split.
- revert x; induction n; intros x Safe.
+ exists (fun _ => x); split; auto.
inversion 1.
+ inversion Safe as [ | ? ? x' Step Safe']; subst.
destruct (IHn x' Safe') as (f' & <- & IH).
exists (fun n => match n with O => x | S n => f' n end).
split; auto.
intros [|i] Hi; simpl...
- intros (f & <- & Sf).
replace 0 with (n - n)...
assert (L : n <= n)... revert L.
generalize n at 1 3 5; intros i Hi; induction i. apply safeO.
apply safeS with (f (n - i))...
replace (n - i) with (1 + (n - S i))...
Qed.
(** Coinductive safety & corresponding Knaster-Tarski definition *)
CoInductive safe : X -> Prop :=
safe_cons : forall x x', R x x' -> safe x' -> safe x.
Definition stable (P : X -> Prop) := forall x, P x -> exists x', R x x' /\ P x'.
Definition kt_safe x := exists P, P x /\ stable P.

(* Specifications: *)
Lemma kt_safe_safe x : safe x <-> kt_safe x.
Definition safe' f := forall i, R (f i) (f (1 + i)).