Inductive InternalOrExternal: MachState -> mem -> MachState -> mem -> Prop:=
| IsInternal st st' m m':
internal_step (fst (fst st)) (snd st) m (snd st') m'  ->
InternalOrExternal st m st' m'
| IsExternal st st' m m':
external_step (fst (fst st)) (snd (fst st)) (snd st) m (fst (fst st')) (snd (fst st')) (snd st') m'  ->
InternalOrExternal st m st' m'.

(* Specifications: *)
(* All machine steps are either Internal or External (according to csafe)*)
Lemma step_InternalOrExternal: forall st m st' m',
MachStep st m st' m' ->
InternalOrExternal st m st' m'.
(*BUT, this is basically the same safety!!! *)
Lemma safety_equivalence21: forall st m tr,
(forall U, valid (tr, st, m) U ->
safe_kstep (U, tr, st) m) ->
forall U, valid (tr, st, m) U ->
explicit_safety U tr st m.
Lemma safety_equivalence22: forall st m tr,
(forall U, valid (tr, st, m) U ->
explicit_safety U tr st m) ->
(forall U, valid (tr, st, m) U ->
safe_kstep (U, tr, st) m).
Lemma safety_equivalence2: forall st m tr,
(forall U, valid (tr, st, m) U ->
safe_kstep (U, tr, st) m) <->
(forall U, valid (tr, st, m) U ->
explicit_safety U tr st m).