Fixpoint safeN (n:nat) (z:Z) (c:C) (m:M) : Prop :=
    match n with
    | O => True
    | S n' =>
       match at_external Hcore c, halted Hcore c with
       | None, None =>
           exists c', exists m',
             corestep Hcore ge c m c' m' /\
             safeN n' z c' m'
       | Some (e,sig,args), None =>
           exists x:ext_spec_type Hspec e,
             ext_spec_pre Hspec e x (sig_args sig) args z m /\
             (forall ret m' z',
               ext_spec_post Hspec e x (sig_res sig) ret z' m' ->
               exists c',
                 after_external Hcore ret c = Some c' /\
                 safeN n' z' c' m')
       | None, Some i => ext_spec_exit Hspec (Some i) z m
       | Some _, Some _ => False
       end
    end.Definition corestep_fun  :=
       forall ge m q m1 q1 m2 q2 ,
       corestep Hcore ge q m q1 m1 ->
       corestep Hcore ge q m q2 m2 ->
       (q1, m1) = (q2, m2).

Lemma safe_downward : forall n n' c m z, le n' n -> safeN n z c m -> safeN n' z c m.