Built with Alectryon, running Coq+SerAPI v8.10.0+0.7.0. Coq sources are in this panel; goals and messages will appear in the other. Bubbles () indicate interactive fragments: hover for details, tap to reveal contents. Use Ctrl+↑ Ctrl+↓ to navigate, Ctrl+🖱️ to focus.

(************************************************************************)
(*         *   The Coq Proof Assistant / The Coq Development Team       *)
(*  v      *   INRIA, CNRS and contributors - Copyright 1999-2018       *)
(* <O___,, *       (see CREDITS file for the list of authors)           *)
(*   \VV/  **************************************************************)
(*    //   *    This file is distributed under the terms of the         *)
(*         *     GNU Lesser General Public License Version 2.1          *)
(*         *     (see LICENSE file for the text of the license)         *)
(************************************************************************)

This library has been deprecated since Coq version 8.10.

Int31 numbers defines indeed a cyclic structure : Z/(2^31)Z

Author: Arnaud Spiwack (+ Pierre Letouzey)

Require Import List.
Require Import Min.
Require Export Int31.
Require Import Znumtheory.
Require Import Zgcd_alt.
Require Import Zpow_facts.
Require Import CyclicAxioms.
Require Import Lia.

Local Open Scope nat_scope.
Local Open Scope int31_scope.

Local Hint Resolve Z.lt_gt Z.div_pos : zarith.

Section Basics.

Basic results about iszero, shiftl, shiftr

 Lemma iszero_eq0 : forall x, iszero x = true -> x=0.forall x : int31, iszero x = true -> x = 0
 Proof.forall x : int31, iszero x = true -> x = 0
 destruct x; simpl; intros.d, d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12, d13, d14, d15, d16, d17, d18, d19, d20, d21, d22, d23, d24, d25, d26, d27, d28, d29:digits
H:match d with
| D0 =>
    match d0 with
    | D0 =>
        match d1 with
        | D0 =>
            match d2 with
            | D0 =>
                match d3 with
                | D0 =>
                    match d4 with
                    | D0 =>
                        match d5 with
                        | D0 =>
                            match d6 with
                            | D0 =>
                                match d7 with
                                | D0 =>
                                    match d8 with
                                    | D0 =>
                                        match
                                          d9
                                        with
                                        | D0 =>
                                            match
                                              d10
                                            with
                                            | D0 =>
                                                match
                                                 ...
                                                with
                                                | ...
                                                 ...
                                                | ...
                                                 false
                                                end
                                            | D1 =>
                                                false
                                            end
                                        | D1 =>
                                            false
                                        end
                                    | D1 => false
                                    end
                                | D1 => false
                                end
                            | D1 => false
                            end
                        | D1 => false
                        end
                    | D1 => false
                    end
                | D1 => false
                end
            | D1 => false
            end
        | D1 => false
        end
    | D1 => false
    end
| D1 => false
end = true
I31 d d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13
  d14 d15 d16 d17 d18 d19 d20 d21 d22 d23 d24 d25 d26
  d27 d28 d29 = 0
 repeat
   match goal with H:(if ?d then _ else _) = true |- _ =>
     destruct d; try discriminate
   end.H:true = true
0 = 0
 reflexivity.
 Qed.

 Lemma iszero_not_eq0 : forall x, iszero x = false -> x<>0.forall x : int31, iszero x = false -> x <> 0
 Proof.forall x : int31, iszero x = false -> x <> 0
 intros x H Eq; rewrite Eq in H; simpl in *; discriminate.
 Qed.

 Lemma sneakl_shiftr : forall x,
  x = sneakl (firstr x) (shiftr x).forall x : int31, x = sneakl (firstr x) (shiftr x)
 Proof.forall x : int31, x = sneakl (firstr x) (shiftr x)
 destruct x; simpl; auto.
 Qed.

 Lemma sneakr_shiftl : forall x,
  x = sneakr (firstl x) (shiftl x).forall x : int31, x = sneakr (firstl x) (shiftl x)
 Proof.forall x : int31, x = sneakr (firstl x) (shiftl x)
 destruct x; simpl; auto.
 Qed.

 Lemma twice_zero : forall x,
  twice x = 0 <-> twice_plus_one x = 1.forall x : int31, twice x = 0 <-> twice_plus_one x = 1
 Proof.forall x : int31, twice x = 0 <-> twice_plus_one x = 1
 destruct x; simpl in *; split;
 intro H; injection H; intros; subst; auto.
 Qed.

 Lemma twice_or_twice_plus_one : forall x,
  x = twice (shiftr x) \/ x = twice_plus_one (shiftr x).forall x : int31,
x = twice (shiftr x) \/ x = twice_plus_one (shiftr x)
 Proof.forall x : int31,
x = twice (shiftr x) \/ x = twice_plus_one (shiftr x)
 intros; case_eq (firstr x); intros.x:int31
H:firstr x = D0
x = twice (shiftr x) \/ x = twice_plus_one (shiftr x)
x:int31
H:firstr x = D1
x = twice (shiftr x) \/ x = twice_plus_one (shiftr x)
 destruct x; simpl in *; rewrite H; auto.x:int31
H:firstr x = D1
x = twice (shiftr x) \/ x = twice_plus_one (shiftr x)
 destruct x; simpl in *; rewrite H; auto.
 Qed.

Iterated shift to the right

 Definition nshiftr x := nat_rect _ x (fun _ => shiftr).

 Lemma nshiftr_S :
  forall n x, nshiftr x (S n) = shiftr (nshiftr x n).forall (n : nat) (x : int31),
nshiftr x (S n) = shiftr (nshiftr x n)
 Proof.forall (n : nat) (x : int31),
nshiftr x (S n) = shiftr (nshiftr x n)
 reflexivity.
 Qed.

 Lemma nshiftr_S_tail :
  forall n x, nshiftr x (S n) = nshiftr (shiftr x) n.forall (n : nat) (x : int31),
nshiftr x (S n) = nshiftr (shiftr x) n
 Proof.forall (n : nat) (x : int31),
nshiftr x (S n) = nshiftr (shiftr x) n
 intros n; elim n; simpl; auto.n:nat
forall n0 : nat,
(forall x : int31,
 shiftr (nshiftr x n0) = nshiftr (shiftr x) n0) ->
forall x : int31,
shiftr (shiftr (nshiftr x n0)) =
shiftr (nshiftr (shiftr x) n0)
 intros; now f_equal.
 Qed.

 Lemma nshiftr_n_0 : forall n, nshiftr 0 n = 0.forall n : nat, nshiftr 0 n = 0
 Proof.forall n : nat, nshiftr 0 n = 0
 induction n; simpl; auto.n:nat
IHn:nshiftr 0 n = 0
shiftr (nshiftr 0 n) = 0
 rewrite IHn; auto.
 Qed.

 Lemma nshiftr_size : forall x, nshiftr x size = 0.forall x : int31, nshiftr x size = 0
 Proof.forall x : int31, nshiftr x size = 0
 destruct x; simpl; auto.
 Qed.

 Lemma nshiftr_above_size : forall k x, size<=k ->
  nshiftr x k = 0.forall (k : nat) (x : int31),
size <= k -> nshiftr x k = 0
 Proof.forall (k : nat) (x : int31),
size <= k -> nshiftr x k = 0
 intros.k:nat
x:int31
H:size <= k
nshiftr x k = 0
 replace k with ((k-size)+size)%nat by omega.k:nat
x:int31
H:size <= k
nshiftr x (k - size + size) = 0
 induction (k-size)%nat; auto.k:nat
x:int31
H:size <= k
nshiftr x (0 + size) = 0
k:nat
x:int31
H:size <= k
n:nat
IHn:nshiftr x (n + size) = 0
nshiftr x (S n + size) = 0
  rewrite nshiftr_size; auto.k:nat
x:int31
H:size <= k
n:nat
IHn:nshiftr x (n + size) = 0
nshiftr x (S n + size) = 0
  simpl; rewrite IHn; auto.
 Qed.

Iterated shift to the left

 Definition nshiftl x := nat_rect _ x (fun _ => shiftl).

 Lemma nshiftl_S :
  forall n x, nshiftl x (S n) = shiftl (nshiftl x n).forall (n : nat) (x : int31),
nshiftl x (S n) = shiftl (nshiftl x n)
 Proof.forall (n : nat) (x : int31),
nshiftl x (S n) = shiftl (nshiftl x n)
 reflexivity.
 Qed.

 Lemma nshiftl_S_tail :
  forall n x, nshiftl x (S n) = nshiftl (shiftl x) n.forall (n : nat) (x : int31),
nshiftl x (S n) = nshiftl (shiftl x) n
 Proof.forall (n : nat) (x : int31),
nshiftl x (S n) = nshiftl (shiftl x) n
 intros n; elim n; simpl; intros; now f_equal.
 Qed.

 Lemma nshiftl_n_0 : forall n, nshiftl 0 n = 0.forall n : nat, nshiftl 0 n = 0
 Proof.forall n : nat, nshiftl 0 n = 0
 induction n; simpl; auto.n:nat
IHn:nshiftl 0 n = 0
shiftl (nshiftl 0 n) = 0
 rewrite IHn; auto.
 Qed.

 Lemma nshiftl_size : forall x, nshiftl x size = 0.forall x : int31, nshiftl x size = 0
 Proof.forall x : int31, nshiftl x size = 0
 destruct x; simpl; auto.
 Qed.

 Lemma nshiftl_above_size : forall k x, size<=k ->
  nshiftl x k = 0.forall (k : nat) (x : int31),
size <= k -> nshiftl x k = 0
 Proof.forall (k : nat) (x : int31),
size <= k -> nshiftl x k = 0
 intros.k:nat
x:int31
H:size <= k
nshiftl x k = 0
 replace k with ((k-size)+size)%nat by omega.k:nat
x:int31
H:size <= k
nshiftl x (k - size + size) = 0
 induction (k-size)%nat; auto.k:nat
x:int31
H:size <= k
nshiftl x (0 + size) = 0
k:nat
x:int31
H:size <= k
n:nat
IHn:nshiftl x (n + size) = 0
nshiftl x (S n + size) = 0
  rewrite nshiftl_size; auto.k:nat
x:int31
H:size <= k
n:nat
IHn:nshiftl x (n + size) = 0
nshiftl x (S n + size) = 0
  simpl; rewrite IHn; auto.
 Qed.

 Lemma firstr_firstl :
  forall x, firstr x = firstl (nshiftl x (pred size)).forall x : int31,
firstr x = firstl (nshiftl x (Init.Nat.pred size))
 Proof.forall x : int31,
firstr x = firstl (nshiftl x (Init.Nat.pred size))
 destruct x; simpl; auto.
 Qed.

 Lemma firstl_firstr :
  forall x, firstl x = firstr (nshiftr x (pred size)).forall x : int31,
firstl x = firstr (nshiftr x (Init.Nat.pred size))
 Proof.forall x : int31,
firstl x = firstr (nshiftr x (Init.Nat.pred size))
 destruct x; simpl; auto.
 Qed.

More advanced results about nshiftr

 Lemma nshiftr_predsize_0_firstl : forall x,
  nshiftr x (pred size) = 0 -> firstl x = D0.forall x : int31,
nshiftr x (Init.Nat.pred size) = 0 -> firstl x = D0
 Proof.forall x : int31,
nshiftr x (Init.Nat.pred size) = 0 -> firstl x = D0
 destruct x; compute; intros H; injection H; intros; subst; auto.
 Qed.

 Lemma nshiftr_0_propagates : forall n p x, n <= p ->
  nshiftr x n = 0 -> nshiftr x p = 0.forall (n p : nat) (x : int31),
n <= p -> nshiftr x n = 0 -> nshiftr x p = 0
 Proof.forall (n p : nat) (x : int31),
n <= p -> nshiftr x n = 0 -> nshiftr x p = 0
 intros.n, p:nat
x:int31
H:n <= p
H0:nshiftr x n = 0
nshiftr x p = 0
 replace p with ((p-n)+n)%nat by omega.n, p:nat
x:int31
H:n <= p
H0:nshiftr x n = 0
nshiftr x (p - n + n) = 0
 induction (p-n)%nat.n, p:nat
x:int31
H:n <= p
H0:nshiftr x n = 0
nshiftr x (0 + n) = 0
n, p:nat
x:int31
H:n <= p
H0:nshiftr x n = 0
n0:nat
IHn0:nshiftr x (n0 + n) = 0
nshiftr x (S n0 + n) = 0
 simpl; auto.n, p:nat
x:int31
H:n <= p
H0:nshiftr x n = 0
n0:nat
IHn0:nshiftr x (n0 + n) = 0
nshiftr x (S n0 + n) = 0
 simpl; rewrite IHn0; auto.
 Qed.

 Lemma nshiftr_0_firstl : forall n x, n < size ->
  nshiftr x n = 0 -> firstl x = D0.forall (n : nat) (x : int31),
n < size -> nshiftr x n = 0 -> firstl x = D0
 Proof.forall (n : nat) (x : int31),
n < size -> nshiftr x n = 0 -> firstl x = D0
 intros.n:nat
x:int31
H:n < size
H0:nshiftr x n = 0
firstl x = D0
 apply nshiftr_predsize_0_firstl.n:nat
x:int31
H:n < size
H0:nshiftr x n = 0
nshiftr x (Init.Nat.pred size) = 0
 apply nshiftr_0_propagates with n; auto; omega.
 Qed.

Some induction principles over int31

Not used for the moment. Are they really useful ?

 Lemma int31_ind_sneakl : forall P : int31->Prop,
  P 0 ->
  (forall x d, P x -> P (sneakl d x)) ->
  forall x, P x.forall P : int31 -> Prop,
P 0 ->
(forall (x : int31) (d : digits),
 P x -> P (sneakl d x)) -> forall x : int31, P x
 Proof.forall P : int31 -> Prop,
P 0 ->
(forall (x : int31) (d : digits),
 P x -> P (sneakl d x)) -> forall x : int31, P x
 intros.P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
P x
 assert (forall n, n<=size -> P (nshiftr x (size - n))).P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
forall n : nat, n <= size -> P (nshiftr x (size - n))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 induction n; intros.P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:0 <= size
P (nshiftr x (size - 0))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
n:nat
IHn:n <= size -> P (nshiftr x (size - n))
H1:S n <= size
P (nshiftr x (size - S n))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 rewrite nshiftr_size; auto.P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
n:nat
IHn:n <= size -> P (nshiftr x (size - n))
H1:S n <= size
P (nshiftr x (size - S n))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 rewrite sneakl_shiftr.P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
n:nat
IHn:n <= size -> P (nshiftr x (size - n))
H1:S n <= size
P
  (sneakl (firstr (nshiftr x (size - S n)))
     (shiftr (nshiftr x (size - S n))))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 apply H0.P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
n:nat
IHn:n <= size -> P (nshiftr x (size - n))
H1:S n <= size
P (shiftr (nshiftr x (size - S n)))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 change (P (nshiftr x (S (size - S n)))).P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
n:nat
IHn:n <= size -> P (nshiftr x (size - n))
H1:S n <= size
P (nshiftr x (S (size - S n)))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 replace (S (size - S n))%nat with (size - n)%nat by omega.P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
n:nat
IHn:n <= size -> P (nshiftr x (size - n))
H1:S n <= size
P (nshiftr x (size - n))
P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 apply IHn; omega.P:int31 -> Prop
H:P 0
H0:forall (x0 : int31) (d : digits),
P x0 -> P (sneakl d x0)
x:int31
H1:forall n : nat,
n <= size -> P (nshiftr x (size - n))
P x
 change x with (nshiftr x (size-size)); auto.
 Qed.

 Lemma int31_ind_twice : forall P : int31->Prop,
  P 0 ->
  (forall x, P x -> P (twice x)) ->
  (forall x, P x -> P (twice_plus_one x)) ->
  forall x, P x.forall P : int31 -> Prop,
P 0 ->
(forall x : int31, P x -> P (twice x)) ->
(forall x : int31, P x -> P (twice_plus_one x)) ->
forall x : int31, P x
 Proof.forall P : int31 -> Prop,
P 0 ->
(forall x : int31, P x -> P (twice x)) ->
(forall x : int31, P x -> P (twice_plus_one x)) ->
forall x : int31, P x
 induction x using int31_ind_sneakl; auto.P:int31 -> Prop
H:P 0
H0:forall x0 : int31, P x0 -> P (twice x0)
H1:forall x0 : int31, P x0 -> P (twice_plus_one x0)
x:int31
d:digits
IHx:P x
P (sneakl d x)
 destruct d; auto.
 Qed.

Some generic results about recr

 Section Recr.

recr satisfies the fixpoint equation used for its definition.

 Variable (A:Type)(case0:A)(caserec:digits->int31->A->A).

 Lemma recr_aux_eqn : forall n x, iszero x = false ->
   recr_aux (S n) A case0 caserec x =
   caserec (firstr x) (shiftr x) (recr_aux n A case0 caserec (shiftr x)).A:Type
case0:A
caserec:digits -> int31 -> A -> A
forall (n : nat) (x : int31),
iszero x = false ->
recr_aux (S n) A case0 caserec x =
caserec (firstr x) (shiftr x)
  (recr_aux n A case0 caserec (shiftr x))
 Proof.A:Type
case0:A
caserec:digits -> int31 -> A -> A
forall (n : nat) (x : int31),
iszero x = false ->
recr_aux (S n) A case0 caserec x =
caserec (firstr x) (shiftr x)
  (recr_aux n A case0 caserec (shiftr x))
 intros; simpl; rewrite H; auto.
 Qed.

 Lemma recr_aux_converges :
  forall n p x, n <= size -> n <= p ->
  recr_aux n A case0 caserec (nshiftr x (size - n)) =
  recr_aux p A case0 caserec (nshiftr x (size - n)).A:Type
case0:A
caserec:digits -> int31 -> A -> A
forall (n p : nat) (x : int31),
n <= size ->
n <= p ->
recr_aux n A case0 caserec (nshiftr x (size - n)) =
recr_aux p A case0 caserec (nshiftr x (size - n))
 Proof.A:Type
case0:A
caserec:digits -> int31 -> A -> A
forall (n p : nat) (x : int31),
n <= size ->
n <= p ->
recr_aux n A case0 caserec (nshiftr x (size - n)) =
recr_aux p A case0 caserec (nshiftr x (size - n))
 induction n.A:Type
case0:A
caserec:digits -> int31 -> A -> A
forall (p : nat) (x : int31),
0 <= size ->
0 <= p ->
recr_aux 0 A case0 caserec (nshiftr x (size - 0)) =
recr_aux p A case0 caserec (nshiftr x (size - 0))
A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p : nat) (x : int31),
n <= size ->
n <= p ->
recr_aux n A case0 caserec
  (nshiftr x (size - n)) =
recr_aux p A case0 caserec
  (nshiftr x (size - n))
forall (p : nat) (x : int31),
S n <= size ->
S n <= p ->
recr_aux (S n) A case0 caserec
  (nshiftr x (size - S n)) =
recr_aux p A case0 caserec (nshiftr x (size - S n))
 simpl minus; intros.A:Type
case0:A
caserec:digits -> int31 -> A -> A
p:nat
x:int31
H:0 <= size
H0:0 <= p
recr_aux 0 A case0 caserec (nshiftr x 31) =
recr_aux p A case0 caserec (nshiftr x 31)
A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p : nat) (x : int31),
n <= size ->
n <= p ->
recr_aux n A case0 caserec
  (nshiftr x (size - n)) =
recr_aux p A case0 caserec
  (nshiftr x (size - n))
forall (p : nat) (x : int31),
S n <= size ->
S n <= p ->
recr_aux (S n) A case0 caserec
  (nshiftr x (size - S n)) =
recr_aux p A case0 caserec (nshiftr x (size - S n))
 rewrite nshiftr_size; destruct p; simpl; auto.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p : nat) (x : int31),
n <= size ->
n <= p ->
recr_aux n A case0 caserec
  (nshiftr x (size - n)) =
recr_aux p A case0 caserec
  (nshiftr x (size - n))
forall (p : nat) (x : int31),
S n <= size ->
S n <= p ->
recr_aux (S n) A case0 caserec
  (nshiftr x (size - S n)) =
recr_aux p A case0 caserec (nshiftr x (size - S n))
 intros.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= p
recr_aux (S n) A case0 caserec
  (nshiftr x (size - S n)) =
recr_aux p A case0 caserec (nshiftr x (size - S n))
 destruct p.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p : nat) (x0 : int31),
n <= size ->
n <= p ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p A case0 caserec
  (nshiftr x0 (size - n))
x:int31
H:S n <= size
H0:S n <= 0
recr_aux (S n) A case0 caserec
  (nshiftr x (size - S n)) =
recr_aux 0 A case0 caserec (nshiftr x (size - S n))
A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= S p
recr_aux (S n) A case0 caserec
  (nshiftr x (size - S n)) =
recr_aux (S p) A case0 caserec
  (nshiftr x (size - S n))
 inversion H0.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= S p
recr_aux (S n) A case0 caserec
  (nshiftr x (size - S n)) =
recr_aux (S p) A case0 caserec
  (nshiftr x (size - S n))
 unfold recr_aux; fold recr_aux.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= S p
(if iszero (nshiftr x (size - S n))
 then case0
 else
  caserec (firstr (nshiftr x (size - S n)))
    (shiftr (nshiftr x (size - S n)))
    (recr_aux n A case0 caserec
       (shiftr (nshiftr x (size - S n))))) =
(if iszero (nshiftr x (size - S n))
 then case0
 else
  caserec (firstr (nshiftr x (size - S n)))
    (shiftr (nshiftr x (size - S n)))
    (recr_aux p A case0 caserec
       (shiftr (nshiftr x (size - S n)))))
 destruct (iszero (nshiftr x (size - S n))); auto.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= S p
caserec (firstr (nshiftr x (size - S n)))
  (shiftr (nshiftr x (size - S n)))
  (recr_aux n A case0 caserec
     (shiftr (nshiftr x (size - S n)))) =
caserec (firstr (nshiftr x (size - S n)))
  (shiftr (nshiftr x (size - S n)))
  (recr_aux p A case0 caserec
     (shiftr (nshiftr x (size - S n))))
 f_equal.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= S p
recr_aux n A case0 caserec
  (shiftr (nshiftr x (size - S n))) =
recr_aux p A case0 caserec
  (shiftr (nshiftr x (size - S n)))
 change (shiftr (nshiftr x (size - S n))) with (nshiftr x (S (size - S n))).A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= S p
recr_aux n A case0 caserec
  (nshiftr x (S (size - S n))) =
recr_aux p A case0 caserec
  (nshiftr x (S (size - S n)))
 replace (S (size - S n))%nat with (size - n)%nat by omega.A:Type
case0:A
caserec:digits -> int31 -> A -> A
n:nat
IHn:forall (p0 : nat) (x0 : int31),
n <= size ->
n <= p0 ->
recr_aux n A case0 caserec
  (nshiftr x0 (size - n)) =
recr_aux p0 A case0 caserec
  (nshiftr x0 (size - n))
p:nat
x:int31
H:S n <= size
H0:S n <= S p
recr_aux n A case0 caserec (nshiftr x (size - n)) =
recr_aux p A case0 caserec (nshiftr x (size - n))
 apply IHn; auto with arith.
 Qed.

 Lemma recr_eqn : forall x, iszero x = false ->
  recr A case0 caserec x =
  caserec (firstr x) (shiftr x) (recr A case0 caserec (shiftr x)).A:Type
case0:A
caserec:digits -> int31 -> A -> A
forall x : int31,
iszero x = false ->
recr A case0 caserec x =
caserec (firstr x) (shiftr x)
  (recr A case0 caserec (shiftr x))
 Proof.A:Type
case0:A
caserec:digits -> int31 -> A -> A
forall x : int31,
iszero x = false ->
recr A case0 caserec x =
caserec (firstr x) (shiftr x)
  (recr A case0 caserec (shiftr x))
 intros.A:Type
case0:A
caserec:digits -> int31 -> A -> A
x:int31
H:iszero x = false
recr A case0 caserec x =
caserec (firstr x) (shiftr x)
  (recr A case0 caserec (shiftr x))
 unfold recr.A:Type
case0:A
caserec:digits -> int31 -> A -> A
x:int31
H:iszero x = false
recr_aux size A case0 caserec x =
caserec (firstr x) (shiftr x)
  (recr_aux size A case0 caserec (shiftr x))
 change x with (nshiftr x (size - size)).A:Type
case0:A
caserec:digits -> int31 -> A -> A
x:int31
H:iszero x = false
recr_aux size A case0 caserec
  (nshiftr x (size - size)) =
caserec (firstr (nshiftr x (size - size)))
  (shiftr (nshiftr x (size - size)))
  (recr_aux size A case0 caserec
     (shiftr (nshiftr x (size - size))))
 rewrite (recr_aux_converges size (S size)); auto with arith.A:Type
case0:A
caserec:digits -> int31 -> A -> A
x:int31
H:iszero x = false
recr_aux (S size) A case0 caserec
  (nshiftr x (size - size)) =
caserec (firstr (nshiftr x (size - size)))
  (shiftr (nshiftr x (size - size)))
  (recr_aux size A case0 caserec
     (shiftr (nshiftr x (size - size))))
 rewrite recr_aux_eqn; auto.
 Qed.

recr is usually equivalent to a variant recrbis written without iszero check.

 Fixpoint recrbis_aux (n:nat)(A:Type)(case0:A)(caserec:digits->int31->A->A)
 (i:int31) : A :=
  match n with
  | O => case0
  | S next =>
      let si := shiftr i in
      caserec (firstr i) si (recrbis_aux next A case0 caserec si)
  end.

 Definition recrbis := recrbis_aux size.

 Hypothesis case0_caserec : caserec D0 0 case0 = case0.

 Lemma recrbis_aux_equiv : forall n x,
   recrbis_aux n A case0 caserec x = recr_aux n A case0 caserec x.A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
forall (n : nat) (x : int31),
recrbis_aux n A case0 caserec x =
recr_aux n A case0 caserec x
 Proof.A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
forall (n : nat) (x : int31),
recrbis_aux n A case0 caserec x =
recr_aux n A case0 caserec x
 induction n; simpl; auto; intros.A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
n:nat
IHn:forall x0 : int31,
recrbis_aux n A case0 caserec x0 =
recr_aux n A case0 caserec x0
x:int31
caserec (firstr x) (shiftr x)
  (recrbis_aux n A case0 caserec (shiftr x)) =
(if iszero x
 then case0
 else
  caserec (firstr x) (shiftr x)
    (recr_aux n A case0 caserec (shiftr x)))
 case_eq (iszero x); intros; [ | f_equal; auto ].A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
n:nat
IHn:forall x0 : int31,
recrbis_aux n A case0 caserec x0 =
recr_aux n A case0 caserec x0
x:int31
H:iszero x = true
caserec (firstr x) (shiftr x)
  (recrbis_aux n A case0 caserec (shiftr x)) = case0
 rewrite (iszero_eq0 _ H); simpl; auto.A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
n:nat
IHn:forall x0 : int31,
recrbis_aux n A case0 caserec x0 =
recr_aux n A case0 caserec x0
x:int31
H:iszero x = true
caserec D0 0 (recrbis_aux n A case0 caserec 0) = case0
 replace (recrbis_aux n A case0 caserec 0) with case0; auto.A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
n:nat
IHn:forall x0 : int31,
recrbis_aux n A case0 caserec x0 =
recr_aux n A case0 caserec x0
x:int31
H:iszero x = true
case0 = recrbis_aux n A case0 caserec 0
 clear H IHn; induction n; simpl; congruence.
 Qed.

 Lemma recrbis_equiv : forall x,
   recrbis A case0 caserec x = recr A case0 caserec x.A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
forall x : int31,
recrbis A case0 caserec x = recr A case0 caserec x
 Proof.A:Type
case0:A
caserec:digits -> int31 -> A -> A
case0_caserec:caserec D0 0 case0 = case0
forall x : int31,
recrbis A case0 caserec x = recr A case0 caserec x
 intros; apply recrbis_aux_equiv; auto.
 Qed.

 End Recr.

Incrementation

 Section Incr.

Variant of incr via recrbis

 Let Incr (b : digits) (si rec : int31) :=
  match b with
   | D0 => sneakl D1 si
   | D1 => sneakl D0 rec
  end.

 Definition incrbis_aux n x := recrbis_aux n _ In Incr x.

 Lemma incrbis_aux_equiv : forall x, incrbis_aux size x = incr x.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31, incrbis_aux size x = incr x
 Proof.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31, incrbis_aux size x = incr x
 unfold incr, recr, incrbis_aux; fold Incr; intros.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
recrbis_aux size int31 In Incr x =
recr_aux size int31 In Incr x
 apply recrbis_aux_equiv; auto.
 Qed.

Recursive equations satisfied by incr

 Lemma incr_eqn1 :
  forall x, firstr x = D0 -> incr x = twice_plus_one (shiftr x).Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31,
firstr x = D0 -> incr x = twice_plus_one (shiftr x)
 Proof.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31,
firstr x = D0 -> incr x = twice_plus_one (shiftr x)
 intros.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D0
incr x = twice_plus_one (shiftr x)
 case_eq (iszero x); intros.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D0
H0:iszero x = true
incr x = twice_plus_one (shiftr x)
Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D0
H0:iszero x = false
incr x = twice_plus_one (shiftr x)
 rewrite (iszero_eq0 _ H0); simpl; auto.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D0
H0:iszero x = false
incr x = twice_plus_one (shiftr x)
 unfold incr; rewrite recr_eqn; fold incr; auto.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D0
H0:iszero x = false
match firstr x with
| D0 => sneakl D1 (shiftr x)
| D1 => sneakl D0 (incr (shiftr x))
end = twice_plus_one (shiftr x)
 rewrite H; auto.
 Qed.

 Lemma incr_eqn2 :
  forall x, firstr x = D1 -> incr x = twice (incr (shiftr x)).Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31,
firstr x = D1 -> incr x = twice (incr (shiftr x))
 Proof.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31,
firstr x = D1 -> incr x = twice (incr (shiftr x))
 intros.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D1
incr x = twice (incr (shiftr x))
 case_eq (iszero x); intros.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D1
H0:iszero x = true
incr x = twice (incr (shiftr x))
Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D1
H0:iszero x = false
incr x = twice (incr (shiftr x))
 rewrite (iszero_eq0 _ H0) in H; simpl in H; discriminate.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D1
H0:iszero x = false
incr x = twice (incr (shiftr x))
 unfold incr; rewrite recr_eqn; fold incr; auto.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstr x = D1
H0:iszero x = false
match firstr x with
| D0 => sneakl D1 (shiftr x)
| D1 => sneakl D0 (incr (shiftr x))
end = twice (incr (shiftr x))
 rewrite H; auto.
 Qed.

 Lemma incr_twice : forall x, incr (twice x) = twice_plus_one x.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31, incr (twice x) = twice_plus_one x
 Proof.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31, incr (twice x) = twice_plus_one x
 intros.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
incr (twice x) = twice_plus_one x
 rewrite incr_eqn1; destruct x; simpl; auto.
 Qed.

 Lemma incr_twice_plus_one_firstl :
  forall x, firstl x = D0 -> incr (twice_plus_one x) = twice (incr x).Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31,
firstl x = D0 ->
incr (twice_plus_one x) = twice (incr x)
 Proof.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
forall x : int31,
firstl x = D0 ->
incr (twice_plus_one x) = twice (incr x)
 intros.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstl x = D0
incr (twice_plus_one x) = twice (incr x)
 rewrite incr_eqn2; [ | destruct x; simpl; auto ].Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstl x = D0
twice (incr (shiftr (twice_plus_one x))) =
twice (incr x)
 f_equal; f_equal.Incr:=fun (b : digits) (si rec : int31) =>
match b with
| D0 => sneakl D1 si
| D1 => sneakl D0 rec
end:digits -> int31 -> int31 -> int31
x:int31
H:firstl x = D0
shiftr (twice_plus_one x) = x
 destruct x; simpl in *; rewrite H; auto.
 Qed.

The previous result is actually true even without the constraint on firstl, but this is harder to prove (see later).

 End Incr.

Conversion to Z : the phi function

 Section Phi.

Variant of phi via recrbis

 Let Phi := fun b (_:int31) =>
       match b with D0 => Z.double | D1 => Z.succ_double end.

 Definition phibis_aux n x := recrbis_aux n _ Z0 Phi x.

 Lemma phibis_aux_equiv : forall x, phibis_aux size x = phi x.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31, phibis_aux size x = phi x
 Proof.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31, phibis_aux size x = phi x
 unfold phi, recr, phibis_aux; fold Phi; intros.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
recrbis_aux size Z 0%Z Phi x =
recr_aux size Z 0%Z Phi x
 apply recrbis_aux_equiv; auto.
 Qed.

Recursive equations satisfied by phi

 Lemma phi_eqn1 : forall x, firstr x = D0 ->
  phi x = Z.double (phi (shiftr x)).Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstr x = D0 -> phi x = Z.double (phi (shiftr x))
 Proof.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstr x = D0 -> phi x = Z.double (phi (shiftr x))
 intros.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D0
phi x = Z.double (phi (shiftr x))
 case_eq (iszero x); intros.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D0
H0:iszero x = true
phi x = Z.double (phi (shiftr x))
Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D0
H0:iszero x = false
phi x = Z.double (phi (shiftr x))
 rewrite (iszero_eq0 _ H0); simpl; auto.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D0
H0:iszero x = false
phi x = Z.double (phi (shiftr x))
 intros; unfold phi; rewrite recr_eqn; fold phi; auto.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D0
H0:iszero x = false
match firstr x with
| D0 => Z.double
| D1 => Z.succ_double
end (phi (shiftr x)) = Z.double (phi (shiftr x))
 rewrite H; auto.
 Qed.

 Lemma phi_eqn2 : forall x, firstr x = D1 ->
  phi x = Z.succ_double (phi (shiftr x)).Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstr x = D1 ->
phi x = Z.succ_double (phi (shiftr x))
 Proof.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstr x = D1 ->
phi x = Z.succ_double (phi (shiftr x))
 intros.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D1
phi x = Z.succ_double (phi (shiftr x))
 case_eq (iszero x); intros.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D1
H0:iszero x = true
phi x = Z.succ_double (phi (shiftr x))
Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D1
H0:iszero x = false
phi x = Z.succ_double (phi (shiftr x))
 rewrite (iszero_eq0 _ H0) in H; simpl in H; discriminate.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D1
H0:iszero x = false
phi x = Z.succ_double (phi (shiftr x))
 intros; unfold phi; rewrite recr_eqn; fold phi; auto.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstr x = D1
H0:iszero x = false
match firstr x with
| D0 => Z.double
| D1 => Z.succ_double
end (phi (shiftr x)) = Z.succ_double (phi (shiftr x))
 rewrite H; auto.
 Qed.

 Lemma phi_twice_firstl : forall x, firstl x = D0 ->
  phi (twice x) = Z.double (phi x).Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstl x = D0 -> phi (twice x) = Z.double (phi x)
 Proof.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstl x = D0 -> phi (twice x) = Z.double (phi x)
 intros.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstl x = D0
phi (twice x) = Z.double (phi x)
 rewrite phi_eqn1; auto; [ | destruct x; auto ].Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstl x = D0
Z.double (phi (shiftr (twice x))) = Z.double (phi x)
 f_equal; f_equal.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstl x = D0
shiftr (twice x) = x
 destruct x; simpl in *; rewrite H; auto.
 Qed.

 Lemma phi_twice_plus_one_firstl : forall x, firstl x = D0 ->
  phi (twice_plus_one x) = Z.succ_double (phi x).Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstl x = D0 ->
phi (twice_plus_one x) = Z.succ_double (phi x)
 Proof.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
forall x : int31,
firstl x = D0 ->
phi (twice_plus_one x) = Z.succ_double (phi x)
 intros.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstl x = D0
phi (twice_plus_one x) = Z.succ_double (phi x)
 rewrite phi_eqn2; auto; [ | destruct x; auto ].Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstl x = D0
Z.succ_double (phi (shiftr (twice_plus_one x))) =
Z.succ_double (phi x)
 f_equal; f_equal.Phi:=fun (b : digits) (_ : int31) =>
match b with
| D0 => Z.double
| D1 => Z.succ_double
end:digits -> int31 -> Z -> Z
x:int31
H:firstl x = D0
shiftr (twice_plus_one x) = x
 destruct x; simpl in *; rewrite H; auto.
 Qed.

 End Phi.

phi x is positive and lower than 2^31

 Lemma phibis_aux_pos : forall n x, (0 <= phibis_aux n x)%Z.forall (n : nat) (x : int31), (0 <= phibis_aux n x)%Z
 Proof.forall (n : nat) (x : int31), (0 <= phibis_aux n x)%Z
 induction n.forall x : int31, (0 <= phibis_aux 0 x)%Z
n:nat
IHn:forall x : int31, (0 <= phibis_aux n x)%Z
forall x : int31, (0 <= phibis_aux (S n) x)%Z
 simpl; unfold phibis_aux; simpl; auto with zarith.n:nat
IHn:forall x : int31, (0 <= phibis_aux n x)%Z
forall x : int31, (0 <= phibis_aux (S n) x)%Z
 intros.n:nat
IHn:forall x0 : int31, (0 <= phibis_aux n x0)%Z
x:int31
(0 <= phibis_aux (S n) x)%Z
 unfold phibis_aux, recrbis_aux; fold recrbis_aux;
  fold (phibis_aux n (shiftr x)).n:nat
IHn:forall x0 : int31, (0 <= phibis_aux n x0)%Z
x:int31
(0 <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (shiftr x)))%Z
 destruct (firstr x).n:nat
IHn:forall x0 : int31, (0 <= phibis_aux n x0)%Z
x:int31
(0 <= Z.double (phibis_aux n (shiftr x)))%Z
n:nat
IHn:forall x0 : int31, (0 <= phibis_aux n x0)%Z
x:int31
(0 <= Z.succ_double (phibis_aux n (shiftr x)))%Z
 specialize IHn with (shiftr x); rewrite Z.double_spec; omega.n:nat
IHn:forall x0 : int31, (0 <= phibis_aux n x0)%Z
x:int31
(0 <= Z.succ_double (phibis_aux n (shiftr x)))%Z
 specialize IHn with (shiftr x); rewrite Z.succ_double_spec; omega.
 Qed.

 Lemma phibis_aux_bounded :
  forall n x, n <= size ->
  (phibis_aux n (nshiftr x (size-n)) < 2 ^ (Z.of_nat n))%Z.forall (n : nat) (x : int31),
n <= size ->
(phibis_aux n (nshiftr x (size - n)) < 2 ^ Z.of_nat n)%Z
 Proof.forall (n : nat) (x : int31),
n <= size ->
(phibis_aux n (nshiftr x (size - n)) < 2 ^ Z.of_nat n)%Z
 induction n.forall x : int31,
0 <= size ->
(phibis_aux 0 (nshiftr x (size - 0)) < 2 ^ Z.of_nat 0)%Z
n:nat
IHn:forall x : int31,
n <= size -> (phibis_aux n (nshiftr x (size - n)) < 2 ^ Z.of_nat n)%Z
forall x : int31,
S n <= size ->
(phibis_aux (S n) (nshiftr x (size - S n)) <
 2 ^ Z.of_nat (S n))%Z
 simpl minus; unfold phibis_aux; simpl; auto with zarith.n:nat
IHn:forall x : int31,
n <= size -> (phibis_aux n (nshiftr x (size - n)) < 2 ^ Z.of_nat n)%Z
forall x : int31,
S n <= size ->
(phibis_aux (S n) (nshiftr x (size - S n)) <
 2 ^ Z.of_nat (S n))%Z
 intros.n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
(phibis_aux (S n) (nshiftr x (size - S n)) <
 2 ^ Z.of_nat (S n))%Z
 unfold phibis_aux, recrbis_aux; fold recrbis_aux;
  fold (phibis_aux n (shiftr (nshiftr x (size - S n)))).n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (shiftr (nshiftr x (size - S n)))) <
 2 ^ Z.of_nat (S n))%Z
 assert (shiftr (nshiftr x (size - S n)) =  nshiftr x (size-n)).n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
shiftr (nshiftr x (size - S n)) = nshiftr x (size - n)
n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (shiftr (nshiftr x (size - S n)))) <
 2 ^ Z.of_nat (S n))%Z
  replace (size - n)%nat with (S (size - (S n))) by omega.n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
shiftr (nshiftr x (size - S n)) =
nshiftr x (S (size - S n))
n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (shiftr (nshiftr x (size - S n)))) <
 2 ^ Z.of_nat (S n))%Z
  simpl; auto.n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (shiftr (nshiftr x (size - S n)))) <
 2 ^ Z.of_nat (S n))%Z
 rewrite H0.n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (nshiftr x (size - n))) <
 2 ^ Z.of_nat (S n))%Z
 assert (H1 : n <= size) by omega.n:nat
IHn:forall x0 : int31,
n <= size -> (phibis_aux n (nshiftr x0 (size - n)) < 2 ^ Z.of_nat n)%Z
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:n <= size
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (nshiftr x (size - n))) <
 2 ^ Z.of_nat (S n))%Z
 specialize (IHn x H1).n:nat
x:int31
IHn:(phibis_aux n (nshiftr x (size - n)) < 2 ^ Z.of_nat n)%Z
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:n <= size
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux n (nshiftr x (size - n))) <
 2 ^ Z.of_nat (S n))%Z
 set (y:=phibis_aux n (nshiftr x (size - n))) in *.n:nat
x:int31
y:=phibis_aux n (nshiftr x (size - n)):Z
IHn:(y < 2 ^ Z.of_nat n)%Z
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:n <= size
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end y < 2 ^ Z.of_nat (S n))%Z
 rewrite Nat2Z.inj_succ, Z.pow_succ_r; auto with zarith.n:nat
x:int31
y:=phibis_aux n (nshiftr x (size - n)):Z
IHn:(y < 2 ^ Z.of_nat n)%Z
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:n <= size
(match firstr (nshiftr x (size - S n)) with
 | D0 => Z.double
 | D1 => Z.succ_double
 end y < 2 * 2 ^ Z.of_nat n)%Z
 case_eq (firstr (nshiftr x (size - S n))); intros.n:nat
x:int31
y:=phibis_aux n (nshiftr x (size - n)):Z
IHn:(y < 2 ^ Z.of_nat n)%Z
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:n <= size
H2:firstr (nshiftr x (size - S n)) = D0
(Z.double y < 2 * 2 ^ Z.of_nat n)%Z
n:nat
x:int31
y:=phibis_aux n (nshiftr x (size - n)):Z
IHn:(y < 2 ^ Z.of_nat n)%Z
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:n <= size
H2:firstr (nshiftr x (size - S n)) = D1
(Z.succ_double y < 2 * 2 ^ Z.of_nat n)%Z
 rewrite Z.double_spec; auto with zarith.n:nat
x:int31
y:=phibis_aux n (nshiftr x (size - n)):Z
IHn:(y < 2 ^ Z.of_nat n)%Z
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:n <= size
H2:firstr (nshiftr x (size - S n)) = D1
(Z.succ_double y < 2 * 2 ^ Z.of_nat n)%Z
 rewrite Z.succ_double_spec; auto with zarith.
 Qed.

 Lemma phi_nonneg : forall x, (0 <= phi x)%Z.forall x : int31, (0 <= phi x)%Z
 Proof.forall x : int31, (0 <= phi x)%Z
 intros.x:int31
(0 <= phi x)%Z
 rewrite <- phibis_aux_equiv.x:int31
(0 <= phibis_aux size x)%Z
 apply phibis_aux_pos.
 Qed.

 Hint Resolve phi_nonneg : zarith.

