Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Inductive schedule :=
  ActStep | SeqRet | SeqStep of schedule |  
  InjectStep of schedule | InjectRet |
  WithInvStep of schedule | WithInvRet.Fixpoint good (W : world) A (p : proc this W A) sc  : Prop :=
  match sc, p with
  | ActStep, Act _ => True
  | SeqRet, Seq _ (Ret _) _ => True
  | SeqStep sc', Seq _ p' _ => good p' sc'
  | InjectStep sc', Inject _ _ _ p' => good p' sc'
  | InjectRet, Inject _ _ _ (Ret _) => True
  | WithInvStep sc', WithInv _ _ _ _ p' => good p' sc'
  | WithInvRet, WithInv _ _ _ _ (Ret _) => True
  | _, _ => False
  end.(*

[Safety in small-step semantics]

The safety (in order to make the following step) with respect to the
schedule is defined inductively on the shape of the program and the
schedule. Omitting the schedule is not a good idea, at it's required
in order to "sequentialize" the execution of the program
structure. Once it's dropped, this structure is lost.

 *)

Fixpoint safe (W : world) A (p : proc this W A) sc (s : state)  : Prop :=
  match sc, p with
  | ActStep, Act a => a_safe a s
  | SeqRet, Seq _ (Ret _) _ => True
  | SeqStep sc', Seq _ p' _ => safe p' sc' s
  | InjectStep sc', Inject V K pf p' =>
      exists s', extends pf s s' /\ safe p' sc' s'
  | InjectRet, Inject V K pf (Ret _) => exists s', extends pf s s'
  | WithInvStep sc', WithInv _ _ _ _ p' => safe p' sc' s
  | WithInvRet, WithInv _ _ _ _ (Ret _) => True
  | _, _ => True
  end.

Lemma pstep_safe (W : world) A s1 (t : proc this W A) sc s2 q : pstep s1 t sc s2 q -> safe t sc s1.