Built with Alectryon, running Coq+SerAPI v8.10.0+0.7.0. Coq sources are in this panel; goals and messages will appear in the other. Bubbles () indicate interactive fragments: hover for details, tap to reveal contents. Use Ctrl+↑ Ctrl+↓ to navigate, Ctrl+🖱️ to focus.

(************************************************************************)
(*         *   The Coq Proof Assistant / The Coq Development Team       *)
(*  v      *   INRIA, CNRS and contributors - Copyright 1999-2018       *)
(* <O___,, *       (see CREDITS file for the list of authors)           *)
(*   \VV/  **************************************************************)
(*    //   *    This file is distributed under the terms of the         *)
(*         *     GNU Lesser General Public License Version 2.1          *)
(*         *     (see LICENSE file for the text of the license)         *)
(************************************************************************)

Require Import
 Bool ZAxioms ZMulOrder ZPow ZDivFloor ZSgnAbs ZParity NZLog.

Derived properties of bitwise operations

Module Type ZBitsProp
 (Import A : ZAxiomsSig')
 (Import B : ZMulOrderProp A)
 (Import C : ZParityProp A B)
 (Import D : ZSgnAbsProp A B)
 (Import E : ZPowProp A B C D)
 (Import F : ZDivProp A B D)
 (Import G : NZLog2Prop A A A B E).

Include BoolEqualityFacts A.

Ltac order_nz := try apply pow_nonzero; order'.
Ltac order_pos' := try apply abs_nonneg; order_pos.
Hint Rewrite div_0_l mod_0_l div_1_r mod_1_r : nz.

Some properties of power and division

Lemma pow_sub_r : forall a b c, a~=0 -> 0<=c<=b -> a^(b-c) == a^b / a^c.forall a b c : t,
a ~= 0 -> 0 <= c <= b -> a ^ (b - c) == a ^ b / a ^ c
Proof.forall a b c : t,
a ~= 0 -> 0 <= c <= b -> a ^ (b - c) == a ^ b / a ^ c
 intros a b c Ha (H,H').a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
a ^ (b - c) == a ^ b / a ^ c rewrite <- (sub_simpl_r b c) at 2.a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
a ^ (b - c) == a ^ (b - c + c) / a ^ c
 rewrite pow_add_r; trivial.a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
a ^ (b - c) == a ^ (b - c) * a ^ c / a ^ c
a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
0 <= b - c
 rewrite div_mul.a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
a ^ (b - c) == a ^ (b - c)
a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
a ^ c ~= 0
a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
0 <= b - c reflexivity.a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
a ^ c ~= 0
a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
0 <= b - c
 now apply pow_nonzero.a, b, c:t
Ha:a ~= 0
H:0 <= c
H':c <= b
0 <= b - c
 now apply le_0_sub.
Qed.

Lemma pow_div_l : forall a b c, b~=0 -> 0<=c -> a mod b == 0 ->
 (a/b)^c == a^c / b^c.forall a b c : t,
b ~= 0 ->
0 <= c -> a mod b == 0 -> (a / b) ^ c == a ^ c / b ^ c
Proof.forall a b c : t,
b ~= 0 ->
0 <= c -> a mod b == 0 -> (a / b) ^ c == a ^ c / b ^ c
 intros a b c Hb Hc H.a, b, c:t
Hb:b ~= 0
Hc:0 <= c
H:a mod b == 0
(a / b) ^ c == a ^ c / b ^ c rewrite (div_mod a b Hb) at 2.a, b, c:t
Hb:b ~= 0
Hc:0 <= c
H:a mod b == 0
(a / b) ^ c == (b * (a / b) + a mod b) ^ c / b ^ c
 rewrite H, add_0_r, pow_mul_l, mul_comm, div_mul.a, b, c:t
Hb:b ~= 0
Hc:0 <= c
H:a mod b == 0
(a / b) ^ c == (a / b) ^ c
a, b, c:t
Hb:b ~= 0
Hc:0 <= c
H:a mod b == 0
b ^ c ~= 0 reflexivity.a, b, c:t
Hb:b ~= 0
Hc:0 <= c
H:a mod b == 0
b ^ c ~= 0
 now apply pow_nonzero.
Qed.

An injection from bits true and false to numbers 1 and 0. We declare it as a (local) coercion for shorter statements.

Definition b2z (b:bool) := if b then 1 else 0.
Coercion b2z : bool >-> t.

Instance b2z_wd : Proper (Logic.eq ==> eq) b2z := _.

Lemma exists_div2 a : exists a' (b:bool), a == 2*a' + b.a:t
exists (a' : t) (b : bool), a == 2 * a' + b
Proof.a:t
exists (a' : t) (b : bool), a == 2 * a' + b
 elim (Even_or_Odd a); [intros (a',H)| intros (a',H)].a, a':t
H:a == 2 * a'
exists (a'0 : t) (b : bool), a == 2 * a'0 + b
a, a':t
H:a == 2 * a' + 1
exists (a'0 : t) (b : bool), a == 2 * a'0 + b
 exists a'.a, a':t
H:a == 2 * a'
exists b : bool, a == 2 * a' + b
a, a':t
H:a == 2 * a' + 1
exists (a'0 : t) (b : bool), a == 2 * a'0 + b exists false.a, a':t
H:a == 2 * a'
a == 2 * a' + false
a, a':t
H:a == 2 * a' + 1
exists (a'0 : t) (b : bool), a == 2 * a'0 + b now nzsimpl.a, a':t
H:a == 2 * a' + 1
exists (a'0 : t) (b : bool), a == 2 * a'0 + b
 exists a'.a, a':t
H:a == 2 * a' + 1
exists b : bool, a == 2 * a' + b exists true.a, a':t
H:a == 2 * a' + 1
a == 2 * a' + true now simpl.
Qed.

We can compact testbit_odd_0 testbit_even_0 testbit_even_succ testbit_odd_succ in only two lemmas.

Lemma testbit_0_r a (b:bool) : testbit (2*a+b) 0 = b.a:t
b:bool
(2 * a + b).[0] = b
Proof.a:t
b:bool
(2 * a + b).[0] = b
 destruct b; simpl; rewrite ?add_0_r.a:t
(2 * a + 1).[0] = true
a:t
(2 * a).[0] = false
 apply testbit_odd_0.a:t
(2 * a).[0] = false
 apply testbit_even_0.
Qed.

Lemma testbit_succ_r a (b:bool) n : 0<=n ->
 testbit (2*a+b) (succ n) = testbit a n.a:t
b:bool
n:t
0 <= n -> (2 * a + b).[S n] = a.[n]
Proof.a:t
b:bool
n:t
0 <= n -> (2 * a + b).[S n] = a.[n]
 destruct b; simpl; rewrite ?add_0_r.a, n:t
0 <= n -> (2 * a + 1).[S n] = a.[n]
a, n:t
0 <= n -> (2 * a).[S n] = a.[n]
 now apply testbit_odd_succ.a, n:t
0 <= n -> (2 * a).[S n] = a.[n]
 now apply testbit_even_succ.
Qed.

Alternative characterisations of testbit

This concise equation could have been taken as specification for testbit in the interface, but it would have been hard to implement with little initial knowledge about div and mod

Lemma testbit_spec' a n : 0<=n -> a.[n] == (a / 2^n) mod 2.a, n:t
0 <= n -> a.[n] == (a / 2 ^ n) mod 2
Proof.a, n:t
0 <= n -> a.[n] == (a / 2 ^ n) mod 2
 intro Hn.a, n:t
Hn:0 <= n
a.[n] == (a / 2 ^ n) mod 2 revert a.n:t
Hn:0 <= n
forall a : t, a.[n] == (a / 2 ^ n) mod 2 apply le_ind with (4:=Hn).n:t
Hn:0 <= n
Proper (eq ==> iff)
  (fun n0 : t =>
   forall a : t, a.[n0] == (a / 2 ^ n0) mod 2)
n:t
Hn:0 <= n
forall a : t, a.[0] == (a / 2 ^ 0) mod 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2 
   solve_proper.n:t
Hn:0 <= n
forall a : t, a.[0] == (a / 2 ^ 0) mod 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2
 intros a.n:t
Hn:0 <= n
a:t
a.[0] == (a / 2 ^ 0) mod 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2 nzsimpl.n:t
Hn:0 <= n
a:t
a.[0] == a mod 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2
 destruct (exists_div2 a) as (a' & b & H).n:t
Hn:0 <= n
a, a':t
b:bool
H:a == 2 * a' + b
a.[0] == a mod 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2 rewrite H at 1.n:t
Hn:0 <= n
a, a':t
b:bool
H:a == 2 * a' + b
(2 * a' + b).[0] == a mod 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2
 rewrite testbit_0_r.n:t
Hn:0 <= n
a, a':t
b:bool
H:a == 2 * a' + b
b == a mod 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2 apply mod_unique with a'; trivial.n:t
Hn:0 <= n
a, a':t
b:bool
H:a == 2 * a' + b
0 <= b < 2 \/ 2 < b <= 0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2
 left.n:t
Hn:0 <= n
a, a':t
b:bool
H:a == 2 * a' + b
0 <= b < 2
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2 destruct b; split; simpl; order'.n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2
 clear n Hn.forall m : t,
0 <= m ->
(forall a : t, a.[m] == (a / 2 ^ m) mod 2) ->
forall a : t, a.[S m] == (a / 2 ^ S m) mod 2 intros n Hn IH a.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a:t
a.[S n] == (a / 2 ^ S n) mod 2
 destruct (exists_div2 a) as (a' & b & H).n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
a.[S n] == (a / 2 ^ S n) mod 2 rewrite H at 1.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
(2 * a' + b).[S n] == (a / 2 ^ S n) mod 2
 rewrite testbit_succ_r, IH by trivial.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
(a' / 2 ^ n) mod 2 == (a / 2 ^ S n) mod 2 f_equiv.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
a' / 2 ^ n == a / 2 ^ S n
 rewrite pow_succ_r, <- div_div by order_pos.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
a' / 2 ^ n == a / 2 / 2 ^ n f_equiv.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
a' == a / 2
 apply div_unique with b; trivial.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
0 <= b < 2 \/ 2 < b <= 0
 left.n:t
Hn:0 <= n
IH:forall a0 : t, a0.[n] == (a0 / 2 ^ n) mod 2
a, a':t
b:bool
H:a == 2 * a' + b
0 <= b < 2 destruct b; split; simpl; order'.
Qed.

This characterisation that uses only basic operations and power was initially taken as specification for testbit. We describe a as having a low part and a high part, with the corresponding bit in the middle. This characterisation is moderatly complex to implement, but also moderately usable...

