Section Safety.
Variables (f : val) (arg : list val).
Variable init_coarse_safe:
forall sched tpc mem' n,
tpc_init sched init_mem (sched, [::], tpc) mem' f arg ->
HybridCoarseMachine.csafe (sched,[::],tpc) mem' n.
(** [init_mach] and [init_mem] are related by [mem_compatible]*)
(* Lemma init_compatible: *)
(*   forall pmap tp m m', *)
(*     @init_mach DryHybridMachine.dryResources _ _ _ pmap m tp m' f arg -> *)
(*     mem_compatible tp m'. *)
(* Proof. *)
(*   intros. *)
(*   destruct init_perm as [pmap|] eqn:Hinit_perm; *)
(*     [| eapply init_mach_none in H0; now exfalso]. *)
(*   unfold init_perm in Hinit_perm. *)
(*   rewrite H in Hinit_perm. *)
(*   inversion Hinit_perm; subst. *)
(*   constructor. *)
(*   - intros j cntj. *)
(*     pose proof (init_thread H0 cntj); subst. *)
(*     erewrite getThreadR_init by eauto. *)
(*     simpl. *)
(*     split; [intros ? ?; now apply getCur_Max |now apply empty_LT]. *)
(*   - intros. *)
(*     erewrite init_lockRes_empty in H1 by eauto. *)
(*     discriminate. *)
(*   - intros. *)
(*     erewrite init_lockRes_empty in H1 by eauto. *)
(*     discriminate. *)
(* Qed. *)
(** Proof of safety of the FineConc machine*)
Notation fsafe := (@HybridFineMachine.fsafe _ _ _ _ FineDilMem).

Lemma fsafe_reduce:
forall sched tp mem n m,
fsafe tp mem sched n ->
(m <= n)%nat ->
fsafe tp mem sched m.