 Lemma phi_bounded  : forall x, (0 <= phi x < 2 ^ (Z.of_nat size))%Z.forall x : int31, (0 <= phi x < 2 ^ Z.of_nat size)%Z
 Proof.forall x : int31, (0 <= phi x < 2 ^ Z.of_nat size)%Z
 intros.x:int31
(0 <= phi x < 2 ^ Z.of_nat size)%Z split; [auto with zarith|].x:int31
(phi x < 2 ^ Z.of_nat size)%Z
 rewrite <- phibis_aux_equiv.x:int31
(phibis_aux size x < 2 ^ Z.of_nat size)%Z
 change x with (nshiftr x (size-size)).x:int31
(phibis_aux size (nshiftr x (size - size)) <
 2 ^ Z.of_nat size)%Z
 apply phibis_aux_bounded; auto.
 Qed.

 Lemma phibis_aux_lowerbound :
  forall n x, firstr (nshiftr x n) = D1 ->
  (2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z.forall (n : nat) (x : int31),
firstr (nshiftr x n) = D1 ->
(2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z
 Proof.forall (n : nat) (x : int31),
firstr (nshiftr x n) = D1 ->
(2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z
 induction n.forall x : int31,
firstr (nshiftr x 0) = D1 ->
(2 ^ Z.of_nat 0 <= phibis_aux 1 x)%Z
n:nat
IHn:forall x : int31,
firstr (nshiftr x n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z
forall x : int31,
firstr (nshiftr x (S n)) = D1 ->
(2 ^ Z.of_nat (S n) <= phibis_aux (S (S n)) x)%Z
 intros.x:int31
H:firstr (nshiftr x 0) = D1
(2 ^ Z.of_nat 0 <= phibis_aux 1 x)%Z
n:nat
IHn:forall x : int31,
firstr (nshiftr x n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z
forall x : int31,
firstr (nshiftr x (S n)) = D1 ->
(2 ^ Z.of_nat (S n) <= phibis_aux (S (S n)) x)%Z
 unfold nshiftr in H; simpl in *.x:int31
H:firstr x = D1
(1 <= phibis_aux 1 x)%Z
n:nat
IHn:forall x : int31,
firstr (nshiftr x n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z
forall x : int31,
firstr (nshiftr x (S n)) = D1 ->
(2 ^ Z.of_nat (S n) <= phibis_aux (S (S n)) x)%Z
 unfold phibis_aux, recrbis_aux.x:int31
H:firstr x = D1
(1 <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end 0)%Z
n:nat
IHn:forall x : int31,
firstr (nshiftr x n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z
forall x : int31,
firstr (nshiftr x (S n)) = D1 ->
(2 ^ Z.of_nat (S n) <= phibis_aux (S (S n)) x)%Z
 rewrite H, Z.succ_double_spec; omega.n:nat
IHn:forall x : int31,
firstr (nshiftr x n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x)%Z
forall x : int31,
firstr (nshiftr x (S n)) = D1 ->
(2 ^ Z.of_nat (S n) <= phibis_aux (S (S n)) x)%Z

 intros.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
(2 ^ Z.of_nat (S n) <= phibis_aux (S (S n)) x)%Z
 remember (S n) as m.n, m:nat
Heqm:m = S n
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 ->
(2 ^ Z.of_nat n <= phibis_aux m x0)%Z
x:int31
H:firstr (nshiftr x m) = D1
(2 ^ Z.of_nat m <= phibis_aux (S m) x)%Z
 unfold phibis_aux, recrbis_aux; fold recrbis_aux;
  fold (phibis_aux m (shiftr x)).n, m:nat
Heqm:m = S n
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 ->
(2 ^ Z.of_nat n <= phibis_aux m x0)%Z
x:int31
H:firstr (nshiftr x m) = D1
(2 ^ Z.of_nat m <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux m (shiftr x)))%Z
 subst m.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
(2 ^ Z.of_nat (S n) <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux (S n) (shiftr x)))%Z
 rewrite Nat2Z.inj_succ, Z.pow_succ_r; auto with zarith.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
(2 * 2 ^ Z.of_nat n <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux (S n) (shiftr x)))%Z
 assert (2^(Z.of_nat n) <= phibis_aux (S n) (shiftr x))%Z.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux (S n) (shiftr x)))%Z
  apply IHn.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
firstr (nshiftr (shiftr x) n) = D1
n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux (S n) (shiftr x)))%Z
  rewrite <- nshiftr_S_tail; auto.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <=
 match firstr x with
 | D0 => Z.double
 | D1 => Z.succ_double
 end (phibis_aux (S n) (shiftr x)))%Z
 destruct (firstr x).n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <=
 Z.double (phibis_aux (S n) (shiftr x)))%Z
n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <=
 Z.succ_double (phibis_aux (S n) (shiftr x)))%Z
 change (Z.double (phibis_aux (S n) (shiftr x))) with
        (2*(phibis_aux (S n) (shiftr x)))%Z.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <= 2 * phibis_aux (S n) (shiftr x))%Z
n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <=
 Z.succ_double (phibis_aux (S n) (shiftr x)))%Z
 omega.n:nat
IHn:forall x0 : int31,
firstr (nshiftr x0 n) = D1 -> (2 ^ Z.of_nat n <= phibis_aux (S n) x0)%Z
x:int31
H:firstr (nshiftr x (S n)) = D1
H0:(2 ^ Z.of_nat n <= phibis_aux (S n) (shiftr x))%Z
(2 * 2 ^ Z.of_nat n <=
 Z.succ_double (phibis_aux (S n) (shiftr x)))%Z
 rewrite Z.succ_double_spec; omega.
 Qed.

 Lemma phi_lowerbound :
  forall x, firstl x = D1 -> (2^(Z.of_nat (pred size)) <= phi x)%Z.forall x : int31,
firstl x = D1 ->
(2 ^ Z.of_nat (Init.Nat.pred size) <= phi x)%Z
 Proof.forall x : int31,
firstl x = D1 ->
(2 ^ Z.of_nat (Init.Nat.pred size) <= phi x)%Z
 intros.x:int31
H:firstl x = D1
(2 ^ Z.of_nat (Init.Nat.pred size) <= phi x)%Z
 generalize (phibis_aux_lowerbound (pred size) x).x:int31
H:firstl x = D1
(firstr (nshiftr x (Init.Nat.pred size)) = D1 ->
 (2 ^ Z.of_nat (Init.Nat.pred size) <=
  phibis_aux (S (Init.Nat.pred size)) x)%Z) ->
(2 ^ Z.of_nat (Init.Nat.pred size) <= phi x)%Z
 rewrite <- firstl_firstr.x:int31
H:firstl x = D1
(firstl x = D1 ->
 (2 ^ Z.of_nat (Init.Nat.pred size) <=
  phibis_aux (S (Init.Nat.pred size)) x)%Z) ->
(2 ^ Z.of_nat (Init.Nat.pred size) <= phi x)%Z
 change (S (pred size)) with size; auto.x:int31
H:firstl x = D1
(firstl x = D1 ->
 (2 ^ Z.of_nat (Init.Nat.pred size) <=
  phibis_aux size x)%Z) ->
(2 ^ Z.of_nat (Init.Nat.pred size) <= phi x)%Z
 rewrite phibis_aux_equiv; auto.
 Qed.

Equivalence modulo 2^n

 Section EqShiftL.

After killing n bits at the left, are the numbers equal ?

 Definition EqShiftL n x y :=
  nshiftl x n = nshiftl y n.

 Lemma EqShiftL_zero : forall x y, EqShiftL O x y <-> x = y.forall x y : int31, EqShiftL 0 x y <-> x = y
 Proof.forall x y : int31, EqShiftL 0 x y <-> x = y
 unfold EqShiftL; intros; unfold nshiftl; simpl; split; auto.
 Qed.

 Lemma EqShiftL_size : forall k x y, size<=k -> EqShiftL k x y.forall (k : nat) (x y : int31),
size <= k -> EqShiftL k x y
 Proof.forall (k : nat) (x y : int31),
size <= k -> EqShiftL k x y
 red; intros; rewrite 2 nshiftl_above_size; auto.
 Qed.

 Lemma EqShiftL_le : forall k k' x y, k <= k' ->
   EqShiftL k x y -> EqShiftL k' x y.forall (k k' : nat) (x y : int31),
k <= k' -> EqShiftL k x y -> EqShiftL k' x y
 Proof.forall (k k' : nat) (x y : int31),
k <= k' -> EqShiftL k x y -> EqShiftL k' x y
 unfold EqShiftL; intros.k, k':nat
x, y:int31
H:k <= k'
H0:nshiftl x k = nshiftl y k
nshiftl x k' = nshiftl y k'
 replace k' with ((k'-k)+k)%nat by omega.k, k':nat
x, y:int31
H:k <= k'
H0:nshiftl x k = nshiftl y k
nshiftl x (k' - k + k) = nshiftl y (k' - k + k)
 remember (k'-k)%nat as n.k, k':nat
x, y:int31
H:k <= k'
H0:nshiftl x k = nshiftl y k
n:nat
Heqn:n = (k' - k)%nat
nshiftl x (n + k) = nshiftl y (n + k)
 clear Heqn H k'.k:nat
x, y:int31
H0:nshiftl x k = nshiftl y k
n:nat
nshiftl x (n + k) = nshiftl y (n + k)
 induction n; simpl; auto.k:nat
x, y:int31
H0:nshiftl x k = nshiftl y k
n:nat
IHn:nshiftl x (n + k) = nshiftl y (n + k)
shiftl (nshiftl x (n + k)) =
shiftl (nshiftl y (n + k))
 f_equal; auto.
 Qed.

 Lemma EqShiftL_firstr : forall k x y, k < size ->
  EqShiftL k x y -> firstr x = firstr y.forall (k : nat) (x y : int31),
k < size -> EqShiftL k x y -> firstr x = firstr y
 Proof.forall (k : nat) (x y : int31),
k < size -> EqShiftL k x y -> firstr x = firstr y
 intros.k:nat
x, y:int31
H:k < size
H0:EqShiftL k x y
firstr x = firstr y
 rewrite 2 firstr_firstl.k:nat
x, y:int31
H:k < size
H0:EqShiftL k x y
firstl (nshiftl x (Init.Nat.pred size)) =
firstl (nshiftl y (Init.Nat.pred size))
 f_equal.k:nat
x, y:int31
H:k < size
H0:EqShiftL k x y
nshiftl x (Init.Nat.pred size) =
nshiftl y (Init.Nat.pred size)
 apply EqShiftL_le with k; auto.k:nat
x, y:int31
H:k < size
H0:EqShiftL k x y
k <= Init.Nat.pred size
 unfold size.k:nat
x, y:int31
H:k < size
H0:EqShiftL k x y
k <= Init.Nat.pred 31
 auto with arith.
 Qed.

 Lemma EqShiftL_twice : forall k x y,
  EqShiftL k (twice x) (twice y) <-> EqShiftL (S k) x y.forall (k : nat) (x y : int31),
EqShiftL k (twice x) (twice y) <-> EqShiftL (S k) x y
 Proof.forall (k : nat) (x y : int31),
EqShiftL k (twice x) (twice y) <-> EqShiftL (S k) x y
 intros; unfold EqShiftL.k:nat
x, y:int31
nshiftl (twice x) k = nshiftl (twice y) k <->
nshiftl x (S k) = nshiftl y (S k)
 rewrite 2 nshiftl_S_tail; split; auto.
 Qed.

From int31 to list of digits.

Lower (=rightmost) bits comes first.

 Definition i2l := recrbis _ nil (fun d _ rec => d::rec).

 Lemma i2l_length : forall x, length (i2l x) = size.forall x : int31, length (i2l x) = size
 Proof.forall x : int31, length (i2l x) = size
 intros; reflexivity.
 Qed.

 Fixpoint lshiftl l x :=
   match l with
     | nil => x
     | d::l => sneakl d (lshiftl l x)
   end.

 Definition l2i l := lshiftl l On.

 Lemma l2i_i2l : forall x, l2i (i2l x) = x.forall x : int31, l2i (i2l x) = x
 Proof.forall x : int31, l2i (i2l x) = x
 destruct x; compute; auto.
 Qed.

 Lemma i2l_sneakr : forall x d,
   i2l (sneakr d x) = tail (i2l x) ++ d::nil.forall (x : int31) (d : digits),
i2l (sneakr d x) = tl (i2l x) ++ d :: nil
 Proof.forall (x : int31) (d : digits),
i2l (sneakr d x) = tl (i2l x) ++ d :: nil
 destruct x; compute; auto.
 Qed.

 Lemma i2l_sneakl : forall x d,
   i2l (sneakl d x) = d :: removelast (i2l x).forall (x : int31) (d : digits),
i2l (sneakl d x) = d :: removelast (i2l x)
 Proof.forall (x : int31) (d : digits),
i2l (sneakl d x) = d :: removelast (i2l x)
 destruct x; compute; auto.
 Qed.

 Lemma i2l_l2i : forall l, length l = size ->
  i2l (l2i l) = l.forall l : list digits,
length l = size -> i2l (l2i l) = l
 Proof.forall l : list digits,
length l = size -> i2l (l2i l) = l
 repeat (destruct l as [ |? l]; [intros; discriminate | ]).d, d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12, d13, d14, d15, d16, d17, d18, d19, d20, d21, d22, d23, d24, d25, d26, d27, d28, d29:digits
l:list digits
length
  (d
   :: d0
      :: d1
         :: d2
            :: d3
               :: d4
                  :: d5
                     :: d6
                        :: d7
                           :: d8
                              :: d9
                                 :: d10
                                    :: d11
                                       :: d12
                                          :: d13
                                             :: d14
                                                :: 
                                                d15
                                                :: 
                                                d16
                                                :: 
                                                d17
                                                :: 
                                                d18
                                                :: 
                                                d19
                                                :: 
                                                d20
                                                :: 
                                                d21
                                                :: ...) =
size ->
i2l
  (l2i
     (d
      :: d0
         :: d1
            :: d2
               :: d3
                  :: d4
                     :: d5
                        :: d6
                           :: d7
                              :: d8
                                 :: d9
                                    :: d10
                                       :: d11
                                          :: d12
                                             :: d13
                                                :: 
                                                d14
                                                :: 
                                                d15
                                                :: 
                                                d16
                                                :: 
                                                d17
                                                :: 
                                                d18
                                                :: 
                                                d19
                                                :: ...)) =
d
:: d0
   :: d1
      :: d2
         :: d3
            :: d4
               :: d5
                  :: d6
                     :: d7
                        :: d8
                           :: d9
                              :: d10
                                 :: d11
                                    :: d12
                                       :: d13
                                          :: d14
                                             :: d15
                                                :: 
                                                d16
                                                :: 
                                                d17
                                                :: 
                                                d18
                                                :: 
                                                d19
                                                :: 
                                                d20
                                                :: 
                                                d21
                                                :: 
                                                d22
                                                :: 
                                                d23
                                                :: ...
 destruct l; [ | intros; discriminate].d, d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12, d13, d14, d15, d16, d17, d18, d19, d20, d21, d22, d23, d24, d25, d26, d27, d28, d29:digits
length
  (d
   :: d0
      :: d1
         :: d2
            :: d3
               :: d4
                  :: d5
                     :: d6
                        :: d7
                           :: d8
                              :: d9
                                 :: d10
                                    :: d11
                                       :: d12
                                          :: d13
                                             :: d14
                                                :: 
                                                d15
                                                :: 
                                                d16
                                                :: 
                                                d17
                                                :: 
                                                d18
                                                :: 
                                                d19
                                                :: 
                                                d20
                                                :: 
                                                d21
                                                :: ...) =
size ->
i2l
  (l2i
     (d
      :: d0
         :: d1
            :: d2
               :: d3
                  :: d4
                     :: d5
                        :: d6
                           :: d7
                              :: d8
                                 :: d9
                                    :: d10
                                       :: d11
                                          :: d12
                                             :: d13
                                                :: 
                                                d14
                                                :: 
                                                d15
                                                :: 
                                                d16
                                                :: 
                                                d17
                                                :: 
                                                d18
                                                :: 
                                                d19
                                                :: ...)) =
d
:: d0
   :: d1
      :: d2
         :: d3
            :: d4
               :: d5
                  :: d6
                     :: d7
                        :: d8
                           :: d9
                              :: d10
                                 :: d11
                                    :: d12
                                       :: d13
                                          :: d14
                                             :: d15
                                                :: 
                                                d16
                                                :: 
                                                d17
                                                :: 
                                                d18
                                                :: 
                                                d19
                                                :: 
                                                d20
                                                :: 
                                                d21
                                                :: 
                                                d22
                                                :: 
                                                d23
                                                :: ...
 intros _; compute; auto.
 Qed.

 Fixpoint cstlist (A:Type)(a:A) n :=
  match n with
   | O => nil
   | S n => a::cstlist _ a n
  end.

 Lemma i2l_nshiftl : forall n x, n<=size ->
  i2l (nshiftl x n) = cstlist _ D0 n ++ firstn (size-n) (i2l x).forall (n : nat) (x : int31),
n <= size ->
i2l (nshiftl x n) =
cstlist digits D0 n ++ firstn (size - n) (i2l x)
 Proof.forall (n : nat) (x : int31),
n <= size ->
i2l (nshiftl x n) =
cstlist digits D0 n ++ firstn (size - n) (i2l x)
 induction n.forall x : int31,
0 <= size ->
i2l (nshiftl x 0) =
cstlist digits D0 0 ++ firstn (size - 0) (i2l x)
n:nat
IHn:forall x : int31,
n <= size ->
i2l (nshiftl x n) = cstlist digits D0 n ++ firstn (size - n) (i2l x)
forall x : int31,
S n <= size ->
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
 intros.x:int31
H:0 <= size
i2l (nshiftl x 0) =
cstlist digits D0 0 ++ firstn (size - 0) (i2l x)
n:nat
IHn:forall x : int31,
n <= size ->
i2l (nshiftl x n) = cstlist digits D0 n ++ firstn (size - n) (i2l x)
forall x : int31,
S n <= size ->
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
 assert (firstn (size-0) (i2l x) = i2l x).x:int31
H:0 <= size
firstn (size - 0) (i2l x) = i2l x
x:int31
H:0 <= size
H0:firstn (size - 0) (i2l x) = i2l x
i2l (nshiftl x 0) =
cstlist digits D0 0 ++ firstn (size - 0) (i2l x)
n:nat
IHn:forall x : int31,
n <= size ->
i2l (nshiftl x n) = cstlist digits D0 n ++ firstn (size - n) (i2l x)
forall x : int31,
S n <= size ->
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
  rewrite <- minus_n_O, <- (i2l_length x).x:int31
H:0 <= size
firstn (length (i2l x)) (i2l x) = i2l x
x:int31
H:0 <= size
H0:firstn (size - 0) (i2l x) = i2l x
i2l (nshiftl x 0) =
cstlist digits D0 0 ++ firstn (size - 0) (i2l x)
n:nat
IHn:forall x : int31,
n <= size ->
i2l (nshiftl x n) = cstlist digits D0 n ++ firstn (size - n) (i2l x)
forall x : int31,
S n <= size ->
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
  induction (i2l x); simpl; f_equal; auto.x:int31
H:0 <= size
H0:firstn (size - 0) (i2l x) = i2l x
i2l (nshiftl x 0) =
cstlist digits D0 0 ++ firstn (size - 0) (i2l x)
n:nat
IHn:forall x : int31,
n <= size ->
i2l (nshiftl x n) = cstlist digits D0 n ++ firstn (size - n) (i2l x)
forall x : int31,
S n <= size ->
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
 rewrite H0; clear H0.x:int31
H:0 <= size
i2l (nshiftl x 0) = cstlist digits D0 0 ++ i2l x
n:nat
IHn:forall x : int31,
n <= size ->
i2l (nshiftl x n) = cstlist digits D0 n ++ firstn (size - n) (i2l x)
forall x : int31,
S n <= size ->
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
 reflexivity.n:nat
IHn:forall x : int31,
n <= size ->
i2l (nshiftl x n) = cstlist digits D0 n ++ firstn (size - n) (i2l x)
forall x : int31,
S n <= size ->
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)

 intros.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
i2l (nshiftl x (S n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
 rewrite nshiftl_S.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
i2l (shiftl (nshiftl x n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
 unfold shiftl; rewrite i2l_sneakl.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
D0 :: removelast (i2l (nshiftl x n)) =
cstlist digits D0 (S n) ++ firstn (size - S n) (i2l x)
 simpl cstlist.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
D0 :: removelast (i2l (nshiftl x n)) =
(D0 :: cstlist digits D0 n) ++
firstn (size - S n) (i2l x)
 rewrite <- app_comm_cons; f_equal.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
removelast (i2l (nshiftl x n)) =
cstlist digits D0 n ++ firstn (size - S n) (i2l x)
 rewrite IHn; [ | omega].n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
removelast
  (cstlist digits D0 n ++ firstn (size - n) (i2l x)) =
cstlist digits D0 n ++ firstn (size - S n) (i2l x)
 rewrite removelast_app.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
cstlist digits D0 n ++
removelast (firstn (size - n) (i2l x)) =
cstlist digits D0 n ++ firstn (size - S n) (i2l x)
n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
firstn (size - n) (i2l x) <> nil
 apply f_equal.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
removelast (firstn (size - n) (i2l x)) =
firstn (size - S n) (i2l x)
n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
firstn (size - n) (i2l x) <> nil
 replace (size-n)%nat with (S (size - S n))%nat by omega.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
removelast (firstn (S (size - S n)) (i2l x)) =
firstn (size - S n) (i2l x)
n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
firstn (size - n) (i2l x) <> nil
 rewrite removelast_firstn; auto.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
size - S n < length (i2l x)
n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
firstn (size - n) (i2l x) <> nil
 rewrite i2l_length; omega.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
firstn (size - n) (i2l x) <> nil
 generalize (firstn_length (size-n) (i2l x)).n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
length (firstn (size - n) (i2l x)) =
Init.Nat.min (size - n) (length (i2l x)) ->
firstn (size - n) (i2l x) <> nil
 rewrite i2l_length.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
length (firstn (size - n) (i2l x)) =
Init.Nat.min (size - n) size ->
firstn (size - n) (i2l x) <> nil
 intros H0 H1.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
H0:length (firstn (size - n) (i2l x)) =
Init.Nat.min (size - n) size
H1:firstn (size - n) (i2l x) = nil
False rewrite H1 in H0.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
H0:length nil = Init.Nat.min (size - n) size
H1:firstn (size - n) (i2l x) = nil
False
 rewrite min_l in H0 by omega.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
H0:length nil = (size - n)%nat
H1:firstn (size - n) (i2l x) = nil
False
 simpl length in H0.n:nat
IHn:forall x0 : int31,
n <= size ->
i2l (nshiftl x0 n) = cstlist digits D0 n ++ firstn (size - n) (i2l x0)
x:int31
H:S n <= size
H0:0%nat = (size - n)%nat
H1:firstn (size - n) (i2l x) = nil
False
 omega.
 Qed.

i2l can be used to define a relation equivalent to EqShiftL

 Lemma EqShiftL_i2l : forall k x y,
   EqShiftL k x y  <-> firstn (size-k) (i2l x) = firstn (size-k) (i2l y).forall (k : nat) (x y : int31),
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 Proof.forall (k : nat) (x y : int31),
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 intros.k:nat
x, y:int31
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 destruct (le_lt_dec size k) as [Hle|Hlt].k:nat
x, y:int31
Hle:size <= k
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
k:nat
x, y:int31
Hlt:k < size
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 split; intros.k:nat
x, y:int31
Hle:size <= k
H:EqShiftL k x y
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
k:nat
x, y:int31
Hle:size <= k
H:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
EqShiftL k x y
k:nat
x, y:int31
Hlt:k < size
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 replace (size-k)%nat with O by omega.k:nat
x, y:int31
Hle:size <= k
H:EqShiftL k x y
firstn 0 (i2l x) = firstn 0 (i2l y)
k:nat
x, y:int31
Hle:size <= k
H:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
EqShiftL k x y
k:nat
x, y:int31
Hlt:k < size
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 unfold firstn; auto.k:nat
x, y:int31
Hle:size <= k
H:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
EqShiftL k x y
k:nat
x, y:int31
Hlt:k < size
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 apply EqShiftL_size; auto.k:nat
x, y:int31
Hlt:k < size
EqShiftL k x y <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)

 unfold EqShiftL.k:nat
x, y:int31
Hlt:k < size
nshiftl x k = nshiftl y k <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 assert (k <= size) by omega.k:nat
x, y:int31
Hlt:k < size
H:k <= size
nshiftl x k = nshiftl y k <->
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
 split; intros.k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:nshiftl x k = nshiftl y k
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
nshiftl x k = nshiftl y k
 assert (i2l (nshiftl x k) = i2l (nshiftl y k)) by (f_equal; auto).k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:nshiftl x k = nshiftl y k
H1:i2l (nshiftl x k) = i2l (nshiftl y k)
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
nshiftl x k = nshiftl y k
 rewrite 2 i2l_nshiftl in H1; auto.k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:nshiftl x k = nshiftl y k
H1:cstlist digits D0 k ++ firstn (size - k) (i2l x) =
cstlist digits D0 k ++ firstn (size - k) (i2l y)
firstn (size - k) (i2l x) = firstn (size - k) (i2l y)
k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
nshiftl x k = nshiftl y k
 eapply app_inv_head; eauto.k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
nshiftl x k = nshiftl y k
 assert (i2l (nshiftl x k) = i2l (nshiftl y k)).k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
i2l (nshiftl x k) = i2l (nshiftl y k)
k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
H1:i2l (nshiftl x k) = i2l (nshiftl y k)
nshiftl x k = nshiftl y k
  rewrite 2 i2l_nshiftl; auto.k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
cstlist digits D0 k ++ firstn (size - k) (i2l x) =
cstlist digits D0 k ++ firstn (size - k) (i2l y)
k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
H1:i2l (nshiftl x k) = i2l (nshiftl y k)
nshiftl x k = nshiftl y k
  f_equal; auto.k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
H1:i2l (nshiftl x k) = i2l (nshiftl y k)
nshiftl x k = nshiftl y k
 rewrite <- (l2i_i2l (nshiftl x k)), <- (l2i_i2l (nshiftl y k)).k:nat
x, y:int31
Hlt:k < size
H:k <= size
H0:firstn (size - k) (i2l x) =
firstn (size - k) (i2l y)
H1:i2l (nshiftl x k) = i2l (nshiftl y k)
l2i (i2l (nshiftl x k)) = l2i (i2l (nshiftl y k))
 f_equal; auto.
 Qed.

This equivalence allows proving easily the following delicate result

 Lemma EqShiftL_twice_plus_one : forall k x y,
  EqShiftL k (twice_plus_one x) (twice_plus_one y) <-> EqShiftL (S k) x y.forall (k : nat) (x y : int31),
EqShiftL k (twice_plus_one x) (twice_plus_one y) <->
EqShiftL (S k) x y
 Proof.forall (k : nat) (x y : int31),
EqShiftL k (twice_plus_one x) (twice_plus_one y) <->
EqShiftL (S k) x y
 intros.k:nat
x, y:int31
EqShiftL k (twice_plus_one x) (twice_plus_one y) <->
EqShiftL (S k) x y
 destruct (le_lt_dec size k) as [Hle|Hlt].k:nat
x, y:int31
Hle:size <= k
EqShiftL k (twice_plus_one x) (twice_plus_one y) <->
EqShiftL (S k) x y
k:nat
x, y:int31
Hlt:k < size
EqShiftL k (twice_plus_one x) (twice_plus_one y) <->
EqShiftL (S k) x y
 split; intros; apply EqShiftL_size; auto.k:nat
x, y:int31
Hlt:k < size
EqShiftL k (twice_plus_one x) (twice_plus_one y) <->
EqShiftL (S k) x y

 rewrite 2 EqShiftL_i2l.k:nat
x, y:int31
Hlt:k < size
firstn (size - k) (i2l (twice_plus_one x)) =
firstn (size - k) (i2l (twice_plus_one y)) <->
firstn (size - S k) (i2l x) =
firstn (size - S k) (i2l y)
 unfold twice_plus_one.k:nat
x, y:int31
Hlt:k < size
firstn (size - k) (i2l (sneakl D1 x)) =
firstn (size - k) (i2l (sneakl D1 y)) <->
firstn (size - S k) (i2l x) =
firstn (size - S k) (i2l y)
 rewrite 2 i2l_sneakl.k:nat
x, y:int31
Hlt:k < size
firstn (size - k) (D1 :: removelast (i2l x)) =
firstn (size - k) (D1 :: removelast (i2l y)) <->
firstn (size - S k) (i2l x) =
firstn (size - S k) (i2l y)
 replace (size-k)%nat with (S (size - S k))%nat by omega.k:nat
x, y:int31
Hlt:k < size
firstn (S (size - S k)) (D1 :: removelast (i2l x)) =
firstn (S (size - S k)) (D1 :: removelast (i2l y)) <->
firstn (size - S k) (i2l x) =
firstn (size - S k) (i2l y)
 remember (size - S k)%nat as n.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
firstn (S n) (D1 :: removelast (i2l x)) =
firstn (S n) (D1 :: removelast (i2l y)) <->
firstn n (i2l x) = firstn n (i2l y)
 remember (i2l x) as lx.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
firstn (S n) (D1 :: removelast lx) =
firstn (S n) (D1 :: removelast (i2l y)) <->
firstn n lx = firstn n (i2l y)
 remember (i2l y) as ly.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
firstn (S n) (D1 :: removelast lx) =
firstn (S n) (D1 :: removelast ly) <->
firstn n lx = firstn n ly
 simpl.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
D1 :: firstn n (removelast lx) =
D1 :: firstn n (removelast ly) <->
firstn n lx = firstn n ly
 rewrite 2 firstn_removelast.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
D1 :: firstn n lx = D1 :: firstn n ly <->
firstn n lx = firstn n ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length lx
 split; intros.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
H:D1 :: firstn n lx = D1 :: firstn n ly
firstn n lx = firstn n ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
H:firstn n lx = firstn n ly
D1 :: firstn n lx = D1 :: firstn n ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length lx
 injection H; auto.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
H:firstn n lx = firstn n ly
D1 :: firstn n lx = D1 :: firstn n ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length lx
 f_equal; auto.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length ly
k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length lx
 subst ly n; rewrite i2l_length; omega.k:nat
x, y:int31
Hlt:k < size
n:nat
Heqn:n = (size - S k)%nat
lx:list digits
Heqlx:lx = i2l x
ly:list digits
Heqly:ly = i2l y
n < length lx
 subst lx n; rewrite i2l_length; omega.
 Qed.

 Lemma EqShiftL_shiftr : forall k x y, EqShiftL k x y ->
  EqShiftL (S k) (shiftr x) (shiftr y).forall (k : nat) (x y : int31),
EqShiftL k x y -> EqShiftL (S k) (shiftr x) (shiftr y)
 Proof.forall (k : nat) (x y : int31),
EqShiftL k x y -> EqShiftL (S k) (shiftr x) (shiftr y)
 intros.k:nat
x, y:int31
H:EqShiftL k x y
EqShiftL (S k) (shiftr x) (shiftr y)
 destruct (le_lt_dec size (S k)) as [Hle|Hlt].k:nat
x, y:int31
H:EqShiftL k x y
Hle:size <= S k
EqShiftL (S k) (shiftr x) (shiftr y)
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
EqShiftL (S k) (shiftr x) (shiftr y)
 apply EqShiftL_size; auto.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
EqShiftL (S k) (shiftr x) (shiftr y)
 case_eq (firstr x); intros.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D0
EqShiftL (S k) (shiftr x) (shiftr y)
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 rewrite <- EqShiftL_twice.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D0
EqShiftL k (twice (shiftr x)) (twice (shiftr y))
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 unfold twice; rewrite <- H0.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D0
EqShiftL k (sneakl (firstr x) (shiftr x))
  (sneakl (firstr x) (shiftr y))
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 rewrite <- sneakl_shiftr.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D0
EqShiftL k x (sneakl (firstr x) (shiftr y))
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 rewrite (EqShiftL_firstr k x y); auto.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D0
EqShiftL k x (sneakl (firstr y) (shiftr y))
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D0
k < size
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 rewrite <- sneakl_shiftr; auto.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D0
k < size
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 omega.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 rewrite <- EqShiftL_twice_plus_one.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL k (twice_plus_one (shiftr x))
  (twice_plus_one (shiftr y))
 unfold twice_plus_one; rewrite <- H0.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL k (sneakl (firstr x) (shiftr x))
  (sneakl (firstr x) (shiftr y))
 rewrite <- sneakl_shiftr.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL k x (sneakl (firstr x) (shiftr y))
 rewrite (EqShiftL_firstr k x y); auto.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
EqShiftL k x (sneakl (firstr y) (shiftr y))
k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
k < size
 rewrite <- sneakl_shiftr; auto.k:nat
x, y:int31
H:EqShiftL k x y
Hlt:S k < size
H0:firstr x = D1
k < size
 omega.
 Qed.

 Lemma EqShiftL_incrbis : forall n k x y, n<=size ->
  (n+k=S size)%nat ->
  EqShiftL k x y ->
  EqShiftL k (incrbis_aux n x) (incrbis_aux n y).forall (n k : nat) (x y : int31),
n <= size ->
(n + k)%nat = S size ->
EqShiftL k x y ->
EqShiftL k (incrbis_aux n x) (incrbis_aux n y)
 Proof.forall (n k : nat) (x y : int31),
n <= size ->
(n + k)%nat = S size ->
EqShiftL k x y ->
EqShiftL k (incrbis_aux n x) (incrbis_aux n y)
 induction n; simpl; intros.k:nat
x, y:int31
H:0 <= size
H0:k = S size
H1:EqShiftL k x y
EqShiftL k (incrbis_aux 0 x) (incrbis_aux 0 y)
n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
EqShiftL k (incrbis_aux (S n) x) (incrbis_aux (S n) y)
 red; auto.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
EqShiftL k (incrbis_aux (S n) x) (incrbis_aux (S n) y)
 destruct (eq_nat_dec k size).n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
e:k = size
EqShiftL k (incrbis_aux (S n) x) (incrbis_aux (S n) y)
n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
EqShiftL k (incrbis_aux (S n) x) (incrbis_aux (S n) y)
  subst k; apply EqShiftL_size; auto.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
EqShiftL k (incrbis_aux (S n) x) (incrbis_aux (S n) y)
 unfold incrbis_aux; simpl;
  fold (incrbis_aux n (shiftr x)); fold (incrbis_aux n (shiftr y)).n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
EqShiftL k
  match firstr x with
  | D0 => sneakl D1 (shiftr x)
  | D1 => sneakl D0 (incrbis_aux n (shiftr x))
  end
  match firstr y with
  | D0 => sneakl D1 (shiftr y)
  | D1 => sneakl D0 (incrbis_aux n (shiftr y))
  end

 rewrite (EqShiftL_firstr k x y); auto; try omega.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
EqShiftL k
  match firstr y with
  | D0 => sneakl D1 (shiftr x)
  | D1 => sneakl D0 (incrbis_aux n (shiftr x))
  end
  match firstr y with
  | D0 => sneakl D1 (shiftr y)
  | D1 => sneakl D0 (incrbis_aux n (shiftr y))
  end
 case_eq (firstr y); intros.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
H2:firstr y = D0
EqShiftL k (sneakl D1 (shiftr x))
  (sneakl D1 (shiftr y))
n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
H2:firstr y = D1
EqShiftL k (sneakl D0 (incrbis_aux n (shiftr x)))
  (sneakl D0 (incrbis_aux n (shiftr y)))
 rewrite EqShiftL_twice_plus_one.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
H2:firstr y = D0
EqShiftL (S k) (shiftr x) (shiftr y)
n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
H2:firstr y = D1
EqShiftL k (sneakl D0 (incrbis_aux n (shiftr x)))
  (sneakl D0 (incrbis_aux n (shiftr y)))
 apply EqShiftL_shiftr; auto.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
H2:firstr y = D1
EqShiftL k (sneakl D0 (incrbis_aux n (shiftr x)))
  (sneakl D0 (incrbis_aux n (shiftr y)))

 rewrite EqShiftL_twice.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
H2:firstr y = D1
EqShiftL (S k) (incrbis_aux n (shiftr x))
  (incrbis_aux n (shiftr y))
 apply IHn; try omega.n:nat
IHn:forall (k0 : nat) (x0 y0 : int31),
n <= size ->
(n + k0)%nat = S size ->
EqShiftL k0 x0 y0 -> EqShiftL k0 (incrbis_aux n x0) (incrbis_aux n y0)
k:nat
x, y:int31
H:S n <= size
H0:S (n + k) = S size
H1:EqShiftL k x y
n0:k <> size
H2:firstr y = D1
EqShiftL (S k) (shiftr x) (shiftr y)
 apply EqShiftL_shiftr; auto.
 Qed.

 Lemma EqShiftL_incr : forall x y,
  EqShiftL 1 x y -> EqShiftL 1 (incr x) (incr y).forall x y : int31,
EqShiftL 1 x y -> EqShiftL 1 (incr x) (incr y)
 Proof.forall x y : int31,
EqShiftL 1 x y -> EqShiftL 1 (incr x) (incr y)
 intros.x, y:int31
H:EqShiftL 1 x y
EqShiftL 1 (incr x) (incr y)
 rewrite <- 2 incrbis_aux_equiv.x, y:int31
H:EqShiftL 1 x y
EqShiftL 1 (incrbis_aux size x) (incrbis_aux size y)
 apply EqShiftL_incrbis; auto.
 Qed.

 End EqShiftL.

More equations about incr

 Lemma incr_twice_plus_one :
  forall x, incr (twice_plus_one x) = twice (incr x).forall x : int31,
incr (twice_plus_one x) = twice (incr x)
 Proof.forall x : int31,
incr (twice_plus_one x) = twice (incr x)
 intros.x:int31
incr (twice_plus_one x) = twice (incr x)
 rewrite incr_eqn2; [ | destruct x; simpl; auto].x:int31
twice (incr (shiftr (twice_plus_one x))) =
twice (incr x)
 apply EqShiftL_incr.x:int31
EqShiftL 1 (shiftr (twice_plus_one x)) x
 red; destruct x; simpl; auto.
 Qed.

 Lemma incr_firstr : forall x, firstr (incr x) <> firstr x.forall x : int31, firstr (incr x) <> firstr x
 Proof.forall x : int31, firstr (incr x) <> firstr x
 intros.x:int31
firstr (incr x) <> firstr x
 case_eq (firstr x); intros.x:int31
H:firstr x = D0
firstr (incr x) <> D0
x:int31
H:firstr x = D1
firstr (incr x) <> D1
 rewrite incr_eqn1; auto.x:int31
H:firstr x = D0
firstr (twice_plus_one (shiftr x)) <> D0
x:int31
H:firstr x = D1
firstr (incr x) <> D1
 destruct (shiftr x); simpl; discriminate.x:int31
H:firstr x = D1
firstr (incr x) <> D1
 rewrite incr_eqn2; auto.x:int31
H:firstr x = D1
firstr (twice (incr (shiftr x))) <> D1
 destruct (incr (shiftr x)); simpl; discriminate.
 Qed.

 Lemma incr_inv : forall x y,
  incr x = twice_plus_one y -> x = twice y.forall x y : int31,
incr x = twice_plus_one y -> x = twice y
 Proof.forall x y : int31,
incr x = twice_plus_one y -> x = twice y
 intros.x, y:int31
H:incr x = twice_plus_one y
x = twice y
 case_eq (iszero x); intros.x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = true
x = twice y
x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
x = twice y
 rewrite (iszero_eq0 _ H0) in *; simpl in *.x, y:int31
H:incr 0 = twice_plus_one y
H0:iszero x = true
0 = twice y
x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
x = twice y
 change (incr 0) with 1 in H.x, y:int31
H:1 = twice_plus_one y
H0:iszero x = true
0 = twice y
x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
x = twice y
 symmetry; rewrite twice_zero; auto.x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
x = twice y
 case_eq (firstr x); intros.x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
H1:firstr x = D0
x = twice y
x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
H1:firstr x = D1
x = twice y
 rewrite incr_eqn1 in H; auto.x, y:int31
H:twice_plus_one (shiftr x) = twice_plus_one y
H0:iszero x = false
H1:firstr x = D0
x = twice y
x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
H1:firstr x = D1
x = twice y
 clear H0; destruct x; destruct y; simpl in *.d, d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12, d13, d14, d15, d16, d17, d18, d19, d20, d21, d22, d23, d24, d25, d26, d27, d28, d29, d30, d31, d32, d33, d34, d35, d36, d37, d38, d39, d40, d41, d42, d43, d44, d45, d46, d47, d48, d49, d50, d51, d52, d53, d54, d55, d56, d57, d58, d59, d60:digits
H:I31 d d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12
  d13 d14 d15 d16 d17 d18 d19 d20 d21 d22 d23 d24
  d25 d26 d27 d28 D1 =
I31 d31 d32 d33 d34 d35 d36 d37 d38 d39 d40 d41
  d42 d43 d44 d45 d46 d47 d48 d49 d50 d51 d52 d53
  d54 d55 d56 d57 d58 d59 d60 D1
H1:d29 = D0
I31 d d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13
  d14 d15 d16 d17 d18 d19 d20 d21 d22 d23 d24 d25 d26
  d27 d28 d29 =
I31 d31 d32 d33 d34 d35 d36 d37 d38 d39 d40 d41 d42
  d43 d44 d45 d46 d47 d48 d49 d50 d51 d52 d53 d54 d55
  d56 d57 d58 d59 d60 D0
x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
H1:firstr x = D1
x = twice y
 injection H; intros; subst; auto.x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
H1:firstr x = D1
x = twice y
 elim (incr_firstr x).x, y:int31
H:incr x = twice_plus_one y
H0:iszero x = false
H1:firstr x = D1
firstr (incr x) = firstr x
 rewrite H1, H; destruct y; simpl; auto.
 Qed.

Conversion from Z : the phi_inv function

First, recursive equations

 Lemma phi_inv_double_plus_one : forall z,
   phi_inv (Z.succ_double z) = twice_plus_one (phi_inv z).forall z : Z,
phi_inv (Z.succ_double z) = twice_plus_one (phi_inv z)
 Proof.forall z : Z,
phi_inv (Z.succ_double z) = twice_plus_one (phi_inv z)
 destruct z; simpl; auto.p:positive
incr (complement_negative (Pos.pred_double p)) =
twice_plus_one (incr (complement_negative p))
 induction p; simpl.p:positive
IHp:incr (complement_negative (Pos.pred_double p)) =
twice_plus_one (incr (complement_negative p))
incr (twice (twice_plus_one (complement_negative p))) =
twice_plus_one (incr (twice (complement_negative p)))
p:positive
IHp:incr (complement_negative (Pos.pred_double p)) =
twice_plus_one (incr (complement_negative p))
incr (twice (complement_negative (Pos.pred_double p))) =
twice_plus_one
  (incr (twice_plus_one (complement_negative p)))
incr 2147483646 = 2147483647
 rewrite 2 incr_twice; auto.p:positive
IHp:incr (complement_negative (Pos.pred_double p)) =
twice_plus_one (incr (complement_negative p))
incr (twice (complement_negative (Pos.pred_double p))) =
twice_plus_one
  (incr (twice_plus_one (complement_negative p)))
incr 2147483646 = 2147483647
 rewrite incr_twice, incr_twice_plus_one.p:positive
IHp:incr (complement_negative (Pos.pred_double p)) =
twice_plus_one (incr (complement_negative p))
twice_plus_one
  (complement_negative (Pos.pred_double p)) =
twice_plus_one (twice (incr (complement_negative p)))
incr 2147483646 = 2147483647
 f_equal.p:positive
IHp:incr (complement_negative (Pos.pred_double p)) =
twice_plus_one (incr (complement_negative p))
complement_negative (Pos.pred_double p) =
twice (incr (complement_negative p))
incr 2147483646 = 2147483647
 apply incr_inv; auto.incr 2147483646 = 2147483647
 auto.
 Qed.