Lemma testbit_spec a n : 0<=n ->
  exists l h, 0<=l<2^n /\ a == l + (a.[n] + 2*h)*2^n.a, n:t
0 <= n ->
exists l h : t,
  0 <= l < 2 ^ n /\ a == l + (a.[n] + 2 * h) * 2 ^ n
Proof.a, n:t
0 <= n ->
exists l h : t,
  0 <= l < 2 ^ n /\ a == l + (a.[n] + 2 * h) * 2 ^ n
 intro Hn.a, n:t
Hn:0 <= n
exists l h : t,
  0 <= l < 2 ^ n /\ a == l + (a.[n] + 2 * h) * 2 ^ n exists (a mod 2^n).a, n:t
Hn:0 <= n
exists h : t,
  0 <= a mod 2 ^ n < 2 ^ n /\
  a == a mod 2 ^ n + (a.[n] + 2 * h) * 2 ^ n exists (a / 2^n / 2).a, n:t
Hn:0 <= n
0 <= a mod 2 ^ n < 2 ^ n /\
a ==
a mod 2 ^ n + (a.[n] + 2 * (a / 2 ^ n / 2)) * 2 ^ n split.a, n:t
Hn:0 <= n
0 <= a mod 2 ^ n < 2 ^ n
a, n:t
Hn:0 <= n
a ==
a mod 2 ^ n + (a.[n] + 2 * (a / 2 ^ n / 2)) * 2 ^ n
 apply mod_pos_bound; order_pos.a, n:t
Hn:0 <= n
a ==
a mod 2 ^ n + (a.[n] + 2 * (a / 2 ^ n / 2)) * 2 ^ n
 rewrite add_comm, mul_comm, (add_comm a.[n]).a, n:t
Hn:0 <= n
a ==
2 ^ n * (2 * (a / 2 ^ n / 2) + a.[n]) + a mod 2 ^ n
 rewrite (div_mod a (2^n)) at 1 by order_nz.a, n:t
Hn:0 <= n
2 ^ n * (a / 2 ^ n) + a mod 2 ^ n ==
2 ^ n * (2 * (a / 2 ^ n / 2) + a.[n]) + a mod 2 ^ n do 2 f_equiv.a, n:t
Hn:0 <= n
a / 2 ^ n == 2 * (a / 2 ^ n / 2) + a.[n]
 rewrite testbit_spec' by trivial.a, n:t
Hn:0 <= n
a / 2 ^ n == 2 * (a / 2 ^ n / 2) + (a / 2 ^ n) mod 2 apply div_mod.a, n:t
Hn:0 <= n
2 ~= 0 order'.
Qed.

Lemma testbit_true : forall a n, 0<=n ->
 (a.[n] = true <-> (a / 2^n) mod 2 == 1).forall a n : t,
0 <= n -> a.[n] = true <-> (a / 2 ^ n) mod 2 == 1
Proof.forall a n : t,
0 <= n -> a.[n] = true <-> (a / 2 ^ n) mod 2 == 1
 intros a n Hn.a, n:t
Hn:0 <= n
a.[n] = true <-> (a / 2 ^ n) mod 2 == 1
 rewrite <- testbit_spec' by trivial.a, n:t
Hn:0 <= n
a.[n] = true <-> a.[n] == 1
 destruct a.[n]; split; simpl; now try order'.
Qed.

Lemma testbit_false : forall a n, 0<=n ->
 (a.[n] = false <-> (a / 2^n) mod 2 == 0).forall a n : t,
0 <= n -> a.[n] = false <-> (a / 2 ^ n) mod 2 == 0
Proof.forall a n : t,
0 <= n -> a.[n] = false <-> (a / 2 ^ n) mod 2 == 0
 intros a n Hn.a, n:t
Hn:0 <= n
a.[n] = false <-> (a / 2 ^ n) mod 2 == 0
 rewrite <- testbit_spec' by trivial.a, n:t
Hn:0 <= n
a.[n] = false <-> a.[n] == 0
 destruct a.[n]; split; simpl; now try order'.
Qed.

Lemma testbit_eqb : forall a n, 0<=n ->
 a.[n] = eqb ((a / 2^n) mod 2) 1.forall a n : t,
0 <= n -> a.[n] = ((a / 2 ^ n) mod 2 =? 1)
Proof.forall a n : t,
0 <= n -> a.[n] = ((a / 2 ^ n) mod 2 =? 1)
 intros a n Hn.a, n:t
Hn:0 <= n
a.[n] = ((a / 2 ^ n) mod 2 =? 1)
 apply eq_true_iff_eq.a, n:t
Hn:0 <= n
a.[n] = true <-> ((a / 2 ^ n) mod 2 =? 1) = true now rewrite testbit_true, eqb_eq.
Qed.

Results about the injection b2z

Lemma b2z_inj : forall (a0 b0:bool), a0 == b0 -> a0 = b0.forall a0 b0 : bool, a0 == b0 -> a0 = b0
Proof.forall a0 b0 : bool, a0 == b0 -> a0 = b0
 intros [|] [|]; simpl; trivial; order'.
Qed.

Lemma add_b2z_double_div2 : forall (a0:bool) a, (a0+2*a)/2 == a.forall (a0 : bool) (a : t), (a0 + 2 * a) / 2 == a
Proof.forall (a0 : bool) (a : t), (a0 + 2 * a) / 2 == a
 intros a0 a.a0:bool
a:t
(a0 + 2 * a) / 2 == a rewrite mul_comm, div_add by order'.a0:bool
a:t
a0 / 2 + a == a
 now rewrite div_small, add_0_l by (destruct a0; split; simpl; order').
Qed.

Lemma add_b2z_double_bit0 : forall (a0:bool) a, (a0+2*a).[0] = a0.forall (a0 : bool) (a : t), (a0 + 2 * a).[0] = a0
Proof.forall (a0 : bool) (a : t), (a0 + 2 * a).[0] = a0
 intros a0 a.a0:bool
a:t
(a0 + 2 * a).[0] = a0 apply b2z_inj.a0:bool
a:t
(a0 + 2 * a).[0] == a0
 rewrite testbit_spec' by order.a0:bool
a:t
((a0 + 2 * a) / 2 ^ 0) mod 2 == a0
 nzsimpl.a0:bool
a:t
(a0 + 2 * a) mod 2 == a0 rewrite mul_comm, mod_add by order'.a0:bool
a:t
a0 mod 2 == a0
 now rewrite mod_small by (destruct a0; split; simpl; order').
Qed.

Lemma b2z_div2 : forall (a0:bool), a0/2 == 0.forall a0 : bool, a0 / 2 == 0
Proof.forall a0 : bool, a0 / 2 == 0
 intros a0.a0:bool
a0 / 2 == 0 rewrite <- (add_b2z_double_div2 a0 0).a0:bool
a0 / 2 == (a0 + 2 * 0) / 2 now nzsimpl.
Qed.

Lemma b2z_bit0 : forall (a0:bool), a0.[0] = a0.forall a0 : bool, a0.[0] = a0
Proof.forall a0 : bool, a0.[0] = a0
 intros a0.a0:bool
a0.[0] = a0 rewrite <- (add_b2z_double_bit0 a0 0) at 2.a0:bool
a0.[0] = (a0 + 2 * 0).[0] now nzsimpl.
Qed.

The specification of testbit by low and high parts is complete

Lemma testbit_unique : forall a n (a0:bool) l h,
 0<=l<2^n -> a == l + (a0 + 2*h)*2^n -> a.[n] = a0.forall (a n : t) (a0 : bool) (l h : t),
0 <= l < 2 ^ n ->
a == l + (a0 + 2 * h) * 2 ^ n -> a.[n] = a0
Proof.forall (a n : t) (a0 : bool) (l h : t),
0 <= l < 2 ^ n ->
a == l + (a0 + 2 * h) * 2 ^ n -> a.[n] = a0
 intros a n a0 l h Hl EQ.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
a.[n] = a0
 assert (0<=n).a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
0 <= n
a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a.[n] = a0
  destruct (le_gt_cases 0 n) as [Hn|Hn]; trivial.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
Hn:n < 0
0 <= n
a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a.[n] = a0
  rewrite pow_neg_r in Hl by trivial.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 0
EQ:a == l + (a0 + 2 * h) * 2 ^ n
Hn:n < 0
0 <= n
a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a.[n] = a0 destruct Hl; order.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a.[n] = a0
 apply b2z_inj.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a.[n] == a0 rewrite testbit_spec' by trivial.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
(a / 2 ^ n) mod 2 == a0
 symmetry.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a0 == (a / 2 ^ n) mod 2 apply mod_unique with h.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
0 <= a0 < 2 \/ 2 < a0 <= 0
a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a / 2 ^ n == 2 * h + a0
 left; destruct a0; simpl; split; order'.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a / 2 ^ n == 2 * h + a0
 symmetry.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
2 * h + a0 == a / 2 ^ n apply div_unique with l.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
0 <= l < 2 ^ n \/ 2 ^ n < l <= 0
a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a == 2 ^ n * (2 * h + a0) + l
 now left.a, n:t
a0:bool
l, h:t
Hl:0 <= l < 2 ^ n
EQ:a == l + (a0 + 2 * h) * 2 ^ n
H:0 <= n
a == 2 ^ n * (2 * h + a0) + l
 now rewrite add_comm, (add_comm _ a0), mul_comm.
Qed.

All bits of number 0 are 0

Lemma bits_0 : forall n, 0.[n] = false.forall n : t, 0.[n] = false
Proof.forall n : t, 0.[n] = false
 intros n.n:t
0.[n] = false
 destruct (le_gt_cases 0 n).n:t
H:0 <= n
0.[n] = false
n:t
H:n < 0
0.[n] = false
 apply testbit_false; trivial.n:t
H:0 <= n
(0 / 2 ^ n) mod 2 == 0
n:t
H:n < 0
0.[n] = false nzsimpl; order_nz.n:t
H:n < 0
0.[n] = false
 now apply testbit_neg_r.
Qed.

For negative numbers, we are actually doing two's complement

Lemma bits_opp : forall a n, 0<=n -> (-a).[n] = negb (P a).[n].forall a n : t, 0 <= n -> (- a).[n] = negb (P a).[n]
Proof.forall a n : t, 0 <= n -> (- a).[n] = negb (P a).[n]
 intros a n Hn.a, n:t
Hn:0 <= n
(- a).[n] = negb (P a).[n]
 destruct (testbit_spec (-a) n Hn) as (l & h & Hl & EQ).a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] = negb (P a).[n]
 fold (b2z (-a).[n]) in EQ.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] = negb (P a).[n]
 apply negb_sym.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(P a).[n] = negb (- a).[n]
 apply testbit_unique with (2^n-l-1) (-h-1).a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
0 <= 2 ^ n - l - 1 < 2 ^ n
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n
 split.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
0 <= 2 ^ n - l - 1
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
2 ^ n - l - 1 < 2 ^ n
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n
 apply lt_succ_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
0 < S (2 ^ n - l - 1)
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
2 ^ n - l - 1 < 2 ^ n
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n rewrite sub_1_r, succ_pred.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
0 < 2 ^ n - l
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
2 ^ n - l - 1 < 2 ^ n
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n now apply lt_0_sub.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
2 ^ n - l - 1 < 2 ^ n
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n
 apply le_succ_l.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
S (2 ^ n - l - 1) <= 2 ^ n
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n rewrite sub_1_r, succ_pred.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
2 ^ n - l <= 2 ^ n
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n apply le_sub_le_add_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
2 ^ n <= 2 ^ n + l
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n
 rewrite <- (add_0_r (2^n)) at 1.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
2 ^ n + 0 <= 2 ^ n + l
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n now apply add_le_mono_l.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
2 ^ n - l - 1 +
(negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n
 rewrite <- add_sub_swap, sub_1_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
P a ==
P
  (2 ^ n - l +
   (negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n) f_equiv.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
a ==
2 ^ n - l + (negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n
 apply opp_inj.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
- a ==
-
(2 ^ n - l + (negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n) rewrite opp_add_distr, opp_sub_distr.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
- a ==
- 2 ^ n + l +
- ((negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n)
 rewrite (add_comm _ l), <- add_assoc.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
- a ==
l +
(- 2 ^ n +
 - ((negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n))
 rewrite EQ at 1.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
l + ((- a).[n] + 2 * h) * 2 ^ n ==
l +
(- 2 ^ n +
 - ((negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n)) apply add_cancel_l.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
((- a).[n] + 2 * h) * 2 ^ n ==
- 2 ^ n + - ((negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n)
 rewrite <- opp_add_distr.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
((- a).[n] + 2 * h) * 2 ^ n ==
- (2 ^ n + (negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n)
 rewrite <- (mul_1_l (2^n)) at 2.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
((- a).[n] + 2 * h) * 2 ^ n ==
-
(1 * 2 ^ n + (negb (- a).[n] + 2 * (- h - 1)) * 2 ^ n) rewrite <- mul_add_distr_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
((- a).[n] + 2 * h) * 2 ^ n ==
- ((1 + (negb (- a).[n] + 2 * (- h - 1))) * 2 ^ n)
 rewrite <- mul_opp_l.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
((- a).[n] + 2 * h) * 2 ^ n ==
- (1 + (negb (- a).[n] + 2 * (- h - 1))) * 2 ^ n
 f_equiv.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] + 2 * h ==
- (1 + (negb (- a).[n] + 2 * (- h - 1)))
 rewrite !opp_add_distr.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] + 2 * h ==
-1 + (- negb (- a).[n] + - (2 * (- h - 1)))
 rewrite <- mul_opp_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] + 2 * h ==
-1 + (- negb (- a).[n] + 2 * - (- h - 1))
 rewrite opp_sub_distr, opp_involutive.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] + 2 * h ==
-1 + (- negb (- a).[n] + 2 * (h + 1))
 rewrite (add_comm h).a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] + 2 * h ==
-1 + (- negb (- a).[n] + 2 * (1 + h))
 rewrite mul_add_distr_l.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] + 2 * h ==
-1 + (- negb (- a).[n] + (2 * 1 + 2 * h))
 rewrite !add_assoc.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] + 2 * h ==
-1 + - negb (- a).[n] + 2 * 1 + 2 * h
 apply add_cancel_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] == -1 + - negb (- a).[n] + 2 * 1
 rewrite mul_1_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] == -1 + - negb (- a).[n] + 2
 rewrite add_comm, add_assoc, !add_opp_r, sub_1_r, two_succ, pred_succ.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + ((- a).[n] + 2 * h) * 2 ^ n
(- a).[n] == 1 - negb (- a).[n]
 destruct (-a).[n]; simpl.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + (true + 2 * h) * 2 ^ n
1 == 1 - 0
a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + (false + 2 * h) * 2 ^ n
0 == 1 - 1 now rewrite sub_0_r.a, n:t
Hn:0 <= n
l, h:t
Hl:0 <= l < 2 ^ n
EQ:- a == l + (false + 2 * h) * 2 ^ n
0 == 1 - 1 now nzsimpl'.
Qed.

