \<subseteq> fv \<phi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.Let p \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; safe_assignment (fv \<phi>) \<psi>; P \<phi>\<rbrakk> \<Longrightarrow> P (formula.And \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; \<not> safe_assignment (fv \<phi>) \<psi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.And \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; \<not> safe_assignment (fv \<phi>) \<psi>; \<not> safe_formula \<psi>; fv \<psi> \<subseteq> fv \<phi>; is_constraint \<psi>; P \<phi>\<rbrakk> \<Longrightarrow> P (formula.And \<phi> \<psi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>safe_formula \<phi>; \<not> safe_assignment (fv \<phi>) (formula.Neg \<psi>); \<not> safe_formula (formula.Neg \<psi>); fv (formula.Neg \<psi>) \<subseteq> fv \<phi>; \<not> is_constraint (formula.Neg \<psi>); safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.And \<phi> (formula.Neg \<psi>))"   and "\<And>l pos neg. \<lbrakk>(pos, neg) = partition safe_formula l; pos \<noteq> []; list_all safe_formula pos; list_all safe_formula (map remove_neg neg); \<Union> (fv ` set neg) \<subseteq> \<Union> (fv ` set pos); list_all P pos; list_all P (map remove_neg neg)\<rbrakk> \<Longrightarrow> P (formula.Ands l)"   and "\<And>\<phi>. \<lbrakk>fv \<phi> = {}; safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (formula.Neg \<phi>)"   and "\<And>\<phi> \<psi>. \<lbrakk>fv \<psi> = fv \<phi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.Or \<phi> \<psi>)"   and "\<And>\<phi>. \<lbrakk>safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (formula.Exists \<phi>)"   and "\<And>y \<omega> b f \<phi>. \<lbrakk>y + b \<notin> fv \<phi>; {0..<b} \<subseteq> fv \<phi>; fv_trm f \<subseteq> fv \<phi>; safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (formula.Agg y \<omega> b f \<phi>)"   and "\<And>I \<phi>. \<lbrakk>safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (formula.Prev I \<phi>)"   and "\<And>I \<phi>. \<lbrakk>safe_formula \<phi>; P \<phi>\<rbrakk> \<Longrightarrow> P (formula.Next I \<phi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv \<phi> \<subseteq> fv \<psi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.Since \<phi> I \<psi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv (formula.Neg \<phi>) \<subseteq> fv \<psi>; safe_formula \<phi>; \<not> safe_formula (formula.Neg \<phi>); safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.Since (formula.Neg \<phi>) I \<psi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv \<phi> \<subseteq> fv \<psi>; safe_formula \<phi>; safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.Until \<phi> I \<psi>)"   and "\<And>\<phi> I \<psi>. \<lbrakk>fv (formula.Neg \<phi>) \<subseteq> fv \<psi>; safe_formula \<phi>; \<not> safe_formula (formula.Neg \<phi>); safe_formula \<psi>; P \<phi>; P \<psi>\<rbrakk> \<Longrightarrow> P (formula.Until (formula.Neg \<phi>) I \<psi>)"   and "\<And>I r. \<lbrakk>safe_regex Past Strict r; \<forall>\<phi>\<in>atms r. P \<phi>\<rbrakk> \<Longrightarrow> P (formula.MatchP I r)"   and "\<And>I r. \<lbrakk>safe_regex Futu Strict r; \<forall>\<phi>\<in>atms r. P \<phi>\<rbrakk> \<Longrightarrow> P (formula.MatchF I r)" shows "P \<phi>"