 Lemma phi_inv_double : forall z,
   phi_inv (Z.double z) = twice (phi_inv z).forall z : Z, phi_inv (Z.double z) = twice (phi_inv z)
 Proof.forall z : Z, phi_inv (Z.double z) = twice (phi_inv z)
 destruct z; simpl; auto.p:positive
incr (twice_plus_one (complement_negative p)) =
twice (incr (complement_negative p))
 rewrite incr_twice_plus_one; auto.
 Qed.

 Lemma phi_inv_incr : forall z,
  phi_inv (Z.succ z) = incr (phi_inv z).forall z : Z, phi_inv (Z.succ z) = incr (phi_inv z)
 Proof.forall z : Z, phi_inv (Z.succ z) = incr (phi_inv z)
 destruct z.phi_inv (Z.succ 0) = incr (phi_inv 0)
p:positive
phi_inv (Z.succ (Z.pos p)) = incr (phi_inv (Z.pos p))
p:positive
phi_inv (Z.succ (Z.neg p)) = incr (phi_inv (Z.neg p))
 simpl; auto.p:positive
phi_inv (Z.succ (Z.pos p)) = incr (phi_inv (Z.pos p))
p:positive
phi_inv (Z.succ (Z.neg p)) = incr (phi_inv (Z.neg p))
 simpl; auto.p:positive
phi_inv_positive (p + 1) = incr (phi_inv_positive p)
p:positive
phi_inv (Z.succ (Z.neg p)) = incr (phi_inv (Z.neg p))
 induction p; simpl; auto.p:positive
IHp:phi_inv_positive (p + 1) = incr (phi_inv_positive p)
twice (phi_inv_positive (Pos.succ p)) =
incr (twice_plus_one (phi_inv_positive p))
p:positive
IHp:phi_inv_positive (p + 1) = incr (phi_inv_positive p)
twice_plus_one (phi_inv_positive p) =
incr (twice (phi_inv_positive p))
p:positive
phi_inv (Z.succ (Z.neg p)) = incr (phi_inv (Z.neg p))
 rewrite <- Pos.add_1_r, IHp, incr_twice_plus_one; auto.p:positive
IHp:phi_inv_positive (p + 1) = incr (phi_inv_positive p)
twice_plus_one (phi_inv_positive p) =
incr (twice (phi_inv_positive p))
p:positive
phi_inv (Z.succ (Z.neg p)) = incr (phi_inv (Z.neg p))
 rewrite incr_twice; auto.p:positive
phi_inv (Z.succ (Z.neg p)) = incr (phi_inv (Z.neg p))
 simpl; auto.p:positive
phi_inv (Z.pos_sub 1 p) =
incr (incr (complement_negative p))
 destruct p; simpl; auto.p:positive
incr (twice_plus_one (complement_negative p)) =
incr (incr (twice (complement_negative p)))
p:positive
incr (complement_negative (Pos.pred_double p)) =
incr (incr (twice_plus_one (complement_negative p)))
 rewrite incr_twice; auto.p:positive
incr (complement_negative (Pos.pred_double p)) =
incr (incr (twice_plus_one (complement_negative p)))
 f_equal.p:positive
complement_negative (Pos.pred_double p) =
incr (twice_plus_one (complement_negative p))
 rewrite incr_twice_plus_one; auto.p:positive
complement_negative (Pos.pred_double p) =
twice (incr (complement_negative p))
 induction p; simpl; auto.p:positive
IHp:complement_negative (Pos.pred_double p) =
twice (incr (complement_negative p))
twice (twice_plus_one (complement_negative p)) =
twice (incr (twice (complement_negative p)))
p:positive
IHp:complement_negative (Pos.pred_double p) =
twice (incr (complement_negative p))
twice (complement_negative (Pos.pred_double p)) =
twice (incr (twice_plus_one (complement_negative p)))
 rewrite incr_twice; auto.p:positive
IHp:complement_negative (Pos.pred_double p) =
twice (incr (complement_negative p))
twice (complement_negative (Pos.pred_double p)) =
twice (incr (twice_plus_one (complement_negative p)))
 f_equal.p:positive
IHp:complement_negative (Pos.pred_double p) =
twice (incr (complement_negative p))
complement_negative (Pos.pred_double p) =
incr (twice_plus_one (complement_negative p))
 rewrite incr_twice_plus_one; auto.
 Qed.

phi_inv o inv, the always-exact and easy-to-prove trip : from int31 to Z and then back to int31.

 Lemma phi_inv_phi_aux :
  forall n x, n <= size ->
   phi_inv (phibis_aux n (nshiftr x (size-n))) =
   nshiftr x (size-n).forall (n : nat) (x : int31),
n <= size ->
phi_inv (phibis_aux n (nshiftr x (size - n))) =
nshiftr x (size - n)
 Proof.forall (n : nat) (x : int31),
n <= size ->
phi_inv (phibis_aux n (nshiftr x (size - n))) =
nshiftr x (size - n)
 induction n.forall x : int31,
0 <= size ->
phi_inv (phibis_aux 0 (nshiftr x (size - 0))) =
nshiftr x (size - 0)
n:nat
IHn:forall x : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x (size - n))) = nshiftr x (size - n)
forall x : int31,
S n <= size ->
phi_inv (phibis_aux (S n) (nshiftr x (size - S n))) =
nshiftr x (size - S n)
 intros; simpl minus.x:int31
H:0 <= size
phi_inv (phibis_aux 0 (nshiftr x 31)) = nshiftr x 31
n:nat
IHn:forall x : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x (size - n))) = nshiftr x (size - n)
forall x : int31,
S n <= size ->
phi_inv (phibis_aux (S n) (nshiftr x (size - S n))) =
nshiftr x (size - S n)
 rewrite nshiftr_size; auto.n:nat
IHn:forall x : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x (size - n))) = nshiftr x (size - n)
forall x : int31,
S n <= size ->
phi_inv (phibis_aux (S n) (nshiftr x (size - S n))) =
nshiftr x (size - S n)
 intros.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
phi_inv (phibis_aux (S n) (nshiftr x (size - S n))) =
nshiftr x (size - S n)
 unfold phibis_aux, recrbis_aux; fold recrbis_aux;
  fold (phibis_aux n (shiftr (nshiftr x (size-S n)))).n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
phi_inv
  (match firstr (nshiftr x (size - S n)) with
   | D0 => Z.double
   | D1 => Z.succ_double
   end
     (phibis_aux n (shiftr (nshiftr x (size - S n))))) =
nshiftr x (size - S n)
 assert (shiftr (nshiftr x (size - S n)) = nshiftr x (size-n)).n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
shiftr (nshiftr x (size - S n)) = nshiftr x (size - n)
n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
phi_inv
  (match firstr (nshiftr x (size - S n)) with
   | D0 => Z.double
   | D1 => Z.succ_double
   end
     (phibis_aux n (shiftr (nshiftr x (size - S n))))) =
nshiftr x (size - S n)
  replace (size - n)%nat with (S (size - (S n))); auto; omega.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
phi_inv
  (match firstr (nshiftr x (size - S n)) with
   | D0 => Z.double
   | D1 => Z.succ_double
   end
     (phibis_aux n (shiftr (nshiftr x (size - S n))))) =
nshiftr x (size - S n)
 rewrite H0.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
phi_inv
  (match firstr (nshiftr x (size - S n)) with
   | D0 => Z.double
   | D1 => Z.succ_double
   end (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
 case_eq (firstr (nshiftr x (size - S n))); intros.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D0
phi_inv
  (Z.double (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
phi_inv
  (Z.succ_double (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)

 rewrite phi_inv_double.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D0
twice (phi_inv (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
phi_inv
  (Z.succ_double (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
 rewrite IHn by omega.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D0
twice (nshiftr x (size - n)) = nshiftr x (size - S n)
n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
phi_inv
  (Z.succ_double (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
 rewrite <- H0.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D0
twice (shiftr (nshiftr x (size - S n))) =
nshiftr x (size - S n)
n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
phi_inv
  (Z.succ_double (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
 remember (nshiftr x (size - S n)) as y.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
y:(fun _ : nat => int31) (size - S n)%nat
Heqy:y = nshiftr x (size - S n)
H0:shiftr y = nshiftr x (size - n)
H1:firstr y = D0
twice (shiftr y) = y
n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) =
nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
phi_inv
  (Z.succ_double (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
 destruct y; simpl in H1; rewrite H1; auto.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
phi_inv
  (Z.succ_double (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)

 rewrite phi_inv_double_plus_one.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
twice_plus_one
  (phi_inv (phibis_aux n (nshiftr x (size - n)))) =
nshiftr x (size - S n)
 rewrite IHn by omega.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
twice_plus_one (nshiftr x (size - n)) =
nshiftr x (size - S n)
 rewrite <- H0.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
H0:shiftr (nshiftr x (size - S n)) =
nshiftr x (size - n)
H1:firstr (nshiftr x (size - S n)) = D1
twice_plus_one (shiftr (nshiftr x (size - S n))) =
nshiftr x (size - S n)
 remember (nshiftr x (size - S n)) as y.n:nat
IHn:forall x0 : int31,
n <= size ->
phi_inv (phibis_aux n (nshiftr x0 (size - n))) = nshiftr x0 (size - n)
x:int31
H:S n <= size
y:(fun _ : nat => int31) (size - S n)%nat
Heqy:y = nshiftr x (size - S n)
H0:shiftr y = nshiftr x (size - n)
H1:firstr y = D1
twice_plus_one (shiftr y) = y
 destruct y; simpl in H1; rewrite H1; auto.
 Qed.

 Lemma phi_inv_phi : forall x, phi_inv (phi x) = x.forall x : int31, phi_inv (phi x) = x
 Proof.forall x : int31, phi_inv (phi x) = x
 intros.x:int31
phi_inv (phi x) = x
 rewrite <- phibis_aux_equiv.x:int31
phi_inv (phibis_aux size x) = x
 replace x with (nshiftr x (size - size)) by auto.x:int31
phi_inv (phibis_aux size (nshiftr x (size - size))) =
nshiftr x (size - size)
 apply phi_inv_phi_aux; auto.
 Qed.

The other composition phi o phi_inv is harder to prove correct. In particular, an overflow can happen, so a modulo is needed. For the moment, we proceed via several steps, the first one being a detour to positive_to_in31.

positive_to_int31

A variant of p2i with twice and twice_plus_one instead of 2*i and 2*i+1

 Fixpoint p2ibis n p : (N*int31)%type :=
  match n with
    | O => (Npos p, On)
    | S n => match p with
               | xO p => let (r,i) := p2ibis n p in (r, twice i)
               | xI p => let (r,i) := p2ibis n p in (r, twice_plus_one i)
               | xH => (N0, In)
             end
  end.

 Lemma p2ibis_bounded : forall n p,
  nshiftr (snd (p2ibis n p)) n = 0.forall (n : nat) (p : positive),
nshiftr (snd (p2ibis n p)) n = 0
 Proof.forall (n : nat) (p : positive),
nshiftr (snd (p2ibis n p)) n = 0
 induction n.forall p : positive, nshiftr (snd (p2ibis 0 p)) 0 = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
forall p : positive,
nshiftr (snd (p2ibis (S n) p)) (S n) = 0
 simpl; intros; auto.n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
forall p : positive,
nshiftr (snd (p2ibis (S n) p)) (S n) = 0
 simpl p2ibis; intros.n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd
     match p with
     | (p0~1)%positive =>
         let (r, i) := p2ibis n p0 in
         (r, twice_plus_one i)
     | (p0~0)%positive =>
         let (r, i) := p2ibis n p0 in (r, twice i)
     | 1%positive => (0%N, In)
     end) (S n) = 0
 destruct p; simpl snd.n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd
     (let (r, i) := p2ibis n p in
      (r, twice_plus_one i))) (S n) = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0

 specialize IHn with p.n:nat
p:positive
IHn:nshiftr (snd (p2ibis n p)) n = 0
nshiftr
  (snd
     (let (r, i) := p2ibis n p in
      (r, twice_plus_one i))) (S n) = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 destruct (p2ibis n p).n:nat
p:positive
n0:N
i:int31
IHn:nshiftr (snd (n0, i)) n = 0
nshiftr (snd (n0, twice_plus_one i)) (S n) = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0 simpl @snd in *.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
nshiftr (twice_plus_one i) (S n) = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 rewrite nshiftr_S_tail.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
nshiftr (shiftr (twice_plus_one i)) n = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 destruct (le_lt_dec size n) as [Hle|Hlt].n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hle:size <= n
nshiftr (shiftr (twice_plus_one i)) n = 0
n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
nshiftr (shiftr (twice_plus_one i)) n = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 rewrite nshiftr_above_size; auto.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
nshiftr (shiftr (twice_plus_one i)) n = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 assert (H:=nshiftr_0_firstl _ _ Hlt IHn).n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
H:firstl i = D0
nshiftr (shiftr (twice_plus_one i)) n = 0
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 replace (shiftr (twice_plus_one i)) with i; auto.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
H:firstl i = D0
i = shiftr (twice_plus_one i)
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 destruct i; simpl in *.n:nat
p:positive
n0:N
d, d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12, d13, d14, d15, d16, d17, d18, d19, d20, d21, d22, d23, d24, d25, d26, d27, d28, d29:digits
IHn:nshiftr
(I31 d d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13 d14 d15 d16 d17 d18
d19 d20 d21 d22 d23 d24 d25 d26 d27 d28 d29) n = 0
Hlt:n < size
H:d = D0
I31 d d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13
  d14 d15 d16 d17 d18 d19 d20 d21 d22 d23 d24 d25 d26
  d27 d28 d29 =
I31 D0 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13
  d14 d15 d16 d17 d18 d19 d20 d21 d22 d23 d24 d25 d26
  d27 d28 d29
n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0 rewrite H; auto.n:nat
IHn:forall p0 : positive, nshiftr (snd (p2ibis n p0)) n = 0
p:positive
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0

 specialize IHn with p.n:nat
p:positive
IHn:nshiftr (snd (p2ibis n p)) n = 0
nshiftr
  (snd (let (r, i) := p2ibis n p in (r, twice i)))
  (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 destruct (p2ibis n p); simpl @snd in *.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
nshiftr (twice i) (S n) = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 rewrite nshiftr_S_tail.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
nshiftr (shiftr (twice i)) n = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 destruct (le_lt_dec size n) as [Hle|Hlt].n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hle:size <= n
nshiftr (shiftr (twice i)) n = 0
n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
nshiftr (shiftr (twice i)) n = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 rewrite nshiftr_above_size; auto.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
nshiftr (shiftr (twice i)) n = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 assert (H:=nshiftr_0_firstl _ _ Hlt IHn).n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
H:firstl i = D0
nshiftr (shiftr (twice i)) n = 0
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 replace (shiftr (twice i)) with i; auto.n:nat
p:positive
n0:N
i:int31
IHn:nshiftr i n = 0
Hlt:n < size
H:firstl i = D0
i = shiftr (twice i)
n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0
 destruct i; simpl in *; rewrite H; auto.n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr In (S n) = 0

 rewrite nshiftr_S_tail; auto.n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr (shiftr In) n = 0
 replace (shiftr In) with 0; auto.n:nat
IHn:forall p : positive, nshiftr (snd (p2ibis n p)) n = 0
nshiftr 0 n = 0
 apply nshiftr_n_0.
 Qed.

 Local Open Scope Z_scope.

 Lemma p2ibis_spec : forall n p, (n<=size)%nat ->
    Zpos p = (Z.of_N (fst (p2ibis n p)))*2^(Z.of_nat n) +
             phi (snd (p2ibis n p)).forall (n : nat) (p : positive),
(n <= size)%nat ->
Z.pos p =
Z.of_N (fst (p2ibis n p)) * 2 ^ Z.of_nat n +
phi (snd (p2ibis n p))
 Proof.forall (n : nat) (p : positive),
(n <= size)%nat ->
Z.pos p =
Z.of_N (fst (p2ibis n p)) * 2 ^ Z.of_nat n +
phi (snd (p2ibis n p))
 induction n; intros.p:positive
H:(0 <= size)%nat
Z.pos p =
Z.of_N (fst (p2ibis 0 p)) * 2 ^ Z.of_nat 0 +
phi (snd (p2ibis 0 p))
n:nat
IHn:forall p0 : positive,
(n <= size)%nat ->
Z.pos p0 =
Z.of_N (fst (p2ibis n p0)) * 2 ^ Z.of_nat n + phi (snd (p2ibis n p0))
p:positive
H:(S n <= size)%nat
Z.pos p =
Z.of_N (fst (p2ibis (S n) p)) * 2 ^ Z.of_nat (S n) +
phi (snd (p2ibis (S n) p))
 simpl; rewrite Pos.mul_1_r; auto.n:nat
IHn:forall p0 : positive,
(n <= size)%nat ->
Z.pos p0 =
Z.of_N (fst (p2ibis n p0)) * 2 ^ Z.of_nat n + phi (snd (p2ibis n p0))
p:positive
H:(S n <= size)%nat
Z.pos p =
Z.of_N (fst (p2ibis (S n) p)) * 2 ^ Z.of_nat (S n) +
phi (snd (p2ibis (S n) p))
 replace (2^(Z.of_nat (S n)))%Z with (2*2^(Z.of_nat n))%Z by
  (rewrite <- Z.pow_succ_r, <- Zpos_P_of_succ_nat;
   auto with zarith).n:nat
IHn:forall p0 : positive,
(n <= size)%nat ->
Z.pos p0 =
Z.of_N (fst (p2ibis n p0)) * 2 ^ Z.of_nat n + phi (snd (p2ibis n p0))
p:positive
H:(S n <= size)%nat
Z.pos p =
Z.of_N (fst (p2ibis (S n) p)) * (2 * 2 ^ Z.of_nat n) +
phi (snd (p2ibis (S n) p))
 rewrite (Z.mul_comm 2).n:nat
IHn:forall p0 : positive,
(n <= size)%nat ->
Z.pos p0 =
Z.of_N (fst (p2ibis n p0)) * 2 ^ Z.of_nat n + phi (snd (p2ibis n p0))
p:positive
H:(S n <= size)%nat
Z.pos p =
Z.of_N (fst (p2ibis (S n) p)) * (2 ^ Z.of_nat n * 2) +
phi (snd (p2ibis (S n) p))
 assert (n<=size)%nat by omega.n:nat
IHn:forall p0 : positive,
(n <= size)%nat ->
Z.pos p0 =
Z.of_N (fst (p2ibis n p0)) * 2 ^ Z.of_nat n + phi (snd (p2ibis n p0))
p:positive
H:(S n <= size)%nat
H0:(n <= size)%nat
Z.pos p =
Z.of_N (fst (p2ibis (S n) p)) * (2 ^ Z.of_nat n * 2) +
phi (snd (p2ibis (S n) p))
 destruct p; simpl; [ | | auto];
  specialize (IHn p H0);
  generalize (p2ibis_bounded n p);
  destruct (p2ibis n p) as (r,i); simpl in *; intros.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
Z.pos p~1 =
Z.of_N r * (2 ^ Z.of_nat n * 2) +
phi (twice_plus_one i)
n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
Z.pos p~0 =
Z.of_N r * (2 ^ Z.of_nat n * 2) + phi (twice i)

 change (Zpos p~1) with (2*Zpos p + 1)%Z.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
2 * Z.pos p + 1 =
Z.of_N r * (2 ^ Z.of_nat n * 2) +
phi (twice_plus_one i)
n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
Z.pos p~0 =
Z.of_N r * (2 ^ Z.of_nat n * 2) + phi (twice i)
 rewrite phi_twice_plus_one_firstl, Z.succ_double_spec.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
2 * Z.pos p + 1 =
Z.of_N r * (2 ^ Z.of_nat n * 2) + (2 * phi i + 1)
n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
firstl i = D0
n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
Z.pos p~0 =
Z.of_N r * (2 ^ Z.of_nat n * 2) + phi (twice i)
 rewrite IHn; ring.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
firstl i = D0
n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
Z.pos p~0 =
Z.of_N r * (2 ^ Z.of_nat n * 2) + phi (twice i)
 apply (nshiftr_0_firstl n); auto; try omega.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
Z.pos p~0 =
Z.of_N r * (2 ^ Z.of_nat n * 2) + phi (twice i)

 change (Zpos p~0) with (2*Zpos p)%Z.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
2 * Z.pos p =
Z.of_N r * (2 ^ Z.of_nat n * 2) + phi (twice i)
 rewrite phi_twice_firstl.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
2 * Z.pos p =
Z.of_N r * (2 ^ Z.of_nat n * 2) + Z.double (phi i)
n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
firstl i = D0
 change (Z.double (phi i)) with (2*(phi i))%Z.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
2 * Z.pos p =
Z.of_N r * (2 ^ Z.of_nat n * 2) + 2 * phi i
n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
firstl i = D0
 rewrite IHn; ring.n:nat
p:positive
r:N
i:int31
IHn:Z.pos p = Z.of_N r * 2 ^ Z.of_nat n + phi i
H:(S n <= size)%nat
H0:(n <= size)%nat
H1:nshiftr i n = 0%int31
firstl i = D0
 apply (nshiftr_0_firstl n); auto; try omega.
 Qed.

We now prove that this p2ibis is related to phi_inv_positive

 Lemma phi_inv_positive_p2ibis : forall n p, (n<=size)%nat ->
  EqShiftL (size-n) (phi_inv_positive p) (snd (p2ibis n p)).forall (n : nat) (p : positive),
(n <= size)%nat ->
EqShiftL (size - n) (phi_inv_positive p)
  (snd (p2ibis n p))
 Proof.forall (n : nat) (p : positive),
(n <= size)%nat ->
EqShiftL (size - n) (phi_inv_positive p)
  (snd (p2ibis n p))
 induction n.forall p : positive,
(0 <= size)%nat ->
EqShiftL (size - 0) (phi_inv_positive p)
  (snd (p2ibis 0 p))
n:nat
IHn:forall p : positive,
(n <= size)%nat ->
EqShiftL (size - n) (phi_inv_positive p) (snd (p2ibis n p))
forall p : positive,
(S n <= size)%nat ->
EqShiftL (size - S n) (phi_inv_positive p)
  (snd (p2ibis (S n) p))
 intros.p:positive
H:(0 <= size)%nat
EqShiftL (size - 0) (phi_inv_positive p)
  (snd (p2ibis 0 p))
n:nat
IHn:forall p : positive,
(n <= size)%nat ->
EqShiftL (size - n) (phi_inv_positive p) (snd (p2ibis n p))
forall p : positive,
(S n <= size)%nat ->
EqShiftL (size - S n) (phi_inv_positive p)
  (snd (p2ibis (S n) p))
 apply EqShiftL_size; auto.n:nat
IHn:forall p : positive,
(n <= size)%nat ->
EqShiftL (size - n) (phi_inv_positive p) (snd (p2ibis n p))
forall p : positive,
(S n <= size)%nat ->
EqShiftL (size - S n) (phi_inv_positive p)
  (snd (p2ibis (S n) p))
 intros.n:nat
IHn:forall p0 : positive,
(n <= size)%nat ->
EqShiftL (size - n) (phi_inv_positive p0) (snd (p2ibis n p0))
p:positive
H:(S n <= size)%nat
EqShiftL (size - S n) (phi_inv_positive p)
  (snd (p2ibis (S n) p))
 simpl p2ibis; destruct p; [ | | red; auto];
  specialize IHn with p;
  destruct (p2ibis n p); simpl @snd in *; simpl phi_inv_positive;
  rewrite ?EqShiftL_twice_plus_one, ?EqShiftL_twice;
  replace (S (size - S n))%nat with (size - n)%nat by omega;
  apply IHn; omega.
 Qed.

This gives the expected result about phi o phi_inv, at least for the positive case.

 Lemma phi_phi_inv_positive : forall p,
  phi (phi_inv_positive p) = (Zpos p) mod (2^(Z.of_nat size)).forall p : positive,
phi (phi_inv_positive p) =
Z.pos p mod 2 ^ Z.of_nat size
 Proof.forall p : positive,
phi (phi_inv_positive p) =
Z.pos p mod 2 ^ Z.of_nat size
 intros.p:positive
phi (phi_inv_positive p) =
Z.pos p mod 2 ^ Z.of_nat size
 replace (phi_inv_positive p) with (snd (p2ibis size p)).p:positive
phi (snd (p2ibis size p)) =
Z.pos p mod 2 ^ Z.of_nat size
p:positive
snd (p2ibis size p) = phi_inv_positive p
 rewrite (p2ibis_spec size p) by auto.p:positive
phi (snd (p2ibis size p)) =
(Z.of_N (fst (p2ibis size p)) * 2 ^ Z.of_nat size +
 phi (snd (p2ibis size p))) mod 2 ^ Z.of_nat size
p:positive
snd (p2ibis size p) = phi_inv_positive p
 rewrite Z.add_comm, Z_mod_plus.p:positive
phi (snd (p2ibis size p)) =
phi (snd (p2ibis size p)) mod 2 ^ Z.of_nat size
p:positive
2 ^ Z.of_nat size > 0
p:positive
snd (p2ibis size p) = phi_inv_positive p
 symmetry; apply Zmod_small.p:positive
0 <= phi (snd (p2ibis size p)) < 2 ^ Z.of_nat size
p:positive
2 ^ Z.of_nat size > 0
p:positive
snd (p2ibis size p) = phi_inv_positive p
 apply phi_bounded.p:positive
2 ^ Z.of_nat size > 0
p:positive
snd (p2ibis size p) = phi_inv_positive p
 auto with zarith.p:positive
snd (p2ibis size p) = phi_inv_positive p
 symmetry.p:positive
phi_inv_positive p = snd (p2ibis size p)
 rewrite <- EqShiftL_zero.p:positive
EqShiftL 0 (phi_inv_positive p) (snd (p2ibis size p))
 apply (phi_inv_positive_p2ibis size p); auto.
 Qed.

Moreover, p2ibis is also related with p2i and hence with positive_to_int31.

 Lemma double_twice_firstl : forall x, firstl x = D0 ->
  (Twon*x = twice x)%int31.forall x : int31,
firstl x = D0 -> (Twon * x)%int31 = twice x
 Proof.forall x : int31,
firstl x = D0 -> (Twon * x)%int31 = twice x
 intros.x:int31
H:firstl x = D0
(Twon * x)%int31 = twice x
 unfold mul31.x:int31
H:firstl x = D0
phi_inv (phi Twon * phi x) = twice x
 rewrite <- Z.double_spec, <- phi_twice_firstl, phi_inv_phi; auto.
 Qed.

 Lemma double_twice_plus_one_firstl : forall x, firstl x = D0 ->
  (Twon*x+In = twice_plus_one x)%int31.forall x : int31,
firstl x = D0 ->
(Twon * x + In)%int31 = twice_plus_one x
 Proof.forall x : int31,
firstl x = D0 ->
(Twon * x + In)%int31 = twice_plus_one x
 intros.x:int31
H:firstl x = D0
(Twon * x + In)%int31 = twice_plus_one x
 rewrite double_twice_firstl; auto.x:int31
H:firstl x = D0
(twice x + In)%int31 = twice_plus_one x
 unfold add31.x:int31
H:firstl x = D0
phi_inv (phi (twice x) + phi In) = twice_plus_one x
 rewrite phi_twice_firstl, <- Z.succ_double_spec,
   <- phi_twice_plus_one_firstl, phi_inv_phi; auto.
 Qed.

 Lemma p2i_p2ibis : forall n p, (n<=size)%nat ->
  p2i n p = p2ibis n p.forall (n : nat) (p : positive),
(n <= size)%nat -> p2i n p = p2ibis n p
 Proof.forall (n : nat) (p : positive),
(n <= size)%nat -> p2i n p = p2ibis n p
 induction n; simpl; auto; intros.n:nat
IHn:forall p0 : positive, (n <= size)%nat -> p2i n p0 = p2ibis n p0
p:positive
H:(S n <= size)%nat
match p with
| (p0~1)%positive =>
    let (r, i) := p2i n p0 in
    (r, (Twon * i + In)%int31)
| (p0~0)%positive =>
    let (r, i) := p2i n p0 in (r, (Twon * i)%int31)
| 1%positive => (0%N, In)
end =
match p with
| (p0~1)%positive =>
    let (r, i) := p2ibis n p0 in (r, twice_plus_one i)
| (p0~0)%positive =>
    let (r, i) := p2ibis n p0 in (r, twice i)
| 1%positive => (0%N, In)
end
 destruct p; auto; specialize IHn with p;
  generalize (p2ibis_bounded n p);
  rewrite IHn; try omega; destruct (p2ibis n p); simpl; intros;
  f_equal; auto.n:nat
p:positive
n0:N
i:int31
IHn:(n <= size)%nat -> p2i n p = (n0, i)
H:(S n <= size)%nat
H0:nshiftr i n = 0%int31
(Twon * i + In)%int31 = twice_plus_one i
n:nat
p:positive
n0:N
i:int31
IHn:(n <= size)%nat -> p2i n p = (n0, i)
H:(S n <= size)%nat
H0:nshiftr i n = 0%int31
(Twon * i)%int31 = twice i
 apply double_twice_plus_one_firstl.n:nat
p:positive
n0:N
i:int31
IHn:(n <= size)%nat -> p2i n p = (n0, i)
H:(S n <= size)%nat
H0:nshiftr i n = 0%int31
firstl i = D0
n:nat
p:positive
n0:N
i:int31
IHn:(n <= size)%nat -> p2i n p = (n0, i)
H:(S n <= size)%nat
H0:nshiftr i n = 0%int31
(Twon * i)%int31 = twice i
 apply (nshiftr_0_firstl n); auto; omega.n:nat
p:positive
n0:N
i:int31
IHn:(n <= size)%nat -> p2i n p = (n0, i)
H:(S n <= size)%nat
H0:nshiftr i n = 0%int31
(Twon * i)%int31 = twice i
 apply double_twice_firstl.n:nat
p:positive
n0:N
i:int31
IHn:(n <= size)%nat -> p2i n p = (n0, i)
H:(S n <= size)%nat
H0:nshiftr i n = 0%int31
firstl i = D0
 apply (nshiftr_0_firstl n); auto; omega.
 Qed.

 Lemma positive_to_int31_phi_inv_positive : forall p,
   snd (positive_to_int31 p) = phi_inv_positive p.forall p : positive,
snd (positive_to_int31 p) = phi_inv_positive p
 Proof.forall p : positive,
snd (positive_to_int31 p) = phi_inv_positive p
 intros; unfold positive_to_int31.p:positive
snd (p2i size p) = phi_inv_positive p
 rewrite p2i_p2ibis; auto.p:positive
snd (p2ibis size p) = phi_inv_positive p
 symmetry.p:positive
phi_inv_positive p = snd (p2ibis size p)
 rewrite <- EqShiftL_zero.p:positive
EqShiftL 0 (phi_inv_positive p) (snd (p2ibis size p))
 apply (phi_inv_positive_p2ibis size); auto.
 Qed.

 Lemma positive_to_int31_spec : forall p,
    Zpos p = (Z.of_N (fst (positive_to_int31 p)))*2^(Z.of_nat size) +
               phi (snd (positive_to_int31 p)).forall p : positive,
Z.pos p =
Z.of_N (fst (positive_to_int31 p)) * 2 ^ Z.of_nat size +
phi (snd (positive_to_int31 p))
 Proof.forall p : positive,
Z.pos p =
Z.of_N (fst (positive_to_int31 p)) * 2 ^ Z.of_nat size +
phi (snd (positive_to_int31 p))
 unfold positive_to_int31.forall p : positive,
Z.pos p =
Z.of_N (fst (p2i size p)) * 2 ^ Z.of_nat size +
phi (snd (p2i size p))
 intros; rewrite p2i_p2ibis; auto.p:positive
Z.pos p =
Z.of_N (fst (p2ibis size p)) * 2 ^ Z.of_nat size +
phi (snd (p2ibis size p))
 apply p2ibis_spec; auto.
 Qed.

Thanks to the result about phi o phi_inv_positive, we can now establish easily the most general results about phi o twice and so one.

 Lemma phi_twice : forall x,
   phi (twice x) = (Z.double (phi x)) mod 2^(Z.of_nat size).forall x : int31,
phi (twice x) = Z.double (phi x) mod 2 ^ Z.of_nat size
 Proof.forall x : int31,
phi (twice x) = Z.double (phi x) mod 2 ^ Z.of_nat size
 intros.x:int31
phi (twice x) = Z.double (phi x) mod 2 ^ Z.of_nat size
 pattern x at 1; rewrite <- (phi_inv_phi x).x:int31
phi (twice (phi_inv (phi x))) =
Z.double (phi x) mod 2 ^ Z.of_nat size
 rewrite <- phi_inv_double.x:int31
phi (phi_inv (Z.double (phi x))) =
Z.double (phi x) mod 2 ^ Z.of_nat size
 assert (0 <= Z.double (phi x)).x:int31
0 <= Z.double (phi x)
x:int31
H:0 <= Z.double (phi x)
phi (phi_inv (Z.double (phi x))) =
Z.double (phi x) mod 2 ^ Z.of_nat size
  rewrite Z.double_spec; generalize (phi_bounded x); omega.x:int31
H:0 <= Z.double (phi x)
phi (phi_inv (Z.double (phi x))) =
Z.double (phi x) mod 2 ^ Z.of_nat size
 destruct (Z.double (phi x)).x:int31
H:0 <= 0
phi (phi_inv 0) = 0 mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.pos p
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 simpl; auto.x:int31
p:positive
H:0 <= Z.pos p
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 apply phi_phi_inv_positive.x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 compute in H; elim H; auto.
 Qed.

 Lemma phi_twice_plus_one : forall x,
   phi (twice_plus_one x) = (Z.succ_double (phi x)) mod 2^(Z.of_nat size).forall x : int31,
phi (twice_plus_one x) =
Z.succ_double (phi x) mod 2 ^ Z.of_nat size
 Proof.forall x : int31,
phi (twice_plus_one x) =
Z.succ_double (phi x) mod 2 ^ Z.of_nat size
 intros.x:int31
phi (twice_plus_one x) =
Z.succ_double (phi x) mod 2 ^ Z.of_nat size
 pattern x at 1; rewrite <- (phi_inv_phi x).x:int31
phi (twice_plus_one (phi_inv (phi x))) =
Z.succ_double (phi x) mod 2 ^ Z.of_nat size
 rewrite <- phi_inv_double_plus_one.x:int31
phi (phi_inv (Z.succ_double (phi x))) =
Z.succ_double (phi x) mod 2 ^ Z.of_nat size
 assert (0 <= Z.succ_double (phi x)).x:int31
0 <= Z.succ_double (phi x)
x:int31
H:0 <= Z.succ_double (phi x)
phi (phi_inv (Z.succ_double (phi x))) =
Z.succ_double (phi x) mod 2 ^ Z.of_nat size
  rewrite Z.succ_double_spec; generalize (phi_bounded x); omega.x:int31
H:0 <= Z.succ_double (phi x)
phi (phi_inv (Z.succ_double (phi x))) =
Z.succ_double (phi x) mod 2 ^ Z.of_nat size
 destruct (Z.succ_double (phi x)).x:int31
H:0 <= 0
phi (phi_inv 0) = 0 mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.pos p
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 simpl; auto.x:int31
p:positive
H:0 <= Z.pos p
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 apply phi_phi_inv_positive.x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 compute in H; elim H; auto.
 Qed.

 Lemma phi_incr : forall x,
   phi (incr x) = (Z.succ (phi x)) mod 2^(Z.of_nat size).forall x : int31,
phi (incr x) = Z.succ (phi x) mod 2 ^ Z.of_nat size
 Proof.forall x : int31,
phi (incr x) = Z.succ (phi x) mod 2 ^ Z.of_nat size
 intros.x:int31
phi (incr x) = Z.succ (phi x) mod 2 ^ Z.of_nat size
 pattern x at 1; rewrite <- (phi_inv_phi x).x:int31
phi (incr (phi_inv (phi x))) =
Z.succ (phi x) mod 2 ^ Z.of_nat size
 rewrite <- phi_inv_incr.x:int31
phi (phi_inv (Z.succ (phi x))) =
Z.succ (phi x) mod 2 ^ Z.of_nat size
 assert (0 <= Z.succ (phi x)).x:int31
0 <= Z.succ (phi x)
x:int31
H:0 <= Z.succ (phi x)
phi (phi_inv (Z.succ (phi x))) =
Z.succ (phi x) mod 2 ^ Z.of_nat size
  change (Z.succ (phi x)) with ((phi x)+1)%Z;
   generalize (phi_bounded x); omega.x:int31
H:0 <= Z.succ (phi x)
phi (phi_inv (Z.succ (phi x))) =
Z.succ (phi x) mod 2 ^ Z.of_nat size
 destruct (Z.succ (phi x)).x:int31
H:0 <= 0
phi (phi_inv 0) = 0 mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.pos p
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 simpl; auto.x:int31
p:positive
H:0 <= Z.pos p
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 apply phi_phi_inv_positive.x:int31
p:positive
H:0 <= Z.neg p
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 compute in H; elim H; auto.
 Qed.

With the previous results, we can deal with phi o phi_inv even in the negative case

 Lemma phi_phi_inv_negative :
  forall p, phi (incr (complement_negative p)) = (Zneg p) mod 2^(Z.of_nat size).forall p : positive,
phi (incr (complement_negative p)) =
Z.neg p mod 2 ^ Z.of_nat size
 Proof.forall p : positive,
phi (incr (complement_negative p)) =
Z.neg p mod 2 ^ Z.of_nat size
 induction p.p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~1)) =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size

 simpl complement_negative.p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (twice (complement_negative p))) =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 rewrite phi_incr in IHp.p:positive
IHp:Z.succ (phi (complement_negative p)) mod 2 ^ Z.of_nat size =
Z.neg p mod 2 ^ Z.of_nat size
phi (incr (twice (complement_negative p))) =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 rewrite incr_twice, phi_twice_plus_one.p:positive
IHp:Z.succ (phi (complement_negative p)) mod 2 ^ Z.of_nat size =
Z.neg p mod 2 ^ Z.of_nat size
Z.succ_double (phi (complement_negative p))
mod 2 ^ Z.of_nat size =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 remember (phi (complement_negative p)) as q.p:positive
q:Z
Heqq:q = phi (complement_negative p)
IHp:Z.succ q mod 2 ^ Z.of_nat size =
Z.neg p mod 2 ^ Z.of_nat size
Z.succ_double q mod 2 ^ Z.of_nat size =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) =
Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 rewrite Z.succ_double_spec.p:positive
q:Z
Heqq:q = phi (complement_negative p)
IHp:Z.succ q mod 2 ^ Z.of_nat size =
Z.neg p mod 2 ^ Z.of_nat size
(2 * q + 1) mod 2 ^ Z.of_nat size =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) =
Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 replace (2*q+1) with (2*(Z.succ q)-1) by omega.p:positive
q:Z
Heqq:q = phi (complement_negative p)
IHp:Z.succ q mod 2 ^ Z.of_nat size =
Z.neg p mod 2 ^ Z.of_nat size
(2 * Z.succ q - 1) mod 2 ^ Z.of_nat size =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) =
Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 rewrite <- Zminus_mod_idemp_l, <- Zmult_mod_idemp_r, IHp.p:positive
q:Z
Heqq:q = phi (complement_negative p)
IHp:Z.succ q mod 2 ^ Z.of_nat size =
Z.neg p mod 2 ^ Z.of_nat size
((2 * (Z.neg p mod 2 ^ Z.of_nat size))
 mod 2 ^ Z.of_nat size - 1) mod 2 ^ Z.of_nat size =
Z.neg p~1 mod 2 ^ Z.of_nat size
p:positive
IHp:phi (incr (complement_negative p)) =
Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 rewrite Zmult_mod_idemp_r, Zminus_mod_idemp_l; auto with zarith.p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (complement_negative p~0)) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size

 simpl complement_negative.p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
phi (incr (twice_plus_one (complement_negative p))) =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 rewrite incr_twice_plus_one, phi_twice.p:positive
IHp:phi (incr (complement_negative p)) = Z.neg p mod 2 ^ Z.of_nat size
Z.double (phi (incr (complement_negative p)))
mod 2 ^ Z.of_nat size =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 remember (phi (incr (complement_negative p))) as q.p:positive
q:Z
Heqq:q = phi (incr (complement_negative p))
IHp:q = Z.neg p mod 2 ^ Z.of_nat size
Z.double q mod 2 ^ Z.of_nat size =
Z.neg p~0 mod 2 ^ Z.of_nat size
phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size
 rewrite Z.double_spec, IHp, Zmult_mod_idemp_r; auto with zarith.phi (incr (complement_negative 1)) =
-1 mod 2 ^ Z.of_nat size

 simpl; auto.
 Qed.

 Lemma phi_phi_inv :
  forall z, phi (phi_inv z) = z mod 2 ^ (Z.of_nat size).forall z : Z,
phi (phi_inv z) = z mod 2 ^ Z.of_nat size
 Proof.forall z : Z,
phi (phi_inv z) = z mod 2 ^ Z.of_nat size
 destruct z.phi (phi_inv 0) = 0 mod 2 ^ Z.of_nat size
p:positive
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
p:positive
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 simpl; auto.p:positive
phi (phi_inv (Z.pos p)) =
Z.pos p mod 2 ^ Z.of_nat size
p:positive
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 apply phi_phi_inv_positive.p:positive
phi (phi_inv (Z.neg p)) =
Z.neg p mod 2 ^ Z.of_nat size
 apply phi_phi_inv_negative.
 Qed.

End Basics.

Instance int31_ops : ZnZ.Ops int31 :=
{
 digits      := 31%positive; (* number of digits *)
 zdigits     := 31; (* number of digits *)
 to_Z        := phi; (* conversion to Z *)
 of_pos      := positive_to_int31; (* positive -> N*int31 :  p => N,i
                                      where p = N*2^31+phi i *)
 head0       := head031;  (* number of head 0 *)
 tail0       := tail031;  (* number of tail 0 *)
 zero        := 0;
 one         := 1;
 minus_one   := Tn; (* 2^31 - 1 *)
 compare     := compare31;
 eq0         := fun i => match i ?= 0 with Eq => true | _ => false end;
 opp_c       := fun i => 0 -c i;
 opp         := opp31;
 opp_carry   := fun i => 0-i-1;
 succ_c      := fun i => i +c 1;
 add_c       := add31c;
 add_carry_c := add31carryc;
 succ        := fun i => i + 1;
 add         := add31;
 add_carry   := fun i j => i + j + 1;
 pred_c      := fun i => i -c 1;
 sub_c       := sub31c;
 sub_carry_c := sub31carryc;
 pred        := fun i => i - 1;
 sub         := sub31;
 sub_carry   := fun i j => i - j - 1;
 mul_c       := mul31c;
 mul         := mul31;
 square_c    := fun x => x *c x;
 div21       := div3121;
 div_gt      := div31; (* this is supposed to be the special case of
                         division a/b where a > b *)
 div         := div31;
 modulo_gt   := fun i j => let (_,r) := i/j in r;
 modulo      := fun i j => let (_,r) := i/j in r;
 gcd_gt      := gcd31;
 gcd         := gcd31;
 add_mul_div := addmuldiv31;
 pos_mod     := (* modulo 2^p *)
  fun p i =>
  match p ?= 31 with
    | Lt => addmuldiv31 p 0 (addmuldiv31 (31-p) i 0)
    | _ => i
  end;
 is_even      :=
  fun i => let (_,r) := i/2 in
  match r ?= 0 with Eq => true | _ => false end;
 sqrt2       := sqrt312;
 sqrt        := sqrt31;
 lor         := lor31;
 land        := land31;
 lxor        := lxor31
}.

Section Int31_Specs.

 Local Open Scope Z_scope.

 Notation "[| x |]" := (phi x)  (at level 0, x at level 99).

 Notation wB := (2 ^ (Z.of_nat size)).