All bits of number (-1) are 1

Lemma bits_m1 : forall n, 0<=n -> (-1).[n] = true.forall n : t, 0 <= n -> (-1).[n] = true
Proof.forall n : t, 0 <= n -> (-1).[n] = true
 intros.n:t
H:0 <= n
(-1).[n] = true now rewrite bits_opp, one_succ, pred_succ, bits_0.
Qed.

Various ways to refer to the lowest bit of a number

Lemma bit0_odd : forall a, a.[0] = odd a.forall a : t, a.[0] = odd a
Proof.forall a : t, a.[0] = odd a
 intros.a:t
a.[0] = odd a symmetry.a:t
odd a = a.[0]
 destruct (exists_div2 a) as (a' & b & EQ).a, a':t
b:bool
EQ:a == 2 * a' + b
odd a = a.[0]
 rewrite EQ, testbit_0_r, add_comm, odd_add_mul_2.a, a':t
b:bool
EQ:a == 2 * a' + b
odd b = b
 destruct b; simpl; apply odd_1 || apply odd_0.
Qed.

Lemma bit0_eqb : forall a, a.[0] = eqb (a mod 2) 1.forall a : t, a.[0] = (a mod 2 =? 1)
Proof.forall a : t, a.[0] = (a mod 2 =? 1)
 intros a.a:t
a.[0] = (a mod 2 =? 1) rewrite testbit_eqb by order.a:t
((a / 2 ^ 0) mod 2 =? 1) = (a mod 2 =? 1) now nzsimpl.
Qed.

Lemma bit0_mod : forall a, a.[0] == a mod 2.forall a : t, a.[0] == a mod 2
Proof.forall a : t, a.[0] == a mod 2
 intros a.a:t
a.[0] == a mod 2 rewrite testbit_spec' by order.a:t
(a / 2 ^ 0) mod 2 == a mod 2 now nzsimpl.
Qed.

Hence testing a bit is equivalent to shifting and testing parity

Lemma testbit_odd : forall a n, a.[n] = odd (a>>n).forall a n : t, a.[n] = odd (a >> n)
Proof.forall a n : t, a.[n] = odd (a >> n)
 intros.a, n:t
a.[n] = odd (a >> n) now rewrite <- bit0_odd, shiftr_spec, add_0_l.
Qed.

log2 gives the highest nonzero bit of positive numbers

Lemma bit_log2 : forall a, 0<a -> a.[log2 a] = true.forall a : t, 0 < a -> a.[log2 a] = true
Proof.forall a : t, 0 < a -> a.[log2 a] = true
 intros a Ha.a:t
Ha:0 < a
a.[log2 a] = true
 assert (Ha' := log2_nonneg a).a:t
Ha:0 < a
Ha':0 <= log2 a
a.[log2 a] = true
 destruct (log2_spec_alt a Ha) as (r & EQ & Hr).a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
a.[log2 a] = true
 rewrite EQ at 1.a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
(2 ^ log2 a + r).[log2 a] = true
 rewrite testbit_true, add_comm by trivial.a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
((r + 2 ^ log2 a) / 2 ^ log2 a) mod 2 == 1
 rewrite <- (mul_1_l (2^log2 a)) at 1.a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
((r + 1 * 2 ^ log2 a) / 2 ^ log2 a) mod 2 == 1
 rewrite div_add by order_nz.a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
(r / 2 ^ log2 a + 1) mod 2 == 1
 rewrite div_small; trivial.a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
(0 + 1) mod 2 == 1
 rewrite add_0_l.a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
1 mod 2 == 1 apply mod_small.a:t
Ha:0 < a
Ha':0 <= log2 a
r:t
EQ:a == 2 ^ log2 a + r
Hr:0 <= r < 2 ^ log2 a
0 <= 1 < 2 split; order'.
Qed.

Lemma bits_above_log2 : forall a n, 0<=a -> log2 a < n ->
 a.[n] = false.forall a n : t, 0 <= a -> log2 a < n -> a.[n] = false
Proof.forall a n : t, 0 <= a -> log2 a < n -> a.[n] = false
 intros a n Ha H.a, n:t
Ha:0 <= a
H:log2 a < n
a.[n] = false
 assert (Hn : 0<=n).a, n:t
Ha:0 <= a
H:log2 a < n
0 <= n
a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a.[n] = false
  transitivity (log2 a).a, n:t
Ha:0 <= a
H:log2 a < n
0 <= log2 a
a, n:t
Ha:0 <= a
H:log2 a < n
log2 a <= n
a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a.[n] = false apply log2_nonneg.a, n:t
Ha:0 <= a
H:log2 a < n
log2 a <= n
a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a.[n] = false order'.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a.[n] = false
 rewrite testbit_false by trivial.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
(a / 2 ^ n) mod 2 == 0
 rewrite div_small.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
0 mod 2 == 0
a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
0 <= a < 2 ^ n nzsimpl; order'.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
0 <= a < 2 ^ n
 split.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
0 <= a
a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a < 2 ^ n order.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a < 2 ^ n apply log2_lt_cancel.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
log2 a < log2 (2 ^ n) now rewrite log2_pow2.
Qed.

Hence the number of bits of a is 1+log2 a (see Pos.size_nat and Pos.size).

For negative numbers, things are the other ways around: log2 gives the highest zero bit (for numbers below -1).

Lemma bit_log2_neg : forall a, a < -1 -> a.[log2 (P (-a))] = false.forall a : t, a < -1 -> a.[log2 (P (- a))] = false
Proof.forall a : t, a < -1 -> a.[log2 (P (- a))] = false
 intros a Ha.a:t
Ha:a < -1
a.[log2 (P (- a))] = false
 rewrite <- (opp_involutive a) at 1.a:t
Ha:a < -1
(- - a).[log2 (P (- a))] = false
 rewrite bits_opp.a:t
Ha:a < -1
negb (P (- a)).[log2 (P (- a))] = false
a:t
Ha:a < -1
0 <= log2 (P (- a))
 apply negb_false_iff.a:t
Ha:a < -1
(P (- a)).[log2 (P (- a))] = true
a:t
Ha:a < -1
0 <= log2 (P (- a))
 apply bit_log2.a:t
Ha:a < -1
0 < P (- a)
a:t
Ha:a < -1
0 <= log2 (P (- a))
 apply opp_lt_mono in Ha.a:t
Ha:- -1 < - a
0 < P (- a)
a:t
Ha:a < -1
0 <= log2 (P (- a)) rewrite opp_involutive in Ha.a:t
Ha:1 < - a
0 < P (- a)
a:t
Ha:a < -1
0 <= log2 (P (- a))
 apply lt_succ_lt_pred.a:t
Ha:1 < - a
S 0 < - a
a:t
Ha:a < -1
0 <= log2 (P (- a)) now rewrite <- one_succ.a:t
Ha:a < -1
0 <= log2 (P (- a))
 apply log2_nonneg.
Qed.

Lemma bits_above_log2_neg : forall a n, a < 0 -> log2 (P (-a)) < n ->
 a.[n] = true.forall a n : t,
a < 0 -> log2 (P (- a)) < n -> a.[n] = true
Proof.forall a n : t,
a < 0 -> log2 (P (- a)) < n -> a.[n] = true
 intros a n Ha H.a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
a.[n] = true
 assert (Hn : 0<=n).a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
0 <= n
a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
Hn:0 <= n
a.[n] = true
  transitivity (log2 (P (-a))).a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
0 <= log2 (P (- a))
a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
log2 (P (- a)) <= n
a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
Hn:0 <= n
a.[n] = true apply log2_nonneg.a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
log2 (P (- a)) <= n
a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
Hn:0 <= n
a.[n] = true order'.a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
Hn:0 <= n
a.[n] = true
 rewrite <- (opp_involutive a), bits_opp, negb_true_iff by trivial.a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
Hn:0 <= n
(P (- a)).[n] = false
 apply bits_above_log2; trivial.a, n:t
Ha:a < 0
H:log2 (P (- a)) < n
Hn:0 <= n
0 <= P (- a)
 now rewrite <- opp_succ, opp_nonneg_nonpos, le_succ_l.
Qed.

Accessing a high enough bit of a number gives its sign

Lemma bits_iff_nonneg : forall a n, log2 (abs a) < n ->
 (0<=a <-> a.[n] = false).forall a n : t,
log2 (abs a) < n -> 0 <= a <-> a.[n] = false
Proof.forall a n : t,
log2 (abs a) < n -> 0 <= a <-> a.[n] = false
 intros a n Hn.a, n:t
Hn:log2 (abs a) < n
0 <= a <-> a.[n] = false split; intros H.a, n:t
Hn:log2 (abs a) < n
H:0 <= a
a.[n] = false
a, n:t
Hn:log2 (abs a) < n
H:a.[n] = false
0 <= a
 rewrite abs_eq in Hn; trivial.a, n:t
Hn:log2 a < n
H:0 <= a
a.[n] = false
a, n:t
Hn:log2 (abs a) < n
H:a.[n] = false
0 <= a now apply bits_above_log2.a, n:t
Hn:log2 (abs a) < n
H:a.[n] = false
0 <= a
 destruct (le_gt_cases 0 a); trivial.a, n:t
Hn:log2 (abs a) < n
H:a.[n] = false
H0:a < 0
0 <= a
 rewrite abs_neq in Hn by order.a, n:t
Hn:log2 (- a) < n
H:a.[n] = false
H0:a < 0
0 <= a
 rewrite bits_above_log2_neg in H; try easy.a, n:t
Hn:log2 (- a) < n
H:a.[n] = false
H0:a < 0
log2 (P (- a)) < n
 apply le_lt_trans with (log2 (-a)); trivial.a, n:t
Hn:log2 (- a) < n
H:a.[n] = false
H0:a < 0
log2 (P (- a)) <= log2 (- a)
 apply log2_le_mono.a, n:t
Hn:log2 (- a) < n
H:a.[n] = false
H0:a < 0
P (- a) <= - a apply le_pred_l.
Qed.

