Ltac inv_safe H :=
inv H;
try solve[match goal with
| H : semantics.at_external _ _ _ = _ |- _ =>
simpl in H; congruence
| H : j_at_external _ _ _ = _ |- _ =>
simpl in H; congruence
| H : semantics.halted _ _ _ |- _ =>
simpl in H; unfold cl_halted in H; contradiction
end].

(* Specifications: *)
Lemma semax_seq:
forall Delta (R: ret_assert) P Q h t,
semax Espec Delta P h (overridePost Q R) ->
semax Espec Delta Q t R ->
semax Espec Delta P (Clight.Ssequence h t) R.
Lemma control_as_safe_refl psi n k : control_as_safe psi n k k.
Lemma semax_loop:
forall Delta Q Q' incr body R,
semax Espec Delta Q body (loop1_ret_assert Q' R) ->
semax Espec Delta Q' incr (loop2_ret_assert Q R) ->
semax Espec Delta Q (Sloop body incr) R.
Lemma semax_break:
forall Delta Q,        semax Espec Delta (RA_break Q) Sbreak Q.
Lemma semax_continue:
forall Delta Q,        semax Espec Delta (RA_continue Q) Scontinue Q.