 Lemma wB_pos : wB > 0.wB > 0
 Proof.wB > 0
  auto with zarith.
 Qed.

 Notation "[+| c |]" :=
   (interp_carry 1 wB phi c)  (at level 0, c at level 99).

 Notation "[-| c |]" :=
   (interp_carry (-1) wB phi c)  (at level 0, c at level 99).

 Notation "[|| x ||]" :=
   (zn2z_to_Z wB phi x)  (at level 0, x at level 99).

 Lemma spec_zdigits : [| 31 |] = 31.[|31|] = 31
 Proof.[|31|] = 31
  reflexivity.
 Qed.

 Lemma spec_more_than_1_digit: 1 < 31.1 < 31
 Proof.1 < 31
  auto with zarith.
 Qed.

 Lemma spec_0   : [| 0 |] = 0.[|0|] = 0
 Proof.[|0|] = 0
  reflexivity.
 Qed.

 Lemma spec_1   : [| 1 |] = 1.[|1|] = 1
 Proof.[|1|] = 1
  reflexivity.
 Qed.

 Lemma spec_m1 : [| Tn |] = wB - 1.[|Tn|] = wB - 1
 Proof.[|Tn|] = wB - 1
  reflexivity.
 Qed.

 Lemma spec_compare : forall x y,
   (x ?= y)%int31 = ([|x|] ?= [|y|]).forall x y : int31, (x ?= y)%int31 = ([|x|] ?= [|y|])
 Proof.forall x y : int31, (x ?= y)%int31 = ([|x|] ?= [|y|]) reflexivity. Qed.

Addition

 Lemma spec_add_c  : forall x y, [+|add31c x y|] = [|x|] + [|y|].forall x y : int31, [+|x +c y|] = [|x|] + [|y|]
 Proof.forall x y : int31, [+|x +c y|] = [|x|] + [|y|]
 intros; unfold add31c, add31, interp_carry; rewrite phi_phi_inv.x, y:int31
match
  match ([|x|] + [|y|]) mod wB ?= [|x|] + [|y|] with
  | Eq => C0 (phi_inv ([|x|] + [|y|]))
  | _ => C1 (phi_inv ([|x|] + [|y|]))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = [|x|] + [|y|]
 generalize (phi_bounded x)(phi_bounded y); intros.x, y:int31
H:0 <= [|x|] < wB
H0:0 <= [|y|] < wB
match
  match ([|x|] + [|y|]) mod wB ?= [|x|] + [|y|] with
  | Eq => C0 (phi_inv ([|x|] + [|y|]))
  | _ => C1 (phi_inv ([|x|] + [|y|]))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = [|x|] + [|y|]
 set (X:=[|x|]) in *; set (Y:=[|y|]) in *; clearbody X Y.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y

 assert ((X+Y) mod wB ?= X+Y <> Eq -> [+|C1 (phi_inv (X+Y))|] = X+Y).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y
  unfold interp_carry; rewrite phi_phi_inv, Z.compare_eq_iff; intros.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y) mod wB <> X + Y
1 * wB + (X + Y) mod wB = X + Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y
  destruct (Z_lt_le_dec (X+Y) wB).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y) mod wB <> X + Y
l:X + Y < wB
1 * wB + (X + Y) mod wB = X + Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y) mod wB <> X + Y
l:wB <= X + Y
1 * wB + (X + Y) mod wB = X + Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y
  contradict H1; auto using Zmod_small with zarith.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y) mod wB <> X + Y
l:wB <= X + Y
1 * wB + (X + Y) mod wB = X + Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y
  rewrite <- (Z_mod_plus_full (X+Y) (-1) wB).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y) mod wB <> X + Y
l:wB <= X + Y
1 * wB + (X + Y + -1 * wB) mod wB = X + Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y
  rewrite Zmod_small; lia.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y

 generalize (Z.compare_eq ((X+Y) mod wB) (X+Y)); intros Heq.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y) mod wB ?= X + Y) <> Eq ->
[+|C1 (phi_inv (X + Y))|] = X + Y
Heq:((X + Y) mod wB ?= X + Y) = Eq -> (X + Y) mod wB = X + Y
match
  match (X + Y) mod wB ?= X + Y with
  | Eq => C0 (phi_inv (X + Y))
  | _ => C1 (phi_inv (X + Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y
 destruct Z.compare; intros;
  [ rewrite phi_phi_inv; auto | now apply H1 | now apply H1].
 Qed.

 Lemma spec_succ_c : forall x, [+|add31c x 1|] = [|x|] + 1.forall x : int31, [+|x +c 1|] = [|x|] + 1
 Proof.forall x : int31, [+|x +c 1|] = [|x|] + 1
 intros; apply spec_add_c.
 Qed.

 Lemma spec_add_carry_c : forall x y, [+|add31carryc x y|] = [|x|] + [|y|] + 1.forall x y : int31,
[+|add31carryc x y|] = [|x|] + [|y|] + 1
 Proof.forall x y : int31,
[+|add31carryc x y|] = [|x|] + [|y|] + 1
 intros.x, y:int31
[+|add31carryc x y|] = [|x|] + [|y|] + 1
 unfold add31carryc, interp_carry; rewrite phi_phi_inv.x, y:int31
match
  match
    ([|x|] + [|y|] + 1) mod wB ?= [|x|] + [|y|] + 1
  with
  | Eq => C0 (phi_inv ([|x|] + [|y|] + 1))
  | _ => C1 (phi_inv ([|x|] + [|y|] + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = [|x|] + [|y|] + 1
 generalize (phi_bounded x)(phi_bounded y); intros.x, y:int31
H:0 <= [|x|] < wB
H0:0 <= [|y|] < wB
match
  match
    ([|x|] + [|y|] + 1) mod wB ?= [|x|] + [|y|] + 1
  with
  | Eq => C0 (phi_inv ([|x|] + [|y|] + 1))
  | _ => C1 (phi_inv ([|x|] + [|y|] + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = [|x|] + [|y|] + 1
 set (X:=[|x|]) in *; set (Y:=[|y|]) in *; clearbody X Y.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1

 assert ((X+Y+1) mod wB ?= X+Y+1 <> Eq -> [+|C1 (phi_inv (X+Y+1))|] = X+Y+1).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1
  unfold interp_carry; rewrite phi_phi_inv, Z.compare_eq_iff; intros.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y + 1) mod wB <> X + Y + 1
1 * wB + (X + Y + 1) mod wB = X + Y + 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1
  destruct (Z_lt_le_dec (X+Y+1) wB).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y + 1) mod wB <> X + Y + 1
l:X + Y + 1 < wB
1 * wB + (X + Y + 1) mod wB = X + Y + 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y + 1) mod wB <> X + Y + 1
l:wB <= X + Y + 1
1 * wB + (X + Y + 1) mod wB = X + Y + 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1
  contradict H1; auto using Zmod_small with zarith.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y + 1) mod wB <> X + Y + 1
l:wB <= X + Y + 1
1 * wB + (X + Y + 1) mod wB = X + Y + 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1
  rewrite <- (Z_mod_plus_full (X+Y+1) (-1) wB).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X + Y + 1) mod wB <> X + Y + 1
l:wB <= X + Y + 1
1 * wB + (X + Y + 1 + -1 * wB) mod wB = X + Y + 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1
  rewrite Zmod_small; lia.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1

 generalize (Z.compare_eq ((X+Y+1) mod wB) (X+Y+1)); intros Heq.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X + Y + 1) mod wB ?= X + Y + 1) <> Eq ->
[+|C1 (phi_inv (X + Y + 1))|] = X + Y + 1
Heq:((X + Y + 1) mod wB ?= X + Y + 1) = Eq -> (X + Y + 1) mod wB = X + Y + 1
match
  match (X + Y + 1) mod wB ?= X + Y + 1 with
  | Eq => C0 (phi_inv (X + Y + 1))
  | _ => C1 (phi_inv (X + Y + 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => 1 * wB + [|x0|]
end = X + Y + 1
 destruct Z.compare; intros;
  [ rewrite phi_phi_inv; auto | now apply H1 | now apply H1].
 Qed.

 Lemma spec_add : forall x y, [|x+y|] = ([|x|] + [|y|]) mod wB.forall x y : int31, [|x + y|] = ([|x|] + [|y|]) mod wB
 Proof.forall x y : int31, [|x + y|] = ([|x|] + [|y|]) mod wB
 intros; apply phi_phi_inv.
 Qed.

 Lemma spec_add_carry :
         forall x y, [|x+y+1|] = ([|x|] + [|y|] + 1) mod wB.forall x y : int31,
[|x + y + 1|] = ([|x|] + [|y|] + 1) mod wB
 Proof.forall x y : int31,
[|x + y + 1|] = ([|x|] + [|y|] + 1) mod wB
 unfold add31; intros.x, y:int31
[|phi_inv ([|phi_inv ([|x|] + [|y|])|] + [|1|])|] =
([|x|] + [|y|] + 1) mod wB
 repeat rewrite phi_phi_inv.x, y:int31
(([|x|] + [|y|]) mod wB + [|1|]) mod wB =
([|x|] + [|y|] + 1) mod wB
 apply Zplus_mod_idemp_l.
 Qed.

 Lemma spec_succ : forall x, [|x+1|] = ([|x|] + 1) mod wB.forall x : int31, [|x + 1|] = ([|x|] + 1) mod wB
 Proof.forall x : int31, [|x + 1|] = ([|x|] + 1) mod wB
 intros; rewrite <- spec_1; apply spec_add.
 Qed.

Subtraction

 Lemma spec_sub_c : forall x y, [-|sub31c x y|] = [|x|] - [|y|].forall x y : int31, [-|x -c y|] = [|x|] - [|y|]
 Proof.forall x y : int31, [-|x -c y|] = [|x|] - [|y|]
 unfold sub31c, sub31, interp_carry; intros.x, y:int31
match
  match
    [|phi_inv ([|x|] - [|y|])|] ?= [|x|] - [|y|]
  with
  | Eq => C0 (phi_inv ([|x|] - [|y|]))
  | _ => C1 (phi_inv ([|x|] - [|y|]))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = [|x|] - [|y|]
 rewrite phi_phi_inv.x, y:int31
match
  match ([|x|] - [|y|]) mod wB ?= [|x|] - [|y|] with
  | Eq => C0 (phi_inv ([|x|] - [|y|]))
  | _ => C1 (phi_inv ([|x|] - [|y|]))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = [|x|] - [|y|]
 generalize (phi_bounded x)(phi_bounded y); intros.x, y:int31
H:0 <= [|x|] < wB
H0:0 <= [|y|] < wB
match
  match ([|x|] - [|y|]) mod wB ?= [|x|] - [|y|] with
  | Eq => C0 (phi_inv ([|x|] - [|y|]))
  | _ => C1 (phi_inv ([|x|] - [|y|]))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = [|x|] - [|y|]
 set (X:=[|x|]) in *; set (Y:=[|y|]) in *; clearbody X Y.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y

 assert ((X-Y) mod wB ?= X-Y <> Eq -> [-|C1 (phi_inv (X-Y))|] = X-Y).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y
  unfold interp_carry; rewrite phi_phi_inv, Z.compare_eq_iff; intros.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y) mod wB <> X - Y
-1 * wB + (X - Y) mod wB = X - Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y
  destruct (Z_lt_le_dec (X-Y) 0).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y) mod wB <> X - Y
l:X - Y < 0
-1 * wB + (X - Y) mod wB = X - Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y) mod wB <> X - Y
l:0 <= X - Y
-1 * wB + (X - Y) mod wB = X - Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y
  rewrite <- (Z_mod_plus_full (X-Y) 1 wB).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y) mod wB <> X - Y
l:X - Y < 0
-1 * wB + (X - Y + 1 * wB) mod wB = X - Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y) mod wB <> X - Y
l:0 <= X - Y
-1 * wB + (X - Y) mod wB = X - Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y
  rewrite Zmod_small; lia.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y) mod wB <> X - Y
l:0 <= X - Y
-1 * wB + (X - Y) mod wB = X - Y
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y
  contradict H1; apply Zmod_small; lia.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y

 generalize (Z.compare_eq ((X-Y) mod wB) (X-Y)); intros Heq.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y) mod wB ?= X - Y) <> Eq ->
[-|C1 (phi_inv (X - Y))|] = X - Y
Heq:((X - Y) mod wB ?= X - Y) = Eq -> (X - Y) mod wB = X - Y
match
  match (X - Y) mod wB ?= X - Y with
  | Eq => C0 (phi_inv (X - Y))
  | _ => C1 (phi_inv (X - Y))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y
 destruct Z.compare; intros;
  [ rewrite phi_phi_inv; auto | now apply H1 | now apply H1].
 Qed.

 Lemma spec_sub_carry_c : forall x y, [-|sub31carryc x y|] = [|x|] - [|y|] - 1.forall x y : int31,
[-|sub31carryc x y|] = [|x|] - [|y|] - 1
 Proof.forall x y : int31,
[-|sub31carryc x y|] = [|x|] - [|y|] - 1
 unfold sub31carryc, sub31, interp_carry; intros.x, y:int31
match
  match
    [|phi_inv ([|x|] - [|y|] - 1)|]
    ?= [|x|] - [|y|] - 1
  with
  | Eq => C0 (phi_inv ([|x|] - [|y|] - 1))
  | _ => C1 (phi_inv ([|x|] - [|y|] - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = [|x|] - [|y|] - 1
 rewrite phi_phi_inv.x, y:int31
match
  match
    ([|x|] - [|y|] - 1) mod wB ?= [|x|] - [|y|] - 1
  with
  | Eq => C0 (phi_inv ([|x|] - [|y|] - 1))
  | _ => C1 (phi_inv ([|x|] - [|y|] - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = [|x|] - [|y|] - 1
 generalize (phi_bounded x)(phi_bounded y); intros.x, y:int31
H:0 <= [|x|] < wB
H0:0 <= [|y|] < wB
match
  match
    ([|x|] - [|y|] - 1) mod wB ?= [|x|] - [|y|] - 1
  with
  | Eq => C0 (phi_inv ([|x|] - [|y|] - 1))
  | _ => C1 (phi_inv ([|x|] - [|y|] - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = [|x|] - [|y|] - 1
 set (X:=[|x|]) in *; set (Y:=[|y|]) in *; clearbody X Y.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1

 assert ((X-Y-1) mod wB ?= X-Y-1 <> Eq -> [-|C1 (phi_inv (X-Y-1))|] = X-Y-1).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1
  unfold interp_carry; rewrite phi_phi_inv, Z.compare_eq_iff; intros.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y - 1) mod wB <> X - Y - 1
-1 * wB + (X - Y - 1) mod wB = X - Y - 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1
  destruct (Z_lt_le_dec (X-Y-1) 0).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y - 1) mod wB <> X - Y - 1
l:X - Y - 1 < 0
-1 * wB + (X - Y - 1) mod wB = X - Y - 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y - 1) mod wB <> X - Y - 1
l:0 <= X - Y - 1
-1 * wB + (X - Y - 1) mod wB = X - Y - 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1
  rewrite <- (Z_mod_plus_full (X-Y-1) 1 wB).x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y - 1) mod wB <> X - Y - 1
l:X - Y - 1 < 0
-1 * wB + (X - Y - 1 + 1 * wB) mod wB = X - Y - 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y - 1) mod wB <> X - Y - 1
l:0 <= X - Y - 1
-1 * wB + (X - Y - 1) mod wB = X - Y - 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1
  rewrite Zmod_small; lia.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:(X - Y - 1) mod wB <> X - Y - 1
l:0 <= X - Y - 1
-1 * wB + (X - Y - 1) mod wB = X - Y - 1
x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1
  contradict H1; apply Zmod_small; lia.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1

 generalize (Z.compare_eq ((X-Y-1) mod wB) (X-Y-1)); intros Heq.x, y:int31
X:Z
H:0 <= X < wB
Y:Z
H0:0 <= Y < wB
H1:((X - Y - 1) mod wB ?= X - Y - 1) <> Eq ->
[-|C1 (phi_inv (X - Y - 1))|] = X - Y - 1
Heq:((X - Y - 1) mod wB ?= X - Y - 1) = Eq -> (X - Y - 1) mod wB = X - Y - 1
match
  match (X - Y - 1) mod wB ?= X - Y - 1 with
  | Eq => C0 (phi_inv (X - Y - 1))
  | _ => C1 (phi_inv (X - Y - 1))
  end
with
| C0 x0 => [|x0|]
| C1 x0 => -1 * wB + [|x0|]
end = X - Y - 1
 destruct Z.compare; intros;
  [ rewrite phi_phi_inv; auto | now apply H1 | now apply H1].
 Qed.

 Lemma spec_sub : forall x y, [|x-y|] = ([|x|] - [|y|]) mod wB.forall x y : int31, [|x - y|] = ([|x|] - [|y|]) mod wB
 Proof.forall x y : int31, [|x - y|] = ([|x|] - [|y|]) mod wB
 intros; apply phi_phi_inv.
 Qed.

 Lemma spec_sub_carry :
   forall x y, [|x-y-1|] = ([|x|] - [|y|] - 1) mod wB.forall x y : int31,
[|x - y - 1|] = ([|x|] - [|y|] - 1) mod wB
 Proof.forall x y : int31,
[|x - y - 1|] = ([|x|] - [|y|] - 1) mod wB
 unfold sub31; intros.x, y:int31
[|phi_inv ([|phi_inv ([|x|] - [|y|])|] - [|1|])|] =
([|x|] - [|y|] - 1) mod wB
 repeat rewrite phi_phi_inv.x, y:int31
(([|x|] - [|y|]) mod wB - [|1|]) mod wB =
([|x|] - [|y|] - 1) mod wB
 apply Zminus_mod_idemp_l.
 Qed.

 Lemma spec_opp_c : forall x, [-|sub31c 0 x|] = -[|x|].forall x : int31, [-|0 -c x|] = - [|x|]
 Proof.forall x : int31, [-|0 -c x|] = - [|x|]
 intros; apply spec_sub_c.
 Qed.

 Lemma spec_opp : forall x, [|0 - x|] = (-[|x|]) mod wB.forall x : int31, [|0 - x|] = - [|x|] mod wB
 Proof.forall x : int31, [|0 - x|] = - [|x|] mod wB
 intros; apply phi_phi_inv.
 Qed.

 Lemma spec_opp_carry : forall x, [|0 - x - 1|] = wB - [|x|] - 1.forall x : int31, [|0 - x - 1|] = wB - [|x|] - 1
 Proof.forall x : int31, [|0 - x - 1|] = wB - [|x|] - 1
 unfold sub31; intros.x:int31
[|phi_inv ([|phi_inv ([|0|] - [|x|])|] - [|1|])|] =
wB - [|x|] - 1
 repeat rewrite phi_phi_inv.x:int31
(([|0|] - [|x|]) mod wB - [|1|]) mod wB =
wB - [|x|] - 1
 change [|1|] with 1; change [|0|] with 0.x:int31
((0 - [|x|]) mod wB - 1) mod wB = wB - [|x|] - 1
 rewrite <- (Z_mod_plus_full (0-[|x|]) 1 wB).x:int31
((0 - [|x|] + 1 * wB) mod wB - 1) mod wB =
wB - [|x|] - 1
 rewrite Zminus_mod_idemp_l.x:int31
(0 - [|x|] + 1 * wB - 1) mod wB = wB - [|x|] - 1
 rewrite Zmod_small; generalize (phi_bounded x); lia.
 Qed.

 Lemma spec_pred_c : forall x, [-|sub31c x 1|] = [|x|] - 1.forall x : int31, [-|x -c 1|] = [|x|] - 1
 Proof.forall x : int31, [-|x -c 1|] = [|x|] - 1
 intros; apply spec_sub_c.
 Qed.

 Lemma spec_pred : forall x, [|x-1|] = ([|x|] - 1) mod wB.forall x : int31, [|x - 1|] = ([|x|] - 1) mod wB
 Proof.forall x : int31, [|x - 1|] = ([|x|] - 1) mod wB
 intros; apply spec_sub.
 Qed.

Multiplication

 Lemma phi2_phi_inv2 : forall x, [||phi_inv2 x||] = x mod (wB^2).forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
 Proof.forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
 assert (forall z, (z / wB) mod wB * wB + z mod wB = z mod wB ^ 2).forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  intros.z:Z
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  assert ((z/wB) mod wB = z/wB - (z/wB/wB)*wB).z:Z
(z / wB) mod wB = z / wB - z / wB / wB * wB
z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
   rewrite (Z_div_mod_eq (z/wB) wB wB_pos) at 2; ring.z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  assert (z mod wB = z - (z/wB)*wB).z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
z mod wB = z - z / wB * wB
z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
H0:z mod wB = z - z / wB * wB
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
   rewrite (Z_div_mod_eq z wB wB_pos) at 2; ring.z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
H0:z mod wB = z - z / wB * wB
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  rewrite H.z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
H0:z mod wB = z - z / wB * wB
(z / wB - z / wB / wB * wB) * wB + z mod wB =
z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  rewrite H0 at 1.z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
H0:z mod wB = z - z / wB * wB
(z / wB - z / wB / wB * wB) * wB + (z - z / wB * wB) =
z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  ring_simplify.z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
H0:z mod wB = z - z / wB * wB
- (z / wB / wB) * wB ^ 2 + z = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  rewrite Zdiv_Zdiv; auto with zarith.z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
H0:z mod wB = z - z / wB * wB
- (z / (wB * wB)) * wB ^ 2 + z = z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  rewrite (Z_div_mod_eq z (wB*wB)) at 2; auto with zarith.z:Z
H:(z / wB) mod wB = z / wB - z / wB / wB * wB
H0:z mod wB = z - z / wB * wB
- (z / (wB * wB)) * wB ^ 2 +
(wB * wB * (z / (wB * wB)) + z mod (wB * wB)) =
z mod wB ^ 2
H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2
  change (wB*wB) with (wB^2); ring.H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z, [||phi_inv2 x||] = x mod wB ^ 2

 unfold phi_inv2.H:forall z : Z,
(z / wB) mod wB * wB + z mod wB = z mod wB ^ 2
forall x : Z,
[||match x with
   | 0 => W0
   | _ => WW (phi_inv (x / base)) (phi_inv x)
   end||] = x mod wB ^ 2
 destruct x; unfold zn2z_to_Z; rewrite ?phi_phi_inv;
  change base with wB; auto.
 Qed.

 Lemma spec_mul_c : forall x y, [|| mul31c x y ||] = [|x|] * [|y|].forall x y : int31, [||x *c y||] = [|x|] * [|y|]
 Proof.forall x y : int31, [||x *c y||] = [|x|] * [|y|]
 unfold mul31c; intros.x, y:int31
[||phi_inv2 ([|x|] * [|y|])||] = [|x|] * [|y|]
 rewrite phi2_phi_inv2.x, y:int31
([|x|] * [|y|]) mod wB ^ 2 = [|x|] * [|y|]
 apply Zmod_small.x, y:int31
0 <= [|x|] * [|y|] < wB ^ 2
 generalize (phi_bounded x)(phi_bounded y); intros.x, y:int31
H:0 <= [|x|] < wB
H0:0 <= [|y|] < wB
0 <= [|x|] * [|y|] < wB ^ 2
 change (wB^2) with (wB * wB).x, y:int31
H:0 <= [|x|] < wB
H0:0 <= [|y|] < wB
0 <= [|x|] * [|y|] < wB * wB
 auto using Z.mul_lt_mono_nonneg with zarith.
 Qed.

 Lemma spec_mul : forall x y, [|x*y|] = ([|x|] * [|y|]) mod wB.forall x y : int31, [|x * y|] = ([|x|] * [|y|]) mod wB
 Proof.forall x y : int31, [|x * y|] = ([|x|] * [|y|]) mod wB
 intros; apply phi_phi_inv.
 Qed.

 Lemma spec_square_c : forall x, [|| mul31c x x ||] = [|x|] * [|x|].forall x : int31, [||x *c x||] = [|x|] * [|x|]
 Proof.forall x : int31, [||x *c x||] = [|x|] * [|x|]
 intros; apply spec_mul_c.
 Qed.

Division

 Lemma spec_div21 : forall a1 a2 b,
      wB/2 <= [|b|] ->
      [|a1|] < [|b|] ->
      let (q,r) := div3121 a1 a2 b in
      [|a1|] *wB+ [|a2|] = [|q|] * [|b|] + [|r|] /\
      0 <= [|r|] < [|b|].forall a1 a2 b : int31,
wB / 2 <= [|b|] ->
[|a1|] < [|b|] ->
let (q, r) := div3121 a1 a2 b in
[|a1|] * wB + [|a2|] = [|q|] * [|b|] + [|r|] /\
0 <= [|r|] < [|b|]
 Proof.forall a1 a2 b : int31,
wB / 2 <= [|b|] ->
[|a1|] < [|b|] ->
let (q, r) := div3121 a1 a2 b in
[|a1|] * wB + [|a2|] = [|q|] * [|b|] + [|r|] /\
0 <= [|r|] < [|b|]
 unfold div3121; intros.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
let (q, r) :=
  let (q, r) := Z.div_eucl (phi2 a1 a2) [|b|] in
  (phi_inv q, phi_inv r) in
[|a1|] * wB + [|a2|] = [|q|] * [|b|] + [|r|] /\
0 <= [|r|] < [|b|]
 generalize (phi_bounded a1)(phi_bounded a2)(phi_bounded b); intros.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
let (q, r) :=
  let (q, r) := Z.div_eucl (phi2 a1 a2) [|b|] in
  (phi_inv q, phi_inv r) in
[|a1|] * wB + [|a2|] = [|q|] * [|b|] + [|r|] /\
0 <= [|r|] < [|b|]
 assert ([|b|]>0) by (auto with zarith).a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
let (q, r) :=
  let (q, r) := Z.div_eucl (phi2 a1 a2) [|b|] in
  (phi_inv q, phi_inv r) in
[|a1|] * wB + [|a2|] = [|q|] * [|b|] + [|r|] /\
0 <= [|r|] < [|b|]
 generalize (Z_div_mod (phi2 a1 a2) [|b|] H4) (Z_div_pos (phi2 a1 a2) [|b|] H4).a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
(let (q, r) := Z.div_eucl (phi2 a1 a2) [|b|] in
 phi2 a1 a2 = [|b|] * q + r /\ 0 <= r < [|b|]) ->
(0 <= phi2 a1 a2 -> 0 <= phi2 a1 a2 / [|b|]) ->
let (q, r) :=
  let (q, r) := Z.div_eucl (phi2 a1 a2) [|b|] in
  (phi_inv q, phi_inv r) in
[|a1|] * wB + [|a2|] = [|q|] * [|b|] + [|r|] /\
0 <= [|r|] < [|b|]
 unfold Z.div; destruct (Z.div_eucl (phi2 a1 a2) [|b|]).a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
phi2 a1 a2 = [|b|] * z + z0 /\ 0 <= z0 < [|b|] ->
(0 <= phi2 a1 a2 -> 0 <= z) ->
[|a1|] * wB + [|a2|] =
[|phi_inv z|] * [|b|] + [|phi_inv z0|] /\
0 <= [|phi_inv z0|] < [|b|]
 rewrite ?phi_phi_inv.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
phi2 a1 a2 = [|b|] * z + z0 /\ 0 <= z0 < [|b|] ->
(0 <= phi2 a1 a2 -> 0 <= z) ->
[|a1|] * wB + [|a2|] = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 destruct 1; intros.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:phi2 a1 a2 = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= phi2 a1 a2 -> 0 <= z
[|a1|] * wB + [|a2|] = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 unfold phi2 in *.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * base + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
[|a1|] * wB + [|a2|] = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 change base with wB; change base with wB in H5.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
[|a1|] * wB + [|a2|] = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 change (Z.pow_pos 2 31) with wB; change (Z.pow_pos 2 31) with wB in H.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
[|a1|] * wB + [|a2|] = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 rewrite H5, Z.mul_comm.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
z * [|b|] + z0 = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 replace (z0 mod wB) with z0 by (symmetry; apply Zmod_small; omega).a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
z * [|b|] + z0 = z mod wB * [|b|] + z0 /\
0 <= z0 < [|b|]
 replace (z mod wB) with z; auto with zarith.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
z = z mod wB
  symmetry; apply Zmod_small.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
0 <= z < wB
  split.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
0 <= z
a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
z < wB
  apply H7; change base with wB; auto with zarith.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
z < wB
  apply Z.mul_lt_mono_pos_r with [|b|]; [omega| ].a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
z * [|b|] < wB * [|b|]
  rewrite Z.mul_comm.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
[|b|] * z < wB * [|b|]
  apply Z.le_lt_trans with ([|b|]*z+z0); [omega| ].a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
[|b|] * z + z0 < wB * [|b|]
  rewrite <- H5.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
[|a1|] * wB + [|a2|] < wB * [|b|]
  apply Z.le_lt_trans with ([|a1|]*wB+(wB-1)); [omega | ].a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
[|a1|] * wB + (wB - 1) < wB * [|b|]
  replace ([|a1|]*wB+(wB-1)) with (wB*([|a1|]+1)-1) by ring.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
wB * ([|a1|] + 1) - 1 < wB * [|b|]
  assert (wB*([|a1|]+1) <= wB*[|b|]); try omega.a1, a2, b:int31
H:wB / 2 <= [|b|]
H0:[|a1|] < [|b|]
H1:0 <= [|a1|] < wB
H2:0 <= [|a2|] < wB
H3:0 <= [|b|] < wB
H4:[|b|] > 0
z, z0:Z
H5:[|a1|] * wB + [|a2|] = [|b|] * z + z0
H6:0 <= z0 < [|b|]
H7:0 <= [|a1|] * base + [|a2|] -> 0 <= z
wB * ([|a1|] + 1) <= wB * [|b|]
  apply Z.mul_le_mono_nonneg; omega.
 Qed.

 Lemma spec_div : forall a b, 0 < [|b|] ->
      let (q,r) := div31 a b in
      [|a|] = [|q|] * [|b|] + [|r|] /\
      0 <= [|r|] < [|b|].forall a b : int31,
0 < [|b|] ->
let (q, r) := (a / b)%int31 in
[|a|] = [|q|] * [|b|] + [|r|] /\ 0 <= [|r|] < [|b|]
 Proof.forall a b : int31,
0 < [|b|] ->
let (q, r) := (a / b)%int31 in
[|a|] = [|q|] * [|b|] + [|r|] /\ 0 <= [|r|] < [|b|]
 unfold div31; intros.a, b:int31
H:0 < [|b|]
let (q, r) :=
  let (q, r) := Z.div_eucl [|a|] [|b|] in
  (phi_inv q, phi_inv r) in
[|a|] = [|q|] * [|b|] + [|r|] /\ 0 <= [|r|] < [|b|]
 assert ([|b|]>0) by (auto with zarith).a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
let (q, r) :=
  let (q, r) := Z.div_eucl [|a|] [|b|] in
  (phi_inv q, phi_inv r) in
[|a|] = [|q|] * [|b|] + [|r|] /\ 0 <= [|r|] < [|b|]
 generalize (Z_div_mod [|a|] [|b|] H0) (Z_div_pos [|a|] [|b|] H0).a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
(let (q, r) := Z.div_eucl [|a|] [|b|] in
 [|a|] = [|b|] * q + r /\ 0 <= r < [|b|]) ->
(0 <= [|a|] -> 0 <= [|a|] / [|b|]) ->
let (q, r) :=
  let (q, r) := Z.div_eucl [|a|] [|b|] in
  (phi_inv q, phi_inv r) in
[|a|] = [|q|] * [|b|] + [|r|] /\ 0 <= [|r|] < [|b|]
 unfold Z.div; destruct (Z.div_eucl [|a|] [|b|]).a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
[|a|] = [|b|] * z + z0 /\ 0 <= z0 < [|b|] ->
(0 <= [|a|] -> 0 <= z) ->
[|a|] = [|phi_inv z|] * [|b|] + [|phi_inv z0|] /\
0 <= [|phi_inv z0|] < [|b|]
 rewrite ?phi_phi_inv.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
[|a|] = [|b|] * z + z0 /\ 0 <= z0 < [|b|] ->
(0 <= [|a|] -> 0 <= z) ->
[|a|] = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 destruct 1; intros.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
[|a|] = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 rewrite H1, Z.mul_comm.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
z * [|b|] + z0 = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 generalize (phi_bounded a)(phi_bounded b); intros.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
z * [|b|] + z0 = z mod wB * [|b|] + z0 mod wB /\
0 <= z0 mod wB < [|b|]
 replace (z0 mod wB) with z0 by (symmetry; apply Zmod_small; omega).a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
z * [|b|] + z0 = z mod wB * [|b|] + z0 /\
0 <= z0 < [|b|]
 replace (z mod wB) with z; auto with zarith.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
z = z mod wB
  symmetry; apply Zmod_small.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
0 <= z < wB
  split; auto with zarith.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
z < wB
  apply Z.le_lt_trans with [|a|]; auto with zarith.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
z <= [|a|]
  rewrite H1.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
z <= [|b|] * z + z0
  apply Z.le_trans with ([|b|]*z); try omega.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
z <= [|b|] * z
  rewrite <- (Z.mul_1_l z) at 1.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|a|] -> 0 <= z
H4:0 <= [|a|] < wB
H5:0 <= [|b|] < wB
1 * z <= [|b|] * z
  apply Z.mul_le_mono_nonneg; auto with zarith.
 Qed.

 Lemma spec_mod :  forall a b, 0 < [|b|] ->
      [|let (_,r) := (a/b)%int31 in r|] = [|a|] mod [|b|].forall a b : int31,
0 < [|b|] ->
[|(let (_, r) := (a / b)%int31 in r)|] =
[|a|] mod [|b|]
 Proof.forall a b : int31,
0 < [|b|] ->
[|(let (_, r) := (a / b)%int31 in r)|] =
[|a|] mod [|b|]
 unfold div31; intros.a, b:int31
H:0 < [|b|]
[|(let (_, r) :=
     let (q, r) := Z.div_eucl [|a|] [|b|] in
     (phi_inv q, phi_inv r) in
   r)|] = [|a|] mod [|b|]
 assert ([|b|]>0) by (auto with zarith).a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
[|(let (_, r) :=
     let (q, r) := Z.div_eucl [|a|] [|b|] in
     (phi_inv q, phi_inv r) in
   r)|] = [|a|] mod [|b|]
 unfold Z.modulo.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
[|(let (_, r) :=
     let (q, r) := Z.div_eucl [|a|] [|b|] in
     (phi_inv q, phi_inv r) in
   r)|] = (let (_, r) := Z.div_eucl [|a|] [|b|] in r)
 generalize (Z_div_mod [|a|] [|b|] H0).a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
(let (q, r) := Z.div_eucl [|a|] [|b|] in
 [|a|] = [|b|] * q + r /\ 0 <= r < [|b|]) ->
[|(let (_, r) :=
     let (q, r) := Z.div_eucl [|a|] [|b|] in
     (phi_inv q, phi_inv r) in
   r)|] = (let (_, r) := Z.div_eucl [|a|] [|b|] in r)
 destruct (Z.div_eucl [|a|] [|b|]).a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
[|a|] = [|b|] * z + z0 /\ 0 <= z0 < [|b|] ->
[|phi_inv z0|] = z0
 rewrite ?phi_phi_inv.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
[|a|] = [|b|] * z + z0 /\ 0 <= z0 < [|b|] ->
z0 mod wB = z0
 destruct 1; intros.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
z0 mod wB = z0
 generalize (phi_bounded b); intros.a, b:int31
H:0 < [|b|]
H0:[|b|] > 0
z, z0:Z
H1:[|a|] = [|b|] * z + z0
H2:0 <= z0 < [|b|]
H3:0 <= [|b|] < wB
z0 mod wB = z0
 apply Zmod_small; omega.
 Qed.

 Lemma phi_gcd : forall i j,
  [|gcd31 i j|] = Zgcdn (2*size) [|j|] [|i|].forall i j : int31,
[|gcd31 i j|] = Zgcdn (2 * size) [|j|] [|i|]
 Proof.forall i j : int31,
[|gcd31 i j|] = Zgcdn (2 * size) [|j|] [|i|]
  unfold gcd31.forall i j : int31,
[|euler (2 * size) i j|] =
Zgcdn (2 * size) [|j|] [|i|]
  induction (2*size)%nat; intros.i, j:int31
[|euler 0 i j|] = Zgcdn 0 [|j|] [|i|]
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
[|euler (S n) i j|] = Zgcdn (S n) [|j|] [|i|]
  reflexivity.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
[|euler (S n) i j|] = Zgcdn (S n) [|j|] [|i|]
  simpl euler.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
[|match (j ?= On)%int31 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) [|j|] [|i|]
  unfold compare31.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
[|match [|j|] ?= [|On|] with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) [|j|] [|i|]
  change [|On|] with 0.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
[|match [|j|] ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) [|j|] [|i|]
  generalize (phi_bounded j)(phi_bounded i); intros.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
[|match [|j|] ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) [|j|] [|i|]
  case_eq [|j|]; intros.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
H1:[|j|] = 0
[|match 0 ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) 0 [|i|]
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.pos p
[|match Z.pos p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.pos p) [|i|]
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.neg p
[|match Z.neg p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.neg p) [|i|]
  simpl; intros.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
H1:[|j|] = 0
[|i|] = Z.abs [|i|]
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.pos p
[|match Z.pos p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.pos p) [|i|]
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.neg p
[|match Z.neg p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.neg p) [|i|]
  generalize (Zabs_spec [|i|]); omega.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.pos p
[|match Z.pos p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.pos p) [|i|]
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.neg p
[|match Z.neg p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.neg p) [|i|]
  simpl.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.pos p
[|euler n j (let (_, r) := (i / j)%int31 in r)|] =
Zgcdn n ([|i|] mod Z.pos p) (Z.pos p)
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.neg p
[|match Z.neg p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.neg p) [|i|] rewrite IHn, H1; f_equal.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.pos p
[|(let (_, r) := (i / j)%int31 in r)|] =
[|i|] mod Z.pos p
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.neg p
[|match Z.neg p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.neg p) [|i|]
  rewrite spec_mod, H1; auto.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.pos p
0 < [|j|]
n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.neg p
[|match Z.neg p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.neg p) [|i|]
  rewrite H1; compute; auto.n:nat
IHn:forall i0 j0 : int31, [|euler n i0 j0|] = Zgcdn n [|j0|] [|i0|]
i, j:int31
H:0 <= [|j|] < wB
H0:0 <= [|i|] < wB
p:positive
H1:[|j|] = Z.neg p
[|match Z.neg p ?= 0 with
  | Eq => i
  | _ => euler n j (let (_, r) := (i / j)%int31 in r)
  end|] = Zgcdn (S n) (Z.neg p) [|i|]
  rewrite H1 in H; destruct H as [H _]; compute in H; elim H; auto.
 Qed.

 Lemma spec_gcd : forall a b, Zis_gcd [|a|] [|b|] [|gcd31 a b|].forall a b : int31, Zis_gcd [|a|] [|b|] [|gcd31 a b|]
 Proof.forall a b : int31, Zis_gcd [|a|] [|b|] [|gcd31 a b|]
 intros.a, b:int31
Zis_gcd [|a|] [|b|] [|gcd31 a b|]
 rewrite phi_gcd.a, b:int31
Zis_gcd [|a|] [|b|] (Zgcdn (2 * size) [|b|] [|a|])
 apply Zis_gcd_sym.a, b:int31
Zis_gcd [|b|] [|a|] (Zgcdn (2 * size) [|b|] [|a|])
 apply Zgcdn_is_gcd.a, b:int31
(Zgcd_bound [|b|] <= 2 * size)%nat
 unfold Zgcd_bound.a, b:int31
(match [|b|] with
 | 0%Z => 1
 | Z.pos p | Z.neg p =>
     Pos.size_nat p + Pos.size_nat p
 end <= 2 * size)%nat
 generalize (phi_bounded b).a, b:int31
0 <= [|b|] < wB ->
(match [|b|] with
 | 0%Z => 1
 | Z.pos p | Z.neg p =>
     Pos.size_nat p + Pos.size_nat p
 end <= 2 * size)%nat
 destruct [|b|].a, b:int31
0 <= 0 < wB -> (1 <= 2 * size)%nat
a, b:int31
p:positive
0 <= Z.pos p < wB ->
(Pos.size_nat p + Pos.size_nat p <= 2 * size)%nat
a, b:int31
p:positive
0 <= Z.neg p < wB ->
(Pos.size_nat p + Pos.size_nat p <= 2 * size)%nat
 unfold size; auto with zarith.a, b:int31
p:positive
0 <= Z.pos p < wB ->
(Pos.size_nat p + Pos.size_nat p <= 2 * size)%nat
a, b:int31
p:positive
0 <= Z.neg p < wB ->
(Pos.size_nat p + Pos.size_nat p <= 2 * size)%nat
 intros (_,H).a, b:int31
p:positive
H:Z.pos p < wB
(Pos.size_nat p + Pos.size_nat p <= 2 * size)%nat
a, b:int31
p:positive
0 <= Z.neg p < wB ->
(Pos.size_nat p + Pos.size_nat p <= 2 * size)%nat
 cut (Pos.size_nat p <= size)%nat; [ omega | rewrite <- Zpower2_Psize; auto].a, b:int31
p:positive
0 <= Z.neg p < wB ->
(Pos.size_nat p + Pos.size_nat p <= 2 * size)%nat
 intros (H,_); compute in H; elim H; auto.
 Qed.

