Definition explicit_safety (U:schedule)  (tr:event_trace) (st:machine_state) (m:mem): Prop:=
    exp_safety _ _ (fun U stm => is_true (ssrbool.isSome (halted_machine (U, fst(fst stm), snd(fst stm)))))
                   (fun U stm stm' => internal_step U (snd(fst stm)) (snd stm) (snd(fst stm')) (snd stm'))
                   (fun U stm U' stm' => external_step U (fst(fst stm)) (snd(fst stm)) (snd stm) U' (fst(fst stm')) (snd(fst stm')) (snd stm'))
                   (fun U stm => @valid (fst(fst stm),snd(fst stm), snd stm) U) U (tr,st,m).Definition explicit_safety_bounded (U:schedule)  (tr:event_trace)(st:machine_state) (m:mem): Prop:=
    exp_safety _ _ (fun U stm => is_true (ssrbool.isSome (halted_machine (U, fst(fst stm), snd(fst stm)))))
                   (fun U stm stm' => internal_step U (snd(fst stm)) (snd stm) (snd(fst stm')) (snd stm'))
                   (fun U stm U' stm' => external_step U (fst(fst stm))  (snd(fst stm)) (snd stm) U' (fst(fst stm')) (snd(fst stm')) (snd stm'))
                   (fun U stm => @valid_bound (fst(fst stm),snd(fst stm), snd stm) U) U (tr,st,m).

(* Specifications: *)
Lemma kstep_trace_irr: forall U U' tr1 tr1' tr2 tp tp' m m', kstep (tr1, tp, m) U (tr1', tp', m') U' -> exists tr2', kstep (tr2, tp, m) U (tr2', tp', m') U'.
Lemma safe_kstep_trace_irr: forall U tr tr' tp m, safe_kstep (U,tr,tp) m -> safe_kstep (U,tr',tp) m.
Lemma external_step_trace_irr: forall U U' tr1 tr1' tr2 tp tp' m m', external_step U tr1 tp m U' tr1' tp' m' -> exists tr2', external_step U tr2 tp m U' tr2' tp' m'.
Lemma explicit_safety_trace_irr: forall U tr tr' tp m, explicit_safety U tr tp m -> explicit_safety U tr' tp m.
Lemma explicit_safety_schedule_irr: forall U U' tr tp m, schedPeek U = schedPeek U' -> explicit_safety U tr tp m -> explicit_safety U' tr tp m.