Lemma bits_iff_nonneg' : forall a,
 0<=a <-> a.[S (log2 (abs a))] = false.forall a : t, 0 <= a <-> a.[S (log2 (abs a))] = false
Proof.forall a : t, 0 <= a <-> a.[S (log2 (abs a))] = false
 intros.a:t
0 <= a <-> a.[S (log2 (abs a))] = false apply bits_iff_nonneg.a:t
log2 (abs a) < S (log2 (abs a)) apply lt_succ_diag_r.
Qed.

Lemma bits_iff_nonneg_ex : forall a,
 0<=a <-> (exists k, forall m, k<m -> a.[m] = false).forall a : t,
0 <= a <->
(exists k : t, forall m : t, k < m -> a.[m] = false)
Proof.forall a : t,
0 <= a <->
(exists k : t, forall m : t, k < m -> a.[m] = false)
 intros a.a:t
0 <= a <->
(exists k : t, forall m : t, k < m -> a.[m] = false) split.a:t
0 <= a ->
exists k : t, forall m : t, k < m -> a.[m] = false
a:t
(exists k : t, forall m : t, k < m -> a.[m] = false) ->
0 <= a
 intros Ha.a:t
Ha:0 <= a
exists k : t, forall m : t, k < m -> a.[m] = false
a:t
(exists k : t, forall m : t, k < m -> a.[m] = false) ->
0 <= a exists (log2 a).a:t
Ha:0 <= a
forall m : t, log2 a < m -> a.[m] = false
a:t
(exists k : t, forall m : t, k < m -> a.[m] = false) ->
0 <= a intros m Hm.a:t
Ha:0 <= a
m:t
Hm:log2 a < m
a.[m] = false
a:t
(exists k : t, forall m : t, k < m -> a.[m] = false) ->
0 <= a now apply bits_above_log2.a:t
(exists k : t, forall m : t, k < m -> a.[m] = false) ->
0 <= a
 intros (k,Hk).a, k:t
Hk:forall m : t, k < m -> a.[m] = false
0 <= a destruct (le_gt_cases k (log2 (abs a))).a, k:t
Hk:forall m : t, k < m -> a.[m] = false
H:k <= log2 (abs a)
0 <= a
a, k:t
Hk:forall m : t, k < m -> a.[m] = false
H:log2 (abs a) < k
0 <= a
 now apply bits_iff_nonneg', Hk, lt_succ_r.a, k:t
Hk:forall m : t, k < m -> a.[m] = false
H:log2 (abs a) < k
0 <= a
 apply (bits_iff_nonneg a (S k)).a, k:t
Hk:forall m : t, k < m -> a.[m] = false
H:log2 (abs a) < k
log2 (abs a) < S k
a, k:t
Hk:forall m : t, k < m -> a.[m] = false
H:log2 (abs a) < k
a.[S k] = false
 now apply lt_succ_r, lt_le_incl.a, k:t
Hk:forall m : t, k < m -> a.[m] = false
H:log2 (abs a) < k
a.[S k] = false
 apply Hk.a, k:t
Hk:forall m : t, k < m -> a.[m] = false
H:log2 (abs a) < k
k < S k apply lt_succ_diag_r.
Qed.

Lemma bits_iff_neg : forall a n, log2 (abs a) < n ->
 (a<0 <-> a.[n] = true).forall a n : t,
log2 (abs a) < n -> a < 0 <-> a.[n] = true
Proof.forall a n : t,
log2 (abs a) < n -> a < 0 <-> a.[n] = true
 intros a n Hn.a, n:t
Hn:log2 (abs a) < n
a < 0 <-> a.[n] = true
 now rewrite lt_nge, <- not_false_iff_true, (bits_iff_nonneg a n).
Qed.

Lemma bits_iff_neg' : forall a, a<0 <-> a.[S (log2 (abs a))] = true.forall a : t, a < 0 <-> a.[S (log2 (abs a))] = true
Proof.forall a : t, a < 0 <-> a.[S (log2 (abs a))] = true
 intros.a:t
a < 0 <-> a.[S (log2 (abs a))] = true apply bits_iff_neg.a:t
log2 (abs a) < S (log2 (abs a)) apply lt_succ_diag_r.
Qed.

Lemma bits_iff_neg_ex : forall a,
 a<0 <-> (exists k, forall m, k<m -> a.[m] = true).forall a : t,
a < 0 <->
(exists k : t, forall m : t, k < m -> a.[m] = true)
Proof.forall a : t,
a < 0 <->
(exists k : t, forall m : t, k < m -> a.[m] = true)
 intros a.a:t
a < 0 <->
(exists k : t, forall m : t, k < m -> a.[m] = true) split.a:t
a < 0 ->
exists k : t, forall m : t, k < m -> a.[m] = true
a:t
(exists k : t, forall m : t, k < m -> a.[m] = true) ->
a < 0
 intros Ha.a:t
Ha:a < 0
exists k : t, forall m : t, k < m -> a.[m] = true
a:t
(exists k : t, forall m : t, k < m -> a.[m] = true) ->
a < 0 exists (log2 (P (-a))).a:t
Ha:a < 0
forall m : t, log2 (P (- a)) < m -> a.[m] = true
a:t
(exists k : t, forall m : t, k < m -> a.[m] = true) ->
a < 0 intros m Hm.a:t
Ha:a < 0
m:t
Hm:log2 (P (- a)) < m
a.[m] = true
a:t
(exists k : t, forall m : t, k < m -> a.[m] = true) ->
a < 0 now apply bits_above_log2_neg.a:t
(exists k : t, forall m : t, k < m -> a.[m] = true) ->
a < 0
 intros (k,Hk).a, k:t
Hk:forall m : t, k < m -> a.[m] = true
a < 0 destruct (le_gt_cases k (log2 (abs a))).a, k:t
Hk:forall m : t, k < m -> a.[m] = true
H:k <= log2 (abs a)
a < 0
a, k:t
Hk:forall m : t, k < m -> a.[m] = true
H:log2 (abs a) < k
a < 0
 now apply bits_iff_neg', Hk, lt_succ_r.a, k:t
Hk:forall m : t, k < m -> a.[m] = true
H:log2 (abs a) < k
a < 0
 apply (bits_iff_neg a (S k)).a, k:t
Hk:forall m : t, k < m -> a.[m] = true
H:log2 (abs a) < k
log2 (abs a) < S k
a, k:t
Hk:forall m : t, k < m -> a.[m] = true
H:log2 (abs a) < k
a.[S k] = true
 now apply lt_succ_r, lt_le_incl.a, k:t
Hk:forall m : t, k < m -> a.[m] = true
H:log2 (abs a) < k
a.[S k] = true
 apply Hk.a, k:t
Hk:forall m : t, k < m -> a.[m] = true
H:log2 (abs a) < k
k < S k apply lt_succ_diag_r.
Qed.

Testing bits after division or multiplication by a power of two

Lemma div2_bits : forall a n, 0<=n -> (a/2).[n] = a.[S n].forall a n : t, 0 <= n -> (a / 2).[n] = a.[S n]
Proof.forall a n : t, 0 <= n -> (a / 2).[n] = a.[S n]
 intros a n Hn.a, n:t
Hn:0 <= n
(a / 2).[n] = a.[S n]
 apply eq_true_iff_eq.a, n:t
Hn:0 <= n
(a / 2).[n] = true <-> a.[S n] = true rewrite 2 testbit_true by order_pos.a, n:t
Hn:0 <= n
(a / 2 / 2 ^ n) mod 2 == 1 <->
(a / 2 ^ S n) mod 2 == 1
 rewrite pow_succ_r by trivial.a, n:t
Hn:0 <= n
(a / 2 / 2 ^ n) mod 2 == 1 <->
(a / (2 * 2 ^ n)) mod 2 == 1
 now rewrite div_div by order_pos.
Qed.

Lemma div_pow2_bits : forall a n m, 0<=n -> 0<=m -> (a/2^n).[m] = a.[m+n].forall a n m : t,
0 <= n -> 0 <= m -> (a / 2 ^ n).[m] = a.[m + n]
Proof.forall a n m : t,
0 <= n -> 0 <= m -> (a / 2 ^ n).[m] = a.[m + n]
 intros a n m Hn.a, n, m:t
Hn:0 <= n
0 <= m -> (a / 2 ^ n).[m] = a.[m + n] revert a m.n:t
Hn:0 <= n
forall a m : t, 0 <= m -> (a / 2 ^ n).[m] = a.[m + n] apply le_ind with (4:=Hn).n:t
Hn:0 <= n
Proper (eq ==> iff)
  (fun n0 : t =>
   forall a m : t,
   0 <= m -> (a / 2 ^ n0).[m] = a.[m + n0])
n:t
Hn:0 <= n
forall a m : t, 0 <= m -> (a / 2 ^ 0).[m] = a.[m + 0]
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t,
 0 <= m0 -> (a / 2 ^ m).[m0] = a.[m0 + m]) ->
forall a m0 : t,
0 <= m0 -> (a / 2 ^ S m).[m0] = a.[m0 + S m]
 solve_proper.n:t
Hn:0 <= n
forall a m : t, 0 <= m -> (a / 2 ^ 0).[m] = a.[m + 0]
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t,
 0 <= m0 -> (a / 2 ^ m).[m0] = a.[m0 + m]) ->
forall a m0 : t,
0 <= m0 -> (a / 2 ^ S m).[m0] = a.[m0 + S m]
 intros a m Hm.n:t
Hn:0 <= n
a, m:t
Hm:0 <= m
(a / 2 ^ 0).[m] = a.[m + 0]
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t,
 0 <= m0 -> (a / 2 ^ m).[m0] = a.[m0 + m]) ->
forall a m0 : t,
0 <= m0 -> (a / 2 ^ S m).[m0] = a.[m0 + S m] now nzsimpl.n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t,
 0 <= m0 -> (a / 2 ^ m).[m0] = a.[m0 + m]) ->
forall a m0 : t,
0 <= m0 -> (a / 2 ^ S m).[m0] = a.[m0 + S m]
 clear n Hn.forall m : t,
0 <= m ->
(forall a m0 : t,
 0 <= m0 -> (a / 2 ^ m).[m0] = a.[m0 + m]) ->
forall a m0 : t,
0 <= m0 -> (a / 2 ^ S m).[m0] = a.[m0 + S m] intros n Hn IH a m Hm.n:t
Hn:0 <= n
IH:forall a0 m0 : t,
0 <= m0 -> (a0 / 2 ^ n).[m0] = a0.[m0 + n]
a, m:t
Hm:0 <= m
(a / 2 ^ S n).[m] = a.[m + S n] nzsimpl; trivial.n:t
Hn:0 <= n
IH:forall a0 m0 : t,
0 <= m0 -> (a0 / 2 ^ n).[m0] = a0.[m0 + n]
a, m:t
Hm:0 <= m
(a / (2 * 2 ^ n)).[m] = a.[S (m + n)]
 rewrite <- div_div by order_pos.n:t
Hn:0 <= n
IH:forall a0 m0 : t,
0 <= m0 -> (a0 / 2 ^ n).[m0] = a0.[m0 + n]
a, m:t
Hm:0 <= m
(a / 2 / 2 ^ n).[m] = a.[S (m + n)]
 now rewrite IH, div2_bits by order_pos.
Qed.