 Lemma iter_int31_iter_nat : forall A f i a,
  iter_int31 i A f a = iter_nat (Z.abs_nat [|i|]) A f a.forall (A : Type) (f : A -> A) (i : int31) (a : A),
iter_int31 i A f a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat [|i|])
 Proof.forall (A : Type) (f : A -> A) (i : int31) (a : A),
iter_int31 i A f a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat [|i|])
 intros.A:Type
f:A -> A
i:int31
a:A
iter_int31 i A f a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat [|i|])
 unfold iter_int31.A:Type
f:A -> A
i:int31
a:A
recr (A -> A) (fun x : A => x)
  (fun (b : digits) (_ : int31) (rec : A -> A) =>
   match b with
   | D0 => fun x : A => rec (rec x)
   | D1 => fun x : A => f (rec (rec x))
   end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat [|i|])
 rewrite <- recrbis_equiv; auto; unfold recrbis.A:Type
f:A -> A
i:int31
a:A
recrbis_aux size (A -> A) (fun x : A => x)
  (fun (b : digits) (_ : int31) (rec : A -> A) =>
   match b with
   | D0 => fun x : A => rec (rec x)
   | D1 => fun x : A => f (rec (rec x))
   end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat [|i|])
 rewrite <- phibis_aux_equiv.A:Type
f:A -> A
i:int31
a:A
recrbis_aux size (A -> A) (fun x : A => x)
  (fun (b : digits) (_ : int31) (rec : A -> A) =>
   match b with
   | D0 => fun x : A => rec (rec x)
   | D1 => fun x : A => f (rec (rec x))
   end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (phibis_aux size i))

 revert i a; induction size.A:Type
f:A -> A
forall (i : int31) (a : A),
recrbis_aux 0 (A -> A) (fun x : A => x)
  (fun (b : digits) (_ : int31) (rec : A -> A) =>
   match b with
   | D0 => fun x : A => rec (rec x)
   | D1 => fun x : A => f (rec (rec x))
   end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (phibis_aux 0 i))
A:Type
f:A -> A
n:nat
IHn:forall (i : int31) (a : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f) (Z.abs_nat (phibis_aux n i))
forall (i : int31) (a : A),
recrbis_aux (S n) (A -> A) (fun x : A => x)
  (fun (b : digits) (_ : int31) (rec : A -> A) =>
   match b with
   | D0 => fun x : A => rec (rec x)
   | D1 => fun x : A => f (rec (rec x))
   end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (phibis_aux (S n) i))
 simpl; auto.A:Type
f:A -> A
n:nat
IHn:forall (i : int31) (a : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f) (Z.abs_nat (phibis_aux n i))
forall (i : int31) (a : A),
recrbis_aux (S n) (A -> A) (fun x : A => x)
  (fun (b : digits) (_ : int31) (rec : A -> A) =>
   match b with
   | D0 => fun x : A => rec (rec x)
   | D1 => fun x : A => f (rec (rec x))
   end) i a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (phibis_aux (S n) i))
 simpl; intros.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
match firstr i with
| D0 =>
    fun x : A =>
    recrbis_aux n (A -> A) (fun x0 : A => x0)
      (fun (b : digits) (_ : int31) (rec : A -> A) =>
       match b with
       | D0 => fun x0 : A => rec (rec x0)
       | D1 => fun x0 : A => f (rec (rec x0))
       end) (shiftr i)
      (recrbis_aux n (A -> A) (fun x0 : A => x0)
         (fun (b : digits) (_ : int31) (rec : A -> A)
          =>
          match b with
          | D0 => fun x0 : A => rec (rec x0)
          | D1 => fun x0 : A => f (rec (rec x0))
          end) (shiftr i) x)
| D1 =>
    fun x : A =>
    f
      (recrbis_aux n (A -> A) (fun x0 : A => x0)
         (fun (b : digits) (_ : int31) (rec : A -> A)
          =>
          match b with
          | D0 => fun x0 : A => rec (rec x0)
          | D1 => fun x0 : A => f (rec (rec x0))
          end) (shiftr i)
         (recrbis_aux n (A -> A) (fun x0 : A => x0)
            (fun (b : digits) (_ : int31)
               (rec : A -> A) =>
             match b with
             | D0 => fun x0 : A => rec (rec x0)
             | D1 => fun x0 : A => f (rec (rec x0))
             end) (shiftr i) x))
end a =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (phibis_aux (S n) i))
 case_eq (firstr i); intros H; rewrite 2 IHn;
  unfold phibis_aux; simpl; rewrite ?H; fold (phibis_aux n (shiftr i));
  generalize (phibis_aux_pos n (shiftr i)); intros;
  set (z := phibis_aux n (shiftr i)) in *; clearbody z;
  rewrite <- nat_rect_plus.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D0
z:Z
H0:0 <= z
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat z + Z.abs_nat z) =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (Z.double z))
A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
f
  (nat_rect (fun _ : nat => A) a (fun _ : nat => f)
     (Z.abs_nat z + Z.abs_nat z)) =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (Z.succ_double z))

 f_equal.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D0
z:Z
H0:0 <= z
(Z.abs_nat z + Z.abs_nat z)%nat =
Z.abs_nat (Z.double z)
A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
f
  (nat_rect (fun _ : nat => A) a (fun _ : nat => f)
     (Z.abs_nat z + Z.abs_nat z)) =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (Z.succ_double z))
 rewrite Z.double_spec, <- Z.add_diag.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D0
z:Z
H0:0 <= z
(Z.abs_nat z + Z.abs_nat z)%nat = Z.abs_nat (z + z)
A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
f
  (nat_rect (fun _ : nat => A) a (fun _ : nat => f)
     (Z.abs_nat z + Z.abs_nat z)) =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (Z.succ_double z))
 symmetry; apply Zabs2Nat.inj_add; auto with zarith.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
f
  (nat_rect (fun _ : nat => A) a (fun _ : nat => f)
     (Z.abs_nat z + Z.abs_nat z)) =
nat_rect (fun _ : nat => A) a (fun _ : nat => f)
  (Z.abs_nat (Z.succ_double z))

 change (iter_nat (S (Z.abs_nat z) + (Z.abs_nat z))%nat A f a =
    iter_nat (Z.abs_nat (Z.succ_double z)) A f a); f_equal.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
(S (Z.abs_nat z) + Z.abs_nat z)%nat =
Z.abs_nat (Z.succ_double z)
 rewrite Z.succ_double_spec, <- Z.add_diag.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
(S (Z.abs_nat z) + Z.abs_nat z)%nat =
Z.abs_nat (z + z + 1)
 rewrite Zabs2Nat.inj_add; auto with zarith.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
(S (Z.abs_nat z) + Z.abs_nat z)%nat =
(Z.abs_nat (z + z) + Z.abs_nat 1)%nat
 rewrite Zabs2Nat.inj_add; auto with zarith.A:Type
f:A -> A
n:nat
IHn:forall (i0 : int31) (a0 : A),
recrbis_aux n (A -> A) (fun x : A => x)
(fun (b : digits) (_ : int31) (rec : A -> A) =>
match b with
| D0 => fun x : A => rec (rec x)
| D1 => fun x : A => f (rec (rec x))
end) i0 a0 =
nat_rect (fun _ : nat => A) a0 (fun _ : nat => f)
(Z.abs_nat (phibis_aux n i0))
i:int31
a:A
H:firstr i = D1
z:Z
H0:0 <= z
(S (Z.abs_nat z) + Z.abs_nat z)%nat =
(Z.abs_nat z + Z.abs_nat z + Z.abs_nat 1)%nat
 change (Z.abs_nat 1) with 1%nat; omega.
 Qed.

 Fixpoint addmuldiv31_alt n i j :=
  match n with
    | O => i
    | S n => addmuldiv31_alt n (sneakl (firstl j) i) (shiftl j)
  end.

 Lemma addmuldiv31_equiv : forall p x y,
  addmuldiv31 p x y = addmuldiv31_alt (Z.abs_nat [|p|]) x y.forall p x y : int31,
addmuldiv31 p x y =
addmuldiv31_alt (Z.abs_nat [|p|]) x y
 Proof.forall p x y : int31,
addmuldiv31 p x y =
addmuldiv31_alt (Z.abs_nat [|p|]) x y
 intros.p, x, y:int31
addmuldiv31 p x y =
addmuldiv31_alt (Z.abs_nat [|p|]) x y
 unfold addmuldiv31.p, x, y:int31
(let (res, _) :=
   iter_int31 p (int31 * int31)
     (fun ij : int31 * int31 =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) (x, y) in
 res) = addmuldiv31_alt (Z.abs_nat [|p|]) x y
 rewrite iter_int31_iter_nat.p, x, y:int31
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j))
     (Z.abs_nat [|p|]) in
 res) = addmuldiv31_alt (Z.abs_nat [|p|]) x y
 set (n:=Z.abs_nat [|p|]); clearbody n; clear p.x, y:int31
n:nat
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) n in
 res) = addmuldiv31_alt n x y
 revert x y; induction n.forall x y : int31,
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) 0 in
 res) = addmuldiv31_alt 0 x y
n:nat
IHn:forall x y : int31,
(let (res, _) :=
nat_rect (fun _ : nat => (int31 * int31)%type) (x, y)
(fun (_ : nat) (ij : int31 * int31) =>
let (i, j) := ij in (sneakl (firstl j) i, shiftl j)) n in
res) = addmuldiv31_alt n x y
forall x y : int31,
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) (S n) in
 res) = addmuldiv31_alt (S n) x y
 simpl; auto.n:nat
IHn:forall x y : int31,
(let (res, _) :=
nat_rect (fun _ : nat => (int31 * int31)%type) (x, y)
(fun (_ : nat) (ij : int31 * int31) =>
let (i, j) := ij in (sneakl (firstl j) i, shiftl j)) n in
res) = addmuldiv31_alt n x y
forall x y : int31,
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) (S n) in
 res) = addmuldiv31_alt (S n) x y
 intros.n:nat
IHn:forall x0 y0 : int31,
(let (res, _) :=
nat_rect (fun _ : nat => (int31 * int31)%type) (x0, y0)
(fun (_ : nat) (ij : int31 * int31) =>
let (i, j) := ij in (sneakl (firstl j) i, shiftl j)) n in
res) = addmuldiv31_alt n x0 y0
x, y:int31
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) (S n) in
 res) = addmuldiv31_alt (S n) x y
 simpl addmuldiv31_alt.n:nat
IHn:forall x0 y0 : int31,
(let (res, _) :=
nat_rect (fun _ : nat => (int31 * int31)%type) (x0, y0)
(fun (_ : nat) (ij : int31 * int31) =>
let (i, j) := ij in (sneakl (firstl j) i, shiftl j)) n in
res) = addmuldiv31_alt n x0 y0
x, y:int31
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) (S n) in
 res) =
addmuldiv31_alt n (sneakl (firstl y) x) (shiftl y)
 replace (S n) with (n+1)%nat by (rewrite plus_comm; auto).n:nat
IHn:forall x0 y0 : int31,
(let (res, _) :=
nat_rect (fun _ : nat => (int31 * int31)%type) (x0, y0)
(fun (_ : nat) (ij : int31 * int31) =>
let (i, j) := ij in (sneakl (firstl j) i, shiftl j)) n in
res) = addmuldiv31_alt n x0 y0
x, y:int31
(let (res, _) :=
   nat_rect (fun _ : nat => (int31 * int31)%type)
     (x, y)
     (fun (_ : nat) (ij : int31 * int31) =>
      let (i, j) := ij in
      (sneakl (firstl j) i, shiftl j)) (n + 1) in
 res) =
addmuldiv31_alt n (sneakl (firstl y) x) (shiftl y)
 rewrite nat_rect_plus; simpl; auto.
 Qed.

 Lemma spec_add_mul_div : forall x y p, [|p|] <= Zpos 31 ->
   [| addmuldiv31 p x y |] =
   ([|x|] * (2 ^ [|p|]) + [|y|] / (2 ^ ((Zpos 31) - [|p|]))) mod wB.forall x y p : int31,
[|p|] <= 31 ->
[|addmuldiv31 p x y|] =
([|x|] * 2 ^ [|p|] + [|y|] / 2 ^ (31 - [|p|])) mod wB
 Proof.forall x y p : int31,
[|p|] <= 31 ->
[|addmuldiv31 p x y|] =
([|x|] * 2 ^ [|p|] + [|y|] / 2 ^ (31 - [|p|])) mod wB
 intros.x, y, p:int31
H:[|p|] <= 31
[|addmuldiv31 p x y|] =
([|x|] * 2 ^ [|p|] + [|y|] / 2 ^ (31 - [|p|])) mod wB
 rewrite addmuldiv31_equiv.x, y, p:int31
H:[|p|] <= 31
[|addmuldiv31_alt (Z.abs_nat [|p|]) x y|] =
([|x|] * 2 ^ [|p|] + [|y|] / 2 ^ (31 - [|p|])) mod wB
 assert ([|p|] = Z.of_nat (Z.abs_nat [|p|])).x, y, p:int31
H:[|p|] <= 31
[|p|] = Z.of_nat (Z.abs_nat [|p|])
x, y, p:int31
H:[|p|] <= 31
H0:[|p|] = Z.of_nat (Z.abs_nat [|p|])
[|addmuldiv31_alt (Z.abs_nat [|p|]) x y|] =
([|x|] * 2 ^ [|p|] + [|y|] / 2 ^ (31 - [|p|])) mod wB
  rewrite Zabs2Nat.id_abs; symmetry; apply Z.abs_eq.x, y, p:int31
H:[|p|] <= 31
0 <= [|p|]
x, y, p:int31
H:[|p|] <= 31
H0:[|p|] = Z.of_nat (Z.abs_nat [|p|])
[|addmuldiv31_alt (Z.abs_nat [|p|]) x y|] =
([|x|] * 2 ^ [|p|] + [|y|] / 2 ^ (31 - [|p|])) mod wB
  destruct (phi_bounded p); auto.x, y, p:int31
H:[|p|] <= 31
H0:[|p|] = Z.of_nat (Z.abs_nat [|p|])
[|addmuldiv31_alt (Z.abs_nat [|p|]) x y|] =
([|x|] * 2 ^ [|p|] + [|y|] / 2 ^ (31 - [|p|])) mod wB
 rewrite H0; rewrite H0 in H; clear H0; rewrite Zabs2Nat.id.x, y, p:int31
H:Z.of_nat (Z.abs_nat [|p|]) <= 31
[|addmuldiv31_alt (Z.abs_nat [|p|]) x y|] =
([|x|] * 2 ^ Z.of_nat (Z.abs_nat [|p|]) +
 [|y|] / 2 ^ (31 - Z.of_nat (Z.abs_nat [|p|]))) mod wB
 set (n := Z.abs_nat [|p|]) in *; clearbody n.x, y, p:int31
n:nat
H:Z.of_nat n <= 31
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n +
 [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
 assert (n <= 31)%nat.x, y, p:int31
n:nat
H:Z.of_nat n <= 31
(n <= 31)%nat
x, y, p:int31
n:nat
H:Z.of_nat n <= 31
H0:(n <= 31)%nat
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n +
 [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
  rewrite Nat2Z.inj_le; auto with zarith.x, y, p:int31
n:nat
H:Z.of_nat n <= 31
H0:(n <= 31)%nat
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n +
 [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
 clear p H; revert x y.n:nat
H0:(n <= 31)%nat
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n +
 [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB

 induction n.H0:(0 <= 31)%nat
forall x y : int31,
[|addmuldiv31_alt 0 x y|] =
([|x|] * 2 ^ Z.of_nat 0 +
 [|y|] / 2 ^ (31 - Z.of_nat 0)) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n + [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
forall x y : int31,
[|addmuldiv31_alt (S n) x y|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 simpl Z.of_nat; intros.H0:(0 <= 31)%nat
x, y:int31
[|addmuldiv31_alt 0 x y|] =
([|x|] * 2 ^ 0 + [|y|] / 2 ^ (31 - 0)) mod 2 ^ 31
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n + [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
forall x y : int31,
[|addmuldiv31_alt (S n) x y|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite Z.mul_1_r.H0:(0 <= 31)%nat
x, y:int31
[|addmuldiv31_alt 0 x y|] =
([|x|] + [|y|] / 2 ^ (31 - 0)) mod 2 ^ 31
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n + [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
forall x y : int31,
[|addmuldiv31_alt (S n) x y|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 replace ([|y|] / 2^(31-0)) with 0.H0:(0 <= 31)%nat
x, y:int31
[|addmuldiv31_alt 0 x y|] = ([|x|] + 0) mod 2 ^ 31
H0:(0 <= 31)%nat
x, y:int31
0 = [|y|] / 2 ^ (31 - 0)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n + [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
forall x y : int31,
[|addmuldiv31_alt (S n) x y|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite Z.add_0_r.H0:(0 <= 31)%nat
x, y:int31
[|addmuldiv31_alt 0 x y|] = [|x|] mod 2 ^ 31
H0:(0 <= 31)%nat
x, y:int31
0 = [|y|] / 2 ^ (31 - 0)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n + [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
forall x y : int31,
[|addmuldiv31_alt (S n) x y|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 symmetry; apply Zmod_small; apply phi_bounded.H0:(0 <= 31)%nat
x, y:int31
0 = [|y|] / 2 ^ (31 - 0)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n + [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
forall x y : int31,
[|addmuldiv31_alt (S n) x y|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 symmetry; apply Zdiv_small; apply phi_bounded.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x y : int31,
[|addmuldiv31_alt n x y|] =
([|x|] * 2 ^ Z.of_nat n + [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB
forall x y : int31,
[|addmuldiv31_alt (S n) x y|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB

 simpl addmuldiv31_alt; intros.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
[|addmuldiv31_alt n (sneakl (firstl y) x) (shiftl y)|] =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite IHn; [ | omega ].n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
([|sneakl (firstl y) x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 case_eq (firstl y); intros.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
([|sneakl D0 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB

 rewrite phi_twice, Z.double_spec.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
((2 * [|x|]) mod wB * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite phi_twice_firstl; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
((2 * [|x|]) mod wB * 2 ^ Z.of_nat n +
 Z.double [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 change (Z.double [|y|]) with (2*[|y|]).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
((2 * [|x|]) mod wB * 2 ^ Z.of_nat n +
 2 * [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite Nat2Z.inj_succ, Z.pow_succ_r; auto with zarith.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
((2 * [|x|]) mod wB * 2 ^ Z.of_nat n +
 2 * [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * (2 * 2 ^ Z.of_nat n) +
 [|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite Zplus_mod; rewrite Zmult_mod_idemp_l; rewrite <- Zplus_mod.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
(2 * [|x|] * 2 ^ Z.of_nat n +
 2 * [|y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * (2 * 2 ^ Z.of_nat n) +
 [|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
2 * [|x|] * 2 ^ Z.of_nat n +
2 * [|y|] / 2 ^ (31 - Z.of_nat n) =
[|x|] * (2 * 2 ^ Z.of_nat n) +
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
2 * [|x|] * 2 ^ Z.of_nat n =
[|x|] * (2 * 2 ^ Z.of_nat n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
2 * [|y|] / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 ring.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
2 * [|y|] / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 replace (31-Z.of_nat n) with (Z.succ(31-Z.succ(Z.of_nat n))) by ring.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
2 * [|y|] / 2 ^ Z.succ (31 - Z.succ (Z.of_nat n)) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite Z.pow_succ_r, <- Zdiv_Zdiv; auto with zarith.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D0
2 * [|y|] / 2 / 2 ^ (31 - Z.succ (Z.of_nat n)) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite Z.mul_comm, Z_div_mult; auto with zarith.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
([|sneakl D1 x|] * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB

 rewrite phi_twice_plus_one, Z.succ_double_spec.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
((2 * [|x|] + 1) mod wB * 2 ^ Z.of_nat n +
 [|shiftl y|] / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite phi_twice; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
((2 * [|x|] + 1) mod wB * 2 ^ Z.of_nat n +
 Z.double [|y|] mod wB / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 change (Z.double [|y|]) with (2*[|y|]).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
((2 * [|x|] + 1) mod wB * 2 ^ Z.of_nat n +
 (2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * 2 ^ Z.of_nat (S n) +
 [|y|] / 2 ^ (31 - Z.of_nat (S n))) mod wB
 rewrite Nat2Z.inj_succ, Z.pow_succ_r; auto with zarith.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
((2 * [|x|] + 1) mod wB * 2 ^ Z.of_nat n +
 (2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * (2 * 2 ^ Z.of_nat n) +
 [|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))) mod wB
 rewrite Zplus_mod; rewrite Zmult_mod_idemp_l; rewrite <- Zplus_mod.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
((2 * [|x|] + 1) * 2 ^ Z.of_nat n +
 (2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n)) mod wB =
([|x|] * (2 * 2 ^ Z.of_nat n) +
 [|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))) mod wB
 rewrite Z.mul_add_distr_r, Z.mul_1_l, <- Z.add_assoc.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
(2 * [|x|] * 2 ^ Z.of_nat n +
 (2 ^ Z.of_nat n +
  (2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n))) mod wB =
([|x|] * (2 * 2 ^ Z.of_nat n) +
 [|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))) mod wB
 f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
2 * [|x|] * 2 ^ Z.of_nat n +
(2 ^ Z.of_nat n +
 (2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n)) =
[|x|] * (2 * 2 ^ Z.of_nat n) +
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
 f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
2 * [|x|] * 2 ^ Z.of_nat n =
[|x|] * (2 * 2 ^ Z.of_nat n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
 ring.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
 assert ((2*[|y|]) mod wB = 2*[|y|] - wB).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
(2 * [|y|]) mod wB = 2 * [|y|] - wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
  clear - H.y:int31
H:firstl y = D1
(2 * [|y|]) mod wB = 2 * [|y|] - wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n)) symmetry.y:int31
H:firstl y = D1
2 * [|y|] - wB = (2 * [|y|]) mod wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n)) apply Zmod_unique with 1; [ | ring ].y:int31
H:firstl y = D1
0 <= 2 * [|y|] - wB < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
  generalize (phi_lowerbound  _ H) (phi_bounded y).y:int31
H:firstl y = D1
2 ^ Z.of_nat (Init.Nat.pred size) <= [|y|] ->
0 <= [|y|] < wB -> 0 <= 2 * [|y|] - wB < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
  set (wB' := 2^Z.of_nat (pred size)).y:int31
H:firstl y = D1
wB':=2 ^ Z.of_nat (Init.Nat.pred size):Z
wB' <= [|y|] ->
0 <= [|y|] < wB -> 0 <= 2 * [|y|] - wB < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
  replace wB with (2*wB'); [ omega | ].y:int31
H:firstl y = D1
wB':=2 ^ Z.of_nat (Init.Nat.pred size):Z
2 * wB' = wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
  unfold wB'.y:int31
H:firstl y = D1
wB':=2 ^ Z.of_nat (Init.Nat.pred size):Z
2 * 2 ^ Z.of_nat (Init.Nat.pred size) = wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n)) rewrite <- Z.pow_succ_r, <- Nat2Z.inj_succ by (auto with zarith).y:int31
H:firstl y = D1
wB':=2 ^ Z.of_nat (Init.Nat.pred size):Z
2 ^ Z.of_nat (S (Init.Nat.pred size)) = wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
  f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|]) mod wB / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
 rewrite H1.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|] - wB) / 2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
 replace wB with (2^(Z.of_nat n)*2^(31-Z.of_nat n)) by
  (rewrite <- Zpower_exp; auto with zarith; f_equal; unfold size; ring).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|] - 2 ^ Z.of_nat n * 2 ^ (31 - Z.of_nat n)) /
2 ^ (31 - Z.of_nat n) =
[|y|] / 2 ^ (31 - Z.succ (Z.of_nat n))
 unfold Z.sub; rewrite <- Z.mul_opp_l.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|] +
 - 2 ^ Z.of_nat n * 2 ^ (31 + - Z.of_nat n)) /
2 ^ (31 + - Z.of_nat n) =
[|y|] / 2 ^ (31 + - Z.succ (Z.of_nat n))
 rewrite Z_div_plus; auto with zarith.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 ^ Z.of_nat n +
(2 * [|y|] / 2 ^ (31 + - Z.of_nat n) +
 - 2 ^ Z.of_nat n) =
[|y|] / 2 ^ (31 + - Z.succ (Z.of_nat n))
 ring_simplify.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 * [|y|] / 2 ^ (31 + - Z.of_nat n) =
[|y|] / 2 ^ (31 + - (Z.of_nat n + 1))
 replace (31+-Z.of_nat n) with (Z.succ(31-Z.succ(Z.of_nat n))) by ring.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 * [|y|] / 2 ^ Z.succ (31 - Z.succ (Z.of_nat n)) =
[|y|] / 2 ^ (31 + - (Z.of_nat n + 1))
 rewrite Z.pow_succ_r, <- Zdiv_Zdiv; auto with zarith.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 y0 : int31,
[|addmuldiv31_alt n x0 y0|] =
([|x0|] * 2 ^ Z.of_nat n + [|y0|] / 2 ^ (31 - Z.of_nat n)) mod wB
x, y:int31
H:firstl y = D1
H1:(2 * [|y|]) mod wB = 2 * [|y|] - wB
2 * [|y|] / 2 / 2 ^ (31 - Z.succ (Z.of_nat n)) =
[|y|] / 2 ^ (31 + - (Z.of_nat n + 1))
 rewrite Z.mul_comm, Z_div_mult; auto with zarith.
 Qed.

 Lemma shift_unshift_mod_2 : forall n p a, 0 <= p <= n ->
   ((a * 2 ^ (n - p)) mod (2^n) / 2 ^ (n - p)) mod (2^n) =
   a mod 2 ^ p.forall n p a : Z,
0 <= p <= n ->
((a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p)) mod 2 ^ n =
a mod 2 ^ p
 Proof.forall n p a : Z,
0 <= p <= n ->
((a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p)) mod 2 ^ n =
a mod 2 ^ p
 intros.n, p, a:Z
H:0 <= p <= n
((a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p)) mod 2 ^ n =
a mod 2 ^ p
 rewrite Zmod_small.n, p, a:Z
H:0 <= p <= n
(a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 rewrite Zmod_eq by (auto with zarith).n, p, a:Z
H:0 <= p <= n
(a * 2 ^ (n - p) - a * 2 ^ (n - p) / 2 ^ n * 2 ^ n) /
2 ^ (n - p) = a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 unfold Z.sub at 1.n, p, a:Z
H:0 <= p <= n
(a * 2 ^ (n - p) + - (a * 2 ^ (n - p) / 2 ^ n * 2 ^ n)) /
2 ^ (n - p) = a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 rewrite Z_div_plus_full_l
  by (cut (0 < 2^(n-p)); auto with zarith).n, p, a:Z
H:0 <= p <= n
a + - (a * 2 ^ (n - p) / 2 ^ n * 2 ^ n) / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 assert (2^n = 2^(n-p)*2^p).n, p, a:Z
H:0 <= p <= n
2 ^ n = 2 ^ (n - p) * 2 ^ p
n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a + - (a * 2 ^ (n - p) / 2 ^ n * 2 ^ n) / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
  rewrite <- Zpower_exp by (auto with zarith).n, p, a:Z
H:0 <= p <= n
2 ^ n = 2 ^ (n - p + p)
n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a + - (a * 2 ^ (n - p) / 2 ^ n * 2 ^ n) / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
  replace (n-p+p) with n; auto with zarith.n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a + - (a * 2 ^ (n - p) / 2 ^ n * 2 ^ n) / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 rewrite H0.n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a +
-
(a * 2 ^ (n - p) / (2 ^ (n - p) * 2 ^ p) *
 (2 ^ (n - p) * 2 ^ p)) / 2 ^ (n - p) = a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 rewrite <- Zdiv_Zdiv, Z_div_mult by (auto with zarith).n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a +
- (a / 2 ^ p * (2 ^ (n - p) * 2 ^ p)) / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 rewrite (Z.mul_comm (2^(n-p))), Z.mul_assoc.n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a + - (a / 2 ^ p * 2 ^ p * 2 ^ (n - p)) / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 rewrite <- Z.mul_opp_l.n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a + - (a / 2 ^ p * 2 ^ p) * 2 ^ (n - p) / 2 ^ (n - p) =
a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 rewrite Z_div_mult by (auto with zarith).n, p, a:Z
H:0 <= p <= n
H0:2 ^ n = 2 ^ (n - p) * 2 ^ p
a + - (a / 2 ^ p * 2 ^ p) = a mod 2 ^ p
n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 symmetry; apply Zmod_eq; auto with zarith.n, p, a:Z
H:0 <= p <= n
0 <= (a * 2 ^ (n - p)) mod 2 ^ n / 2 ^ (n - p) < 2 ^ n

 remember (a * 2 ^ (n - p)) as b.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
0 <= b mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 destruct (Z_mod_lt b (2^n)); auto with zarith.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
0 <= b mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 split.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
0 <= b mod 2 ^ n / 2 ^ (n - p)
n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
b mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 apply Z_div_pos; auto with zarith.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
b mod 2 ^ n / 2 ^ (n - p) < 2 ^ n
 apply Zdiv_lt_upper_bound; auto with zarith.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
b mod 2 ^ n < 2 ^ n * 2 ^ (n - p)
 apply Z.lt_le_trans with (2^n); auto with zarith.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
2 ^ n <= 2 ^ n * 2 ^ (n - p)
 rewrite <- (Z.mul_1_r (2^n)) at 1.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
2 ^ n * 1 <= 2 ^ n * 2 ^ (n - p)
 apply Z.mul_le_mono_nonneg; auto with zarith.n, p, a:Z
H:0 <= p <= n
b:Z
Heqb:b = a * 2 ^ (n - p)
H0:0 <= b mod 2 ^ n
H1:b mod 2 ^ n < 2 ^ n
1 <= 2 ^ (n - p)
 cut (0 < 2 ^ (n-p)); auto with zarith.
 Qed.

 Lemma spec_pos_mod : forall w p,
       [|ZnZ.pos_mod p w|] = [|w|] mod (2 ^ [|p|]).forall w p : int31,
[|ZnZ.pos_mod p w|] = [|w|] mod 2 ^ [|p|]
 Proof.forall w p : int31,
[|ZnZ.pos_mod p w|] = [|w|] mod 2 ^ [|p|]
 unfold int31_ops, ZnZ.pos_mod, compare31.forall w p : int31,
[|match [|p|] ?= [|31|] with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
 change [|31|] with 31%Z.forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
 assert (forall w p, 31<=p -> [|w|] = [|w|] mod 2^p).forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
H:forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
  intros.w:int31
p:Z
H:31 <= p
[|w|] = [|w|] mod 2 ^ p
H:forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
  generalize (phi_bounded w).w:int31
p:Z
H:31 <= p
0 <= [|w|] < wB -> [|w|] = [|w|] mod 2 ^ p
H:forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
  symmetry; apply Zmod_small.w:int31
p:Z
H:31 <= p
H0:0 <= [|w|] < wB
0 <= [|w|] < 2 ^ p
H:forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
  split; auto with zarith.w:int31
p:Z
H:31 <= p
H0:0 <= [|w|] < wB
[|w|] < 2 ^ p
H:forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
  apply Z.lt_le_trans with wB; auto with zarith.w:int31
p:Z
H:31 <= p
H0:0 <= [|w|] < wB
wB <= 2 ^ p
H:forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
  apply Zpower_le_monotone; auto with zarith.H:forall (w : int31) (p : Z),
31 <= p -> [|w|] = [|w|] mod 2 ^ p
forall w p : int31,
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
 intros.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
[|match [|p|] ?= 31 with
  | Lt => addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)
  | _ => w
  end|] = [|w|] mod 2 ^ [|p|]
 case_eq ([|p|] ?= 31); intros;
  [ apply H; rewrite (Z.compare_eq _ _ H0); auto with zarith | |
    apply H; change ([|p|]>31)%Z in H0; auto with zarith ].H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:([|p|] ?= 31) = Lt
[|addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)|] =
[|w|] mod 2 ^ [|p|]
 change ([|p|]<31) in H0.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
[|addmuldiv31 p 0 (addmuldiv31 (31 - p) w 0)|] =
[|w|] mod 2 ^ [|p|]
 rewrite spec_add_mul_div by auto with zarith.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
([|0|] * 2 ^ [|p|] +
 [|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
 change [|0|] with 0%Z; rewrite Z.mul_0_l, Z.add_0_l.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
 generalize (phi_bounded p)(phi_bounded w); intros.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
 assert (31-[|p|]<wB).H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
31 - [|p|] < wB
H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
  apply Z.le_lt_trans with 31%Z; auto with zarith.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
31 < wB
H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
  compute; auto.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
 assert ([|31-p|]=31-[|p|]).H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
[|31 - p|] = 31 - [|p|]
H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
H4:[|31 - p|] = 31 - [|p|]
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
  unfold sub31; rewrite phi_phi_inv.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
([|31|] - [|p|]) mod wB = 31 - [|p|]
H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
H4:[|31 - p|] = 31 - [|p|]
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
  change [|31|] with 31%Z.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
(31 - [|p|]) mod wB = 31 - [|p|]
H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
H4:[|31 - p|] = 31 - [|p|]
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
  apply Zmod_small; auto with zarith.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
H4:[|31 - p|] = 31 - [|p|]
([|addmuldiv31 (31 - p) w 0|] / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
 rewrite spec_add_mul_div by (rewrite H4; auto with zarith).H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
H4:[|31 - p|] = 31 - [|p|]
(([|w|] * 2 ^ [|31 - p|] +
  [|0|] / 2 ^ (31 - [|31 - p|])) mod wB /
 2 ^ (31 - [|p|])) mod wB = [|w|] mod 2 ^ [|p|]
 change [|0|] with 0%Z; rewrite Zdiv_0_l, Z.add_0_r.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
H4:[|31 - p|] = 31 - [|p|]
(([|w|] * 2 ^ [|31 - p|]) mod wB / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
 rewrite H4.H:forall (w0 : int31) (p0 : Z),
31 <= p0 -> [|w0|] = [|w0|] mod 2 ^ p0
w, p:int31
H0:[|p|] < 31
H1:0 <= [|p|] < wB
H2:0 <= [|w|] < wB
H3:31 - [|p|] < wB
H4:[|31 - p|] = 31 - [|p|]
(([|w|] * 2 ^ (31 - [|p|])) mod wB / 2 ^ (31 - [|p|]))
mod wB = [|w|] mod 2 ^ [|p|]
 apply shift_unshift_mod_2; simpl; auto with zarith.
 Qed.

Shift operations

 Lemma spec_head00:  forall x, [|x|] = 0 -> [|head031 x|] = Zpos 31.forall x : int31, [|x|] = 0 -> [|head031 x|] = 31
 Proof.forall x : int31, [|x|] = 0 -> [|head031 x|] = 31
  intros.x:int31
H:[|x|] = 0
[|head031 x|] = 31
  generalize (phi_inv_phi x).x:int31
H:[|x|] = 0
phi_inv [|x|] = x -> [|head031 x|] = 31
  rewrite H; simpl phi_inv.x:int31
H:[|x|] = 0
On = x -> [|head031 x|] = 31
  intros H'; rewrite <- H'.x:int31
H:[|x|] = 0
H':On = x
[|head031 On|] = 31
  simpl; auto.
 Qed.

 Fixpoint head031_alt n x :=
  match n with
    | O => 0%nat
    | S n => match firstl x with
               | D0 => S (head031_alt n (shiftl x))
               | D1 => 0%nat
             end
  end.

 Lemma head031_equiv :
   forall x, [|head031 x|] = Z.of_nat (head031_alt size x).forall x : int31,
[|head031 x|] = Z.of_nat (head031_alt size x)
 Proof.forall x : int31,
[|head031 x|] = Z.of_nat (head031_alt size x)
 intros.x:int31
[|head031 x|] = Z.of_nat (head031_alt size x)
 case_eq (iszero x); intros.x:int31
H:iszero x = true
[|head031 x|] = Z.of_nat (head031_alt size x)
x:int31
H:iszero x = false
[|head031 x|] = Z.of_nat (head031_alt size x)
 rewrite (iszero_eq0 _ H).x:int31
H:iszero x = true
[|head031 0|] = Z.of_nat (head031_alt size 0)
x:int31
H:iszero x = false
[|head031 x|] = Z.of_nat (head031_alt size x)
 simpl; auto.x:int31
H:iszero x = false
[|head031 x|] = Z.of_nat (head031_alt size x)

 unfold head031, recl.x:int31
H:iszero x = false
[|recl_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x On|] = Z.of_nat (head031_alt size x)
 change On with (phi_inv (Z.of_nat (31-size))).x:int31
H:iszero x = false
[|recl_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - size)))|] =
Z.of_nat (head031_alt size x)
 replace (head031_alt size x) with
   (head031_alt size x + (31 - size))%nat by auto.x:int31
H:iszero x = false
[|recl_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - size)))|] =
Z.of_nat (head031_alt size x + (31 - size))
 assert (size <= 31)%nat by auto with arith.x:int31
H:iszero x = false
H0:(size <= 31)%nat
[|recl_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - size)))|] =
Z.of_nat (head031_alt size x + (31 - size))

 revert x H; induction size; intros.H0:(0 <= 31)%nat
x:int31
H:iszero x = false
[|recl_aux 0 (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - 0)))|] =
Z.of_nat (head031_alt 0 x + (31 - 0))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|recl_aux (S n) (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) x (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat (head031_alt (S n) x + (31 - S n))
 simpl; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|recl_aux (S n) (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) x (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat (head031_alt (S n) x + (31 - S n))
 unfold recl_aux; fold recl_aux.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|(if iszero x
   then fun _ : int31 => T31
   else
    fun n0 : int31 =>
    match firstl x with
    | D0 =>
        recl_aux n (int31 -> int31)
          (fun _ : int31 => T31)
          (fun (b : digits) (_ : int31)
             (rec : int31 -> int31) (n1 : int31) =>
           match b with
           | D0 => rec (n1 + In)%int31
           | D1 => n1
           end) (shiftl x) (n0 + In)%int31
    | D1 => n0
    end) (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat (head031_alt (S n) x + (31 - S n))
 unfold head031_alt; fold head031_alt.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|(if iszero x
   then fun _ : int31 => T31
   else
    fun n0 : int31 =>
    match firstl x with
    | D0 =>
        recl_aux n (int31 -> int31)
          (fun _ : int31 => T31)
          (fun (b : digits) (_ : int31)
             (rec : int31 -> int31) (n1 : int31) =>
           match b with
           | D0 => rec (n1 + In)%int31
           | D1 => n1
           end) (shiftl x) (n0 + In)%int31
    | D1 => n0
    end) (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
 rewrite H.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
 assert ([|phi_inv (Z.of_nat (31-S n))|] = Z.of_nat (31 - S n)).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
  rewrite phi_phi_inv.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) mod wB = Z.of_nat (31 - S n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
  apply Zmod_small.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
0 <= Z.of_nat (31 - S n) < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
  split.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
0 <= Z.of_nat (31 - S n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
  change 0 with (Z.of_nat O); apply inj_le; omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
  apply Z.le_lt_trans with (Z.of_nat 31).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) <= Z.of_nat 31
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat 31 < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
  apply inj_le; omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat 31 < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
  compute; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstl x with
  | D0 =>
      recl_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftl x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstl x with
   | D0 => S (head031_alt n (shiftl x))
   | D1 => 0
   end + (31 - S n))
 case_eq (firstl x); intros; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftl x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
Z.of_nat (S (head031_alt n (shiftl x)) + (31 - S n))
 rewrite plus_Sn_m, plus_n_Sm.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftl x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
Z.of_nat (head031_alt n (shiftl x) + S (31 - S n))
 replace (S (31 - S n)) with (31 - n)%nat by omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftl x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
Z.of_nat (head031_alt n (shiftl x) + (31 - n))
 rewrite <- IHn; [ | omega | ].n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftl x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftl x) (phi_inv (Z.of_nat (31 - n)))|]
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false
 f_equal; f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
(phi_inv (Z.of_nat (31 - S n)) + In)%int31 =
phi_inv (Z.of_nat (31 - n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false
 unfold add31.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
phi_inv ([|phi_inv (Z.of_nat (31 - S n))|] + [|In|]) =
phi_inv (Z.of_nat (31 - n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false
 rewrite H1.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
phi_inv (Z.of_nat (31 - S n) + [|In|]) =
phi_inv (Z.of_nat (31 - n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false
 f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
Z.of_nat (31 - S n) + [|In|] = Z.of_nat (31 - n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false
 change [|In|] with 1.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
Z.of_nat (31 - S n) + 1 = Z.of_nat (31 - n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false
 replace (31-n)%nat with (S (31 - S n))%nat by omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
Z.of_nat (31 - S n) + 1 = Z.of_nat (S (31 - S n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false
 rewrite Nat2Z.inj_succ; ring.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recl_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (head031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstl x = D0
iszero (shiftl x) = false

 clear - H H2.x:int31
H:iszero x = false
H2:firstl x = D0
iszero (shiftl x) = false
 rewrite (sneakr_shiftl x) in H.x:int31
H:iszero (sneakr (firstl x) (shiftl x)) = false
H2:firstl x = D0
iszero (shiftl x) = false
 rewrite H2 in H.x:int31
H:iszero (sneakr D0 (shiftl x)) = false
H2:firstl x = D0
iszero (shiftl x) = false
 case_eq (iszero (shiftl x)); intros; auto.x:int31
H:iszero (sneakr D0 (shiftl x)) = false
H2:firstl x = D0
H0:iszero (shiftl x) = true
true = false
 rewrite (iszero_eq0 _ H0) in H; discriminate.
 Qed.

 Lemma phi_nz : forall x, 0 < [|x|] <-> x <> 0%int31.forall x : int31, 0 < [|x|] <-> x <> 0%int31
 Proof.forall x : int31, 0 < [|x|] <-> x <> 0%int31
 split; intros.x:int31
H:0 < [|x|]
x <> 0%int31
x:int31
H:x <> 0%int31
0 < [|x|]
 red; intro; subst x; discriminate.x:int31
H:x <> 0%int31
0 < [|x|]
 assert ([|x|]<>0%Z).x:int31
H:x <> 0%int31
[|x|] <> 0
x:int31
H:x <> 0%int31
H0:[|x|] <> 0
0 < [|x|]
 contradict H.x:int31
H:[|x|] = 0
x = 0%int31
x:int31
H:x <> 0%int31
H0:[|x|] <> 0
0 < [|x|]
 rewrite <- (phi_inv_phi x); rewrite H; auto.x:int31
H:x <> 0%int31
H0:[|x|] <> 0
0 < [|x|]
 generalize (phi_bounded x); auto with zarith.
 Qed.

 Lemma spec_head0  : forall x,  0 < [|x|] ->
         wB/ 2 <= 2 ^ ([|head031 x|]) * [|x|] < wB.forall x : int31,
0 < [|x|] -> wB / 2 <= 2 ^ [|head031 x|] * [|x|] < wB
 Proof.forall x : int31,
0 < [|x|] -> wB / 2 <= 2 ^ [|head031 x|] * [|x|] < wB
 intros.x:int31
H:0 < [|x|]
wB / 2 <= 2 ^ [|head031 x|] * [|x|] < wB
 rewrite head031_equiv.x:int31
H:0 < [|x|]
wB / 2 <= 2 ^ Z.of_nat (head031_alt size x) * [|x|] <
wB
 assert (nshiftl x size = 0%int31).x:int31
H:0 < [|x|]
nshiftl x size = 0%int31
x:int31
H:0 < [|x|]
H0:nshiftl x size = 0%int31
wB / 2 <= 2 ^ Z.of_nat (head031_alt size x) * [|x|] <
wB
  apply nshiftl_size.x:int31
H:0 < [|x|]
H0:nshiftl x size = 0%int31
wB / 2 <= 2 ^ Z.of_nat (head031_alt size x) * [|x|] <
wB
 revert x H H0.forall x : int31,
0 < [|x|] ->
nshiftl x size = 0%int31 ->
wB / 2 <= 2 ^ Z.of_nat (head031_alt size x) * [|x|] <
wB
 unfold size at 2 5.forall x : int31,
0 < [|x|] ->
nshiftl x size = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt size x) * [|x|] <
2 ^ Z.of_nat 31
 induction size.forall x : int31,
0 < [|x|] ->
nshiftl x 0 = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt 0 x) * [|x|] <
2 ^ Z.of_nat 31
n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftl x n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x) * [|x|] <
2 ^ Z.of_nat 31
forall x : int31,
0 < [|x|] ->
nshiftl x (S n) = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt (S n) x) * [|x|] <
2 ^ Z.of_nat 31
 simpl Z.of_nat.forall x : int31,
0 < [|x|] ->
nshiftl x 0 = 0%int31 ->
2 ^ 31 / 2 <= 2 ^ 0 * [|x|] < 2 ^ 31
n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftl x n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x) * [|x|] <
2 ^ Z.of_nat 31
forall x : int31,
0 < [|x|] ->
nshiftl x (S n) = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt (S n) x) * [|x|] <
2 ^ Z.of_nat 31
 intros.x:int31
H:0 < [|x|]
H0:nshiftl x 0 = 0%int31
2 ^ 31 / 2 <= 2 ^ 0 * [|x|] < 2 ^ 31
n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftl x n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x) * [|x|] <
2 ^ Z.of_nat 31
forall x : int31,
0 < [|x|] ->
nshiftl x (S n) = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt (S n) x) * [|x|] <
2 ^ Z.of_nat 31
 compute in H0; rewrite H0 in H; discriminate.n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftl x n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x) * [|x|] <
2 ^ Z.of_nat 31
forall x : int31,
0 < [|x|] ->
nshiftl x (S n) = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt (S n) x) * [|x|] <
2 ^ Z.of_nat 31

 intros.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt (S n) x) * [|x|] <
2 ^ Z.of_nat 31
 simpl head031_alt.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
2 ^ Z.of_nat 31 / 2 <=
2
^ Z.of_nat
    match firstl x with
    | D0 => S (head031_alt n (shiftl x))
    | D1 => 0
    end * [|x|] < 2 ^ Z.of_nat 31
 case_eq (firstl x); intros.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (S (head031_alt n (shiftl x))) * [|x|] <
2 ^ Z.of_nat 31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31
 rewrite (Nat2Z.inj_succ (head031_alt n (shiftl x))), Z.pow_succ_r; auto with zarith.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
2 ^ Z.of_nat 31 / 2 <=
2 * 2 ^ Z.of_nat (head031_alt n (shiftl x)) * [|x|] <
2 ^ Z.of_nat 31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31
 rewrite <- Z.mul_assoc, Z.mul_comm, <- Z.mul_assoc, <-(Z.mul_comm 2).n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt n (shiftl x)) * (2 * [|x|]) <
2 ^ Z.of_nat 31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31
 rewrite <- Z.double_spec, <- (phi_twice_firstl _ H1).n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
2 ^ Z.of_nat 31 / 2 <=
2 ^ Z.of_nat (head031_alt n (shiftl x)) * [|twice x|] <
2 ^ Z.of_nat 31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31
 apply IHn.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
0 < [|twice x|]
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
nshiftl (twice x) n = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31

 rewrite phi_nz; rewrite phi_nz in H; contradict H.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
H:twice x = 0%int31
x = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
nshiftl (twice x) n = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31
 change twice with shiftl in H.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
H:shiftl x = 0%int31
x = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
nshiftl (twice x) n = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31
 rewrite (sneakr_shiftl x), H1, H; auto.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D0
nshiftl (twice x) n = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31

 rewrite <- nshiftl_S_tail; auto.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat 0 * [|x|] <
2 ^ Z.of_nat 31

 change (2^(Z.of_nat 0)) with 1; rewrite Z.mul_1_l.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
2 ^ Z.of_nat 31 / 2 <= [|x|] < 2 ^ Z.of_nat 31
 generalize (phi_bounded x); unfold size; split; auto with zarith.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
H2:0 <= [|x|] < 2 ^ Z.of_nat 31
2 ^ Z.of_nat 31 / 2 <= [|x|]
 change (2^(Z.of_nat 31)/2) with (2^(Z.of_nat (pred size))).n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftl x0 n = 0%int31 ->
2 ^ Z.of_nat 31 / 2 <= 2 ^ Z.of_nat (head031_alt n x0) * [|x0|] <
2 ^ Z.of_nat 31
x:int31
H:0 < [|x|]
H0:nshiftl x (S n) = 0%int31
H1:firstl x = D1
H2:0 <= [|x|] < 2 ^ Z.of_nat 31
2 ^ Z.of_nat (Init.Nat.pred size) <= [|x|]
 apply phi_lowerbound; auto.
 Qed.

