End Csafe_KSafe.
Section Safety_Explicity_Safety.
Definition explicit_safety (U:schedule)  (tr:event_trace) (st:machine_state) (m:mem): Prop:=
exp_safety _ _ (fun U stm => is_true (ssrbool.isSome (halted_machine (U, fst(fst stm), snd(fst stm)))))
(fun U stm stm' => internal_step U (snd(fst stm)) (snd stm) (snd(fst stm')) (snd stm'))
(fun U stm U' stm' => external_step U (fst(fst stm)) (snd(fst stm)) (snd stm) U' (fst(fst stm')) (snd(fst stm')) (snd stm'))
(fun U stm => @valid (fst(fst stm),snd(fst stm), snd stm) U) U (tr,st,m).
Definition explicit_safety_bounded (U:schedule)  (tr:event_trace)(st:machine_state) (m:mem): Prop:=
exp_safety _ _ (fun U stm => is_true (ssrbool.isSome (halted_machine (U, fst(fst stm), snd(fst stm)))))
(fun U stm stm' => internal_step U (snd(fst stm)) (snd stm) (snd(fst stm')) (snd stm'))
(fun U stm U' stm' => external_step U (fst(fst stm))  (snd(fst stm)) (snd stm) U' (fst(fst stm')) (snd(fst stm')) (snd stm'))
(fun U stm => @valid_bound (fst(fst stm),snd(fst stm), snd stm) U) U (tr,st,m).
(* Show that traces are irrelevant*)
Section TracesIrrelevant.

(* Specifications: *)
Lemma kstep_trace_irr: forall U U' tr1 tr1' tr2 tp tp' m m',
kstep (tr1, tp, m) U (tr1', tp', m') U' -> exists tr2', kstep (tr2, tp, m) U (tr2', tp', m') U'.
Lemma safe_kstep_trace_irr: forall U tr tr' tp m,
safe_kstep (U,tr,tp) m -> safe_kstep (U,tr',tp) m.
Lemma external_step_trace_irr: forall U U' tr1 tr1' tr2 tp tp' m m',
external_step U tr1 tp m U' tr1' tp' m' -> exists tr2', external_step U tr2 tp m U' tr2' tp' m'.
Lemma explicit_safety_trace_irr: forall U tr tr' tp m,
explicit_safety U tr tp m -> explicit_safety U tr' tp m.