Fixpoint safeN (n:nat) (c:C) (m:mem) : Prop :=
  match n with
    | O => True
    | S n' =>
      match halted Hcore c with
        | None =>
          exists c', exists m',
            corestep Hcore ge c m c' m' /\
            safeN n' c' m'
        | Some i => P i m
      end
  end.Definition corestep_fun  :=
  forall ge m q m1 q1 m2 q2 ,
    corestep Hcore ge q m q1 m1 ->
    corestep Hcore ge q m q2 m2 ->
    (q1, m1) = (q2, m2).

(* Specifications: *)
Lemma safe_downward1 : forall n c m, safeN (S n) c m -> safeN n c m.
Lemma safe_downward : forall (n n' : nat) c m, le n' n -> safeN n c m -> safeN n' c m.
Lemma safe_corestep_forward: corestep_fun -> forall c m c' m' n, corestep Hcore ge c m c' m' -> safeN (S n) c m -> safeN n c' m'.
Lemma safe_corestepN_forward: corestep_fun -> forall c m c' m' n n0, corestepN Hcore ge n0 c m c' m' -> safeN (n + S n0) c m -> safeN n c' m'.
Lemma safe_corestep_backward: forall c m c' m' n, corestep Hcore ge c m c' m' -> safeN (n - 1) c' m' -> safeN n c m.
Lemma safe_corestepN_backward: forall c m c' m' n n0, corestepN Hcore ge n0 c m c' m' -> safeN (n - n0) c' m' -> safeN n c m.