Section safety.
Context {G C M D Z:Type}.
Context (Hcore:CoreSemantics G C M).
Variable (Hspec:external_specification M external_function Z).
Variable ge : G.
Fixpoint safeN (n:nat) (z:Z) (c:C) (m:M) : Prop :=
match n with
| O => True
| S n' =>
match at_external Hcore c, halted Hcore c with
| None, None =>
exists c', exists m',
corestep Hcore ge c m c' m' /\
safeN n' z c' m'
| Some (e,sig,args), None =>
exists x:ext_spec_type Hspec e,
ext_spec_pre Hspec e x (sig_args sig) args z m /\
(forall ret m' z',
ext_spec_post Hspec e x (sig_res sig) ret z' m' ->
exists c',
after_external Hcore ret c = Some c' /\
safeN n' z' c' m')
| None, Some i => ext_spec_exit Hspec (Some i) z m
| Some _, Some _ => False
end
end.
Definition corestep_fun  :=
forall ge m q m1 q1 m2 q2 ,
corestep Hcore ge q m q1 m1 ->
corestep Hcore ge q m q2 m2 ->
(q1, m1) = (q2, m2).

(* Specifications: *)
Lemma safe_corestep_forward:
corestep_fun ->
forall c m c' m' n z,
corestep Hcore ge c m c' m' -> safeN (S n) z c m -> safeN n z c' m'.
Lemma safe_corestep_backward:
forall c m c' m' n z,
corestep Hcore ge c m c' m' -> safeN n z c' m' -> safeN (S n) z c m.
Lemma safe_downward1 :
forall n c m z,
safeN (S n) z c m -> safeN n z c m.
Lemma safe_downward :
forall n n' c m z,
le n' n ->
safeN n z c m -> safeN n' z c m.
Lemma convergent_controls_safe :
forall m q1 q2,
(at_external Hcore q1 = at_external Hcore q2) ->
(forall ret q', after_external Hcore ret q1 = Some q' ->
after_external Hcore ret q2 = Some q') ->
(halted Hcore q1 = halted Hcore q2) ->
(forall q' m', corestep Hcore ge q1 m q' m' -> corestep Hcore ge q2 m q' m') ->
(forall n z, safeN n z q1 m -> safeN n z q2 m).
Lemma safe_step'_back2 :
forall
{ora st m st' m' n},
corestep Hcore ge st m st' m' ->
safeN (n-1) ora st' m' ->
safeN n ora st m.
Lemma wlog_safeN_gt0 : forall
n z q m,
(lt 0 n -> safeN n z q m) ->
safeN n z q m.