Section explicit_safety.
(** *Normal explicit safety *)
CoInductive exp_safety (x:X) (y:Y): Prop:=
| halted_safety : halted x y -> exp_safety x y
| internal_safety y': int_step x y y'  ->
(forall x',  valid x' y' -> exp_safety x' y') ->
exp_safety x y
| external_safety x' y': ext_step x y x' y' ->
(forall x',  valid x' y' -> exp_safety x' y') ->
exp_safety x y.
(*Parametrized version*)
Inductive exp_safety_gen {_exp_safety} (x:X) (y:Y): Prop:=
| paco_halted_safety : halted x y -> exp_safety_gen x y
| paco_internal_safety y': int_step x y y'  ->
(forall x',  valid x' y' -> _exp_safety x' y') ->
exp_safety_gen x y
| paco_external_safety x' y': ext_step x y x' y' ->
(forall x',  valid x' y' -> _exp_safety x' y') ->
exp_safety_gen x y.
Definition paco_exp_safety := paco2 (@exp_safety_gen).

(* Specifications: *)
(*Show that the paco representation is correct. *)
Lemma exp_safety_paco_correct:
forall x y, exp_safety x y <-> paco_exp_safety bot2 x y.