(* Hoare Logic *)
Inductive immed_safe: state -> Prop :=
| IS_stop: forall rho m, immed_safe (State rho m Cskip)
| IS_step: forall s s', step s s' -> immed_safe s.
Definition safe (s: state) : Prop :=
forall s', stepstar s s' -> immed_safe s'.
Definition guard (P: h_assert) (c: command) :=
forall rho,   P rho -> safe (State rho m0 c).
Definition Hoare (P: h_assert) (c: command) (Q: h_assert) : Prop :=
forall k, guard Q k -> guard P (Cseq c k).
Definition subst (x:var) (v: option val) (P: h_assert) : h_assert :=
fun rho => P (upd rho x v).

Lemma safe_step: forall s s',
step s s' -> safe s' -> safe s.