Fixpoint safeN (n:nat) (z:Z) (c:C) (m:M) : Prop :=
    match n with
    | O => True
    | S n' =>
       match at_external Hcore c, halted Hcore c with
       | None, None =>
           exists c', exists m',
             corestep Hcore ge c m c' m' /\
             safeN n' z c' m'
       | Some (e,sig,args), None =>
           exists x:ext_spec_type Hspec e,
             ext_spec_pre Hspec e x (sig_args sig) args z m /\
             (forall ret m' z',
               ext_spec_post Hspec e x (sig_res sig) ret z' m' ->
               exists c',
                 after_external Hcore ret c = Some c' /\
                 safeN n' z' c' m')
       | None, Some i => ext_spec_exit Hspec (Some i) z m
       | Some _, Some _ => False
       end
    end.Definition corestep_fun  :=
       forall ge m q m1 q1 m2 q2 ,
       corestep Hcore ge q m q1 m1 ->
       corestep Hcore ge q m q2 m2 ->
       (q1, m1) = (q2, m2).

(* Specifications: *)
Lemma safe_corestep_forward: corestep_fun -> forall c m c' m' n z, corestep Hcore ge c m c' m' -> safeN (S n) z c m -> safeN n z c' m'.
Lemma safe_corestep_backward: forall c m c' m' n z, corestep Hcore ge c m c' m' -> safeN n z c' m' -> safeN (S n) z c m.
Lemma safe_downward1 : forall n c m z, safeN (S n) z c m -> safeN n z c m.
Lemma safe_downward : forall n n' c m z, le n' n -> safeN n z c m -> safeN n' z c m.
Lemma convergent_controls_safe : forall m q1 q2, (at_external Hcore q1 = at_external Hcore q2) -> (forall ret q', after_external Hcore ret q1 = Some q' -> after_external Hcore ret q2 = Some q') -> (halted Hcore q1 = halted Hcore q2) -> (forall q' m', corestep Hcore ge q1 m q' m' -> corestep Hcore ge q2 m q' m') -> (forall n z, safeN n z q1 m -> safeN n z q2 m).
Lemma safe_step'_back2 : forall {ora st m st' m' n}, corestep Hcore ge st m st' m' -> safeN (n-1) ora st' m' -> safeN n ora st m.
Lemma wlog_safeN_gt0 : forall n z q m, (lt 0 n -> safeN n z q m) -> safeN n z q m.