Section safety.
Context {G C M D Z:Type}.
Context (Hcore:CoreSemantics G C M).
Variable (Hspec:external_specification M external_function Z).
Variable ge : G.
Fixpoint safeN (n:nat) (z:Z) (c:C) (m:M) : Prop :=
match n with
| O => True
| S n' =>
match at_external Hcore c, halted Hcore c with
| None, None =>
exists c', exists m',
corestep Hcore ge c m c' m' /\
safeN n' z c' m'
| Some (e,sig,args), None =>
exists x:ext_spec_type Hspec e,
ext_spec_pre Hspec e x (sig_args sig) args z m /\
(forall ret m' z',
ext_spec_post Hspec e x (sig_res sig) ret z' m' ->
exists c',
after_external Hcore ret c = Some c' /\
safeN n' z' c' m')
| None, Some i => ext_spec_exit Hspec (Some i) z m
| Some _, Some _ => False
end
end.
Definition corestep_fun  :=
forall ge m q m1 q1 m2 q2 ,
corestep Hcore ge q m q1 m1 ->
corestep Hcore ge q m q2 m2 ->
(q1, m1) = (q2, m2).

Lemma safe_downward1 :
forall n c m z,
safeN (S n) z c m -> safeN n z c m.