Defining and translating a "safe" subset of simulink/stateflow into lustre