Corollary SsafeN_ksafe: forall n st,
      SsafeN n (@P_init st) -> forall U, valid st U -> ksafe st U n.

Lemma ksafe_SsafeN: forall st_init, (forall U, valid st_init U) -> forall n, (forall U, ksafe st_init U n) -> SsafeN n (@P_init st_init).