End Csafe_KSafe.
Section Safety_Explicity_Safety.
Definition explicit_safety (U:schedule)  (tr:event_trace) (st:machine_state) (m:mem): Prop:=
exp_safety _ _ (fun U stm => is_true (ssrbool.isSome (halted_machine (U, fst(fst stm), snd(fst stm)))))
(fun U stm stm' => internal_step U (snd(fst stm)) (snd stm) (snd(fst stm')) (snd stm'))
(fun U stm U' stm' => external_step U (fst(fst stm)) (snd(fst stm)) (snd stm) U' (fst(fst stm')) (snd(fst stm')) (snd stm'))
(fun U stm => @valid (fst(fst stm),snd(fst stm), snd stm) U) U (tr,st,m).
Definition explicit_safety_bounded (U:schedule)  (tr:event_trace)(st:machine_state) (m:mem): Prop:=
exp_safety _ _ (fun U stm => is_true (ssrbool.isSome (halted_machine (U, fst(fst stm), snd(fst stm)))))
(fun U stm stm' => internal_step U (snd(fst stm)) (snd stm) (snd(fst stm')) (snd stm'))
(fun U stm U' stm' => external_step U (fst(fst stm))  (snd(fst stm)) (snd stm) U' (fst(fst stm')) (snd(fst stm')) (snd stm'))
(fun U stm => @valid_bound (fst(fst stm),snd(fst stm), snd stm) U) U (tr,st,m).
(* Show that traces are irrelevant*)
Section TracesIrrelevant.

Lemma external_step_trace_irr: forall U U' tr1 tr1' tr2 tp tp' m m',
external_step U tr1 tp m U' tr1' tp' m' -> exists tr2', external_step U tr2 tp m U' tr2' tp' m'.