(** Safety-enforcing specifications are not the only good properties
  of source programs that are preserved by compilation.  Another example
  of a property that is preserved is the ``initial trace'' property:
  all executions of the program start by producing an expected trace
  of I/O actions, representing the good behavior expected from the program.
  After that, the program may terminate, or continue running, or go wrong
  on an undefined behavior.  What matters is that the program produced
  the expected trace at the beginning of its execution.  This is a typical
  liveness property, and it is preserved by compilation. *)

Definition c_program_has_initial_trace (p: Csyntax.program) (t: trace): Prop :=
  forall beh, program_behaves (Csem.semantics p) beh -> behavior_prefix t beh.Definition asm_program_has_initial_trace (p: Asm.program) (t: trace): Prop :=
  forall beh, program_behaves (Asm.semantics p) beh -> behavior_prefix t beh.

(* Specifications: *)
Theorem transf_c_program_preserves_initial_trace: forall p tp t, transf_c_program p = OK tp -> c_program_has_initial_trace p t -> asm_program_has_initial_trace tp t.
Lemma compiled_linking_succeeds: { asm_program | link_list asm_units = Some asm_program }.
Theorem separate_transf_c_program_preservation: forall beh, program_behaves (Asm.semantics asm_program) beh -> exists beh', program_behaves (Csem.semantics c_program) beh' /\ behavior_improves beh' beh.
Theorem separate_transf_c_program_is_refinement: (forall beh, program_behaves (Csem.semantics c_program) beh -> not_wrong beh) -> (forall beh, program_behaves (Asm.semantics asm_program) beh -> program_behaves (Csem.semantics c_program) beh).
Theorem separate_transf_c_program_preserves_spec: forall spec, safety_enforcing_specification spec -> c_program_satisfies_spec c_program spec -> asm_program_satisfies_spec asm_program spec.
Theorem separate_transf_c_program_preserves_initial_trace: forall t, c_program_has_initial_trace c_program t -> asm_program_has_initial_trace asm_program t.