 Lemma spec_tail00:  forall x, [|x|] = 0 -> [|tail031 x|] = Zpos 31.forall x : int31, [|x|] = 0 -> [|tail031 x|] = 31
 Proof.forall x : int31, [|x|] = 0 -> [|tail031 x|] = 31
  intros.x:int31
H:[|x|] = 0
[|tail031 x|] = 31
  generalize (phi_inv_phi x).x:int31
H:[|x|] = 0
phi_inv [|x|] = x -> [|tail031 x|] = 31
  rewrite H; simpl phi_inv.x:int31
H:[|x|] = 0
On = x -> [|tail031 x|] = 31
  intros H'; rewrite <- H'.x:int31
H:[|x|] = 0
H':On = x
[|tail031 On|] = 31
  simpl; auto.
 Qed.

 Fixpoint tail031_alt n x :=
  match n with
    | O => 0%nat
    | S n => match firstr x with
               | D0 => S (tail031_alt n (shiftr x))
               | D1 => 0%nat
             end
  end.

 Lemma tail031_equiv :
   forall x, [|tail031 x|] = Z.of_nat (tail031_alt size x).forall x : int31,
[|tail031 x|] = Z.of_nat (tail031_alt size x)
 Proof.forall x : int31,
[|tail031 x|] = Z.of_nat (tail031_alt size x)
 intros.x:int31
[|tail031 x|] = Z.of_nat (tail031_alt size x)
 case_eq (iszero x); intros.x:int31
H:iszero x = true
[|tail031 x|] = Z.of_nat (tail031_alt size x)
x:int31
H:iszero x = false
[|tail031 x|] = Z.of_nat (tail031_alt size x)
 rewrite (iszero_eq0 _ H).x:int31
H:iszero x = true
[|tail031 0|] = Z.of_nat (tail031_alt size 0)
x:int31
H:iszero x = false
[|tail031 x|] = Z.of_nat (tail031_alt size x)
 simpl; auto.x:int31
H:iszero x = false
[|tail031 x|] = Z.of_nat (tail031_alt size x)

 unfold tail031, recr.x:int31
H:iszero x = false
[|recr_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x On|] = Z.of_nat (tail031_alt size x)
 change On with (phi_inv (Z.of_nat (31-size))).x:int31
H:iszero x = false
[|recr_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - size)))|] =
Z.of_nat (tail031_alt size x)
 replace (tail031_alt size x) with
   (tail031_alt size x + (31 - size))%nat by auto.x:int31
H:iszero x = false
[|recr_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - size)))|] =
Z.of_nat (tail031_alt size x + (31 - size))
 assert (size <= 31)%nat by auto with arith.x:int31
H:iszero x = false
H0:(size <= 31)%nat
[|recr_aux size (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - size)))|] =
Z.of_nat (tail031_alt size x + (31 - size))

 revert x H; induction size; intros.H0:(0 <= 31)%nat
x:int31
H:iszero x = false
[|recr_aux 0 (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n : int31) =>
     match b with
     | D0 => rec (n + In)%int31
     | D1 => n
     end) x (phi_inv (Z.of_nat (31 - 0)))|] =
Z.of_nat (tail031_alt 0 x + (31 - 0))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|recr_aux (S n) (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) x (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat (tail031_alt (S n) x + (31 - S n))
 simpl; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|recr_aux (S n) (int31 -> int31)
    (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) x (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat (tail031_alt (S n) x + (31 - S n))
 unfold recr_aux; fold recr_aux.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|(if iszero x
   then fun _ : int31 => T31
   else
    fun n0 : int31 =>
    match firstr x with
    | D0 =>
        recr_aux n (int31 -> int31)
          (fun _ : int31 => T31)
          (fun (b : digits) (_ : int31)
             (rec : int31 -> int31) (n1 : int31) =>
           match b with
           | D0 => rec (n1 + In)%int31
           | D1 => n1
           end) (shiftr x) (n0 + In)%int31
    | D1 => n0
    end) (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat (tail031_alt (S n) x + (31 - S n))
 unfold tail031_alt; fold tail031_alt.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|(if iszero x
   then fun _ : int31 => T31
   else
    fun n0 : int31 =>
    match firstr x with
    | D0 =>
        recr_aux n (int31 -> int31)
          (fun _ : int31 => T31)
          (fun (b : digits) (_ : int31)
             (rec : int31 -> int31) (n1 : int31) =>
           match b with
           | D0 => rec (n1 + In)%int31
           | D1 => n1
           end) (shiftr x) (n0 + In)%int31
    | D1 => n0
    end) (phi_inv (Z.of_nat (31 - S n)))|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
 rewrite H.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
 assert ([|phi_inv (Z.of_nat (31-S n))|] = Z.of_nat (31 - S n)).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
  rewrite phi_phi_inv.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) mod wB = Z.of_nat (31 - S n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
  apply Zmod_small.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
0 <= Z.of_nat (31 - S n) < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
  split.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
0 <= Z.of_nat (31 - S n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
  change 0 with (Z.of_nat O); apply inj_le; omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
  apply Z.le_lt_trans with (Z.of_nat 31).n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat (31 - S n) <= Z.of_nat 31
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat 31 < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
  apply inj_le; omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
Z.of_nat 31 < wB
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
  compute; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
[|match firstr x with
  | D0 =>
      recr_aux n (int31 -> int31)
        (fun _ : int31 => T31)
        (fun (b : digits) (_ : int31)
           (rec : int31 -> int31) (n0 : int31) =>
         match b with
         | D0 => rec (n0 + In)%int31
         | D1 => n0
         end) (shiftr x)
        (phi_inv (Z.of_nat (31 - S n)) + In)%int31
  | D1 => phi_inv (Z.of_nat (31 - S n))
  end|] =
Z.of_nat
  (match firstr x with
   | D0 => S (tail031_alt n (shiftr x))
   | D1 => 0
   end + (31 - S n))
 case_eq (firstr x); intros; auto.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftr x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
Z.of_nat (S (tail031_alt n (shiftr x)) + (31 - S n))
 rewrite plus_Sn_m, plus_n_Sm.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftr x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
Z.of_nat (tail031_alt n (shiftr x) + S (31 - S n))
 replace (S (31 - S n)) with (31 - n)%nat by omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftr x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
Z.of_nat (tail031_alt n (shiftr x) + (31 - n))
 rewrite <- IHn; [ | omega | ].n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftr x)
    (phi_inv (Z.of_nat (31 - S n)) + In)%int31|] =
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
    (fun (b : digits) (_ : int31)
       (rec : int31 -> int31) (n0 : int31) =>
     match b with
     | D0 => rec (n0 + In)%int31
     | D1 => n0
     end) (shiftr x) (phi_inv (Z.of_nat (31 - n)))|]
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false
 f_equal; f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
(phi_inv (Z.of_nat (31 - S n)) + In)%int31 =
phi_inv (Z.of_nat (31 - n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false
 unfold add31.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
phi_inv ([|phi_inv (Z.of_nat (31 - S n))|] + [|In|]) =
phi_inv (Z.of_nat (31 - n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false
 rewrite H1.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
phi_inv (Z.of_nat (31 - S n) + [|In|]) =
phi_inv (Z.of_nat (31 - n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false
 f_equal.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
Z.of_nat (31 - S n) + [|In|] = Z.of_nat (31 - n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false
 change [|In|] with 1.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
Z.of_nat (31 - S n) + 1 = Z.of_nat (31 - n)
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false
 replace (31-n)%nat with (S (31 - S n))%nat by omega.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
Z.of_nat (31 - S n) + 1 = Z.of_nat (S (31 - S n))
n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false
 rewrite Nat2Z.inj_succ; ring.n:nat
H0:(S n <= 31)%nat
IHn:(n <= 31)%nat ->
forall x0 : int31,
iszero x0 = false ->
[|recr_aux n (int31 -> int31) (fun _ : int31 => T31)
(fun (b : digits) (_ : int31) (rec : int31 -> int31) (n0 : int31) =>
match b with
| D0 => rec (n0 + In)%int31
| D1 => n0
end) x0 (phi_inv (Z.of_nat (31 - n)))|] =
Z.of_nat (tail031_alt n x0 + (31 - n))
x:int31
H:iszero x = false
H1:[|phi_inv (Z.of_nat (31 - S n))|] =
Z.of_nat (31 - S n)
H2:firstr x = D0
iszero (shiftr x) = false

 clear - H H2.x:int31
H:iszero x = false
H2:firstr x = D0
iszero (shiftr x) = false
 rewrite (sneakl_shiftr x) in H.x:int31
H:iszero (sneakl (firstr x) (shiftr x)) = false
H2:firstr x = D0
iszero (shiftr x) = false
 rewrite H2 in H.x:int31
H:iszero (sneakl D0 (shiftr x)) = false
H2:firstr x = D0
iszero (shiftr x) = false
 case_eq (iszero (shiftr x)); intros; auto.x:int31
H:iszero (sneakl D0 (shiftr x)) = false
H2:firstr x = D0
H0:iszero (shiftr x) = true
true = false
 rewrite (iszero_eq0 _ H0) in H; discriminate.
 Qed.

 Lemma spec_tail0  : forall x, 0 < [|x|] ->
         exists y, 0 <= y /\ [|x|] = (2 * y + 1) * (2 ^ [|tail031 x|]).forall x : int31,
0 < [|x|] ->
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ [|tail031 x|]
 Proof.forall x : int31,
0 < [|x|] ->
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ [|tail031 x|]
 intros.x:int31
H:0 < [|x|]
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ [|tail031 x|]
 rewrite tail031_equiv.x:int31
H:0 < [|x|]
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt size x)
 assert (nshiftr x size = 0%int31).x:int31
H:0 < [|x|]
nshiftr x size = 0%int31
x:int31
H:0 < [|x|]
H0:nshiftr x size = 0%int31
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt size x)
  apply nshiftr_size.x:int31
H:0 < [|x|]
H0:nshiftr x size = 0%int31
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt size x)
 revert x H H0.forall x : int31,
0 < [|x|] ->
nshiftr x size = 0%int31 ->
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt size x)
 induction size.forall x : int31,
0 < [|x|] ->
nshiftr x 0 = 0%int31 ->
exists y : Z,
  0 <= y /\
  [|x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt 0 x)
n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftr x n = 0%int31 ->
exists y : Z, 0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x)
forall x : int31,
0 < [|x|] ->
nshiftr x (S n) = 0%int31 ->
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt (S n) x)
 simpl Z.of_nat.forall x : int31,
0 < [|x|] ->
nshiftr x 0 = 0%int31 ->
exists y : Z, 0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ 0
n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftr x n = 0%int31 ->
exists y : Z, 0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x)
forall x : int31,
0 < [|x|] ->
nshiftr x (S n) = 0%int31 ->
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt (S n) x)
 intros.x:int31
H:0 < [|x|]
H0:nshiftr x 0 = 0%int31
exists y : Z, 0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ 0
n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftr x n = 0%int31 ->
exists y : Z, 0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x)
forall x : int31,
0 < [|x|] ->
nshiftr x (S n) = 0%int31 ->
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt (S n) x)
 compute in H0; rewrite H0 in H; discriminate.n:nat
IHn:forall x : int31,
0 < [|x|] ->
nshiftr x n = 0%int31 ->
exists y : Z, 0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x)
forall x : int31,
0 < [|x|] ->
nshiftr x (S n) = 0%int31 ->
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt (S n) x)

 intros.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt (S n) x)
 simpl tail031_alt.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) *
  2
  ^ Z.of_nat
      match firstr x with
      | D0 => S (tail031_alt n (shiftr x))
      | D1 => 0
      end
 case_eq (firstr x); intros.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) *
  2 ^ Z.of_nat (S (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0
 rewrite (Nat2Z.inj_succ (tail031_alt n (shiftr x))), Z.pow_succ_r; auto with zarith.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
exists y : Z,
  0 <= y /\
  [|x|] =
  (2 * y + 1) *
  (2 * 2 ^ Z.of_nat (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0
 destruct (IHn (shiftr x)) as (y & Hy1 & Hy2).n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
0 < [|shiftr x|]
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
nshiftr (shiftr x) n = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y0 : Z,
0 <= y0 /\ [|x0|] = (2 * y0 + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
y:Z
Hy1:0 <= y
Hy2:[|shiftr x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n (shiftr x))
exists y0 : Z,
  0 <= y0 /\
  [|x|] =
  (2 * y0 + 1) *
  (2 * 2 ^ Z.of_nat (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0

 rewrite phi_nz; rewrite phi_nz in H; contradict H.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
H:shiftr x = 0%int31
x = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
nshiftr (shiftr x) n = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y0 : Z,
0 <= y0 /\ [|x0|] = (2 * y0 + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
y:Z
Hy1:0 <= y
Hy2:[|shiftr x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n (shiftr x))
exists y0 : Z,
  0 <= y0 /\
  [|x|] =
  (2 * y0 + 1) *
  (2 * 2 ^ Z.of_nat (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0
 rewrite (sneakl_shiftr x), H1, H; auto.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
nshiftr (shiftr x) n = 0%int31
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y0 : Z,
0 <= y0 /\ [|x0|] = (2 * y0 + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
y:Z
Hy1:0 <= y
Hy2:[|shiftr x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n (shiftr x))
exists y0 : Z,
  0 <= y0 /\
  [|x|] =
  (2 * y0 + 1) *
  (2 * 2 ^ Z.of_nat (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0

 rewrite <- nshiftr_S_tail; auto.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y0 : Z,
0 <= y0 /\ [|x0|] = (2 * y0 + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
y:Z
Hy1:0 <= y
Hy2:[|shiftr x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n (shiftr x))
exists y0 : Z,
  0 <= y0 /\
  [|x|] =
  (2 * y0 + 1) *
  (2 * 2 ^ Z.of_nat (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0

 exists y; split; auto.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y0 : Z,
0 <= y0 /\ [|x0|] = (2 * y0 + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
y:Z
Hy1:0 <= y
Hy2:[|shiftr x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n (shiftr x))
[|x|] =
(2 * y + 1) *
(2 * 2 ^ Z.of_nat (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0
 rewrite phi_eqn1; auto.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y0 : Z,
0 <= y0 /\ [|x0|] = (2 * y0 + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D0
y:Z
Hy1:0 <= y
Hy2:[|shiftr x|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n (shiftr x))
Z.double [|shiftr x|] =
(2 * y + 1) *
(2 * 2 ^ Z.of_nat (tail031_alt n (shiftr x)))
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0
 rewrite Z.double_spec, Hy2; ring.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
exists y : Z,
  0 <= y /\ [|x|] = (2 * y + 1) * 2 ^ Z.of_nat 0

 exists [|shiftr x|].n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
0 <= [|shiftr x|] /\
[|x|] = (2 * [|shiftr x|] + 1) * 2 ^ Z.of_nat 0
 split.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
0 <= [|shiftr x|]
n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
[|x|] = (2 * [|shiftr x|] + 1) * 2 ^ Z.of_nat 0
 generalize (phi_bounded (shiftr x)); auto with zarith.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
[|x|] = (2 * [|shiftr x|] + 1) * 2 ^ Z.of_nat 0
 rewrite phi_eqn2; auto.n:nat
IHn:forall x0 : int31,
0 < [|x0|] ->
nshiftr x0 n = 0%int31 ->
exists y : Z,
0 <= y /\ [|x0|] = (2 * y + 1) * 2 ^ Z.of_nat (tail031_alt n x0)
x:int31
H:0 < [|x|]
H0:nshiftr x (S n) = 0%int31
H1:firstr x = D1
Z.succ_double [|shiftr x|] =
(2 * [|shiftr x|] + 1) * 2 ^ Z.of_nat 0
 rewrite Z.succ_double_spec; simpl; ring.
 Qed.

 (* Sqrt *)

 (* Direct transcription of an old proof
     of a fortran program in boyer-moore *)

 Lemma quotient_by_2 a: a - 1 <= (a/2) + (a/2).a:Z
a - 1 <= a / 2 + a / 2
 Proof.a:Z
a - 1 <= a / 2 + a / 2
 case (Z_mod_lt a 2); auto with zarith.a:Z
0 <= a mod 2 -> a mod 2 < 2 -> a - 1 <= a / 2 + a / 2
 intros H1; rewrite Zmod_eq_full; auto with zarith.
 Qed.

 Lemma sqrt_main_trick j k: 0 <= j -> 0 <= k ->
   (j * k) + j <= ((j + k)/2 + 1)  ^ 2.j, k:Z
0 <= j -> 0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
 Proof.j, k:Z
0 <= j -> 0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
 intros Hj; generalize Hj k; pattern j; apply natlike_ind;
   auto; clear k j Hj.0 <= 0 ->
forall k : Z,
0 <= k -> 0 * k + 0 <= ((0 + k) / 2 + 1) ^ 2
forall x : Z,
0 <= x ->
(0 <= x ->
 forall k : Z,
 0 <= k -> x * k + x <= ((x + k) / 2 + 1) ^ 2) ->
0 <= Z.succ x ->
forall k : Z,
0 <= k ->
Z.succ x * k + Z.succ x <=
((Z.succ x + k) / 2 + 1) ^ 2
 intros _ k Hk; repeat rewrite Z.add_0_l.k:Z
Hk:0 <= k
0 <= (k / 2 + 1) ^ 2
forall x : Z,
0 <= x ->
(0 <= x ->
 forall k : Z,
 0 <= k -> x * k + x <= ((x + k) / 2 + 1) ^ 2) ->
0 <= Z.succ x ->
forall k : Z,
0 <= k ->
Z.succ x * k + Z.succ x <=
((Z.succ x + k) / 2 + 1) ^ 2
 apply  Z.mul_nonneg_nonneg; generalize (Z_div_pos k 2); auto with zarith.forall x : Z,
0 <= x ->
(0 <= x ->
 forall k : Z,
 0 <= k -> x * k + x <= ((x + k) / 2 + 1) ^ 2) ->
0 <= Z.succ x ->
forall k : Z,
0 <= k ->
Z.succ x * k + Z.succ x <=
((Z.succ x + k) / 2 + 1) ^ 2
 intros j Hj Hrec _ k Hk; pattern k; apply natlike_ind; auto; clear k Hk.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
Z.succ j * 0 + Z.succ j <=
((Z.succ j + 0) / 2 + 1) ^ 2
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
forall x : Z,
0 <= x ->
Z.succ j * x + Z.succ j <=
((Z.succ j + x) / 2 + 1) ^ 2 ->
Z.succ j * Z.succ x + Z.succ j <=
((Z.succ j + Z.succ x) / 2 + 1) ^ 2
 rewrite Z.mul_0_r, Z.add_0_r, Z.add_0_l.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
Z.succ j <= (Z.succ j / 2 + 1) ^ 2
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
forall x : Z,
0 <= x ->
Z.succ j * x + Z.succ j <=
((Z.succ j + x) / 2 + 1) ^ 2 ->
Z.succ j * Z.succ x + Z.succ j <=
((Z.succ j + Z.succ x) / 2 + 1) ^ 2
 generalize (sqr_pos (Z.succ j / 2)) (quotient_by_2 (Z.succ j));
   unfold Z.succ.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
(j + 1) / 2 * ((j + 1) / 2) >= 0 ->
j + 1 - 1 <= (j + 1) / 2 + (j + 1) / 2 ->
j + 1 <= ((j + 1) / 2 + 1) ^ 2
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
forall x : Z,
0 <= x ->
Z.succ j * x + Z.succ j <=
((Z.succ j + x) / 2 + 1) ^ 2 ->
Z.succ j * Z.succ x + Z.succ j <=
((Z.succ j + Z.succ x) / 2 + 1) ^ 2
 rewrite Z.pow_2_r, Z.mul_add_distr_r; repeat rewrite Z.mul_add_distr_l.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
(j + 1) / 2 * ((j + 1) / 2) >= 0 ->
j + 1 - 1 <= (j + 1) / 2 + (j + 1) / 2 ->
j + 1 <=
(j + 1) / 2 * ((j + 1) / 2) + (j + 1) / 2 * 1 +
(1 * ((j + 1) / 2) + 1 * 1)
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
forall x : Z,
0 <= x ->
Z.succ j * x + Z.succ j <=
((Z.succ j + x) / 2 + 1) ^ 2 ->
Z.succ j * Z.succ x + Z.succ j <=
((Z.succ j + Z.succ x) / 2 + 1) ^ 2
 auto with zarith.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k : Z,
0 <= k -> j * k + j <= ((j + k) / 2 + 1) ^ 2
forall x : Z,
0 <= x ->
Z.succ j * x + Z.succ j <=
((Z.succ j + x) / 2 + 1) ^ 2 ->
Z.succ j * Z.succ x + Z.succ j <=
((Z.succ j + Z.succ x) / 2 + 1) ^ 2
 intros k Hk _.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
Z.succ j * Z.succ k + Z.succ j <=
((Z.succ j + Z.succ k) / 2 + 1) ^ 2
 replace ((Z.succ j + Z.succ k) / 2) with ((j + k)/2 + 1).j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
Z.succ j * Z.succ k + Z.succ j <=
((j + k) / 2 + 1 + 1) ^ 2
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
(j + k) / 2 + 1 = (Z.succ j + Z.succ k) / 2
 generalize (Hrec Hj k Hk) (quotient_by_2 (j + k)).j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
j * k + j <= ((j + k) / 2 + 1) ^ 2 ->
j + k - 1 <= (j + k) / 2 + (j + k) / 2 ->
Z.succ j * Z.succ k + Z.succ j <=
((j + k) / 2 + 1 + 1) ^ 2
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
(j + k) / 2 + 1 = (Z.succ j + Z.succ k) / 2
 unfold Z.succ; repeat rewrite Z.pow_2_r;
   repeat rewrite Z.mul_add_distr_r; repeat rewrite Z.mul_add_distr_l.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
j * k + j <=
(j + k) / 2 * ((j + k) / 2) + (j + k) / 2 * 1 +
(1 * ((j + k) / 2) + 1 * 1) ->
j + k - 1 <= (j + k) / 2 + (j + k) / 2 ->
j * k + j * 1 + (1 * k + 1 * 1) + (j + 1) <=
(j + k) / 2 * ((j + k) / 2) + (j + k) / 2 * 1 +
(j + k) / 2 * 1 + (1 * ((j + k) / 2) + 1 * 1 + 1 * 1) +
(1 * ((j + k) / 2) + 1 * 1 + 1 * 1)
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
(j + k) / 2 + 1 = (Z.succ j + Z.succ k) / 2
 repeat rewrite Z.mul_1_l; repeat rewrite Z.mul_1_r.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
j * k + j <=
(j + k) / 2 * ((j + k) / 2) + (j + k) / 2 +
((j + k) / 2 + 1) ->
j + k - 1 <= (j + k) / 2 + (j + k) / 2 ->
j * k + j + (k + 1) + (j + 1) <=
(j + k) / 2 * ((j + k) / 2) + (j + k) / 2 +
(j + k) / 2 + ((j + k) / 2 + 1 + 1) +
((j + k) / 2 + 1 + 1)
j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
(j + k) / 2 + 1 = (Z.succ j + Z.succ k) / 2
 auto with zarith.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
(j + k) / 2 + 1 = (Z.succ j + Z.succ k) / 2
 rewrite Z.add_comm, <- Z_div_plus_full_l; auto with zarith.j:Z
Hj:0 <= j
Hrec:0 <= j ->
forall k0 : Z,
0 <= k0 -> j * k0 + j <= ((j + k0) / 2 + 1) ^ 2
k:Z
Hk:0 <= k
(1 * 2 + (j + k)) / 2 = (Z.succ j + Z.succ k) / 2
 apply f_equal2 with (f := Z.div); auto with zarith.
 Qed.

 Lemma sqrt_main i j: 0 <= i -> 0 < j -> i < ((j + (i/j))/2 + 1) ^ 2.i, j:Z
0 <= i -> 0 < j -> i < ((j + i / j) / 2 + 1) ^ 2
 Proof.i, j:Z
0 <= i -> 0 < j -> i < ((j + i / j) / 2 + 1) ^ 2
 intros Hi Hj.i, j:Z
Hi:0 <= i
Hj:0 < j
i < ((j + i / j) / 2 + 1) ^ 2
 assert (Hij: 0 <= i/j) by (apply Z_div_pos; auto with zarith).i, j:Z
Hi:0 <= i
Hj:0 < j
Hij:0 <= i / j
i < ((j + i / j) / 2 + 1) ^ 2
 apply Z.lt_le_trans with (2 := sqrt_main_trick _ _ (Z.lt_le_incl _ _ Hj) Hij).i, j:Z
Hi:0 <= i
Hj:0 < j
Hij:0 <= i / j
i < j * (i / j) + j
 pattern i at 1; rewrite (Z_div_mod_eq i j); case (Z_mod_lt i j); auto with zarith.
 Qed.

 Lemma sqrt_init i: 1 < i -> i < (i/2 + 1) ^ 2.i:Z
1 < i -> i < (i / 2 + 1) ^ 2
 Proof.i:Z
1 < i -> i < (i / 2 + 1) ^ 2
 intros Hi.i:Z
Hi:1 < i
i < (i / 2 + 1) ^ 2
 assert (H1: 0 <= i - 2) by auto with zarith.i:Z
Hi:1 < i
H1:0 <= i - 2
i < (i / 2 + 1) ^ 2
 assert (H2: 1 <= (i / 2) ^ 2); auto with zarith.i:Z
Hi:1 < i
H1:0 <= i - 2
1 <= (i / 2) ^ 2
i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= (i / 2) ^ 2
i < (i / 2 + 1) ^ 2
   replace i with (1* 2 + (i - 2)); auto with zarith.i:Z
Hi:1 < i
H1:0 <= i - 2
1 <= ((1 * 2 + (i - 2)) / 2) ^ 2
i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= (i / 2) ^ 2
i < (i / 2 + 1) ^ 2
   rewrite Z.pow_2_r, Z_div_plus_full_l; auto with zarith.i:Z
Hi:1 < i
H1:0 <= i - 2
1 <= (1 + (i - 2) / 2) * (1 + (i - 2) / 2)
i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= (i / 2) ^ 2
i < (i / 2 + 1) ^ 2
   generalize (sqr_pos ((i - 2)/ 2)) (Z_div_pos (i - 2) 2).i:Z
Hi:1 < i
H1:0 <= i - 2
(i - 2) / 2 * ((i - 2) / 2) >= 0 ->
(2 > 0 -> 0 <= i - 2 -> 0 <= (i - 2) / 2) ->
1 <= (1 + (i - 2) / 2) * (1 + (i - 2) / 2)
i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= (i / 2) ^ 2
i < (i / 2 + 1) ^ 2
   rewrite Z.mul_add_distr_r; repeat rewrite Z.mul_add_distr_l.i:Z
Hi:1 < i
H1:0 <= i - 2
(i - 2) / 2 * ((i - 2) / 2) >= 0 ->
(2 > 0 -> 0 <= i - 2 -> 0 <= (i - 2) / 2) ->
1 <=
1 * 1 + 1 * ((i - 2) / 2) +
((i - 2) / 2 * 1 + (i - 2) / 2 * ((i - 2) / 2))
i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= (i / 2) ^ 2
i < (i / 2 + 1) ^ 2
   auto with zarith.i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= (i / 2) ^ 2
i < (i / 2 + 1) ^ 2
 generalize (quotient_by_2 i).i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= (i / 2) ^ 2
i - 1 <= i / 2 + i / 2 -> i < (i / 2 + 1) ^ 2
 rewrite Z.pow_2_r in H2 |- *;
   repeat (rewrite Z.mul_add_distr_r ||
           rewrite Z.mul_add_distr_l ||
           rewrite Z.mul_1_l || rewrite Z.mul_1_r).i:Z
Hi:1 < i
H1:0 <= i - 2
H2:1 <= i / 2 * (i / 2)
i - 1 <= i / 2 + i / 2 ->
i < i / 2 * (i / 2) + i / 2 + (i / 2 + 1)
   auto with zarith.
 Qed.

 Lemma sqrt_test_true i j: 0 <= i -> 0 < j -> i/j >= j -> j ^ 2 <= i.i, j:Z
0 <= i -> 0 < j -> i / j >= j -> j ^ 2 <= i
 Proof.i, j:Z
0 <= i -> 0 < j -> i / j >= j -> j ^ 2 <= i
 intros Hi Hj Hd; rewrite Z.pow_2_r.i, j:Z
Hi:0 <= i
Hj:0 < j
Hd:i / j >= j
j * j <= i
 apply Z.le_trans with (j * (i/j)); auto with zarith.i, j:Z
Hi:0 <= i
Hj:0 < j
Hd:i / j >= j
j * (i / j) <= i
 apply Z_mult_div_ge; auto with zarith.
 Qed.

 Lemma sqrt_test_false i j: 0 <= i -> 0 < j -> i/j < j ->  (j + (i/j))/2 < j.i, j:Z
0 <= i -> 0 < j -> i / j < j -> (j + i / j) / 2 < j
 Proof.i, j:Z
0 <= i -> 0 < j -> i / j < j -> (j + i / j) / 2 < j
 intros Hi Hj H; case (Z.le_gt_cases j ((j + (i/j))/2)); auto.i, j:Z
Hi:0 <= i
Hj:0 < j
H:i / j < j
j <= (j + i / j) / 2 -> (j + i / j) / 2 < j
 intros H1; contradict H; apply Z.le_ngt.i, j:Z
Hi:0 <= i
Hj:0 < j
H1:j <= (j + i / j) / 2
j <= i / j
 assert (2 * j <= j + (i/j)); auto with zarith.i, j:Z
Hi:0 <= i
Hj:0 < j
H1:j <= (j + i / j) / 2
2 * j <= j + i / j
 apply Z.le_trans with (2 * ((j + (i/j))/2)); auto with zarith.i, j:Z
Hi:0 <= i
Hj:0 < j
H1:j <= (j + i / j) / 2
2 * ((j + i / j) / 2) <= j + i / j
 apply Z_mult_div_ge; auto with zarith.
 Qed.

 Lemma sqrt31_step_def rec i j:
   sqrt31_step rec i j =
   match (fst (i/j) ?= j)%int31 with
     Lt => rec i (fst ((j + fst(i/j))/2))%int31
   | _ =>  j
   end.rec:int31 -> int31 -> int31
i, j:int31
sqrt31_step rec i j =
match (fst (i / j) ?= j)%int31 with
| Lt => rec i (fst ((j + fst (i / j)) / 2)%int31)
| _ => j
end
 Proof.rec:int31 -> int31 -> int31
i, j:int31
sqrt31_step rec i j =
match (fst (i / j) ?= j)%int31 with
| Lt => rec i (fst ((j + fst (i / j)) / 2)%int31)
| _ => j
end
 unfold sqrt31_step; case div31; intros.rec:int31 -> int31 -> int31
i, j, i0, i1:int31
match (i0 ?= j)%int31 with
| Lt => rec i (fst ((j + i0) / 2)%int31)
| _ => j
end =
match (fst (i0, i1) ?= j)%int31 with
| Lt => rec i (fst ((j + fst (i0, i1)) / 2)%int31)
| _ => j
end
 simpl; case compare31; auto.
 Qed.

 Lemma div31_phi i j: 0 < [|j|] -> [|fst (i/j)%int31|] = [|i|]/[|j|].i, j:int31
0 < [|j|] -> [|fst (i / j)%int31|] = [|i|] / [|j|]
 intros Hj; generalize (spec_div i j Hj).i, j:int31
Hj:0 < [|j|]
(let (q, r) := (i / j)%int31 in
 [|i|] = [|q|] * [|j|] + [|r|] /\ 0 <= [|r|] < [|j|]) ->
[|fst (i / j)%int31|] = [|i|] / [|j|]
 case div31; intros q r; simpl @fst.i, j:int31
Hj:0 < [|j|]
q, r:int31
[|i|] = [|q|] * [|j|] + [|r|] /\ 0 <= [|r|] < [|j|] ->
[|q|] = [|i|] / [|j|]
 intros (H1,H2); apply Zdiv_unique with [|r|]; auto with zarith.i, j:int31
Hj:0 < [|j|]
q, r:int31
H1:[|i|] = [|q|] * [|j|] + [|r|]
H2:0 <= [|r|] < [|j|]
[|i|] = [|j|] * [|q|] + [|r|]
 rewrite H1; ring.
 Qed.

 Lemma sqrt31_step_correct rec i j:
  0 < [|i|] -> 0 < [|j|] -> [|i|] < ([|j|] + 1) ^ 2 ->
   2 * [|j|] < wB ->
  (forall j1 : int31,
    0 < [|j1|] < [|j|] -> [|i|] < ([|j1|] + 1) ^ 2 ->
    [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
  [|sqrt31_step rec i j|] ^ 2 <= [|i|] < ([|sqrt31_step rec i j|] + 1) ^ 2.rec:int31 -> int31 -> int31
i, j:int31
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] < [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step rec i j|] ^ 2 <= [|i|] <
([|sqrt31_step rec i j|] + 1) ^ 2
 Proof.rec:int31 -> int31 -> int31
i, j:int31
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] < [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step rec i j|] ^ 2 <= [|i|] <
([|sqrt31_step rec i j|] + 1) ^ 2
 assert (Hp2: 0 < [|2|]) by exact (eq_refl Lt).rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] < [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step rec i j|] ^ 2 <= [|i|] <
([|sqrt31_step rec i j|] + 1) ^ 2
 intros Hi Hj Hij H31 Hrec; rewrite sqrt31_step_def.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
[|match (fst (i / j) ?= j)%int31 with
  | Lt => rec i (fst ((j + fst (i / j)) / 2)%int31)
  | _ => j
  end|] ^ 2 <= [|i|] <
([|match (fst (i / j) ?= j)%int31 with
   | Lt => rec i (fst ((j + fst (i / j)) / 2)%int31)
   | _ => j
   end|] + 1) ^ 2
 rewrite spec_compare, div31_phi; auto.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
[|match [|i|] / [|j|] ?= [|j|] with
  | Lt => rec i (fst ((j + fst (i / j)) / 2)%int31)
  | _ => j
  end|] ^ 2 <= [|i|] <
([|match [|i|] / [|j|] ?= [|j|] with
   | Lt => rec i (fst ((j + fst (i / j)) / 2)%int31)
   | _ => j
   end|] + 1) ^ 2
 case Z.compare_spec; auto; intros Hc;
   try (split; auto; apply sqrt_test_true; auto with zarith; fail).rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
[|rec i (fst ((j + fst (i / j)) / 2)%int31)|] ^ 2 <=
[|i|] <
([|rec i (fst ((j + fst (i / j)) / 2)%int31)|] + 1)
^ 2
 assert (E : [|(j + fst (i / j)%int31)|] = [|j|] + [|i|] / [|j|]).rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
[|rec i (fst ((j + fst (i / j)) / 2)%int31)|] ^ 2 <=
[|i|] <
([|rec i (fst ((j + fst (i / j)) / 2)%int31)|] + 1)
^ 2
 {rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|] rewrite spec_add, div31_phi; auto using Z.mod_small with zarith. }rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
[|rec i (fst ((j + fst (i / j)) / 2)%int31)|] ^ 2 <=
[|i|] <
([|rec i (fst ((j + fst (i / j)) / 2)%int31)|] + 1)
^ 2
 apply Hrec; rewrite !div31_phi, E; auto using sqrt_main with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|] < [|j|]
 split; try apply sqrt_test_false; auto with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|]
 apply Z.le_succ_l in Hj.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:Z.succ 0 <= [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|] change (1 <= [|j|]) in Hj.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 <= [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|]
 Z.le_elim Hj.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|]
rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 = [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|]
 -rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|] replace ([|j|] + [|i|]/[|j|]) with
   (1 * 2 + (([|j|] - 2) + [|i|] / [|j|])) by ring.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < (1 * 2 + ([|j|] - 2 + [|i|] / [|j|])) / [|2|]
   rewrite Z_div_plus_full_l; auto with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < 1 + ([|j|] - 2 + [|i|] / [|j|]) / [|2|]
   assert (0 <= [|i|]/ [|j|]) by auto with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
H:0 <= [|i|] / [|j|]
0 < 1 + ([|j|] - 2 + [|i|] / [|j|]) / [|2|]
   assert (0 <= ([|j|] - 2 + [|i|] / [|j|]) / [|2|]); auto with zarith.
 -rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 = [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < ([|j|] + [|i|] / [|j|]) / [|2|] rewrite <- Hj, Zdiv_1_r.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 = [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < (1 + [|i|]) / [|2|]
   replace (1 + [|i|]) with (1 * 2 + ([|i|] - 1)) by ring.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 = [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < (1 * 2 + ([|i|] - 1)) / [|2|]
   rewrite Z_div_plus_full_l; auto with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 = [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
0 < 1 + ([|i|] - 1) / [|2|]
   assert (0 <= ([|i|] - 1) /2) by auto with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hp2:0 < [|2|]
Hi:0 < [|i|]
Hj:1 = [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
Hc:[|i|] / [|j|] < [|j|]
E:[|j + fst (i / j)%int31|] = [|j|] + [|i|] / [|j|]
H:0 <= ([|i|] - 1) / 2
0 < 1 + ([|i|] - 1) / [|2|]
   change ([|2|]) with 2; auto with zarith.
 Qed.

