(** As a corollary, if the source C code cannot go wrong, i.e. is free of undefined behaviors, the behavior of the generated assembly code is one of the possible behaviors of the source C code. *)

(* Specifications: *)
Theorem transf_c_program_is_refinement:
forall p tp,
transf_c_program p = OK tp ->
(forall beh, program_behaves (Csem.semantics p) beh -> not_wrong beh) ->
(forall beh, program_behaves (Asm.semantics tp) beh -> program_behaves (Csem.semantics p) beh).