Fixpoint safeN (n : nat) (c : C) (m : M) : Prop :=
  match n with
    | O => True
    | S n' =>
      match halted sem c with
        | None =>
          exists c', exists m',
            corestep sem ge c m c' m' /\
            safeN n' c' m'
        | Some i => True
      end
  end.

(* Specifications: *)
Lemma safe_downward1 n c m : safeN (S n) c m -> safeN n c m.
Lemma safe_downward (n n' : nat) c m : le n' n -> safeN n c m -> safeN n' c m.
Lemma safe_corestep_forward c m c' m' n : corestep_fun sem -> corestep sem ge c m c' m' -> safeN (S n) c m -> safeN n c' m'.
Lemma safe_corestepN_forward c m c' m' n n0 : corestep_fun sem -> corestepN sem ge n0 c m c' m' -> safeN (n + S n0) c m -> safeN n c' m'.
Lemma safe_corestep_backward c m c' m' n : corestep sem ge c m c' m' -> safeN (n - 1) c' m' -> safeN n c m.
Lemma safe_corestepN_backward c m c' m' n n0 : corestepN sem ge n0 c m c' m' -> safeN (n - n0) c' m' -> safeN n c m.