End explicit_safety.
Section explicit_safetyN.
Inductive stepN x y y': nat -> Prop :=
| trivial_step: y = y' -> stepN x y y' 0
| _stepN n _y: int_step x y _y -> stepN x _y y' n -> stepN x y y' (S n).
(** *Safety with stepN *)
Inductive exp_safetyN_gen {_exp_safety} (x:X) (y:Y): Prop:=
| paco_halted_safetyN : halted x y -> exp_safetyN_gen x y
| paco_internal_safetyN y' n: stepN x y y' (S n)  ->
(forall x',  valid x' y' -> _exp_safety x' y') ->
exp_safetyN_gen x y
| paco_external_safetyN x' y': ext_step x y x' y' ->
(forall x',  valid x' y' -> _exp_safety x' y') ->
exp_safetyN_gen x y.
Definition paco_exp_safetyN := paco2 (@exp_safetyN_gen).

(* Specifications: *)
Lemma determinismN:
forall n,
forall x y y',
valid x y  -> stepN x y y' n ->
forall x',
valid x' y -> stepN x' y y' n.
Lemma valid_stepN:
forall n,
forall x y y',
valid x y  -> stepN x y y' n ->
valid x y'.
Lemma safetyN_equivalence:
forall x y,
valid x y ->
paco_exp_safety bot2 x y <-> paco_exp_safetyN bot2 x y.