Section safety.
Context {G C M D Z:Type}.
Context (Hcore:CoreSemantics G C M).
Variable (Hspec:external_specification M external_function Z).
Variable ge : G.
Fixpoint safeN (n:nat) (z:Z) (c:C) (m:M) : Prop :=
match n with
| O => True
| S n' =>
match at_external Hcore c, halted Hcore c with
| None, None =>
exists c', exists m',
corestep Hcore ge c m c' m' /\
safeN n' z c' m'
| Some (e,sig,args), None =>
exists x:ext_spec_type Hspec e,
ext_spec_pre Hspec e x (sig_args sig) args z m /\
(forall ret m' z',
ext_spec_post Hspec e x (sig_res sig) ret z' m' ->
exists c',
after_external Hcore ret c = Some c' /\
safeN n' z' c' m')
| None, Some i => ext_spec_exit Hspec (Some i) z m
| Some _, Some _ => False
end
end.
Definition corestep_fun  :=
forall ge m q m1 q1 m2 q2 ,
corestep Hcore ge q m q1 m1 ->
corestep Hcore ge q m q2 m2 ->
(q1, m1) = (q2, m2).

Lemma convergent_controls_safe :
forall m q1 q2,
(at_external Hcore q1 = at_external Hcore q2) ->
(forall ret q', after_external Hcore ret q1 = Some q' ->
after_external Hcore ret q2 = Some q') ->
(halted Hcore q1 = halted Hcore q2) ->
(forall q' m', corestep Hcore ge q1 m q' m' -> corestep Hcore ge q2 m q' m') ->
(forall n z, safeN n z q1 m -> safeN n z q2 m).