induct: fixes x1 :: "((Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> (Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> bool) set"   and x2 :: "OBJ"   and x3 :: "(Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> (Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> bool"   and P :: "((Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> (Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> bool) set \<Rightarrow> OBJ \<Rightarrow> ((Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> (Var \<Rightarrow> Val) \<times> (Location \<times> Class \<times> (Field \<times> Val) list) list \<Rightarrow> bool) \<Rightarrow> bool" assumes "(x1, x2, x3) \<in> Deriv"   and "\<And>G c. \<lbrakk>(G, c, HighSec) \<in> Deriv; P G c HighSec\<rbrakk> \<Longrightarrow> P G c (Sec (\<lambda>(s, t, \<beta>). s \<equiv>\<^sub>\<beta> t))"   and "\<And>G. P G Skip (Sec (\<lambda>(s, t, \<beta>). s \<equiv>\<^sub>\<beta> t))"   and "\<And>e G x. Expr_low e \<Longrightarrow> P G (Assign x e) (Sec (\<lambda>(s, t, \<beta>). \<exists>r. s = (update (fst r) x (evalE e (fst r)), snd r) \<and> r \<equiv>\<^sub>\<beta> t))"   and "\<And>G c1 \<Phi> c2 \<Psi>. \<lbrakk>(G, c1, Sec \<Phi>) \<in> Deriv; P G c1 (Sec \<Phi>); (G, c2, Sec \<Psi>) \<in> Deriv; P G c2 (Sec \<Psi>)\<rbrakk> \<Longrightarrow> P G (Comp c1 c2) (Sec (\<lambda>(s, t, \<beta>). \<exists>r. \<Phi> (r, t, \<beta>) \<and> (\<forall>w \<gamma>. r \<equiv>\<^sub>\<gamma> w \<longrightarrow> \<Psi> (s, w, \<gamma>))))"   and "\<And>b G c1 \<Phi> c2 \<Psi>. \<lbrakk>BExpr_low b; (G, c1, Sec \<Phi>) \<in> Deriv; P G c1 (Sec \<Phi>); (G, c2, Sec \<Psi>) \<in> Deriv; P G c2 (Sec \<Psi>)\<rbrakk> \<Longrightarrow> P G (Iff b c1 c2) (Sec (\<lambda>(s, t, \<beta>). (evalB b (fst t) \<longrightarrow> \<Phi> (s, t, \<beta>)) \<and> (\<not> evalB b (fst t) \<longrightarrow> \<Psi> (s, t, \<beta>))))"   and "\<And>x G C. CONTEXT x = low \<Longrightarrow> P G (New x C) (Sec (\<lambda>(s, t, \<beta>). \<exists>l r. l \<notin> Dom (snd r) \<and> r \<equiv>\<^sub>\<beta> t \<and> s = (update (fst r) x (RVal (Loc l)), (l, C, []) # snd r)))"   and "\<And>y f G x. \<lbrakk>CONTEXT y = low; GAMMA f = low\<rbrakk> \<Longrightarrow> P G (Get x y f) (Sec (\<lambda>(s, t, \<beta>). \<exists>r l C Flds v. fst r y = RVal (Loc l) \<and> lookup (snd r) l = Some (C, Flds) \<and> lookup Flds f = Some v \<and> r \<equiv>\<^sub>\<beta> t \<and> s = (update (fst r) x v, snd r)))"   and "\<And>x f e G. \<lbrakk>CONTEXT x = low; GAMMA f = low; Expr_low e\<rbrakk> \<Longrightarrow> P G (Put x f e) (Sec (\<lambda>(s, t, \<beta>). \<exists>r l C F h. fst r x = RVal (Loc l) \<and> r \<equiv>\<^sub>\<beta> t \<and> lookup (snd r) l = Some (C, F) \<and> h = (l, C, (f, evalE e (fst r)) # F) # snd r \<and> s = (fst r, h)))"   and "\<And>b G c \<Phi>. \<lbrakk>BExpr_low b; (G, c, Sec \<Phi>) \<in> Deriv; P G c (Sec \<Phi>)\<rbrakk> \<Longrightarrow> P G (While b c) (Sec (PhiWhile b \<Phi>))"   and "\<And>\<phi> G. \<lbrakk>({Sec (FIX \<phi>)} \<union> G, body, Sec (\<phi> (FIX \<phi>))) \<in> Deriv; P ({Sec (FIX \<phi>)} \<union> G) body (Sec (\<phi> (FIX \<phi>))); Monotone \<phi>\<rbrakk> \<Longrightarrow> P G Call (Sec (FIX \<phi>))"   and "\<And>G. P G Skip HighSec"   and "\<And>x e G. \<lbrakk>CONTEXT x = high; \<forall>s. noLowDPs s \<longrightarrow> Expr_good e s\<rbrakk> \<Longrightarrow> P G (Assign x e) HighSec"   and "\<And>x G C. CONTEXT x = high \<Longrightarrow> P G (New x C) HighSec"   and "\<And>x G y f. CONTEXT x = high \<Longrightarrow> P G (Get x y f) HighSec"   and "\<And>f e G x. \<lbrakk>GAMMA f = high; \<forall>s. noLowDPs s \<longrightarrow> Expr_good e s\<rbrakk> \<Longrightarrow> P G (Put x f e) HighSec"   and "\<And>G c d. \<lbrakk>(G, c, HighSec) \<in> Deriv; P G c HighSec; (G, d, HighSec) \<in> Deriv; P G d HighSec\<rbrakk> \<Longrightarrow> P G (Comp c d) HighSec"   and "\<And>G c d b. \<lbrakk>(G, c, HighSec) \<in> Deriv; P G c HighSec; (G, d, HighSec) \<in> Deriv; P G d HighSec\<rbrakk> \<Longrightarrow> P G (Iff b c d) HighSec"   and "\<And>G c b. \<lbrakk>(G, c, HighSec) \<in> Deriv; P G c HighSec\<rbrakk> \<Longrightarrow> P G (While b c) HighSec"   and "\<And>G. \<lbrakk>({HighSec} \<union> G, body, HighSec) \<in> Deriv; P ({HighSec} \<union> G) body HighSec\<rbrakk> \<Longrightarrow> P G Call HighSec" shows "P x1 x2 x3"