Definition possible_image {X Y} (STEP:X-> Y-> X (*-> Y*) -> Prop) (valid: X -> Y -> Prop)  st st' U:= valid st U /\ (* exists U',  *) STEP st U st' (* U' *).Definition finite_on_x {X Y} (A:X->Y->Prop):=
    exists n (f: nat -> X), forall x y, A x y -> exists i, (i < n) /\ f i = x.

(* Specifications: *)
Lemma finite_rel_generalize' {X Y} (V: X -> Y -> Prop) (R: X -> X -> Y -> Prop): (forall x, finite_on_x (possible_image (fun x x' y => R x y x') V x)) -> forall (P:X -> Prop), finite P -> finite (fun x' => exists x y, P x /\ V x y /\ R x x' y).
Lemma power_set_finite {X}: (forall P : Prop, P \/ ~ P) -> forall P: X-> Prop, finite P -> finite (fun A => subset A P).
Lemma subset_finite {X}: forall (P P': X-> Prop), finite P -> subset P' P -> finite P'.
Lemma finite_rel_generalize {X Y} (V: X -> Y -> Prop) (R: X -> X -> Y -> Prop): forall (propositional_extentionality: True), (forall P : Prop, P \/ ~ P) -> (forall x, finite_on_x (possible_image (fun x x' y => R x y x') V x)) -> forall (P:X -> Prop), finite P -> finite (SStep R V P).
Lemma ksafe_safe': (forall P: Prop, P \/ ~ P) -> forall (propositional_extentionality: True), forall (branches_finitely_on_the_state: forall x : ST, @finite_on_x _ _ (possible_image (fun x y x' => exists y', STEP x y x' y') valid x)), forall st, (forall n U, valid st U -> ksafe st U n) -> (forall U, valid st U -> safe st U).
Lemma ksafe_safe: (forall P: Prop, P \/ ~ P) -> forall (propositional_extentionality: True), forall (branches_finitely_on_the_state: forall x : ST, @finite_on_x _ _ (possible_image (fun x y x' => exists y', STEP x y x' y') valid x)), forall st, (forall U : SCH, valid st U) -> (forall n U, ksafe st U n) -> (forall U, safe st U).
Lemma safe_ksafe': forall st, (forall U, valid st U -> safe st U) -> (forall U, valid st U -> forall n, ksafe st U n).
Lemma safe_ksafe: forall st, (forall U : SCH, valid st U) -> (forall U, safe st U) -> (forall n U, ksafe st U n).