Lemma double_bits_succ : forall a n, (2*a).[S n] = a.[n].forall a n : t, (2 * a).[S n] = a.[n]
Proof.forall a n : t, (2 * a).[S n] = a.[n]
 intros a n.a, n:t
(2 * a).[S n] = a.[n]
 destruct (le_gt_cases 0 n) as [Hn|Hn].a, n:t
Hn:0 <= n
(2 * a).[S n] = a.[n]
a, n:t
Hn:n < 0
(2 * a).[S n] = a.[n]
 now rewrite <- div2_bits, mul_comm, div_mul by order'.a, n:t
Hn:n < 0
(2 * a).[S n] = a.[n]
 rewrite (testbit_neg_r a n Hn).a, n:t
Hn:n < 0
(2 * a).[S n] = false
 apply le_succ_l in Hn.a, n:t
Hn:S n <= 0
(2 * a).[S n] = false le_elim Hn.a, n:t
Hn:S n < 0
(2 * a).[S n] = false
a, n:t
Hn:S n == 0
(2 * a).[S n] = false
 now rewrite testbit_neg_r.a, n:t
Hn:S n == 0
(2 * a).[S n] = false
 now rewrite Hn, bit0_odd, odd_mul, odd_2.
Qed.

Lemma double_bits : forall a n, (2*a).[n] = a.[P n].forall a n : t, (2 * a).[n] = a.[P n]
Proof.forall a n : t, (2 * a).[n] = a.[P n]
 intros a n.a, n:t
(2 * a).[n] = a.[P n] rewrite <- (succ_pred n) at 1.a, n:t
(2 * a).[S (P n)] = a.[P n] apply double_bits_succ.
Qed.

Lemma mul_pow2_bits_add : forall a n m, 0<=n -> (a*2^n).[n+m] = a.[m].forall a n m : t,
0 <= n -> (a * 2 ^ n).[n + m] = a.[m]
Proof.forall a n m : t,
0 <= n -> (a * 2 ^ n).[n + m] = a.[m]
 intros a n m Hn.a, n, m:t
Hn:0 <= n
(a * 2 ^ n).[n + m] = a.[m] revert a m.n:t
Hn:0 <= n
forall a m : t, (a * 2 ^ n).[n + m] = a.[m] apply le_ind with (4:=Hn).n:t
Hn:0 <= n
Proper (eq ==> iff)
  (fun n0 : t =>
   forall a m : t, (a * 2 ^ n0).[n0 + m] = a.[m])
n:t
Hn:0 <= n
forall a m : t, (a * 2 ^ 0).[0 + m] = a.[m]
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t, (a * 2 ^ m).[m + m0] = a.[m0]) ->
forall a m0 : t, (a * 2 ^ S m).[S m + m0] = a.[m0]
 solve_proper.n:t
Hn:0 <= n
forall a m : t, (a * 2 ^ 0).[0 + m] = a.[m]
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t, (a * 2 ^ m).[m + m0] = a.[m0]) ->
forall a m0 : t, (a * 2 ^ S m).[S m + m0] = a.[m0]
 intros a m.n:t
Hn:0 <= n
a, m:t
(a * 2 ^ 0).[0 + m] = a.[m]
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t, (a * 2 ^ m).[m + m0] = a.[m0]) ->
forall a m0 : t, (a * 2 ^ S m).[S m + m0] = a.[m0] now nzsimpl.n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a m0 : t, (a * 2 ^ m).[m + m0] = a.[m0]) ->
forall a m0 : t, (a * 2 ^ S m).[S m + m0] = a.[m0]
 clear n Hn.forall m : t,
0 <= m ->
(forall a m0 : t, (a * 2 ^ m).[m + m0] = a.[m0]) ->
forall a m0 : t, (a * 2 ^ S m).[S m + m0] = a.[m0] intros n Hn IH a m.n:t
Hn:0 <= n
IH:forall a0 m0 : t, (a0 * 2 ^ n).[n + m0] = a0.[m0]
a, m:t
(a * 2 ^ S n).[S n + m] = a.[m] nzsimpl; trivial.n:t
Hn:0 <= n
IH:forall a0 m0 : t, (a0 * 2 ^ n).[n + m0] = a0.[m0]
a, m:t
(a * (2 * 2 ^ n)).[S (n + m)] = a.[m]
 rewrite mul_assoc, (mul_comm _ 2), <- mul_assoc.n:t
Hn:0 <= n
IH:forall a0 m0 : t, (a0 * 2 ^ n).[n + m0] = a0.[m0]
a, m:t
(2 * (a * 2 ^ n)).[S (n + m)] = a.[m]
 now rewrite double_bits_succ.
Qed.

Lemma mul_pow2_bits : forall a n m, 0<=n -> (a*2^n).[m] = a.[m-n].forall a n m : t,
0 <= n -> (a * 2 ^ n).[m] = a.[m - n]
Proof.forall a n m : t,
0 <= n -> (a * 2 ^ n).[m] = a.[m - n]
 intros.a, n, m:t
H:0 <= n
(a * 2 ^ n).[m] = a.[m - n]
 rewrite <- (add_simpl_r m n) at 1.a, n, m:t
H:0 <= n
(a * 2 ^ n).[m + n - n] = a.[m - n] rewrite add_sub_swap, add_comm.a, n, m:t
H:0 <= n
(a * 2 ^ n).[n + (m - n)] = a.[m - n]
 now apply mul_pow2_bits_add.
Qed.

Lemma mul_pow2_bits_low : forall a n m, m<n -> (a*2^n).[m] = false.forall a n m : t, m < n -> (a * 2 ^ n).[m] = false
Proof.forall a n m : t, m < n -> (a * 2 ^ n).[m] = false
 intros.a, n, m:t
H:m < n
(a * 2 ^ n).[m] = false
 destruct (le_gt_cases 0 n).a, n, m:t
H:m < n
H0:0 <= n
(a * 2 ^ n).[m] = false
a, n, m:t
H:m < n
H0:n < 0
(a * 2 ^ n).[m] = false
 rewrite mul_pow2_bits by trivial.a, n, m:t
H:m < n
H0:0 <= n
a.[m - n] = false
a, n, m:t
H:m < n
H0:n < 0
(a * 2 ^ n).[m] = false
 apply testbit_neg_r.a, n, m:t
H:m < n
H0:0 <= n
m - n < 0
a, n, m:t
H:m < n
H0:n < 0
(a * 2 ^ n).[m] = false now apply lt_sub_0.a, n, m:t
H:m < n
H0:n < 0
(a * 2 ^ n).[m] = false
 now rewrite pow_neg_r, mul_0_r, bits_0.
Qed.

Selecting the low part of a number can be done by a modulo

Lemma mod_pow2_bits_high : forall a n m, 0<=n<=m ->
 (a mod 2^n).[m] = false.forall a n m : t,
0 <= n <= m -> (a mod 2 ^ n).[m] = false
Proof.forall a n m : t,
0 <= n <= m -> (a mod 2 ^ n).[m] = false
 intros a n m (Hn,H).a, n, m:t
Hn:0 <= n
H:n <= m
(a mod 2 ^ n).[m] = false
 destruct (mod_pos_bound a (2^n)) as [LE LT].a, n, m:t
Hn:0 <= n
H:n <= m
0 < 2 ^ n
a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 <= a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
(a mod 2 ^ n).[m] = false order_pos.a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 <= a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
(a mod 2 ^ n).[m] = false
 le_elim LE.a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 < a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
(a mod 2 ^ n).[m] = false
a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 == a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
(a mod 2 ^ n).[m] = false
 apply bits_above_log2; try order.a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 < a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
log2 (a mod 2 ^ n) < m
a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 == a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
(a mod 2 ^ n).[m] = false
 apply lt_le_trans with n; trivial.a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 < a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
log2 (a mod 2 ^ n) < n
a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 == a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
(a mod 2 ^ n).[m] = false
 apply log2_lt_pow2; trivial.a, n, m:t
Hn:0 <= n
H:n <= m
LE:0 == a mod 2 ^ n
LT:a mod 2 ^ n < 2 ^ n
(a mod 2 ^ n).[m] = false
 now rewrite <- LE, bits_0.
Qed.

Lemma mod_pow2_bits_low : forall a n m, m<n ->
 (a mod 2^n).[m] = a.[m].forall a n m : t, m < n -> (a mod 2 ^ n).[m] = a.[m]
Proof.forall a n m : t, m < n -> (a mod 2 ^ n).[m] = a.[m]
 intros a n m H.a, n, m:t
H:m < n
(a mod 2 ^ n).[m] = a.[m]
 destruct (le_gt_cases 0 m) as [Hm|Hm]; [|now rewrite !testbit_neg_r].a, n, m:t
H:m < n
Hm:0 <= m
(a mod 2 ^ n).[m] = a.[m]
 rewrite testbit_eqb; trivial.a, n, m:t
H:m < n
Hm:0 <= m
((a mod 2 ^ n / 2 ^ m) mod 2 =? 1) = a.[m]
 rewrite <- (mod_add _ (2^(P (n-m))*(a/2^n))) by order'.a, n, m:t
H:m < n
Hm:0 <= m
((a mod 2 ^ n / 2 ^ m +
  2 ^ P (n - m) * (a / 2 ^ n) * 2) mod 2 =? 1) = a.[m]
 rewrite <- div_add by order_nz.a, n, m:t
H:m < n
Hm:0 <= m
(((a mod 2 ^ n +
   2 ^ P (n - m) * (a / 2 ^ n) * 2 * 2 ^ m) / 2 ^ m)
 mod 2 =? 1) = a.[m]
 rewrite (mul_comm _ 2), mul_assoc, <- pow_succ_r, succ_pred.a, n, m:t
H:m < n
Hm:0 <= m
(((a mod 2 ^ n + 2 ^ (n - m) * (a / 2 ^ n) * 2 ^ m) /
  2 ^ m) mod 2 =? 1) = a.[m]
a, n, m:t
H:m < n
Hm:0 <= m
0 <= P (n - m)
 rewrite mul_comm, mul_assoc, <- pow_add_r, (add_comm m), sub_add; trivial.a, n, m:t
H:m < n
Hm:0 <= m
(((a mod 2 ^ n + 2 ^ n * (a / 2 ^ n)) / 2 ^ m) mod 2 =?
 1) = a.[m]
a, n, m:t
H:m < n
Hm:0 <= m
0 <= n - m
a, n, m:t
H:m < n
Hm:0 <= m
0 <= P (n - m)
 rewrite add_comm, <- div_mod by order_nz.a, n, m:t
H:m < n
Hm:0 <= m
((a / 2 ^ m) mod 2 =? 1) = a.[m]
a, n, m:t
H:m < n
Hm:0 <= m
0 <= n - m
a, n, m:t
H:m < n
Hm:0 <= m
0 <= P (n - m)
 symmetry.a, n, m:t
H:m < n
Hm:0 <= m
a.[m] = ((a / 2 ^ m) mod 2 =? 1)
a, n, m:t
H:m < n
Hm:0 <= m
0 <= n - m
a, n, m:t
H:m < n
Hm:0 <= m
0 <= P (n - m) apply testbit_eqb; trivial.a, n, m:t
H:m < n
Hm:0 <= m
0 <= n - m
a, n, m:t
H:m < n
Hm:0 <= m
0 <= P (n - m)
 apply le_0_sub; order.a, n, m:t
H:m < n
Hm:0 <= m
0 <= P (n - m)
 now apply lt_le_pred, lt_0_sub.
Qed.

