Fixpoint safeN (n:nat) (z:Z) (c:C) (m:M) : Prop :=
    match n with
    | O => True
    | S n' =>
       match at_external Hcore c, halted Hcore c with
       | None, None =>
           exists c', exists m',
             corestep Hcore ge c m c' m' /\
             safeN n' z c' m'
       | Some (e,sig,args), None =>
           exists x:ext_spec_type Hspec e,
             ext_spec_pre Hspec e x (sig_args sig) args z m /\
             (forall ret m' z',
               ext_spec_post Hspec e x (sig_res sig) ret z' m' ->
               exists c',
                 after_external Hcore ret c = Some c' /\
                 safeN n' z' c' m')
       | None, Some i => ext_spec_exit Hspec (Some i) z m
       | Some _, Some _ => False
       end
    end.Definition corestep_fun  :=
       forall ge m q m1 q1 m2 q2 ,
       corestep Hcore ge q m q1 m1 ->
       corestep Hcore ge q m q2 m2 ->
       (q1, m1) = (q2, m2).

Lemma convergent_controls_safe : forall m q1 q2, (at_external Hcore q1 = at_external Hcore q2) -> (forall ret q', after_external Hcore ret q1 = Some q' -> after_external Hcore ret q2 = Some q') -> (halted Hcore q1 = halted Hcore q2) -> (forall q' m', corestep Hcore ge q1 m q' m' -> corestep Hcore ge q2 m q' m') -> (forall n z, safeN n z q1 m -> safeN n z q2 m).