 Lemma iter31_sqrt_correct n rec i j: 0 < [|i|] -> 0 < [|j|] ->
  [|i|] < ([|j|] + 1) ^ 2 -> 2 * [|j|] < 2 ^ (Z.of_nat size) ->
  (forall j1, 0 < [|j1|] -> 2^(Z.of_nat n) + [|j1|] <= [|j|] ->
      [|i|] < ([|j1|] + 1) ^ 2 -> 2 * [|j1|] < 2 ^ (Z.of_nat size) ->
       [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
  [|iter31_sqrt n rec i j|] ^ 2 <= [|i|] < ([|iter31_sqrt n rec i j|] + 1) ^ 2.n:nat
rec:int31 -> int31 -> int31
i, j:int31
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|iter31_sqrt n rec i j|] ^ 2 <= [|i|] <
([|iter31_sqrt n rec i j|] + 1) ^ 2
 Proof.n:nat
rec:int31 -> int31 -> int31
i, j:int31
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|iter31_sqrt n rec i j|] ^ 2 <= [|i|] <
([|iter31_sqrt n rec i j|] + 1) ^ 2
 revert rec i j; elim n; unfold iter31_sqrt; fold iter31_sqrt; clear n.forall (rec : int31 -> int31 -> int31) (i j : int31),
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat 0 + [|j1|] <= [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step rec i j|] ^ 2 <= [|i|] <
([|sqrt31_step rec i j|] + 1) ^ 2
forall n : nat,
(forall (rec : int31 -> int31 -> int31) (i j : int31),
 0 < [|i|] ->
 0 < [|j|] ->
 [|i|] < ([|j|] + 1) ^ 2 ->
 2 * [|j|] < wB ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  [|i|] < ([|j1|] + 1) ^ 2 ->
  2 * [|j1|] < wB ->
  [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
 [|iter31_sqrt n rec i j|] ^ 2 <= [|i|] <
 ([|iter31_sqrt n rec i j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31) (i j : int31),
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|]
^ 2 <= [|i|] <
([|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|] +
 1) ^ 2
 intros rec i j Hi Hj Hij H31 Hrec; apply sqrt31_step_correct; auto with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 0 + [|j1|] <= [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2
forall n : nat,
(forall (rec : int31 -> int31 -> int31) (i j : int31),
 0 < [|i|] ->
 0 < [|j|] ->
 [|i|] < ([|j|] + 1) ^ 2 ->
 2 * [|j|] < wB ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  [|i|] < ([|j1|] + 1) ^ 2 ->
  2 * [|j1|] < wB ->
  [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
 [|iter31_sqrt n rec i j|] ^ 2 <= [|i|] <
 ([|iter31_sqrt n rec i j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31) (i j : int31),
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|]
^ 2 <= [|i|] <
([|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|] +
 1) ^ 2
 intros; apply Hrec; auto with zarith.rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
Hrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat 0 + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
H:0 < [|j1|] < [|j|]
H0:[|i|] < ([|j1|] + 1) ^ 2
2 ^ Z.of_nat 0 + [|j1|] <= [|j|]
forall n : nat,
(forall (rec : int31 -> int31 -> int31) (i j : int31),
 0 < [|i|] ->
 0 < [|j|] ->
 [|i|] < ([|j|] + 1) ^ 2 ->
 2 * [|j|] < wB ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  [|i|] < ([|j1|] + 1) ^ 2 ->
  2 * [|j1|] < wB ->
  [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
 [|iter31_sqrt n rec i j|] ^ 2 <= [|i|] <
 ([|iter31_sqrt n rec i j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31) (i j : int31),
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|]
^ 2 <= [|i|] <
([|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|] +
 1) ^ 2
 rewrite Z.pow_0_r; auto with zarith.forall n : nat,
(forall (rec : int31 -> int31 -> int31) (i j : int31),
 0 < [|i|] ->
 0 < [|j|] ->
 [|i|] < ([|j|] + 1) ^ 2 ->
 2 * [|j|] < wB ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  [|i|] < ([|j1|] + 1) ^ 2 ->
  2 * [|j1|] < wB ->
  [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
 [|iter31_sqrt n rec i j|] ^ 2 <= [|i|] <
 ([|iter31_sqrt n rec i j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31) (i j : int31),
0 < [|i|] ->
0 < [|j|] ->
[|i|] < ([|j|] + 1) ^ 2 ->
2 * [|j|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 [|i|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec i j1|] ^ 2 <= [|i|] < ([|rec i j1|] + 1) ^ 2) ->
[|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|]
^ 2 <= [|i|] <
([|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|] +
 1) ^ 2
 intros n Hrec rec i j Hi Hj Hij H31 HHrec.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j0|] ->
 [|i0|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec0 i0 j1|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j1|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
[|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|]
^ 2 <= [|i|] <
([|sqrt31_step (iter31_sqrt n (iter31_sqrt n rec)) i j|] +
 1) ^ 2
 apply sqrt31_step_correct; auto.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j0|] ->
 [|i0|] < ([|j1|] + 1) ^ 2 ->
 2 * [|j1|] < wB ->
 [|rec0 i0 j1|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j1|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|rec i j1|] ^ 2 <= [|i|] <
([|rec i j1|] + 1) ^ 2
forall j1 : int31,
0 < [|j1|] < [|j|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
[|iter31_sqrt n (iter31_sqrt n rec) i j1|] ^ 2 <=
[|i|] <
([|iter31_sqrt n (iter31_sqrt n rec) i j1|] + 1) ^ 2
 intros j1 Hj1  Hjp1; apply Hrec; auto with zarith.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j2 : int31,
 0 < [|j2|] ->
 2 ^ Z.of_nat n + [|j2|] <= [|j0|] ->
 [|i0|] < ([|j2|] + 1) ^ 2 ->
 2 * [|j2|] < wB ->
 [|rec0 i0 j2|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j2|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:[|i|] < ([|j1|] + 1) ^ 2
forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat n + [|j0|] <= [|j1|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|iter31_sqrt n rec i j0|] ^ 2 <= [|i|] <
([|iter31_sqrt n rec i j0|] + 1) ^ 2
 intros j2 Hj2 H2j2 Hjp2 Hj31; apply Hrec; auto with zarith.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j3 : int31,
 0 < [|j3|] ->
 2 ^ Z.of_nat n + [|j3|] <= [|j0|] ->
 [|i0|] < ([|j3|] + 1) ^ 2 ->
 2 * [|j3|] < wB ->
 [|rec0 i0 j3|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j3|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:[|i|] < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:[|i|] < ([|j2|] + 1) ^ 2
Hj31:2 * [|j2|] < wB
forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat n + [|j0|] <= [|j2|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] < ([|rec i j0|] + 1) ^ 2
 intros j3 Hj3 Hpj3.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 [|i0|] < ([|j4|] + 1) ^ 2 ->
 2 * [|j4|] < wB ->
 [|rec0 i0 j4|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j4|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:[|i|] < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:[|i|] < ([|j2|] + 1) ^ 2
Hj31:2 * [|j2|] < wB
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
[|i|] < ([|j3|] + 1) ^ 2 ->
2 * [|j3|] < wB ->
[|rec i j3|] ^ 2 <= [|i|] < ([|rec i j3|] + 1) ^ 2
 apply HHrec; auto.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 [|i0|] < ([|j4|] + 1) ^ 2 ->
 2 * [|j4|] < wB ->
 [|rec0 i0 j4|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j4|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:[|i|] < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:[|i|] < ([|j2|] + 1) ^ 2
Hj31:2 * [|j2|] < wB
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
2 ^ Z.of_nat (S n) + [|j3|] <= [|j|]
 rewrite Nat2Z.inj_succ, Z.pow_succ_r.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 [|i0|] < ([|j4|] + 1) ^ 2 ->
 2 * [|j4|] < wB ->
 [|rec0 i0 j4|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j4|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:[|i|] < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:[|i|] < ([|j2|] + 1) ^ 2
Hj31:2 * [|j2|] < wB
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
2 * 2 ^ Z.of_nat n + [|j3|] <= [|j|]
n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 [|i0|] < ([|j4|] + 1) ^ 2 ->
 2 * [|j4|] < wB ->
 [|rec0 i0 j4|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j4|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:[|i|] < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:[|i|] < ([|j2|] + 1) ^ 2
Hj31:2 * [|j2|] < wB
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
0 <= Z.of_nat n
 apply Z.le_trans with (2 ^Z.of_nat n + [|j2|]); auto with zarith.n:nat
Hrec:forall (rec0 : int31 -> int31 -> int31)
  (i0 j0 : int31),
0 < [|i0|] ->
0 < [|j0|] ->
[|i0|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 [|i0|] < ([|j4|] + 1) ^ 2 ->
 2 * [|j4|] < wB ->
 [|rec0 i0 j4|] ^ 2 <= [|i0|] <
 ([|rec0 i0 j4|] + 1) ^ 2) ->
[|iter31_sqrt n rec0 i0 j0|] ^ 2 <= [|i0|] <
([|iter31_sqrt n rec0 i0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31
i, j:int31
Hi:0 < [|i|]
Hj:0 < [|j|]
Hij:[|i|] < ([|j|] + 1) ^ 2
H31:2 * [|j|] < wB
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
[|i|] < ([|j0|] + 1) ^ 2 ->
2 * [|j0|] < wB ->
[|rec i j0|] ^ 2 <= [|i|] <
([|rec i j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:[|i|] < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:[|i|] < ([|j2|] + 1) ^ 2
Hj31:2 * [|j2|] < wB
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
0 <= Z.of_nat n
 apply Nat2Z.is_nonneg.
 Qed.

 Lemma spec_sqrt : forall x,
       [|sqrt31 x|] ^ 2 <= [|x|] < ([|sqrt31 x|] + 1) ^ 2.forall x : int31,
[|sqrt31 x|] ^ 2 <= [|x|] < ([|sqrt31 x|] + 1) ^ 2
 Proof.forall x : int31,
[|sqrt31 x|] ^ 2 <= [|x|] < ([|sqrt31 x|] + 1) ^ 2
 intros i; unfold sqrt31.i:int31
[|match (1 ?= i)%int31 with
  | Eq => 1
  | Lt =>
      iter31_sqrt 31 (fun _ j : int31 => j) i
        (fst (i / 2)%int31)
  | Gt => 0
  end|] ^ 2 <= [|i|] <
([|match (1 ?= i)%int31 with
   | Eq => 1
   | Lt =>
       iter31_sqrt 31 (fun _ j : int31 => j) i
         (fst (i / 2)%int31)
   | Gt => 0
   end|] + 1) ^ 2
 rewrite spec_compare.i:int31
[|match [|1|] ?= [|i|] with
  | Eq => 1
  | Lt =>
      iter31_sqrt 31 (fun _ j : int31 => j) i
        (fst (i / 2)%int31)
  | Gt => 0
  end|] ^ 2 <= [|i|] <
([|match [|1|] ?= [|i|] with
   | Eq => 1
   | Lt =>
       iter31_sqrt 31 (fun _ j : int31 => j) i
         (fst (i / 2)%int31)
   | Gt => 0
   end|] + 1) ^ 2 case Z.compare_spec; change [|1|] with 1;
   intros Hi; auto with zarith.i:int31
Hi:1 = [|i|]
1 ^ 2 <= [|i|] < (1 + 1) ^ 2
i:int31
Hi:1 < [|i|]
[|iter31_sqrt 31 (fun _ j : int31 => j) i
    (fst (i / 2)%int31)|] ^ 2 <= [|i|] <
([|iter31_sqrt 31 (fun _ j : int31 => j) i
     (fst (i / 2)%int31)|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 repeat rewrite Z.pow_2_r; auto with zarith.i:int31
Hi:1 < [|i|]
[|iter31_sqrt 31 (fun _ j : int31 => j) i
    (fst (i / 2)%int31)|] ^ 2 <= [|i|] <
([|iter31_sqrt 31 (fun _ j : int31 => j) i
     (fst (i / 2)%int31)|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 apply iter31_sqrt_correct; auto with zarith.i:int31
Hi:1 < [|i|]
0 < [|fst (i / 2)%int31|]
i:int31
Hi:1 < [|i|]
[|i|] < ([|fst (i / 2)%int31|] + 1) ^ 2
i:int31
Hi:1 < [|i|]
2 * [|fst (i / 2)%int31|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
  rewrite div31_phi; change ([|2|]) with 2;  auto with zarith.i:int31
Hi:1 < [|i|]
0 < [|i|] / 2
i:int31
Hi:1 < [|i|]
[|i|] < ([|fst (i / 2)%int31|] + 1) ^ 2
i:int31
Hi:1 < [|i|]
2 * [|fst (i / 2)%int31|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
  replace ([|i|]) with (1 * 2 + ([|i|] - 2))%Z; try ring.i:int31
Hi:1 < [|i|]
0 < (1 * 2 + ([|i|] - 2)) / 2
i:int31
Hi:1 < [|i|]
[|i|] < ([|fst (i / 2)%int31|] + 1) ^ 2
i:int31
Hi:1 < [|i|]
2 * [|fst (i / 2)%int31|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
  assert (0 <= ([|i|] - 2)/2)%Z by (apply Z_div_pos; auto with zarith).i:int31
Hi:1 < [|i|]
H:0 <= ([|i|] - 2) / 2
0 < (1 * 2 + ([|i|] - 2)) / 2
i:int31
Hi:1 < [|i|]
[|i|] < ([|fst (i / 2)%int31|] + 1) ^ 2
i:int31
Hi:1 < [|i|]
2 * [|fst (i / 2)%int31|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
  rewrite Z_div_plus_full_l; auto with zarith.i:int31
Hi:1 < [|i|]
[|i|] < ([|fst (i / 2)%int31|] + 1) ^ 2
i:int31
Hi:1 < [|i|]
2 * [|fst (i / 2)%int31|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
  rewrite div31_phi; change ([|2|]) with 2; auto with zarith.i:int31
Hi:1 < [|i|]
[|i|] < ([|i|] / 2 + 1) ^ 2
i:int31
Hi:1 < [|i|]
2 * [|fst (i / 2)%int31|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
  apply sqrt_init; auto.i:int31
Hi:1 < [|i|]
2 * [|fst (i / 2)%int31|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 rewrite div31_phi; change ([|2|]) with 2; auto with zarith.i:int31
Hi:1 < [|i|]
2 * ([|i|] / 2) < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 apply Z.le_lt_trans with ([|i|]).i:int31
Hi:1 < [|i|]
2 * ([|i|] / 2) <= [|i|]
i:int31
Hi:1 < [|i|]
[|i|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 apply Z_mult_div_ge; auto with zarith.i:int31
Hi:1 < [|i|]
[|i|] < wB
i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 case (phi_bounded i); auto.i:int31
Hi:1 < [|i|]
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|fst (i / 2)%int31|] ->
[|i|] < ([|j1|] + 1) ^ 2 ->
2 * [|j1|] < wB ->
[|j1|] ^ 2 <= [|i|] < ([|j1|] + 1) ^ 2
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 intros j2 H1 H2; contradict H2; apply Z.lt_nge.i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
[|fst (i / 2)%int31|] < 2 ^ Z.of_nat 31 + [|j2|]
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 rewrite div31_phi; change ([|2|]) with 2; auto with zarith.i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
[|i|] / 2 < 2 ^ Z.of_nat 31 + [|j2|]
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 apply Z.le_lt_trans with ([|i|]); auto with zarith.i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
[|i|] / 2 <= [|i|]
i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
[|i|] < 2 ^ Z.of_nat 31 + [|j2|]
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 assert (0 <= [|i|]/2)%Z by (apply Z_div_pos; auto with zarith).i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
H:0 <= [|i|] / 2
[|i|] / 2 <= [|i|]
i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
[|i|] < 2 ^ Z.of_nat 31 + [|j2|]
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 apply Z.le_trans with (2 * ([|i|]/2)); auto with zarith.i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
H:0 <= [|i|] / 2
2 * ([|i|] / 2) <= [|i|]
i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
[|i|] < 2 ^ Z.of_nat 31 + [|j2|]
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 apply Z_mult_div_ge; auto with zarith.i:int31
Hi:1 < [|i|]
j2:int31
H1:0 < [|j2|]
[|i|] < 2 ^ Z.of_nat 31 + [|j2|]
i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 case (phi_bounded i); unfold size; auto with zarith.i:int31
Hi:[|i|] < 1
[|0|] ^ 2 <= [|i|] < ([|0|] + 1) ^ 2
 change [|0|] with 0; auto with zarith.i:int31
Hi:[|i|] < 1
0 ^ 2 <= [|i|] < (0 + 1) ^ 2
 case (phi_bounded i); repeat rewrite Z.pow_2_r; auto with zarith.
 Qed.

 Lemma sqrt312_step_def rec ih il j:
   sqrt312_step rec ih il j =
   match (ih ?= j)%int31 with
      Eq => j
    | Gt => j
    | _ =>
       match (fst (div3121 ih il j) ?= j)%int31 with
         Lt => let m := match j +c fst (div3121 ih il j) with
                       C0 m1 => fst (m1/2)%int31
                     | C1 m1 => (fst (m1/2) + v30)%int31
                     end in rec ih il m
       | _ =>  j
       end
   end.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
sqrt312_step rec ih il j =
match (ih ?= j)%int31 with
| Lt =>
    match (fst (div3121 ih il j) ?= j)%int31 with
    | Lt =>
        let m :=
          match j +c fst (div3121 ih il j) with
          | C0 m1 => fst (m1 / 2)%int31
          | C1 m1 => (fst (m1 / 2) + v30)%int31
          end in
        rec ih il m
    | _ => j
    end
| _ => j
end
 Proof.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
sqrt312_step rec ih il j =
match (ih ?= j)%int31 with
| Lt =>
    match (fst (div3121 ih il j) ?= j)%int31 with
    | Lt =>
        let m :=
          match j +c fst (div3121 ih il j) with
          | C0 m1 => fst (m1 / 2)%int31
          | C1 m1 => (fst (m1 / 2) + v30)%int31
          end in
        rec ih il m
    | _ => j
    end
| _ => j
end
 unfold sqrt312_step; case div3121; intros.rec:int31 -> int31 -> int31 -> int31
ih, il, j, i, i0:int31
match (ih ?= j)%int31 with
| Lt =>
    match (i ?= j)%int31 with
    | Lt =>
        rec ih il
          match j +c i with
          | C0 m1 => fst (m1 / 2)%int31
          | C1 m1 => (fst (m1 / 2) + 1073741824)%int31
          end
    | _ => j
    end
| _ => j
end =
match (ih ?= j)%int31 with
| Lt =>
    match (fst (i, i0) ?= j)%int31 with
    | Lt =>
        rec ih il
          match j +c fst (i, i0) with
          | C0 m1 => fst (m1 / 2)%int31
          | C1 m1 => (fst (m1 / 2) + v30)%int31
          end
    | _ => j
    end
| _ => j
end
 simpl; case compare31; auto.
 Qed.

 Lemma sqrt312_lower_bound ih il j:
   phi2 ih  il  < ([|j|] + 1) ^ 2 -> [|ih|] <= [|j|].ih, il, j:int31
phi2 ih il < ([|j|] + 1) ^ 2 -> [|ih|] <= [|j|]
 Proof.ih, il, j:int31
phi2 ih il < ([|j|] + 1) ^ 2 -> [|ih|] <= [|j|]
 intros H1.ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
[|ih|] <= [|j|]
 case (phi_bounded j); intros Hbj _.ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
[|ih|] <= [|j|]
 case (phi_bounded il); intros Hbil _.ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
[|ih|] <= [|j|]
 case (phi_bounded ih); intros Hbih Hbih1.ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] <= [|j|]
 assert ([|ih|] < [|j|] + 1); auto with zarith.ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] < [|j|] + 1
 apply Z.square_lt_simpl_nonneg; auto with zarith.ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] * [|ih|] < ([|j|] + 1) * ([|j|] + 1)
 rewrite <- ?Z.pow_2_r; apply Z.le_lt_trans with (2 := H1).ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] ^ 2 <= phi2 ih il
 apply Z.le_trans with ([|ih|] * wB).ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] ^ 2 <= [|ih|] * wB
ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] * wB <= phi2 ih il
 -ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] ^ 2 <= [|ih|] * wB rewrite ? Z.pow_2_r; auto with zarith.
 -ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] * wB <= phi2 ih il unfold phi2.ih, il, j:int31
H1:phi2 ih il < ([|j|] + 1) ^ 2
Hbj:0 <= [|j|]
Hbil:0 <= [|il|]
Hbih:0 <= [|ih|]
Hbih1:[|ih|] < wB
[|ih|] * wB <= [|ih|] * base + [|il|] change base with wB; auto with zarith.
 Qed.

 Lemma div312_phi ih il j: (2^30 <= [|j|] -> [|ih|] < [|j|] ->
  [|fst (div3121 ih il j)|] = phi2 ih il/[|j|])%Z.ih, il, j:int31
2 ^ 30 <= [|j|] ->
[|ih|] < [|j|] ->
[|fst (div3121 ih il j)|] = phi2 ih il / [|j|]
 Proof.ih, il, j:int31
2 ^ 30 <= [|j|] ->
[|ih|] < [|j|] ->
[|fst (div3121 ih il j)|] = phi2 ih il / [|j|]
 intros Hj Hj1.ih, il, j:int31
Hj:2 ^ 30 <= [|j|]
Hj1:[|ih|] < [|j|]
[|fst (div3121 ih il j)|] = phi2 ih il / [|j|]
 generalize (spec_div21 ih il j Hj Hj1).ih, il, j:int31
Hj:2 ^ 30 <= [|j|]
Hj1:[|ih|] < [|j|]
(let (q, r) := div3121 ih il j in
 [|ih|] * wB + [|il|] = [|q|] * [|j|] + [|r|] /\
 0 <= [|r|] < [|j|]) ->
[|fst (div3121 ih il j)|] = phi2 ih il / [|j|]
 case div3121; intros q r (Hq, Hr).ih, il, j:int31
Hj:2 ^ 30 <= [|j|]
Hj1:[|ih|] < [|j|]
q, r:int31
Hq:[|ih|] * wB + [|il|] = [|q|] * [|j|] + [|r|]
Hr:0 <= [|r|] < [|j|]
[|fst (q, r)|] = phi2 ih il / [|j|]
 apply Zdiv_unique with (phi r); auto with zarith.ih, il, j:int31
Hj:2 ^ 30 <= [|j|]
Hj1:[|ih|] < [|j|]
q, r:int31
Hq:[|ih|] * wB + [|il|] = [|q|] * [|j|] + [|r|]
Hr:0 <= [|r|] < [|j|]
phi2 ih il = [|j|] * [|fst (q, r)|] + [|r|]
 simpl @fst; apply eq_trans with (1 := Hq); ring.
 Qed.

 Lemma sqrt312_step_correct rec ih il j:
  2 ^ 29 <= [|ih|] -> 0 < [|j|] -> phi2 ih il < ([|j|] + 1) ^ 2 ->
  (forall j1, 0 < [|j1|] < [|j|] ->  phi2 ih il < ([|j1|] + 1) ^ 2 ->
     [|rec ih il j1|] ^ 2 <= phi2 ih il < ([|rec ih il j1|] + 1) ^ 2) ->
  [|sqrt312_step rec ih il  j|] ^ 2 <= phi2 ih il
      < ([|sqrt312_step rec ih il j|] + 1) ^  2.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] < [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step rec ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step rec ih il j|] + 1) ^ 2
 Proof.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] < [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step rec ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step rec ih il j|] + 1) ^ 2
 assert (Hp2: (0 < [|2|])%Z) by exact (eq_refl Lt).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] < [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step rec ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step rec ih il j|] + 1) ^ 2
 intros Hih Hj Hij Hrec; rewrite sqrt312_step_def.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
[|match (ih ?= j)%int31 with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (ih ?= j)%int31 with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2
 assert (H1: ([|ih|] <= [|j|])) by (apply sqrt312_lower_bound with il; auto).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
[|match (ih ?= j)%int31 with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (ih ?= j)%int31 with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2
 case (phi_bounded ih); intros Hih1 _.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
[|match (ih ?= j)%int31 with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (ih ?= j)%int31 with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2
 case (phi_bounded il); intros Hil1 _.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
[|match (ih ?= j)%int31 with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (ih ?= j)%int31 with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2
 case (phi_bounded j); intros _ Hj1.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
[|match (ih ?= j)%int31 with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (ih ?= j)%int31 with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2
 assert (Hp3: (0 < phi2 ih il)).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
0 < phi2 ih il
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
[|match (ih ?= j)%int31 with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (ih ?= j)%int31 with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2
 {rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
0 < phi2 ih il unfold phi2; apply Z.lt_le_trans with ([|ih|] * base); auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
0 < [|ih|] * base
   apply Z.mul_pos_pos; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
0 < [|ih|]
   apply Z.lt_le_trans with (2:= Hih); auto with zarith. }rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
[|match (ih ?= j)%int31 with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (ih ?= j)%int31 with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2
 rewrite spec_compare.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
[|match [|ih|] ?= [|j|] with
  | Lt =>
      match (fst (div3121 ih il j) ?= j)%int31 with
      | Lt =>
          let m :=
            match j +c fst (div3121 ih il j) with
            | C0 m1 => fst (m1 / 2)%int31
            | C1 m1 => (fst (m1 / 2) + v30)%int31
            end in
          rec ih il m
      | _ => j
      end
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match [|ih|] ?= [|j|] with
   | Lt =>
       match (fst (div3121 ih il j) ?= j)%int31 with
       | Lt =>
           let m :=
             match j +c fst (div3121 ih il j) with
             | C0 m1 => fst (m1 / 2)%int31
             | C1 m1 => (fst (m1 / 2) + v30)%int31
             end in
           rec ih il m
       | _ => j
       end
   | _ => j
   end|] + 1) ^ 2 case Z.compare_spec; intros Hc1.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
[|j|] ^ 2 <= phi2 ih il < ([|j|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
[|match (fst (div3121 ih il j) ?= j)%int31 with
  | Lt =>
      let m :=
        match j +c fst (div3121 ih il j) with
        | C0 m1 => fst (m1 / 2)%int31
        | C1 m1 => (fst (m1 / 2) + v30)%int31
        end in
      rec ih il m
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (fst (div3121 ih il j) ?= j)%int31 with
   | Lt =>
       let m :=
         match j +c fst (div3121 ih il j) with
         | C0 m1 => fst (m1 / 2)%int31
         | C1 m1 => (fst (m1 / 2) + v30)%int31
         end in
       rec ih il m
   | _ => j
   end|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
[|j|] ^ 2 <= phi2 ih il < ([|j|] + 1) ^ 2
 -rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
[|j|] ^ 2 <= phi2 ih il < ([|j|] + 1) ^ 2 split; auto.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
[|j|] ^ 2 <= phi2 ih il
   apply sqrt_test_true; auto.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
0 <= phi2 ih il
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
phi2 ih il / [|j|] >= [|j|]
   +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
0 <= phi2 ih il unfold phi2, base; auto with zarith.
   +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
phi2 ih il / [|j|] >= [|j|] unfold phi2; rewrite Hc1.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
([|j|] * base + [|il|]) / [|j|] >= [|j|]
     assert (0 <= [|il|]/[|j|]) by (apply Z_div_pos; auto with zarith).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
H:0 <= [|il|] / [|j|]
([|j|] * base + [|il|]) / [|j|] >= [|j|]
     rewrite Z.mul_comm, Z_div_plus_full_l; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
H:0 <= [|il|] / [|j|]
base + [|il|] / [|j|] >= [|j|]
     change base with wB.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] = [|j|]
H:0 <= [|il|] / [|j|]
wB + [|il|] / [|j|] >= [|j|] auto with zarith.
 -rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
[|match (fst (div3121 ih il j) ?= j)%int31 with
  | Lt =>
      let m :=
        match j +c fst (div3121 ih il j) with
        | C0 m1 => fst (m1 / 2)%int31
        | C1 m1 => (fst (m1 / 2) + v30)%int31
        end in
      rec ih il m
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (fst (div3121 ih il j) ?= j)%int31 with
   | Lt =>
       let m :=
         match j +c fst (div3121 ih il j) with
         | C0 m1 => fst (m1 / 2)%int31
         | C1 m1 => (fst (m1 / 2) + v30)%int31
         end in
       rec ih il m
   | _ => j
   end|] + 1) ^ 2 case (Z.le_gt_cases (2 ^ 30) [|j|]); intros Hjj.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
[|match (fst (div3121 ih il j) ?= j)%int31 with
  | Lt =>
      let m :=
        match j +c fst (div3121 ih il j) with
        | C0 m1 => fst (m1 / 2)%int31
        | C1 m1 => (fst (m1 / 2) + v30)%int31
        end in
      rec ih il m
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (fst (div3121 ih il j) ?= j)%int31 with
   | Lt =>
       let m :=
         match j +c fst (div3121 ih il j) with
         | C0 m1 => fst (m1 / 2)%int31
         | C1 m1 => (fst (m1 / 2) + v30)%int31
         end in
       rec ih il m
   | _ => j
   end|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
[|match (fst (div3121 ih il j) ?= j)%int31 with
  | Lt =>
      let m :=
        match j +c fst (div3121 ih il j) with
        | C0 m1 => fst (m1 / 2)%int31
        | C1 m1 => (fst (m1 / 2) + v30)%int31
        end in
      rec ih il m
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (fst (div3121 ih il j) ?= j)%int31 with
   | Lt =>
       let m :=
         match j +c fst (div3121 ih il j) with
         | C0 m1 => fst (m1 / 2)%int31
         | C1 m1 => (fst (m1 / 2) + v30)%int31
         end in
       rec ih il m
   | _ => j
   end|] + 1) ^ 2
   +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
[|match (fst (div3121 ih il j) ?= j)%int31 with
  | Lt =>
      let m :=
        match j +c fst (div3121 ih il j) with
        | C0 m1 => fst (m1 / 2)%int31
        | C1 m1 => (fst (m1 / 2) + v30)%int31
        end in
      rec ih il m
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (fst (div3121 ih il j) ?= j)%int31 with
   | Lt =>
       let m :=
         match j +c fst (div3121 ih il j) with
         | C0 m1 => fst (m1 / 2)%int31
         | C1 m1 => (fst (m1 / 2) + v30)%int31
         end in
       rec ih il m
   | _ => j
   end|] + 1) ^ 2 rewrite spec_compare; case Z.compare_spec;
     rewrite div312_phi; auto; intros Hc;
     try (split; auto; apply sqrt_test_true; auto with zarith; fail).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
[|(let m :=
     match j +c fst (div3121 ih il j) with
     | C0 m1 => fst (m1 / 2)%int31
     | C1 m1 => (fst (m1 / 2) + v30)%int31
     end in
   rec ih il m)|] ^ 2 <= phi2 ih il <
([|(let m :=
      match j +c fst (div3121 ih il j) with
      | C0 m1 => fst (m1 / 2)%int31
      | C1 m1 => (fst (m1 / 2) + v30)%int31
      end in
    rec ih il m)|] + 1) ^ 2
     apply Hrec.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
phi2 ih il <
([|match j +c fst (div3121 ih il j) with
   | C0 m1 => fst (m1 / 2)%int31
   | C1 m1 => fst (m1 / 2)%int31 + v30
   end|] + 1) ^ 2
     *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|] assert (Hf1: 0 <= phi2 ih il/ [|j|]) by auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       apply Z.le_succ_l in Hj.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:Z.succ 0 <= [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|] change (1 <= [|j|]) in Hj.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 <= [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       Z.le_elim Hj;
         [ | contradict Hc; apply Z.le_ngt;
             rewrite <- Hj, Zdiv_1_r; auto with zarith ].rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       assert (Hf3: 0 < ([|j|] + phi2 ih il / [|j|]) / 2).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 < ([|j|] + phi2 ih il / [|j|]) / 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       {rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 < ([|j|] + phi2 ih il / [|j|]) / 2 replace ([|j|] + phi2 ih il/ [|j|]) with
         (1 * 2 + (([|j|] - 2) + phi2 ih il / [|j|])); try ring.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 < (1 * 2 + ([|j|] - 2 + phi2 ih il / [|j|])) / 2
         rewrite Z_div_plus_full_l; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
0 < 1 + ([|j|] - 2 + phi2 ih il / [|j|]) / 2
         assert (0 <= ([|j|] - 2 + phi2 ih il / [|j|]) / 2) ;
         auto with zarith. }rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       assert (Hf4: ([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       {rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
([|j|] + phi2 ih il / [|j|]) / 2 < [|j|] apply sqrt_test_false; auto with zarith. }rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       generalize (spec_add_c j (fst (div3121 ih il j))).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
[+|j +c fst (div3121 ih il j)|] =
[|j|] + [|fst (div3121 ih il j)|] ->
0 <
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|] < [|j|]
       unfold interp_carry;  case add31c; intros r;
       rewrite div312_phi; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
[|r|] = [|j|] + phi2 ih il / [|j|] ->
0 < [|fst (r / 2)%int31|] < [|j|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|] ->
0 < [|fst (r / 2)%int31 + v30|] < [|j|]
       {rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
[|r|] = [|j|] + phi2 ih il / [|j|] ->
0 < [|fst (r / 2)%int31|] < [|j|] rewrite div31_phi; change [|2|] with 2; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
[|r|] = [|j|] + phi2 ih il / [|j|] ->
0 < [|r|] / 2 < [|j|]
         intros HH; rewrite HH; clear HH; auto with zarith. }rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|] ->
0 < [|fst (r / 2)%int31 + v30|] < [|j|]
       {rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|] ->
0 < [|fst (r / 2)%int31 + v30|] < [|j|] rewrite spec_add, div31_phi; change [|2|] with 2; auto.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|] ->
0 < ([|r|] / 2 + [|v30|]) mod wB < [|j|]
         rewrite Z.mul_1_l; intros HH.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
HH:wB + [|r|] = [|j|] + phi2 ih il / [|j|]
0 < ([|r|] / 2 + [|v30|]) mod wB < [|j|]
         rewrite Z.add_comm, <- Z_div_plus_full_l; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
HH:wB + [|r|] = [|j|] + phi2 ih il / [|j|]
0 < (([|v30|] * 2 + [|r|]) / 2) mod wB < [|j|]
         change (phi v30 * 2) with (2 ^ Z.of_nat size).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:1 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
Hf1:0 <= phi2 ih il / [|j|]
Hf3:0 < ([|j|] + phi2 ih il / [|j|]) / 2
Hf4:([|j|] + phi2 ih il / [|j|]) / 2 < [|j|]
r:int31
HH:wB + [|r|] = [|j|] + phi2 ih il / [|j|]
0 < ((wB + [|r|]) / 2) mod wB < [|j|]
         rewrite HH, Zmod_small; auto with zarith. }
     *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
phi2 ih il <
([|match j +c fst (div3121 ih il j) with
   | C0 m1 => fst (m1 / 2)%int31
   | C1 m1 => fst (m1 / 2)%int31 + v30
   end|] + 1) ^ 2 replace (phi _) with (([|j|] + (phi2 ih il)/([|j|]))/2);
       [ apply sqrt_main; auto with zarith | ].rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
([|j|] + phi2 ih il / [|j|]) / 2 =
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|]
       generalize (spec_add_c j (fst (div3121 ih il j))).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
[+|j +c fst (div3121 ih il j)|] =
[|j|] + [|fst (div3121 ih il j)|] ->
([|j|] + phi2 ih il / [|j|]) / 2 =
[|match j +c fst (div3121 ih il j) with
  | C0 m1 => fst (m1 / 2)%int31
  | C1 m1 => fst (m1 / 2)%int31 + v30
  end|]
       unfold interp_carry;  case add31c; intros r;
       rewrite div312_phi; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
[|r|] = [|j|] + phi2 ih il / [|j|] ->
([|j|] + phi2 ih il / [|j|]) / 2 =
[|fst (r / 2)%int31|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|] ->
([|j|] + phi2 ih il / [|j|]) / 2 =
[|fst (r / 2)%int31 + v30|]
       {rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
[|r|] = [|j|] + phi2 ih il / [|j|] ->
([|j|] + phi2 ih il / [|j|]) / 2 =
[|fst (r / 2)%int31|] rewrite div31_phi; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
[|r|] = [|j|] + phi2 ih il / [|j|] ->
([|j|] + phi2 ih il / [|j|]) / 2 = [|r|] / [|2|]
         intros HH; rewrite HH; auto with zarith. }rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|] ->
([|j|] + phi2 ih il / [|j|]) / 2 =
[|fst (r / 2)%int31 + v30|]
       {rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|] ->
([|j|] + phi2 ih il / [|j|]) / 2 =
[|fst (r / 2)%int31 + v30|] intros HH; rewrite <- HH.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
(1 * wB + [|r|]) / 2 = [|fst (r / 2)%int31 + v30|]
         change (1 * 2 ^ Z.of_nat size) with (phi (v30) * 2).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
([|v30|] * 2 + [|r|]) / 2 =
[|fst (r / 2)%int31 + v30|]
         rewrite Z_div_plus_full_l; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|v30|] + [|r|] / 2 = [|fst (r / 2)%int31 + v30|]
         rewrite Z.add_comm.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 + [|v30|] = [|fst (r / 2)%int31 + v30|]
         rewrite spec_add, Zmod_small.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 + [|v30|] = [|fst (r / 2)%int31|] + [|v30|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
0 <= [|fst (r / 2)%int31|] + [|v30|] < wB
         -rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 + [|v30|] = [|fst (r / 2)%int31|] + [|v30|] rewrite div31_phi; auto.
         -rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
0 <= [|fst (r / 2)%int31|] + [|v30|] < wB split; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
0 <= [|fst (r / 2)%int31|] + [|v30|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|fst (r / 2)%int31|] + [|v30|] < wB
           +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
0 <= [|fst (r / 2)%int31|] + [|v30|] case (phi_bounded (fst (r/2)%int31));
             case (phi_bounded v30); auto with zarith.
           +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|fst (r / 2)%int31|] + [|v30|] < wB rewrite div31_phi; change (phi 2) with 2; auto.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 + [|v30|] < wB
             change (2 ^Z.of_nat size) with (base/2 + phi v30).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 + [|v30|] < base / 2 + [|v30|]
             assert (phi r / 2 < base/2); auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 < base / 2
             apply Z.mul_lt_mono_pos_r with 2; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 * 2 < base / 2 * 2
             change (base/2 * 2) with base.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 * 2 < base
             apply Z.le_lt_trans with (phi r).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 * 2 <= [|r|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] < base
             *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] / 2 * 2 <= [|r|] rewrite Z.mul_comm; apply Z_mult_div_ge; auto with zarith.
             *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:2 ^ 30 <= [|j|]
Hc:phi2 ih il / [|j|] < [|j|]
r:int31
HH:1 * wB + [|r|] = [|j|] + phi2 ih il / [|j|]
[|r|] < base case (phi_bounded r); auto with zarith. }
   +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
[|match (fst (div3121 ih il j) ?= j)%int31 with
  | Lt =>
      let m :=
        match j +c fst (div3121 ih il j) with
        | C0 m1 => fst (m1 / 2)%int31
        | C1 m1 => (fst (m1 / 2) + v30)%int31
        end in
      rec ih il m
  | _ => j
  end|] ^ 2 <= phi2 ih il <
([|match (fst (div3121 ih il j) ?= j)%int31 with
   | Lt =>
       let m :=
         match j +c fst (div3121 ih il j) with
         | C0 m1 => fst (m1 / 2)%int31
         | C1 m1 => (fst (m1 / 2) + v30)%int31
         end in
       rec ih il m
   | _ => j
   end|] + 1) ^ 2 contradict Hij; apply Z.le_ngt.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
([|j|] + 1) ^ 2 <= phi2 ih il
     assert ((1 + [|j|]) <= 2 ^ 30); auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
([|j|] + 1) ^ 2 <= phi2 ih il
     apply Z.le_trans with ((2 ^ 30) * (2 ^ 30)); auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
([|j|] + 1) ^ 2 <= 2 ^ 30 * 2 ^ 30
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
2 ^ 30 * 2 ^ 30 <= phi2 ih il
     *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
([|j|] + 1) ^ 2 <= 2 ^ 30 * 2 ^ 30 assert (0 <= 1 + [|j|]); auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
H0:0 <= 1 + [|j|]
([|j|] + 1) ^ 2 <= 2 ^ 30 * 2 ^ 30
       apply Z.mul_le_mono_nonneg; auto with zarith.
     *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
2 ^ 30 * 2 ^ 30 <= phi2 ih il change ((2 ^ 30) * (2 ^ 30)) with ((2 ^ 29) * base).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
2 ^ 29 * base <= phi2 ih il
       apply Z.le_trans with ([|ih|] * base);
         change wB with base in *; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < base
Hp3:0 < phi2 ih il
Hc1:[|ih|] < [|j|]
Hjj:[|j|] < 2 ^ 30
H:1 + [|j|] <= 2 ^ 30
[|ih|] * base <= phi2 ih il
       unfold phi2, base; auto with zarith.
 -rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
[|j|] ^ 2 <= phi2 ih il < ([|j|] + 1) ^ 2 split; auto.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
[|j|] ^ 2 <= phi2 ih il
   apply sqrt_test_true; auto.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
0 <= phi2 ih il
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
phi2 ih il / [|j|] >= [|j|]
   +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
0 <= phi2 ih il unfold phi2, base; auto with zarith.
   +rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
phi2 ih il / [|j|] >= [|j|] apply Z.le_ge; apply Z.le_trans with (([|j|] * base)/[|j|]).rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
[|j|] <= [|j|] * base / [|j|]
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
[|j|] * base / [|j|] <= phi2 ih il / [|j|]
     *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
[|j|] <= [|j|] * base / [|j|] rewrite Z.mul_comm, Z_div_mult; auto with zarith.
     *rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hp2:0 < [|2|]
Hih:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
H1:[|ih|] <= [|j|]
Hih1:0 <= [|ih|]
Hil1:0 <= [|il|]
Hj1:[|j|] < wB
Hp3:0 < phi2 ih il
Hc1:[|j|] < [|ih|]
[|j|] * base / [|j|] <= phi2 ih il / [|j|] apply Z.ge_le; apply Z_div_ge; auto with zarith.
 Qed.

 Lemma iter312_sqrt_correct n rec ih il j:
  2^29 <= [|ih|] ->  0 < [|j|] -> phi2 ih il < ([|j|] + 1) ^ 2 ->
  (forall j1, 0 < [|j1|] -> 2^(Z.of_nat n) + [|j1|] <= [|j|] ->
      phi2 ih il < ([|j1|] + 1) ^ 2 ->
       [|rec ih il j1|] ^ 2 <= phi2 ih il < ([|rec ih il j1|] + 1) ^ 2)  ->
  [|iter312_sqrt n rec ih il j|] ^ 2 <= phi2 ih il
      < ([|iter312_sqrt n rec ih il j|] + 1) ^ 2.n:nat
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|iter312_sqrt n rec ih il j|] ^ 2 <= phi2 ih il <
([|iter312_sqrt n rec ih il j|] + 1) ^ 2
 Proof.n:nat
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|iter312_sqrt n rec ih il j|] ^ 2 <= phi2 ih il <
([|iter312_sqrt n rec ih il j|] + 1) ^ 2
 revert rec ih il j; elim n; unfold iter312_sqrt; fold iter312_sqrt; clear n.forall (rec : int31 -> int31 -> int31 -> int31)
  (ih il j : int31),
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat 0 + [|j1|] <= [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step rec ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step rec ih il j|] + 1) ^ 2
forall n : nat,
(forall (rec : int31 -> int31 -> int31 -> int31)
   (ih il j : int31),
 2 ^ 29 <= [|ih|] ->
 0 < [|j|] ->
 phi2 ih il < ([|j|] + 1) ^ 2 ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  phi2 ih il < ([|j1|] + 1) ^ 2 ->
  [|rec ih il j1|] ^ 2 <= phi2 ih il <
  ([|rec ih il j1|] + 1) ^ 2) ->
 [|iter312_sqrt n rec ih il j|] ^ 2 <= phi2 ih il <
 ([|iter312_sqrt n rec ih il j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31 -> int31)
  (ih il j : int31),
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
    ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
     ih il j|] + 1) ^ 2
 intros rec ih il j Hi Hj Hij Hrec; apply sqrt312_step_correct; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 0 + [|j1|] <= [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
forall n : nat,
(forall (rec : int31 -> int31 -> int31 -> int31)
   (ih il j : int31),
 2 ^ 29 <= [|ih|] ->
 0 < [|j|] ->
 phi2 ih il < ([|j|] + 1) ^ 2 ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  phi2 ih il < ([|j1|] + 1) ^ 2 ->
  [|rec ih il j1|] ^ 2 <= 
  phi2 ih il < ([|rec ih il j1|] + 1) ^ 2) ->
 [|iter312_sqrt n rec ih il j|] ^ 2 <= 
 phi2 ih il < ([|iter312_sqrt n rec ih il j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31 -> int31)
  (ih il j : int31),
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= 
 phi2 ih il < ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
    ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
     ih il j|] + 1) ^ 2
 intros; apply Hrec; auto with zarith.rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
Hrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat 0 + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
H:0 < [|j1|] < [|j|]
H0:phi2 ih il < ([|j1|] + 1) ^ 2
2 ^ Z.of_nat 0 + [|j1|] <= [|j|]
forall n : nat,
(forall (rec : int31 -> int31 -> int31 -> int31)
   (ih il j : int31),
 2 ^ 29 <= [|ih|] ->
 0 < [|j|] ->
 phi2 ih il < ([|j|] + 1) ^ 2 ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  phi2 ih il < ([|j1|] + 1) ^ 2 ->
  [|rec ih il j1|] ^ 2 <= 
  phi2 ih il < ([|rec ih il j1|] + 1) ^ 2) ->
 [|iter312_sqrt n rec ih il j|] ^ 2 <= 
 phi2 ih il < ([|iter312_sqrt n rec ih il j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31 -> int31)
  (ih il j : int31),
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= 
 phi2 ih il < ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
    ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
     ih il j|] + 1) ^ 2
 rewrite Z.pow_0_r; auto with zarith.forall n : nat,
(forall (rec : int31 -> int31 -> int31 -> int31)
   (ih il j : int31),
 2 ^ 29 <= [|ih|] ->
 0 < [|j|] ->
 phi2 ih il < ([|j|] + 1) ^ 2 ->
 (forall j1 : int31,
  0 < [|j1|] ->
  2 ^ Z.of_nat n + [|j1|] <= [|j|] ->
  phi2 ih il < ([|j1|] + 1) ^ 2 ->
  [|rec ih il j1|] ^ 2 <= phi2 ih il <
  ([|rec ih il j1|] + 1) ^ 2) ->
 [|iter312_sqrt n rec ih il j|] ^ 2 <= phi2 ih il <
 ([|iter312_sqrt n rec ih il j|] + 1) ^ 2) ->
forall (rec : int31 -> int31 -> int31 -> int31)
  (ih il j : int31),
2 ^ 29 <= [|ih|] ->
0 < [|j|] ->
phi2 ih il < ([|j|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
 phi2 ih il < ([|j1|] + 1) ^ 2 ->
 [|rec ih il j1|] ^ 2 <= phi2 ih il <
 ([|rec ih il j1|] + 1) ^ 2) ->
[|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
    ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
     ih il j|] + 1) ^ 2
 intros n Hrec rec ih il j Hi Hj Hij HHrec.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j1|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j1|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j1|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
[|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
    ih il j|] ^ 2 <= phi2 ih il <
([|sqrt312_step (iter312_sqrt n (iter312_sqrt n rec))
     ih il j|] + 1) ^ 2
 apply sqrt312_step_correct; auto.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j1 : int31,
 0 < [|j1|] ->
 2 ^ Z.of_nat n + [|j1|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j1|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j1|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j1|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat (S n) + [|j1|] <= [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|rec ih il j1|] ^ 2 <= phi2 ih il <
([|rec ih il j1|] + 1) ^ 2
forall j1 : int31,
0 < [|j1|] < [|j|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|iter312_sqrt n (iter312_sqrt n rec) ih il j1|] ^ 2 <=
phi2 ih il <
([|iter312_sqrt n (iter312_sqrt n rec) ih il j1|] + 1)
^ 2
 intros j1 Hj1  Hjp1; apply Hrec; auto with zarith.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j2 : int31,
 0 < [|j2|] ->
 2 ^ Z.of_nat n + [|j2|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j2|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j2|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j2|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:phi2 ih il < ([|j1|] + 1) ^ 2
forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat n + [|j0|] <= [|j1|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|iter312_sqrt n rec ih il j0|] ^ 2 <= phi2 ih il <
([|iter312_sqrt n rec ih il j0|] + 1) ^ 2
 intros j2 Hj2 H2j2 Hjp2; apply Hrec; auto with zarith.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j3 : int31,
 0 < [|j3|] ->
 2 ^ Z.of_nat n + [|j3|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j3|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j3|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j3|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:phi2 ih il < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:phi2 ih il < ([|j2|] + 1) ^ 2
forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat n + [|j0|] <= [|j2|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
 intros j3 Hj3 Hpj3.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j4|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j4|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j4|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:phi2 ih il < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:phi2 ih il < ([|j2|] + 1) ^ 2
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
phi2 ih il < ([|j3|] + 1) ^ 2 ->
[|rec ih il j3|] ^ 2 <= phi2 ih il <
([|rec ih il j3|] + 1) ^ 2
 apply HHrec; auto.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j4|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j4|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j4|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:phi2 ih il < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:phi2 ih il < ([|j2|] + 1) ^ 2
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
2 ^ Z.of_nat (S n) + [|j3|] <= [|j|]
 rewrite Nat2Z.inj_succ, Z.pow_succ_r.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j4|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j4|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j4|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:phi2 ih il < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:phi2 ih il < ([|j2|] + 1) ^ 2
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
2 * 2 ^ Z.of_nat n + [|j3|] <= [|j|]
n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j4|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j4|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j4|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:phi2 ih il < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:phi2 ih il < ([|j2|] + 1) ^ 2
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
0 <= Z.of_nat n
 apply Z.le_trans with (2 ^Z.of_nat n + [|j2|]); auto with zarith.n:nat
Hrec:forall
  (rec0 : int31 -> int31 -> int31 -> int31)
  (ih0 il0 j0 : int31),
2 ^ 29 <= [|ih0|] ->
0 < [|j0|] ->
phi2 ih0 il0 < ([|j0|] + 1) ^ 2 ->
(forall j4 : int31,
 0 < [|j4|] ->
 2 ^ Z.of_nat n + [|j4|] <= [|j0|] ->
 phi2 ih0 il0 < ([|j4|] + 1) ^ 2 ->
 [|rec0 ih0 il0 j4|] ^ 2 <= 
 phi2 ih0 il0 < ([|rec0 ih0 il0 j4|] + 1) ^ 2) ->
[|iter312_sqrt n rec0 ih0 il0 j0|] ^ 2 <=
phi2 ih0 il0 <
([|iter312_sqrt n rec0 ih0 il0 j0|] + 1) ^ 2
rec:int31 -> int31 -> int31 -> int31
ih, il, j:int31
Hi:2 ^ 29 <= [|ih|]
Hj:0 < [|j|]
Hij:phi2 ih il < ([|j|] + 1) ^ 2
HHrec:forall j0 : int31,
0 < [|j0|] ->
2 ^ Z.of_nat (S n) + [|j0|] <= [|j|] ->
phi2 ih il < ([|j0|] + 1) ^ 2 ->
[|rec ih il j0|] ^ 2 <= phi2 ih il <
([|rec ih il j0|] + 1) ^ 2
j1:int31
Hj1:0 < [|j1|] < [|j|]
Hjp1:phi2 ih il < ([|j1|] + 1) ^ 2
j2:int31
Hj2:0 < [|j2|]
H2j2:2 ^ Z.of_nat n + [|j2|] <= [|j1|]
Hjp2:phi2 ih il < ([|j2|] + 1) ^ 2
j3:int31
Hj3:0 < [|j3|]
Hpj3:2 ^ Z.of_nat n + [|j3|] <= [|j2|]
0 <= Z.of_nat n
 apply Nat2Z.is_nonneg.
 Qed.