We now prove that having the same bits implies equality. For that we use a notion of equality over functional streams of bits.

Definition eqf (f g:t -> bool) := forall n:t, f n = g n.

Instance eqf_equiv : Equivalence eqf.Equivalence eqf
Proof.Equivalence eqf
 split; congruence.
Qed.

Local Infix "===" := eqf (at level 70, no associativity).

Instance testbit_eqf : Proper (eq==>eqf) testbit.Proper (eq ==> eqf) testbit
Proof.Proper (eq ==> eqf) testbit
 intros a a' Ha n.a, a':t
Ha:a == a'
n:t
a.[n] = a'.[n] now rewrite Ha.
Qed.

Only zero corresponds to the always-false stream.

Lemma bits_inj_0 :
 forall a, (forall n, a.[n] = false) -> a == 0.forall a : t, (forall n : t, a.[n] = false) -> a == 0
Proof.forall a : t, (forall n : t, a.[n] = false) -> a == 0
 intros a H.a:t
H:forall n : t, a.[n] = false
a == 0 destruct (lt_trichotomy a 0) as [Ha|[Ha|Ha]]; trivial.a:t
H:forall n : t, a.[n] = false
Ha:a < 0
a == 0
a:t
H:forall n : t, a.[n] = false
Ha:0 < a
a == 0
 apply (bits_above_log2_neg a (S (log2 (P (-a))))) in Ha.a:t
H:forall n : t, a.[n] = false
Ha:a.[S (log2 (P (- a)))] = true
a == 0
a:t
H:forall n : t, a.[n] = false
Ha:a < 0
log2 (P (- a)) < S (log2 (P (- a)))
a:t
H:forall n : t, a.[n] = false
Ha:0 < a
a == 0
 now rewrite H in Ha.a:t
H:forall n : t, a.[n] = false
Ha:a < 0
log2 (P (- a)) < S (log2 (P (- a)))
a:t
H:forall n : t, a.[n] = false
Ha:0 < a
a == 0
 apply lt_succ_diag_r.a:t
H:forall n : t, a.[n] = false
Ha:0 < a
a == 0
 apply bit_log2 in Ha.a:t
H:forall n : t, a.[n] = false
Ha:a.[log2 a] = true
a == 0 now rewrite H in Ha.
Qed.

If two numbers produce the same stream of bits, they are equal.

Lemma bits_inj : forall a b, testbit a === testbit b -> a == b.forall a b : t, testbit a === testbit b -> a == b
Proof.forall a b : t, testbit a === testbit b -> a == b
 assert (AUX : forall n, 0<=n -> forall a b,
                0<=a<2^n -> testbit a === testbit b -> a == b).forall n : t,
0 <= n ->
forall a b : t,
0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  intros n Hn.n:t
Hn:0 <= n
forall a b : t,
0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b apply le_ind with (4:=Hn).n:t
Hn:0 <= n
Proper (eq ==> iff)
  (fun n0 : t =>
   forall a b : t,
   0 <= a < 2 ^ n0 ->
   testbit a === testbit b -> a == b)
n:t
Hn:0 <= n
forall a b : t,
0 <= a < 2 ^ 0 -> testbit a === testbit b -> a == b
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  solve_proper.n:t
Hn:0 <= n
forall a b : t,
0 <= a < 2 ^ 0 -> testbit a === testbit b -> a == b
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  intros a b Ha H.n:t
Hn:0 <= n
a, b:t
Ha:0 <= a < 2 ^ 0
H:testbit a === testbit b
a == b
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b rewrite pow_0_r, one_succ, lt_succ_r in Ha.n:t
Hn:0 <= n
a, b:t
Ha:0 <= a <= 0
H:testbit a === testbit b
a == b
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  assert (Ha' : a == 0) by (destruct Ha; order).n:t
Hn:0 <= n
a, b:t
Ha:0 <= a <= 0
H:testbit a === testbit b
Ha':a == 0
a == b
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  rewrite Ha' in *.n:t
Hn:0 <= n
a, b:t
Ha:0 <= 0 <= 0
H:testbit 0 === testbit b
Ha':a == 0
0 == b
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  symmetry.n:t
Hn:0 <= n
a, b:t
Ha:0 <= 0 <= 0
H:testbit 0 === testbit b
Ha':a == 0
b == 0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b apply bits_inj_0.n:t
Hn:0 <= n
a, b:t
Ha:0 <= 0 <= 0
H:testbit 0 === testbit b
Ha':a == 0
forall n0 : t, b.[n0] = false
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
   intros m.n:t
Hn:0 <= n
a, b:t
Ha:0 <= 0 <= 0
H:testbit 0 === testbit b
Ha':a == 0
m:t
b.[m] = false
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b now rewrite <- H, bits_0.n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  clear n Hn.forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> testbit a === testbit b -> a == b) ->
forall a b : t,
0 <= a < 2 ^ S m -> testbit a === testbit b -> a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b intros n Hn IH a b (Ha,Ha') H.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
a == b
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  rewrite (div_mod a 2), (div_mod b 2) by order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
2 * (a / 2) + a mod 2 == 2 * (b / 2) + b mod 2
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  f_equiv; [ | now rewrite <- 2 bit0_mod, H].n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
2 * (a / 2) == 2 * (b / 2)
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  f_equiv.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
a / 2 == b / 2
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  apply IH.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
0 <= a / 2 < 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
testbit (a / 2) === testbit (b / 2)
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  split.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
0 <= a / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
a / 2 < 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
testbit (a / 2) === testbit (b / 2)
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b apply div_pos; order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
a / 2 < 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
testbit (a / 2) === testbit (b / 2)
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
  apply div_lt_upper_bound.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
0 < 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
a < 2 * 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
testbit (a / 2) === testbit (b / 2)
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
a < 2 * 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
testbit (a / 2) === testbit (b / 2)
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b now rewrite <- pow_succ_r.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
testbit (a / 2) === testbit (b / 2)
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
   intros m.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
m:t
(a / 2).[m] = (b / 2).[m]
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
   destruct (le_gt_cases 0 m).n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
m:t
H0:0 <= m
(a / 2).[m] = (b / 2).[m]
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
m:t
H0:m < 0
(a / 2).[m] = (b / 2).[m]
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
   rewrite 2 div2_bits by trivial.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
m:t
H0:0 <= m
a.[S m] = b.[S m]
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
m:t
H0:m < 0
(a / 2).[m] = (b / 2).[m]
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b apply H.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
testbit a0 === testbit b0 -> a0 == b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
H:testbit a === testbit b
m:t
H0:m < 0
(a / 2).[m] = (b / 2).[m]
AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
   now rewrite 2 testbit_neg_r.AUX:forall n : t,
0 <= n -> forall a b : t, 0 <= a < 2 ^ n -> testbit a === testbit b -> a == b
forall a b : t, testbit a === testbit b -> a == b
 intros a b H.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
a == b
 destruct (le_gt_cases 0 a) as [Ha|Ha].AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:0 <= a
a == b
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
a == b
 apply (AUX a); trivial.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:0 <= a
0 <= a < 2 ^ a
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
a == b split; trivial.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:0 <= a
a < 2 ^ a
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
a == b
 apply pow_gt_lin_r; order'.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
a == b
 apply succ_inj, opp_inj.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
- S a == - S b
 assert (0 <= - S a).AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
0 <= - S a
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
- S a == - S b
  apply opp_le_mono.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
- - S a <= - 0
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
- S a == - S b now rewrite opp_involutive, opp_0, le_succ_l.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
- S a == - S b
 apply (AUX (-(S a))); trivial.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
0 <= - S a < 2 ^ (- S a)
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
testbit (- S a) === testbit (- S b) split; trivial.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
- S a < 2 ^ (- S a)
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
testbit (- S a) === testbit (- S b)
 apply pow_gt_lin_r; order'.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
testbit (- S a) === testbit (- S b)
  intros m.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
m:t
(- S a).[m] = (- S b).[m] destruct (le_gt_cases 0 m).AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
m:t
H1:0 <= m
(- S a).[m] = (- S b).[m]
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
m:t
H1:m < 0
(- S a).[m] = (- S b).[m]
  now rewrite 2 bits_opp, 2 pred_succ, H.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> testbit a0 === testbit b0 -> a0 == b0
a, b:t
H:testbit a === testbit b
Ha:a < 0
H0:0 <= - S a
m:t
H1:m < 0
(- S a).[m] = (- S b).[m]
  now rewrite 2 testbit_neg_r.
Qed.

Lemma bits_inj_iff : forall a b, testbit a === testbit b <-> a == b.forall a b : t, testbit a === testbit b <-> a == b
Proof.forall a b : t, testbit a === testbit b <-> a == b
 split.a, b:t
testbit a === testbit b -> a == b
a, b:t
a == b -> testbit a === testbit b apply bits_inj.a, b:t
a == b -> testbit a === testbit b intros EQ; now rewrite EQ.
Qed.

In fact, checking the bits at positive indexes is enough.

Lemma bits_inj' : forall a b,
 (forall n, 0<=n -> a.[n] = b.[n]) -> a == b.forall a b : t,
(forall n : t, 0 <= n -> a.[n] = b.[n]) -> a == b
Proof.forall a b : t,
(forall n : t, 0 <= n -> a.[n] = b.[n]) -> a == b
 intros a b H.a, b:t
H:forall n : t, 0 <= n -> a.[n] = b.[n]
a == b apply bits_inj.a, b:t
H:forall n : t, 0 <= n -> a.[n] = b.[n]
testbit a === testbit b
 intros n.a, b:t
H:forall n0 : t, 0 <= n0 -> a.[n0] = b.[n0]
n:t
a.[n] = b.[n] destruct (le_gt_cases 0 n).a, b:t
H:forall n0 : t, 0 <= n0 -> a.[n0] = b.[n0]
n:t
H0:0 <= n
a.[n] = b.[n]
a, b:t
H:forall n0 : t, 0 <= n0 -> a.[n0] = b.[n0]
n:t
H0:n < 0
a.[n] = b.[n]
 now apply H.a, b:t
H:forall n0 : t, 0 <= n0 -> a.[n0] = b.[n0]
n:t
H0:n < 0
a.[n] = b.[n]
 now rewrite 2 testbit_neg_r.
Qed.

Lemma bits_inj_iff' : forall a b, (forall n, 0<=n -> a.[n] = b.[n]) <-> a == b.forall a b : t,
(forall n : t, 0 <= n -> a.[n] = b.[n]) <-> a == b
Proof.forall a b : t,
(forall n : t, 0 <= n -> a.[n] = b.[n]) <-> a == b
 split.a, b:t
(forall n : t, 0 <= n -> a.[n] = b.[n]) -> a == b
a, b:t
a == b -> forall n : t, 0 <= n -> a.[n] = b.[n] apply bits_inj'.a, b:t
a == b -> forall n : t, 0 <= n -> a.[n] = b.[n] intros EQ n Hn; now rewrite EQ.
Qed.

Ltac bitwise := apply bits_inj'; intros ?m ?Hm; autorewrite with bitwise.

Hint Rewrite lxor_spec lor_spec land_spec ldiff_spec bits_0 : bitwise.

The streams of bits that correspond to a numbers are exactly the ones which are stationary after some point.

