(** Proof of safety of the FineConc machine*)
Notation fsafe := (@HybridFineMachine.fsafe _ _ _ _ FineDilMem).

(* Specifications: *)
(** If a thread has reached an external then it cannot be in the list that denotes the delta of execution between the two machines *)
Lemma at_external_not_in_xs:
forall tpc trc mc tpf trf mf xs f fg fp i n
(Hsim: SimDefs.sim tpc trc mc tpf trf mf xs f fg fp n)
(pffi: containsThread tpf i),
let mrestr := restrPermMap (compat_th _ _ (SimDefs.mem_compf Hsim) pffi).1 in
forall (Hexternal: getStepType pffi mrestr Concurrent),
~ List.In i xs.
Lemma getStepType_cases:
forall tp m i (cnti: containsThread tp i),
getStepType cnti m Concurrent \/
getStepType cnti m Internal \/
getStepType cnti m Suspend.
(** Simulation between the two machines implies safety*)
Lemma fine_safe_sched:
forall tpf trf tpc trc mf mc (g fg : memren) fp xs sched
(Hsim: SimDefs.sim tpc trc mc tpf trf mf xs g fg fp (S (size sched))),
@fsafe tpf mf sched (S (size sched)).
Lemma fsafe_reduce:
forall sched tp mem n m,
fsafe tp mem sched n ->
(m <= n)%nat ->
fsafe tp mem sched m.
Lemma fine_safe:
forall n tpf mf sched,
@fsafe tpf mf sched (S (size sched)) ->
@fsafe tpf mf sched n.
(** *** Safety preservation for the FineConc machine starting from the initial state*)
Theorem init_fine_safe:
forall sched n tpf m'
(Hinit: tpf_init sched init_mem (sched, [::], tpf) m' f arg)
(ARG: valid_val_list (id_ren init_mem) arg),
fsafe tpf (@diluteMem FineDilMem m') sched n.