Section Safety.
Variables (f : val) (arg : list val).
Variable init_coarse_safe:
forall sched tpc mem' n,
tpc_init sched init_mem (sched, [::], tpc) mem' f arg ->
HybridCoarseMachine.csafe (sched,[::],tpc) mem' n.
(** [init_mach] and [init_mem] are related by [mem_compatible]*)
(* Lemma init_compatible: *)
(*   forall pmap tp m m', *)
(*     @init_mach DryHybridMachine.dryResources _ _ _ pmap m tp m' f arg -> *)
(*     mem_compatible tp m'. *)
(* Proof. *)
(*   intros. *)
(*   destruct init_perm as [pmap|] eqn:Hinit_perm; *)
(*     [| eapply init_mach_none in H0; now exfalso]. *)
(*   unfold init_perm in Hinit_perm. *)
(*   rewrite H in Hinit_perm. *)
(*   inversion Hinit_perm; subst. *)
(*   constructor. *)
(*   - intros j cntj. *)
(*     pose proof (init_thread H0 cntj); subst. *)
(*     erewrite getThreadR_init by eauto. *)
(*     simpl. *)
(*     split; [intros ? ?; now apply getCur_Max |now apply empty_LT]. *)
(*   - intros. *)
(*     erewrite init_lockRes_empty in H1 by eauto. *)
(*     discriminate. *)
(*   - intros. *)
(*     erewrite init_lockRes_empty in H1 by eauto. *)
(*     discriminate. *)
(* Qed. *)
(** Proof of safety of the FineConc machine*)
Notation fsafe := (@HybridFineMachine.fsafe _ _ _ _ FineDilMem).

(** If a thread has reached an external then it cannot be in the list that denotes the delta of execution between the two machines *)
Lemma at_external_not_in_xs:
forall tpc trc mc tpf trf mf xs f fg fp i n
(Hsim: SimDefs.sim tpc trc mc tpf trf mf xs f fg fp n)
(pffi: containsThread tpf i),
let mrestr := restrPermMap (compat_th _ _ (SimDefs.mem_compf Hsim) pffi).1 in
forall (Hexternal: getStepType pffi mrestr Concurrent),
~ List.In i xs.