Lemma are_bits : forall (f:t->bool), Proper (eq==>Logic.eq) f ->
 ((exists n, forall m, 0<=m -> f m = n.[m]) <->
  (exists k, forall m, k<=m -> f m = f k)).forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(exists n : t, forall m : t, 0 <= m -> f m = n.[m]) <->
(exists k : t, forall m : t, k <= m -> f m = f k)
Proof.forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(exists n : t, forall m : t, 0 <= m -> f m = n.[m]) <->
(exists k : t, forall m : t, k <= m -> f m = f k)
 intros f Hf.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists n : t, forall m : t, 0 <= m -> f m = n.[m]) <->
(exists k : t, forall m : t, k <= m -> f m = f k) split.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists n : t, forall m : t, 0 <= m -> f m = n.[m]) ->
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
 intros (a,H).f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  destruct (le_gt_cases 0 a).f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:0 <= a
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  exists (S (log2 a)).f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:0 <= a
forall m : t, S (log2 a) <= m -> f m = f (S (log2 a))
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m] intros m Hm.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:0 <= a
m:t
Hm:S (log2 a) <= m
f m = f (S (log2 a))
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m] apply le_succ_l in Hm.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:0 <= a
m:t
Hm:log2 a < m
f m = f (S (log2 a))
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  rewrite 2 H, 2 bits_above_log2; trivial using lt_succ_diag_r.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:0 <= a
m:t
Hm:log2 a < m
0 <= S (log2 a)
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:0 <= a
m:t
Hm:log2 a < m
0 <= m
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  order_pos.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:0 <= a
m:t
Hm:log2 a < m
0 <= m
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m] apply le_trans with (log2 a); order_pos.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
exists k : t, forall m : t, k <= m -> f m = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  exists (S (log2 (P (-a)))).f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m : t, 0 <= m -> f m = a.[m]
H0:a < 0
forall m : t,
S (log2 (P (- a))) <= m ->
f m = f (S (log2 (P (- a))))
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m] intros m Hm.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:a < 0
m:t
Hm:S (log2 (P (- a))) <= m
f m = f (S (log2 (P (- a))))
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m] apply le_succ_l in Hm.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:a < 0
m:t
Hm:log2 (P (- a)) < m
f m = f (S (log2 (P (- a))))
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  rewrite 2 H, 2 bits_above_log2_neg; trivial using lt_succ_diag_r.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:a < 0
m:t
Hm:log2 (P (- a)) < m
0 <= S (log2 (P (- a)))
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:a < 0
m:t
Hm:log2 (P (- a)) < m
0 <= m
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  order_pos.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
a:t
H:forall m0 : t, 0 <= m0 -> f m0 = a.[m0]
H0:a < 0
m:t
Hm:log2 (P (- a)) < m
0 <= m
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m] apply le_trans with (log2 (P (-a))); order_pos.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
(exists k : t, forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
 intros (k,Hk).f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  destruct (lt_ge_cases k 0) as [LT|LE].f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  case_eq (f 0); intros H0.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = true
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  exists (-1).f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = true
forall m : t, 0 <= m -> f m = (-1).[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m] intros m Hm.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m0 : t, k <= m0 -> f m0 = f k
LT:k < 0
H0:f 0 = true
m:t
Hm:0 <= m
f m = (-1).[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m] rewrite bits_m1, Hk by order.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m0 : t, k <= m0 -> f m0 = f k
LT:k < 0
H0:f 0 = true
m:t
Hm:0 <= m
f k = true
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  symmetry; rewrite <- H0.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m0 : t, k <= m0 -> f m0 = f k
LT:k < 0
H0:f 0 = true
m:t
Hm:0 <= m
f 0 = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m] apply Hk; order.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  exists 0.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LT:k < 0
H0:f 0 = false
forall m : t, 0 <= m -> f m = 0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m] intros m Hm.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m0 : t, k <= m0 -> f m0 = f k
LT:k < 0
H0:f 0 = false
m:t
Hm:0 <= m
f m = 0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m] rewrite bits_0, Hk by order.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m0 : t, k <= m0 -> f m0 = f k
LT:k < 0
H0:f 0 = false
m:t
Hm:0 <= m
f k = false
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  symmetry; rewrite <- H0.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m0 : t, k <= m0 -> f m0 = f k
LT:k < 0
H0:f 0 = false
m:t
Hm:0 <= m
f 0 = f k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m] apply Hk; order.f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
k:t
Hk:forall m : t, k <= m -> f m = f k
LE:0 <= k
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  revert f Hf Hk.k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, k <= m -> f m = f k) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m] apply le_ind with (4:=LE).k:t
LE:0 <= k
Proper (eq ==> iff)
  (fun k0 : t =>
   forall f : t -> bool,
   Proper (eq ==> Logic.eq) f ->
   (forall m : t, k0 <= m -> f m = f k0) ->
   exists n : t, forall m : t, 0 <= m -> f m = n.[m])
k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, 0 <= m -> f m = f 0) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]
  (* compat : solve_proper fails here *)
  apply proper_sym_impl_iff.k:t
LE:0 <= k
Symmetric eq
k:t
LE:0 <= k
Proper (eq ==> Basics.impl)
  (fun k0 : t =>
   forall f : t -> bool,
   Proper (eq ==> Logic.eq) f ->
   (forall m : t, k0 <= m -> f m = f k0) ->
   exists n : t, forall m : t, 0 <= m -> f m = n.[m])
k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, 0 <= m -> f m = f 0) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] exact eq_sym.k:t
LE:0 <= k
Proper (eq ==> Basics.impl)
  (fun k0 : t =>
   forall f : t -> bool,
   Proper (eq ==> Logic.eq) f ->
   (forall m : t, k0 <= m -> f m = f k0) ->
   exists n : t, forall m : t, 0 <= m -> f m = n.[m])
k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, 0 <= m -> f m = f 0) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]
  clear k LE.Proper (eq ==> Basics.impl)
  (fun k : t =>
   forall f : t -> bool,
   Proper (eq ==> Logic.eq) f ->
   (forall m : t, k <= m -> f m = f k) ->
   exists n : t, forall m : t, 0 <= m -> f m = n.[m])
k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, 0 <= m -> f m = f 0) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] intros k k' Hk IH f Hf H.k, k':t
Hk:k == k'
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n : t,
  forall m : t, 0 <= m -> f0 m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H:forall m : t, k' <= m -> f m = f k'
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, 0 <= m -> f m = f 0) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] apply IH; trivial.k, k':t
Hk:k == k'
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n : t,
  forall m : t, 0 <= m -> f0 m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H:forall m : t, k' <= m -> f m = f k'
forall m : t, k <= m -> f m = f k
k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, 0 <= m -> f m = f 0) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]
  now setoid_rewrite Hk.k:t
LE:0 <= k
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m : t, 0 <= m -> f m = f 0) ->
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]
  (* /compat *)
  intros f Hf H0.k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = f 0
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] destruct (f 0).k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = true
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]
  exists (-1).k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = true
forall m : t, 0 <= m -> f m = (-1).[m]
k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] intros m Hm.k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m0 : t, 0 <= m0 -> f m0 = true
m:t
Hm:0 <= m
f m = (-1).[m]
k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] now rewrite bits_m1, H0.k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = false
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]
  exists 0.k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m : t, 0 <= m -> f m = false
forall m : t, 0 <= m -> f m = 0.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] intros m Hm.k:t
LE:0 <= k
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
H0:forall m0 : t, 0 <= m0 -> f m0 = false
m:t
Hm:0 <= m
f m = 0.[m]
k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] now rewrite bits_0, H0.k:t
LE:0 <= k
forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]
  clear k LE.forall m : t,
0 <= m ->
(forall f : t -> bool,
 Proper (eq ==> Logic.eq) f ->
 (forall m0 : t, m <= m0 -> f m0 = f m) ->
 exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0]) ->
forall f : t -> bool,
Proper (eq ==> Logic.eq) f ->
(forall m0 : t, S m <= m0 -> f m0 = f (S m)) ->
exists n : t, forall m0 : t, 0 <= m0 -> f m0 = n.[m0] intros k LE IH f Hf Hk.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n : t,
  forall m : t, 0 <= m -> f0 m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
exists n : t, forall m : t, 0 <= m -> f m = n.[m]
  destruct (IH (fun m => f (S m))) as (n, Hn).k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n : t,
  forall m : t, 0 <= m -> f0 m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
Proper (eq ==> Logic.eq) (fun m : t => f (S m))
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n : t,
  forall m : t, 0 <= m -> f0 m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
forall m : t, k <= m -> f (S m) = f (S k)
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n0 : t,
  forall m : t, 0 <= m -> f0 m = n0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
n:t
Hn:forall m : t, 0 <= m -> f (S m) = n.[m]
exists n0 : t, forall m : t, 0 <= m -> f m = n0.[m]
  solve_proper.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n : t,
  forall m : t, 0 <= m -> f0 m = n.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
forall m : t, k <= m -> f (S m) = f (S k)
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n0 : t,
  forall m : t, 0 <= m -> f0 m = n0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
n:t
Hn:forall m : t, 0 <= m -> f (S m) = n.[m]
exists n0 : t, forall m : t, 0 <= m -> f m = n0.[m]
  intros m Hm.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
m:t
Hm:k <= m
f (S m) = f (S k)
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n0 : t,
  forall m : t, 0 <= m -> f0 m = n0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
n:t
Hn:forall m : t, 0 <= m -> f (S m) = n.[m]
exists n0 : t, forall m : t, 0 <= m -> f m = n0.[m] apply Hk.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
m:t
Hm:k <= m
S k <= S m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n0 : t,
  forall m : t, 0 <= m -> f0 m = n0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
n:t
Hn:forall m : t, 0 <= m -> f (S m) = n.[m]
exists n0 : t, forall m : t, 0 <= m -> f m = n0.[m] now rewrite <- succ_le_mono.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n0 : t,
  forall m : t, 0 <= m -> f0 m = n0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
n:t
Hn:forall m : t, 0 <= m -> f (S m) = n.[m]
exists n0 : t, forall m : t, 0 <= m -> f m = n0.[m]
  exists (f 0 + 2*n).k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m : t, k <= m -> f0 m = f0 k) ->
exists n0 : t,
  forall m : t, 0 <= m -> f0 m = n0.[m]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m : t, S k <= m -> f m = f (S k)
n:t
Hn:forall m : t, 0 <= m -> f (S m) = n.[m]
forall m : t, 0 <= m -> f m = (f 0 + 2 * n).[m] intros m Hm.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 <= m
f m = (f 0 + 2 * n).[m]
  le_elim Hm.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
f m = (f 0 + 2 * n).[m]
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
f m = (f 0 + 2 * n).[m]
  rewrite <- (succ_pred m), Hn, <- div2_bits.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
n.[P m] = ((f 0 + 2 * n) / 2).[P m]
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
0 <= P m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
0 <= P m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
f m = (f 0 + 2 * n).[m]
  rewrite mul_comm, div_add, b2z_div2, add_0_l; trivial.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
2 ~= 0
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
0 <= P m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
0 <= P m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
f m = (f 0 + 2 * n).[m] order'.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
0 <= P m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
0 <= P m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
f m = (f 0 + 2 * n).[m]
  now rewrite <- lt_succ_r, succ_pred.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 < m
0 <= P m
k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
f m = (f 0 + 2 * n).[m]
  now rewrite <- lt_succ_r, succ_pred.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
f m = (f 0 + 2 * n).[m]
  rewrite <- Hm.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
f 0 = (f 0 + 2 * n).[0]
  symmetry.k:t
LE:0 <= k
IH:forall f0 : t -> bool,
Proper (eq ==> Logic.eq) f0 ->
(forall m0 : t, k <= m0 -> f0 m0 = f0 k) ->
exists n0 : t,
  forall m0 : t, 0 <= m0 -> f0 m0 = n0.[m0]
f:t -> bool
Hf:Proper (eq ==> Logic.eq) f
Hk:forall m0 : t, S k <= m0 -> f m0 = f (S k)
n:t
Hn:forall m0 : t, 0 <= m0 -> f (S m0) = n.[m0]
m:t
Hm:0 == m
(f 0 + 2 * n).[0] = f 0 apply add_b2z_double_bit0.
Qed.

