Inductive InternalOrExternal: MachState -> mem -> MachState -> mem -> Prop:=
  | IsInternal st st' m m':
      internal_step (fst (fst st)) (snd st) m (snd st') m'  ->
      InternalOrExternal st m st' m'
  | IsExternal st st' m m':
      external_step (fst (fst st)) (snd (fst st)) (snd st) m (fst (fst st')) (snd (fst st')) (snd st') m'  ->
      InternalOrExternal st m st' m'.Inductive InternalOrExternal: MachState -> mem -> MachState -> mem -> Prop:=
  | IsInternal st st' m m':
      internal_step (fst (fst st)) (snd st) m (snd st') m'  ->
      InternalOrExternal st m st' m'
  | IsExternal st st' m m':
      external_step (fst (fst st)) (snd (fst st)) (snd st) m (fst (fst st')) (snd (fst st')) (snd st') m'  ->
      InternalOrExternal st m st' m'.Inductive InternalOrExternal: MachState -> mem -> MachState -> mem -> Prop:=
  | IsInternal st st' m m':
      internal_step (fst (fst st)) (snd st) m (snd st') m'  ->
      InternalOrExternal st m st' m'
  | IsExternal st st' m m':
      external_step (fst (fst st)) (snd (fst st)) (snd st) m (fst (fst st')) (snd (fst st')) (snd st') m'  ->
      InternalOrExternal st m st' m'.

Lemma csafe_safety: forall tr tp m, (forall (n : nat) U, valid (tr, tp,m) U -> csafe (U, tr, tp) m n) -> forall U : schedule, valid (tr, tp,m) U -> safe kstate schedule kstep valid (tr,tp,m) U.