Fixpoint safeN (n:nat) (c:C) (m:mem) : Prop :=
  match n with
    | O => True
    | S n' =>
      match halted Hcore c with
        | None =>
          exists c', exists m',
            corestep Hcore ge c m c' m' /\
            safeN n' c' m'
        | Some i => P i m
      end
  end.Definition corestep_fun  :=
  forall ge m q m1 q1 m2 q2 ,
    corestep Hcore ge q m q1 m1 ->
    corestep Hcore ge q m q2 m2 ->
    (q1, m1) = (q2, m2).

Lemma safe_downward1 : forall n c m, safeN (S n) c m -> safeN n c m.