 (* Avoid expanding [iter312_sqrt] before variables in the context. *)
 Strategy 1 [iter312_sqrt].

 Lemma spec_sqrt2 : forall x y,
       wB/ 4 <= [|x|] ->
       let (s,r) := sqrt312 x y in
          [||WW x y||] = [|s|] ^ 2 + [+|r|] /\
          [+|r|] <= 2 * [|s|].forall x y : int31,
wB / 4 <= [|x|] ->
let (s, r) := sqrt312 x y in
[||WW x y||] = [|s|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s|]
 Proof.forall x y : int31,
wB / 4 <= [|x|] ->
let (s, r) := sqrt312 x y in
[||WW x y||] = [|s|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s|]
 intros ih il Hih; unfold sqrt312.ih, il:int31
Hih:wB / 4 <= [|ih|]
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
[||WW ih il||] = [|s|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s|]
 change [||WW ih il||] with (phi2 ih il).ih, il:int31
Hih:wB / 4 <= [|ih|]
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 assert (Hbin: forall s, s * s + 2* s + 1 = (s + 1) ^ 2) by
  (intros s; ring).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 assert (Hb: 0 <= base) by (red; intros HH; discriminate).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 assert (Hi2: phi2 ih il < (phi Tn + 1) ^ 2).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
phi2 ih il < ([|Tn|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 {ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
phi2 ih il < ([|Tn|] + 1) ^ 2 change ((phi Tn + 1) ^ 2) with (2^62).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
phi2 ih il < 2 ^ 62
   apply Z.le_lt_trans with ((2^31 -1) * base + (2^31 - 1)); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
phi2 ih il <= (2 ^ 31 - 1) * base + (2 ^ 31 - 1)
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
(2 ^ 31 - 1) * base + (2 ^ 31 - 1) < 2 ^ 62
   2: simpl; unfold Z.pow_pos; simpl; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
phi2 ih il <= (2 ^ 31 - 1) * base + (2 ^ 31 - 1)
   case (phi_bounded ih); case (phi_bounded il); intros H1 H2 H3 H4.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
H1:0 <= [|il|]
H2:[|il|] < wB
H3:0 <= [|ih|]
H4:[|ih|] < wB
phi2 ih il <= (2 ^ 31 - 1) * base + (2 ^ 31 - 1)
   unfold base, Z.pow, Z.pow_pos in H2,H4; simpl in H2,H4.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
H1:0 <= [|il|]
H2:[|il|] < 2147483648
H3:0 <= [|ih|]
H4:[|ih|] < 2147483648
phi2 ih il <= (2 ^ 31 - 1) * base + (2 ^ 31 - 1)
   unfold phi2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
H1:0 <= [|il|]
H2:[|il|] < 2147483648
H3:0 <= [|ih|]
H4:[|ih|] < 2147483648
[|ih|] * base + [|il|] <=
(2 ^ 31 - 1) * base + (2 ^ 31 - 1) cbn [Z.pow Z.pow_pos Pos.iter].ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
H1:0 <= [|il|]
H2:[|il|] < 2147483648
H3:0 <= [|ih|]
H4:[|ih|] < 2147483648
[|ih|] * base + [|il|] <=
(2 *
 (2 *
  (2 *
   (2 *
    (2 * (2 * (2 * (2 * (2 * (2 * (2 * (...))))))))))) -
 1) * base +
(2 *
 (2 *
  (2 *
   (2 *
    (2 * (2 * (2 * (2 * (2 * (2 * (2 * (2 * ...))))))))))) -
 1) auto with zarith. }ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 case (iter312_sqrt_correct 31 (fun _ _ j => j) ih il Tn); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
0 < [|Tn|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|Tn|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|j1|] ^ 2 <= phi2 ih il < ([|j1|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
[|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|]
^ 2 <= phi2 ih il ->
phi2 ih il <
([|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|] +
 1) ^ 2 ->
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 change [|Tn|] with 2147483647; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
forall j1 : int31,
0 < [|j1|] ->
2 ^ Z.of_nat 31 + [|j1|] <= [|Tn|] ->
phi2 ih il < ([|j1|] + 1) ^ 2 ->
[|j1|] ^ 2 <= phi2 ih il < ([|j1|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
[|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|]
^ 2 <= phi2 ih il ->
phi2 ih il <
([|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|] +
 1) ^ 2 ->
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 intros j1 _ HH; contradict HH.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
j1:int31
~ 2 ^ Z.of_nat 31 + [|j1|] <= [|Tn|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
[|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|]
^ 2 <= phi2 ih il ->
phi2 ih il <
([|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|] +
 1) ^ 2 ->
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 apply Z.lt_nge.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
j1:int31
[|Tn|] < 2 ^ Z.of_nat 31 + [|j1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
[|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|]
^ 2 <= phi2 ih il ->
phi2 ih il <
([|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|] +
 1) ^ 2 ->
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 change [|Tn|] with 2147483647; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
j1:int31
2147483647 < 2 ^ Z.of_nat 31 + [|j1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
[|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|]
^ 2 <= phi2 ih il ->
phi2 ih il <
([|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|] +
 1) ^ 2 ->
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 change (2 ^ Z.of_nat 31) with 2147483648; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
j1:int31
2147483647 < 2147483648 + [|j1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
[|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|]
^ 2 <= phi2 ih il ->
phi2 ih il <
([|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|] +
 1) ^ 2 ->
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 case (phi_bounded j1); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s : Z, s * s + 2 * s + 1 = (s + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
[|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|]
^ 2 <= phi2 ih il ->
phi2 ih il <
([|iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn|] +
 1) ^ 2 ->
let (s, r) :=
  match
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn *c
    iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn
  with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C1 il2)
          | _ =>
              (iter312_sqrt 31
                 (fun _ _ j : int31 => j) ih il Tn,
              C0 il2)
          end
      end
  end in
phi2 ih il = [|s|] ^ 2 + [+|r|] /\ [+|r|] <= 2 * [|s|]
 set (s := iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
[|s|] ^ 2 <= phi2 ih il ->
phi2 ih il < ([|s|] + 1) ^ 2 ->
let (s0, r) :=
  match s *c s with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt => (s, C1 il2)
          | _ => (s, C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt => (s, C1 il2)
          | _ => (s, C0 il2)
          end
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 intros Hs1 Hs2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
let (s0, r) :=
  match s *c s with
  | W0 => (0%int31, C0 0%int31)
  | WW ih1 il1 =>
      match il -c il1 with
      | C0 il2 =>
          match (ih ?= ih1)%int31 with
          | Gt => (s, C1 il2)
          | _ => (s, C0 il2)
          end
      | C1 il2 =>
          match (ih - 1 ?= ih1)%int31 with
          | Gt => (s, C1 il2)
          | _ => (s, C0 il2)
          end
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 generalize (spec_mul_c s s); case mul31c.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
[||W0||] = [|s|] * [|s|] ->
phi2 ih il = [|0|] ^ 2 + [+|C0 0%int31|] /\
[+|C0 0%int31|] <= 2 * [|0|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 simpl zn2z_to_Z; intros HH.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
HH:0 = [|s|] * [|s|]
phi2 ih il = [|0|] ^ 2 + [+|C0 0%int31|] /\
[+|C0 0%int31|] <= 2 * [|0|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 assert ([|s|] = 0).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
HH:0 = [|s|] * [|s|]
[|s|] = 0
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
phi2 ih il = [|0|] ^ 2 + [+|C0 0%int31|] /\
[+|C0 0%int31|] <= 2 * [|0|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 {ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
HH:0 = [|s|] * [|s|]
[|s|] = 0 symmetry in HH.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
HH:[|s|] * [|s|] = 0
[|s|] = 0 rewrite Z.mul_eq_0 in HH.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
HH:[|s|] = 0 \/ [|s|] = 0
[|s|] = 0 destruct HH; auto. }ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
phi2 ih il = [|0|] ^ 2 + [+|C0 0%int31|] /\
[+|C0 0%int31|] <= 2 * [|0|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 contradict Hs2; apply Z.le_ngt; rewrite H.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
(0 + 1) ^ 2 <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 change ((0 + 1) ^ 2) with 1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
1 <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 apply Z.le_trans with (2 ^ Z.of_nat size / 4 * base).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
1 <= wB / 4 * base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
wB / 4 * base <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 simpl; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
wB / 4 * base <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 apply Z.le_trans with ([|ih|] * base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
HH:0 = [|s|] * [|s|]
H:[|s|] = 0
[|ih|] * base <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold phi2; case (phi_bounded il); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
forall i i0 : int31,
[||WW i i0||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c i0 with
  | C0 il2 =>
      match (ih ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= i)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 intros ih1 il1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
[||WW ih1 il1||] = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c il1 with
  | C0 il2 =>
      match (ih ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 change [||WW ih1 il1||] with (phi2 ih1 il1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
phi2 ih1 il1 = [|s|] * [|s|] ->
let (s0, r) :=
  match il -c il1 with
  | C0 il2 =>
      match (ih ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 intros Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
let (s0, r) :=
  match il -c il1 with
  | C0 il2 =>
      match (ih ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 generalize (spec_sub_c il il1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
[-|il -c il1|] = [|il|] - [|il1|] ->
let (s0, r) :=
  match il -c il1 with
  | C0 il2 =>
      match (ih ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  | C1 il2 =>
      match (ih - 1 ?= ih1)%int31 with
      | Gt => (s, C1 il2)
      | _ => (s, C0 il2)
      end
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 case sub31c; intros il2 Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite spec_compare; case Z.compare_spec.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] = [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold interp_carry in *.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
[|ih|] = [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 intros H1; split.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
phi2 ih il = [|s|] ^ 2 + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite Z.pow_2_r, <- Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
phi2 ih il = phi2 ih1 il1 + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold phi2; ring[Hil2 H1].ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 replace [|il2|] with (phi2 ih il - phi2 ih1 il1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
phi2 ih il - phi2 ih1 il1 <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
phi2 ih il - phi2 ih1 il1 = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
phi2 ih il - [|s|] * [|s|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
phi2 ih il - phi2 ih1 il1 = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite <-Hbin in Hs2; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih|] = [|ih1|]
phi2 ih il - phi2 ih1 il1 = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold phi2; rewrite H1, Hil2; ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [+|C0 il2|] /\
[+|C0 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold interp_carry.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 intros H1; contradict Hs1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
~ [|s|] ^ 2 <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 apply Z.lt_nge; rewrite Z.pow_2_r, <-Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
phi2 ih il < phi2 ih1 il1
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold phi2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
[|ih|] * base + [|il|] < [|ih1|] * base + [|il1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 case (phi_bounded il); intros _ H2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
H2:[|il|] < wB
[|ih|] * base + [|il|] < [|ih1|] * base + [|il1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 apply Z.lt_le_trans with (([|ih|] + 1) * base + 0).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
H2:[|il|] < wB
[|ih|] * base + [|il|] < ([|ih|] + 1) * base + 0
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
H2:[|il|] < wB
([|ih|] + 1) * base + 0 <= [|ih1|] * base + [|il1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite Z.mul_add_distr_r, Z.add_0_r; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
H2:[|il|] < wB
([|ih|] + 1) * base + 0 <= [|ih1|] * base + [|il1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 case (phi_bounded il1); intros H3 _.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
H1:[|ih|] < [|ih1|]
H2:[|il|] < wB
H3:0 <= [|il1|]
([|ih|] + 1) * base + 0 <= [|ih1|] * base + [|il1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 apply Z.add_le_mono; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C0 il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + [+|C1 il2|] /\
[+|C1 il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold interp_carry in *; change (1 * 2 ^ Z.of_nat size) with base.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite Z.pow_2_r, <- Hihl1, Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
[|ih1|] < [|ih|] ->
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 intros H1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] < [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite <- Z.le_succ_l, <- Z.add_1_r in H1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 <= [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 Z.le_elim H1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 contradict Hs2; apply Z.le_ngt.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
([|s|] + 1) ^ 2 <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 replace (([|s|] + 1) ^ 2) with (phi2 ih1 il1 + 2 * [|s|] + 1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold phi2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
[|ih1|] * base + [|il1|] + 2 * [|s|] + 1 <=
[|ih|] * base + [|il|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 case (phi_bounded il); intros Hpil _.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
[|ih1|] * base + [|il1|] + 2 * [|s|] + 1 <=
[|ih|] * base + [|il|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 assert (Hl1l: [|il1|] <= [|il|]).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
[|il1|] <= [|il|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
Hl1l:[|il1|] <= [|il|]
[|ih1|] * base + [|il1|] + 2 * [|s|] + 1 <=
[|ih|] * base + [|il|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 {ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
[|il1|] <= [|il|] case (phi_bounded il2); rewrite Hil2; auto with zarith. }ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
Hl1l:[|il1|] <= [|il|]
[|ih1|] * base + [|il1|] + 2 * [|s|] + 1 <=
[|ih|] * base + [|il|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 assert ([|ih1|] * base + 2 * [|s|] + 1 <= [|ih|] * base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
Hl1l:[|il1|] <= [|il|]
[|ih1|] * base + 2 * [|s|] + 1 <= [|ih|] * base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 case (phi_bounded s);  change (2 ^ Z.of_nat size) with base; intros _ Hps.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
Hl1l:[|il1|] <= [|il|]
Hps:[|s|] < base
[|ih1|] * base + 2 * [|s|] + 1 <= [|ih|] * base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 case (phi_bounded ih1); intros Hpih1 _; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
Hl1l:[|il1|] <= [|il|]
Hps:[|s|] < base
Hpih1:0 <= [|ih1|]
[|ih1|] * base + 2 * [|s|] + 1 <= [|ih|] * base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 apply Z.le_trans with (([|ih1|] + 2) * base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
Hl1l:[|il1|] <= [|il|]
Hps:[|s|] < base
Hpih1:0 <= [|ih1|]
[|ih1|] * base + 2 * [|s|] + 1 <= ([|ih1|] + 2) * base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite Z.mul_add_distr_r.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
Hpil:0 <= [|il|]
Hl1l:[|il1|] <= [|il|]
Hps:[|s|] < base
Hpih1:0 <= [|ih1|]
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih1|] * base + 2 * base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 assert (2 * [|s|] + 1 <= 2 * base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite Hihl1, Hbin; auto.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|])) /\
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 split.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il =
phi2 ih1 il1 + (base + ([|il|] - [|il1|]))
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold phi2; rewrite <- H1; ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
base + ([|il|] - [|il1|]) <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 replace (base + ([|il|] - [|il1|])) with (phi2 ih il - ([|s|] * [|s|])).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il - [|s|] * [|s|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il - [|s|] * [|s|] = base + ([|il|] - [|il1|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite <-Hbin in Hs2; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[|il2|] = [|il|] - [|il1|]
H1:[|ih1|] + 1 = [|ih|]
phi2 ih il - [|s|] * [|s|] = base + ([|il|] - [|il1|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 rewrite <- Hihl1; unfold phi2; rewrite <- H1; ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:[-|C1 il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il = [|s0|] ^ 2 + [+|r|] /\
[+|r|] <= 2 * [|s0|]
 unfold interp_carry in Hil2 |- *.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il =
[|s0|] ^ 2 +
match r with
| C0 x => [|x|]
| C1 x => 1 * wB + [|x|]
end /\
match r with
| C0 x => [|x|]
| C1 x => 1 * wB + [|x|]
end <= 2 * [|s0|]
 unfold interp_carry; change (1 * 2 ^ Z.of_nat size) with base.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il =
[|s0|] ^ 2 +
match r with
| C0 x => [|x|]
| C1 x => base + [|x|]
end /\
match r with
| C0 x => [|x|]
| C1 x => base + [|x|]
end <= 2 * [|s0|]
 assert (Hsih: [|ih - 1|] = [|ih|] - 1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
[|ih - 1|] = [|ih|] - 1
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il =
[|s0|] ^ 2 +
match r with
| C0 x => [|x|]
| C1 x => base + [|x|]
end /\
match r with
| C0 x => [|x|]
| C1 x => base + [|x|]
end <= 2 * [|s0|]
 {ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
[|ih - 1|] = [|ih|] - 1 rewrite spec_sub, Zmod_small; auto; change [|1|] with 1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
0 <= [|ih|] - 1 < wB
   case (phi_bounded ih); intros H1 H2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
H1:0 <= [|ih|]
H2:[|ih|] < wB
0 <= [|ih|] - 1 < wB
   generalize Hih; change (2 ^ Z.of_nat size / 4) with 536870912.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
H1:0 <= [|ih|]
H2:[|ih|] < wB
536870912 <= [|ih|] -> 0 <= [|ih|] - 1 < wB
   split; auto with zarith. }ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
let (s0, r) :=
  match (ih - 1 ?= ih1)%int31 with
  | Gt => (s, C1 il2)
  | _ => (s, C0 il2)
  end in
phi2 ih il =
[|s0|] ^ 2 +
match r with
| C0 x => [|x|]
| C1 x => base + [|x|]
end /\
match r with
| C0 x => [|x|]
| C1 x => base + [|x|]
end <= 2 * [|s0|]
 rewrite spec_compare; case Z.compare_spec.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] = [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Hsih.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih|] - 1 = [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 intros H1; split.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
phi2 ih il = [|s|] ^ 2 + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Z.pow_2_r, <- Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
phi2 ih il = phi2 ih1 il1 + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 unfold phi2; rewrite <-H1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|ih|] * base + [|il|] =
([|ih|] - 1) * base + [|il1|] + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 transitivity ([|ih|] * base + [|il1|] + ([|il|] - [|il1|])).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|ih|] * base + [|il|] =
[|ih|] * base + [|il1|] + ([|il|] - [|il1|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|ih|] * base + [|il1|] + ([|il|] - [|il1|]) =
([|ih|] - 1) * base + [|il1|] + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|ih|] * base + [|il1|] + ([|il|] - [|il1|]) =
([|ih|] - 1) * base + [|il1|] + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite <-Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|ih|] * base + [|il1|] + (-1 * wB + [|il2|]) =
([|ih|] - 1) * base + [|il1|] + [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 change (2 ^ Z.of_nat size) with base; ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 replace [|il2|] with (phi2 ih il - phi2 ih1 il1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
phi2 ih il - phi2 ih1 il1 <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
phi2 ih il - phi2 ih1 il1 = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
phi2 ih il - [|s|] * [|s|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
phi2 ih il - phi2 ih1 il1 = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite <-Hbin in Hs2; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
phi2 ih il - phi2 ih1 il1 = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 unfold phi2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|ih|] * base + [|il|] - ([|ih1|] * base + [|il1|]) =
[|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite <-H1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
[|ih|] * base + [|il|] -
(([|ih|] - 1) * base + [|il1|]) = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 ring_simplify.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
base + [|il|] - [|il1|] = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 transitivity (base + ([|il|] - [|il1|])).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
base + [|il|] - [|il1|] = base + ([|il|] - [|il1|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
base + ([|il|] - [|il1|]) = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
base + ([|il|] - [|il1|]) = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite <-Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 = [|ih1|]
base + (-1 * wB + [|il2|]) = [|il2|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 change (2 ^ Z.of_nat size) with base; ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih - 1|] < [|ih1|] ->
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Hsih; intros H1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 assert (He: [|ih|] = [|ih1|]).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
[|ih|] = [|ih1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
He:[|ih|] = [|ih1|]
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 {ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
[|ih|] = [|ih1|] apply Z.le_antisymm; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
[|ih1|] <= [|ih|]
   case (Z.le_gt_cases [|ih1|] [|ih|]); auto; intros H2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
[|ih1|] <= [|ih|]
   contradict Hs1; apply Z.lt_nge; rewrite Z.pow_2_r, <-Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
phi2 ih il < phi2 ih1 il1
   unfold phi2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
[|ih|] * base + [|il|] < [|ih1|] * base + [|il1|]
   case (phi_bounded il); change (2 ^ Z.of_nat size) with base;
    intros _ Hpil1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
Hpil1:[|il|] < base
[|ih|] * base + [|il|] < [|ih1|] * base + [|il1|]
   apply Z.lt_le_trans with (([|ih|] + 1) * base).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
Hpil1:[|il|] < base
[|ih|] * base + [|il|] < ([|ih|] + 1) * base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
Hpil1:[|il|] < base
([|ih|] + 1) * base <= [|ih1|] * base + [|il1|]
   rewrite Z.mul_add_distr_r, Z.mul_1_l; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
Hpil1:[|il|] < base
([|ih|] + 1) * base <= [|ih1|] * base + [|il1|]
   case (phi_bounded il1); intros Hpil2 _.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
H2:[|ih|] < [|ih1|]
Hpil1:[|il|] < base
Hpil2:0 <= [|il1|]
([|ih|] + 1) * base <= [|ih1|] * base + [|il1|]
   apply Z.le_trans with (([|ih1|]) * base); auto with zarith. }ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
He:[|ih|] = [|ih1|]
phi2 ih il = [|s|] ^ 2 + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Z.pow_2_r, <-Hihl1; unfold phi2; rewrite <-He.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
He:[|ih|] = [|ih1|]
[|ih|] * base + [|il|] =
[|ih|] * base + [|il1|] + [|il2|] /\
[|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 contradict Hs1; apply Z.lt_nge; rewrite Z.pow_2_r, <-Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
He:[|ih|] = [|ih1|]
phi2 ih il < phi2 ih1 il1
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 unfold phi2; rewrite He.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
He:[|ih|] = [|ih1|]
[|ih1|] * base + [|il|] < [|ih1|] * base + [|il1|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 assert (phi il - phi il1 < 0); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
He:[|ih|] = [|ih1|]
[|il|] - [|il1|] < 0
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite <-Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih|] - 1 < [|ih1|]
He:[|ih|] = [|ih1|]
-1 * wB + [|il2|] < 0
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 case (phi_bounded il2); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
[|ih1|] < [|ih - 1|] ->
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 intros H1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
phi2 ih il = [|s|] ^ 2 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Z.pow_2_r, <-Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 assert (H2 : [|ih1|]+2 <= [|ih|]); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 <= [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 Z.le_elim H2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 contradict Hs2; apply Z.le_ngt.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
([|s|] + 1) ^ 2 <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 replace (([|s|] + 1) ^ 2) with (phi2 ih1 il1 + 2 * [|s|] + 1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 <= phi2 ih il
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 unfold phi2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
[|ih1|] * base + [|il1|] + 2 * [|s|] + 1 <=
[|ih|] * base + [|il|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 assert ([|ih1|] * base + 2 * phi s + 1 <= [|ih|] * base + ([|il|] - [|il1|]));
  auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih|] * base + ([|il|] - [|il1|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite <-Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih|] * base + (-1 * wB + [|il2|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 change (-1 * 2 ^ Z.of_nat size) with (-base).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih|] * base + (- base + [|il2|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 case (phi_bounded il2); intros Hpil2 _.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
Hpil2:0 <= [|il2|]
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih|] * base + (- base + [|il2|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 apply Z.le_trans with ([|ih|] * base + - base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
Hpil2:0 <= [|il2|]
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih|] * base + - base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 case (phi_bounded s);  change (2 ^ Z.of_nat size) with base; intros _ Hps.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
Hpil2:0 <= [|il2|]
Hps:[|s|] < base
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih|] * base + - base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 assert (2 * [|s|] + 1 <= 2 * base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
Hpil2:0 <= [|il2|]
Hps:[|s|] < base
H:2 * [|s|] + 1 <= 2 * base
[|ih1|] * base + 2 * [|s|] + 1 <=
[|ih|] * base + - base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 apply Z.le_trans with ([|ih1|] * base + 2 * base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
Hpil2:0 <= [|il2|]
Hps:[|s|] < base
H:2 * [|s|] + 1 <= 2 * base
[|ih1|] * base + 2 * base <= [|ih|] * base + - base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 assert (Hi: ([|ih1|] + 3) * base <= [|ih|] * base); auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
Hpil2:0 <= [|il2|]
Hps:[|s|] < base
H:2 * [|s|] + 1 <= 2 * base
Hi:([|ih1|] + 3) * base <= [|ih|] * base
[|ih1|] * base + 2 * base <= [|ih|] * base + - base
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Z.mul_add_distr_r in Hi; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 < [|ih|]
phi2 ih1 il1 + 2 * [|s|] + 1 = ([|s|] + 1) ^ 2
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 rewrite Hihl1, Hbin; auto.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il = phi2 ih1 il1 + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 unfold phi2; rewrite <-H2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
([|ih1|] + 2) * base + [|il|] =
[|ih1|] * base + [|il1|] + (base + [|il2|]) /\
base + [|il2|] <= 2 * [|s|]
 split.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
([|ih1|] + 2) * base + [|il|] =
[|ih1|] * base + [|il1|] + (base + [|il2|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
base + [|il2|] <= 2 * [|s|]
 replace [|il|] with (([|il|] - [|il1|]) + [|il1|]); try ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
([|ih1|] + 2) * base + ([|il|] - [|il1|] + [|il1|]) =
[|ih1|] * base + [|il1|] + (base + [|il2|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
base + [|il2|] <= 2 * [|s|]
 rewrite <-Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
([|ih1|] + 2) * base + (-1 * wB + [|il2|] + [|il1|]) =
[|ih1|] * base + [|il1|] + (base + [|il2|])
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
base + [|il2|] <= 2 * [|s|]
 change (-1 * 2 ^ Z.of_nat size) with (-base); ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
base + [|il2|] <= 2 * [|s|]
 replace (base + [|il2|]) with (phi2 ih il - phi2 ih1 il1).ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il - phi2 ih1 il1 <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il - phi2 ih1 il1 = base + [|il2|]
 rewrite Hihl1.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il - [|s|] * [|s|] <= 2 * [|s|]
ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il - phi2 ih1 il1 = base + [|il2|]
 rewrite <-Hbin in Hs2; auto with zarith.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
phi2 ih il - phi2 ih1 il1 = base + [|il2|]
 unfold phi2; rewrite <-H2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
([|ih1|] + 2) * base + [|il|] -
([|ih1|] * base + [|il1|]) = base + [|il2|]
 replace [|il|] with (([|il|] - [|il1|]) + [|il1|]); try ring.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
([|ih1|] + 2) * base + ([|il|] - [|il1|] + [|il1|]) -
([|ih1|] * base + [|il1|]) = base + [|il2|]
 rewrite <-Hil2.ih, il:int31
Hih:wB / 4 <= [|ih|]
Hbin:forall s0 : Z,
s0 * s0 + 2 * s0 + 1 = (s0 + 1) ^ 2
Hb:0 <= base
Hi2:phi2 ih il < ([|Tn|] + 1) ^ 2
s:=iter312_sqrt 31 (fun _ _ j : int31 => j) ih il Tn:int31
Hs1:[|s|] ^ 2 <= phi2 ih il
Hs2:phi2 ih il < ([|s|] + 1) ^ 2
ih1, il1:int31
Hihl1:phi2 ih1 il1 = [|s|] * [|s|]
il2:int31
Hil2:-1 * wB + [|il2|] = [|il|] - [|il1|]
Hsih:[|ih - 1|] = [|ih|] - 1
H1:[|ih1|] < [|ih - 1|]
H2:[|ih1|] + 2 = [|ih|]
([|ih1|] + 2) * base + (-1 * wB + [|il2|] + [|il1|]) -
([|ih1|] * base + [|il1|]) = base + [|il2|]
 change (-1 * 2 ^ Z.of_nat size) with (-base); ring.
Qed.

iszero

 Lemma spec_eq0 : forall x, ZnZ.eq0 x = true -> [|x|] = 0.forall x : int31, ZnZ.eq0 x = true -> [|x|] = 0
 Proof.forall x : int31, ZnZ.eq0 x = true -> [|x|] = 0
 clear; unfold ZnZ.eq0, int31_ops.forall x : int31,
match (x ?= 0)%int31 with
| Eq => true
| _ => false
end = true -> [|x|] = 0
 unfold compare31; intros.x:int31
H:match [|x|] ?= [|0|] with
| Eq => true
| _ => false
end = true
[|x|] = 0
 change [|0|] with 0 in H.x:int31
H:match [|x|] ?= 0 with
| Eq => true
| _ => false
end = true
[|x|] = 0
 apply Z.compare_eq.x:int31
H:match [|x|] ?= 0 with
| Eq => true
| _ => false
end = true
([|x|] ?= 0) = Eq
 now destruct ([|x|] ?= 0).
 Qed.

 (* Even *)

 Lemma spec_is_even : forall x,
      if ZnZ.is_even x then [|x|] mod 2 = 0 else [|x|] mod 2 = 1.forall x : int31,
if ZnZ.is_even x
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 Proof.forall x : int31,
if ZnZ.is_even x
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 unfold ZnZ.is_even, int31_ops; intros.x:int31
if
 let (_, r) := (x / 2)%int31 in
 match (r ?= 0)%int31 with
 | Eq => true
 | _ => false
 end
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 generalize (spec_div x 2).x:int31
(0 < [|2|] ->
 let (q, r) := (x / 2)%int31 in
 [|x|] = [|q|] * [|2|] + [|r|] /\ 0 <= [|r|] < [|2|]) ->
if
 let (_, r) := (x / 2)%int31 in
 match (r ?= 0)%int31 with
 | Eq => true
 | _ => false
 end
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 destruct (x/2)%int31 as (q,r); intros.x, q, r:int31
H:0 < [|2|] ->
[|x|] = [|q|] * [|2|] + [|r|] /\
0 <= [|r|] < [|2|]
if
 match (r ?= 0)%int31 with
 | Eq => true
 | _ => false
 end
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 unfold compare31.x, q, r:int31
H:0 < [|2|] ->
[|x|] = [|q|] * [|2|] + [|r|] /\
0 <= [|r|] < [|2|]
if
 match [|r|] ?= [|0|] with
 | Eq => true
 | _ => false
 end
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 change [|2|] with 2 in H.x, q, r:int31
H:0 < 2 ->
[|x|] = [|q|] * 2 + [|r|] /\ 0 <= [|r|] < 2
if
 match [|r|] ?= [|0|] with
 | Eq => true
 | _ => false
 end
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 change [|0|] with 0.x, q, r:int31
H:0 < 2 ->
[|x|] = [|q|] * 2 + [|r|] /\ 0 <= [|r|] < 2
if match [|r|] ?= 0 with
   | Eq => true
   | _ => false
   end
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 destruct H; auto with zarith.x, q, r:int31
H:[|x|] = [|q|] * 2 + [|r|]
H0:0 <= [|r|] < 2
if match [|r|] ?= 0 with
   | Eq => true
   | _ => false
   end
then [|x|] mod 2 = 0
else [|x|] mod 2 = 1
 replace ([|x|] mod 2) with [|r|].x, q, r:int31
H:[|x|] = [|q|] * 2 + [|r|]
H0:0 <= [|r|] < 2
if match [|r|] ?= 0 with
   | Eq => true
   | _ => false
   end
then [|r|] = 0
else [|r|] = 1
x, q, r:int31
H:[|x|] = [|q|] * 2 + [|r|]
H0:0 <= [|r|] < 2
[|r|] = [|x|] mod 2
 destruct H; auto with zarith.x, q, r:int31
H0:0 <= [|r|] < 2
if match [|r|] ?= 0 with
   | Eq => true
   | _ => false
   end
then [|r|] = 0
else [|r|] = 1
x, q, r:int31
H:[|x|] = [|q|] * 2 + [|r|]
H0:0 <= [|r|] < 2
[|r|] = [|x|] mod 2
 case Z.compare_spec; auto with zarith.x, q, r:int31
H:[|x|] = [|q|] * 2 + [|r|]
H0:0 <= [|r|] < 2
[|r|] = [|x|] mod 2
 apply Zmod_unique with [|q|]; auto with zarith.
 Qed.

 (* Bitwise *)

 Lemma log2_phi_bounded x : Z.log2 [|x|] < Z.of_nat size.x:int31
Z.log2 [|x|] < Z.of_nat size
 Proof.x:int31
Z.log2 [|x|] < Z.of_nat size
  destruct (phi_bounded x) as (H,H').x:int31
H:0 <= [|x|]
H':[|x|] < wB
Z.log2 [|x|] < Z.of_nat size
  Z.le_elim H.x:int31
H:0 < [|x|]
H':[|x|] < wB
Z.log2 [|x|] < Z.of_nat size
x:int31
H:0 = [|x|]
H':[|x|] < wB
Z.log2 [|x|] < Z.of_nat size
  -x:int31
H:0 < [|x|]
H':[|x|] < wB
Z.log2 [|x|] < Z.of_nat size now apply Z.log2_lt_pow2.
  -x:int31
H:0 = [|x|]
H':[|x|] < wB
Z.log2 [|x|] < Z.of_nat size now rewrite <- H.
 Qed.

 Lemma spec_lor x y : [| ZnZ.lor x y |] = Z.lor [|x|] [|y|].x, y:int31
[|ZnZ.lor x y|] = Z.lor [|x|] [|y|]
 Proof.x, y:int31
[|ZnZ.lor x y|] = Z.lor [|x|] [|y|]
 unfold ZnZ.lor,int31_ops.x, y:int31
[|lor31 x y|] = Z.lor [|x|] [|y|] unfold lor31.x, y:int31
[|phi_inv (Z.lor [|x|] [|y|])|] = Z.lor [|x|] [|y|]
 rewrite phi_phi_inv.x, y:int31
Z.lor [|x|] [|y|] mod wB = Z.lor [|x|] [|y|]
 apply Z.mod_small; split; trivial.x, y:int31
0 <= Z.lor [|x|] [|y|]
x, y:int31
Z.lor [|x|] [|y|] < wB
 -x, y:int31
0 <= Z.lor [|x|] [|y|] apply Z.lor_nonneg; split; apply phi_bounded.
 -x, y:int31
Z.lor [|x|] [|y|] < wB apply Z.log2_lt_cancel.x, y:int31
Z.log2 (Z.lor [|x|] [|y|]) < Z.log2 wB rewrite Z.log2_pow2 by easy.x, y:int31
Z.log2 (Z.lor [|x|] [|y|]) < Z.of_nat size
   rewrite Z.log2_lor; try apply phi_bounded.x, y:int31
Z.max (Z.log2 [|x|]) (Z.log2 [|y|]) < Z.of_nat size
   apply Z.max_lub_lt; apply log2_phi_bounded.
 Qed.

 Lemma spec_land x y : [| ZnZ.land x y |] = Z.land [|x|] [|y|].x, y:int31
[|ZnZ.land x y|] = Z.land [|x|] [|y|]
 Proof.x, y:int31
[|ZnZ.land x y|] = Z.land [|x|] [|y|]
 unfold ZnZ.land, int31_ops.x, y:int31
[|land31 x y|] = Z.land [|x|] [|y|] unfold land31.x, y:int31
[|phi_inv (Z.land [|x|] [|y|])|] = Z.land [|x|] [|y|]
 rewrite phi_phi_inv.x, y:int31
Z.land [|x|] [|y|] mod wB = Z.land [|x|] [|y|]
 apply Z.mod_small; split; trivial.x, y:int31
0 <= Z.land [|x|] [|y|]
x, y:int31
Z.land [|x|] [|y|] < wB
 -x, y:int31
0 <= Z.land [|x|] [|y|] apply Z.land_nonneg; left; apply phi_bounded.
 -x, y:int31
Z.land [|x|] [|y|] < wB apply Z.log2_lt_cancel.x, y:int31
Z.log2 (Z.land [|x|] [|y|]) < Z.log2 wB rewrite Z.log2_pow2 by easy.x, y:int31
Z.log2 (Z.land [|x|] [|y|]) < Z.of_nat size
   eapply Z.le_lt_trans.x, y:int31
Z.log2 (Z.land [|x|] [|y|]) <= ?m
x, y:int31
?m < Z.of_nat size
   apply Z.log2_land; try apply phi_bounded.x, y:int31
Z.min (Z.log2 [|x|]) (Z.log2 [|y|]) < Z.of_nat size
   apply Z.min_lt_iff; left; apply log2_phi_bounded.
 Qed.

 Lemma spec_lxor x y : [| ZnZ.lxor x y |] = Z.lxor [|x|] [|y|].x, y:int31
[|ZnZ.lxor x y|] = Z.lxor [|x|] [|y|]
 Proof.x, y:int31
[|ZnZ.lxor x y|] = Z.lxor [|x|] [|y|]
 unfold ZnZ.lxor, int31_ops.x, y:int31
[|lxor31 x y|] = Z.lxor [|x|] [|y|] unfold lxor31.x, y:int31
[|phi_inv (Z.lxor [|x|] [|y|])|] = Z.lxor [|x|] [|y|]
 rewrite phi_phi_inv.x, y:int31
Z.lxor [|x|] [|y|] mod wB = Z.lxor [|x|] [|y|]
 apply Z.mod_small; split; trivial.x, y:int31
0 <= Z.lxor [|x|] [|y|]
x, y:int31
Z.lxor [|x|] [|y|] < wB
 -x, y:int31
0 <= Z.lxor [|x|] [|y|] apply Z.lxor_nonneg; split; intros; apply phi_bounded.
 -x, y:int31
Z.lxor [|x|] [|y|] < wB apply Z.log2_lt_cancel.x, y:int31
Z.log2 (Z.lxor [|x|] [|y|]) < Z.log2 wB rewrite Z.log2_pow2 by easy.x, y:int31
Z.log2 (Z.lxor [|x|] [|y|]) < Z.of_nat size
   eapply Z.le_lt_trans.x, y:int31
Z.log2 (Z.lxor [|x|] [|y|]) <= ?m
x, y:int31
?m < Z.of_nat size
   apply Z.log2_lxor; try apply phi_bounded.x, y:int31
Z.max (Z.log2 [|x|]) (Z.log2 [|y|]) < Z.of_nat size
   apply Z.max_lub_lt; apply log2_phi_bounded.
 Qed.

 Instance int31_specs : ZnZ.Specs int31_ops := {
    spec_to_Z   := phi_bounded;
    spec_of_pos := positive_to_int31_spec;
    spec_zdigits := spec_zdigits;
    spec_more_than_1_digit := spec_more_than_1_digit;
    spec_0   := spec_0;
    spec_1   := spec_1;
    spec_m1  := spec_m1;
    spec_compare := spec_compare;
    spec_eq0 := spec_eq0;
    spec_opp_c := spec_opp_c;
    spec_opp := spec_opp;
    spec_opp_carry := spec_opp_carry;
    spec_succ_c := spec_succ_c;
    spec_add_c := spec_add_c;
    spec_add_carry_c := spec_add_carry_c;
    spec_succ := spec_succ;
    spec_add := spec_add;
    spec_add_carry := spec_add_carry;
    spec_pred_c := spec_pred_c;
    spec_sub_c := spec_sub_c;
    spec_sub_carry_c := spec_sub_carry_c;
    spec_pred := spec_pred;
    spec_sub := spec_sub;
    spec_sub_carry := spec_sub_carry;
    spec_mul_c := spec_mul_c;
    spec_mul := spec_mul;
    spec_square_c := spec_square_c;
    spec_div21 := spec_div21;
    spec_div_gt := fun a b _ => spec_div a b;
    spec_div := spec_div;
    spec_modulo_gt := fun a b _ => spec_mod a b;
    spec_modulo := spec_mod;
    spec_gcd_gt := fun a b _ => spec_gcd a b;
    spec_gcd := spec_gcd;
    spec_head00 := spec_head00;
    spec_head0 := spec_head0;
    spec_tail00 := spec_tail00;
    spec_tail0 := spec_tail0;
    spec_add_mul_div := spec_add_mul_div;
    spec_pos_mod := spec_pos_mod;
    spec_is_even := spec_is_even;
    spec_sqrt2 := spec_sqrt2;
    spec_sqrt := spec_sqrt;
    spec_lor := spec_lor;
    spec_land := spec_land;
    spec_lxor := spec_lxor }.

End Int31_Specs.


Module Int31Cyclic <: CyclicType.
  Definition t := int31.
  Definition ops := int31_ops.
  Definition specs := int31_specs.
End Int31Cyclic.