Properties of shifts

First, a unified specification for shiftl : the shiftl_spec below (combined with testbit_neg_r) is equivalent to shiftl_spec_low and shiftl_spec_high.

Lemma shiftl_spec : forall a n m, 0<=m -> (a << n).[m] = a.[m-n].forall a n m : t, 0 <= m -> (a << n).[m] = a.[m - n]
Proof.forall a n m : t, 0 <= m -> (a << n).[m] = a.[m - n]
 intros.a, n, m:t
H:0 <= m
(a << n).[m] = a.[m - n]
 destruct (le_gt_cases n m).a, n, m:t
H:0 <= m
H0:n <= m
(a << n).[m] = a.[m - n]
a, n, m:t
H:0 <= m
H0:m < n
(a << n).[m] = a.[m - n]
 now apply shiftl_spec_high.a, n, m:t
H:0 <= m
H0:m < n
(a << n).[m] = a.[m - n]
 rewrite shiftl_spec_low, testbit_neg_r; trivial.a, n, m:t
H:0 <= m
H0:m < n
m - n < 0 now apply lt_sub_0.
Qed.

A shiftl by a negative number is a shiftr, and vice-versa

Lemma shiftr_opp_r : forall a n, a >> (-n) == a << n.forall a n : t, a >> (- n) == a << n
Proof.forall a n : t, a >> (- n) == a << n
 intros.a, n:t
a >> (- n) == a << n bitwise.a, n, m:t
Hm:0 <= m
(a >> (- n)).[m] = (a << n).[m] now rewrite shiftr_spec, shiftl_spec, add_opp_r.
Qed.

Lemma shiftl_opp_r : forall a n, a << (-n) == a >> n.forall a n : t, a << (- n) == a >> n
Proof.forall a n : t, a << (- n) == a >> n
 intros.a, n:t
a << (- n) == a >> n bitwise.a, n, m:t
Hm:0 <= m
(a << (- n)).[m] = (a >> n).[m] now rewrite shiftr_spec, shiftl_spec, sub_opp_r.
Qed.

Shifts correspond to multiplication or division by a power of two

Lemma shiftr_div_pow2 : forall a n, 0<=n -> a >> n == a / 2^n.forall a n : t, 0 <= n -> a >> n == a / 2 ^ n
Proof.forall a n : t, 0 <= n -> a >> n == a / 2 ^ n
 intros.a, n:t
H:0 <= n
a >> n == a / 2 ^ n bitwise.a, n:t
H:0 <= n
m:t
Hm:0 <= m
(a >> n).[m] = (a / 2 ^ n).[m] now rewrite shiftr_spec, div_pow2_bits.
Qed.

Lemma shiftr_mul_pow2 : forall a n, n<=0 -> a >> n == a * 2^(-n).forall a n : t, n <= 0 -> a >> n == a * 2 ^ (- n)
Proof.forall a n : t, n <= 0 -> a >> n == a * 2 ^ (- n)
 intros.a, n:t
H:n <= 0
a >> n == a * 2 ^ (- n) bitwise.a, n:t
H:n <= 0
m:t
Hm:0 <= m
(a >> n).[m] = (a * 2 ^ (- n)).[m] rewrite shiftr_spec, mul_pow2_bits; trivial.a, n:t
H:n <= 0
m:t
Hm:0 <= m
a.[m + n] = a.[m - - n]
a, n:t
H:n <= 0
m:t
Hm:0 <= m
0 <= - n
 now rewrite sub_opp_r.a, n:t
H:n <= 0
m:t
Hm:0 <= m
0 <= - n
 now apply opp_nonneg_nonpos.
Qed.

Lemma shiftl_mul_pow2 : forall a n, 0<=n -> a << n == a * 2^n.forall a n : t, 0 <= n -> a << n == a * 2 ^ n
Proof.forall a n : t, 0 <= n -> a << n == a * 2 ^ n
 intros.a, n:t
H:0 <= n
a << n == a * 2 ^ n bitwise.a, n:t
H:0 <= n
m:t
Hm:0 <= m
(a << n).[m] = (a * 2 ^ n).[m] now rewrite shiftl_spec, mul_pow2_bits.
Qed.

Lemma shiftl_div_pow2 : forall a n, n<=0 -> a << n == a / 2^(-n).forall a n : t, n <= 0 -> a << n == a / 2 ^ (- n)
Proof.forall a n : t, n <= 0 -> a << n == a / 2 ^ (- n)
 intros.a, n:t
H:n <= 0
a << n == a / 2 ^ (- n) bitwise.a, n:t
H:n <= 0
m:t
Hm:0 <= m
(a << n).[m] = (a / 2 ^ (- n)).[m] rewrite shiftl_spec, div_pow2_bits; trivial.a, n:t
H:n <= 0
m:t
Hm:0 <= m
a.[m - n] = a.[m + - n]
a, n:t
H:n <= 0
m:t
Hm:0 <= m
0 <= - n
 now rewrite add_opp_r.a, n:t
H:n <= 0
m:t
Hm:0 <= m
0 <= - n
 now apply opp_nonneg_nonpos.
Qed.

Shifts are morphisms

Instance shiftr_wd : Proper (eq==>eq==>eq) shiftr.Proper (eq ==> eq ==> eq) shiftr
Proof.Proper (eq ==> eq ==> eq) shiftr
 intros a a' Ha n n' Hn.a, a':t
Ha:a == a'
n, n':t
Hn:n == n'
a >> n == a' >> n'
 destruct (le_ge_cases n 0) as [H|H]; assert (H':=H); rewrite Hn in H'.a, a':t
Ha:a == a'
n, n':t
Hn:n == n'
H:n <= 0
H':n' <= 0
a >> n == a' >> n'
a, a':t
Ha:a == a'
n, n':t
Hn:n == n'
H:0 <= n
H':0 <= n'
a >> n == a' >> n'
 now rewrite 2 shiftr_mul_pow2, Ha, Hn.a, a':t
Ha:a == a'
n, n':t
Hn:n == n'
H:0 <= n
H':0 <= n'
a >> n == a' >> n'
 now rewrite 2 shiftr_div_pow2, Ha, Hn.
Qed.

Instance shiftl_wd : Proper (eq==>eq==>eq) shiftl.Proper (eq ==> eq ==> eq) shiftl
Proof.Proper (eq ==> eq ==> eq) shiftl
 intros a a' Ha n n' Hn.a, a':t
Ha:a == a'
n, n':t
Hn:n == n'
a << n == a' << n' now rewrite <- 2 shiftr_opp_r, Ha, Hn.
Qed.

We could also have specified shiftl with an addition on the left.

Lemma shiftl_spec_alt : forall a n m, 0<=n -> (a << n).[m+n] = a.[m].forall a n m : t, 0 <= n -> (a << n).[m + n] = a.[m]
Proof.forall a n m : t, 0 <= n -> (a << n).[m + n] = a.[m]
 intros.a, n, m:t
H:0 <= n
(a << n).[m + n] = a.[m] now rewrite shiftl_mul_pow2, mul_pow2_bits, add_simpl_r.
Qed.

Chaining several shifts. The only case for which there isn't any simple expression is a true shiftr followed by a true shiftl.

Lemma shiftl_shiftl : forall a n m, 0<=n ->
 (a << n) << m == a << (n+m).forall a n m : t,
0 <= n -> (a << n) << m == a << (n + m)
Proof.forall a n m : t,
0 <= n -> (a << n) << m == a << (n + m)
 intros a n p Hn.a, n, p:t
Hn:0 <= n
(a << n) << p == a << (n + p) bitwise.a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
((a << n) << p).[m] = (a << (n + p)).[m]
 rewrite 2 (shiftl_spec _ _ m) by trivial.a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
(a << n).[m - p] = a.[m - (n + p)]
 rewrite add_comm, sub_add_distr.a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
(a << n).[m - p] = a.[m - p - n]
 destruct (le_gt_cases 0 (m-p)) as [H|H].a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
H:0 <= m - p
(a << n).[m - p] = a.[m - p - n]
a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m - p < 0
(a << n).[m - p] = a.[m - p - n]
 now rewrite shiftl_spec.a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m - p < 0
(a << n).[m - p] = a.[m - p - n]
 rewrite 2 testbit_neg_r; trivial.a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m - p < 0
m - p - n < 0
 apply lt_sub_0.a, n, p:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m - p < 0
m - p < n now apply lt_le_trans with 0.
Qed.

Lemma shiftr_shiftl_l : forall a n m, 0<=n ->
 (a << n) >> m == a << (n-m).forall a n m : t,
0 <= n -> (a << n) >> m == a << (n - m)
Proof.forall a n m : t,
0 <= n -> (a << n) >> m == a << (n - m)
 intros.a, n, m:t
H:0 <= n
(a << n) >> m == a << (n - m) now rewrite <- shiftl_opp_r, shiftl_shiftl, add_opp_r.
Qed.

Lemma shiftr_shiftl_r : forall a n m, 0<=n ->
 (a << n) >> m == a >> (m-n).forall a n m : t,
0 <= n -> (a << n) >> m == a >> (m - n)
Proof.forall a n m : t,
0 <= n -> (a << n) >> m == a >> (m - n)
 intros.a, n, m:t
H:0 <= n
(a << n) >> m == a >> (m - n) now rewrite <- 2 shiftl_opp_r, shiftl_shiftl, opp_sub_distr, add_comm.
Qed.

Lemma shiftr_shiftr : forall a n m, 0<=m ->
 (a >> n) >> m == a >> (n+m).forall a n m : t,
0 <= m -> (a >> n) >> m == a >> (n + m)
Proof.forall a n m : t,
0 <= m -> (a >> n) >> m == a >> (n + m)
 intros a n p Hn.a, n, p:t
Hn:0 <= p
(a >> n) >> p == a >> (n + p) bitwise.a, n, p:t
Hn:0 <= p
m:t
Hm:0 <= m
((a >> n) >> p).[m] = (a >> (n + p)).[m]
 rewrite 3 shiftr_spec; trivial.a, n, p:t
Hn:0 <= p
m:t
Hm:0 <= m
a.[m + p + n] = a.[m + (n + p)]
a, n, p:t
Hn:0 <= p
m:t
Hm:0 <= m
0 <= m + p
 now rewrite (add_comm n p), add_assoc.a, n, p:t
Hn:0 <= p
m:t
Hm:0 <= m
0 <= m + p
 now apply add_nonneg_nonneg.
Qed.

shifts and constants

Lemma shiftl_1_l : forall n, 1 << n == 2^n.forall n : t, 1 << n == 2 ^ n
Proof.forall n : t, 1 << n == 2 ^ n
 intros n.n:t
1 << n == 2 ^ n destruct (le_gt_cases 0 n).n:t
H:0 <= n
1 << n == 2 ^ n
n:t
H:n < 0
1 << n == 2 ^ n
 now rewrite shiftl_mul_pow2, mul_1_l.n:t
H:n < 0
1 << n == 2 ^ n
 rewrite shiftl_div_pow2, div_1_l, pow_neg_r; try order.n:t
H:n < 0
1 < 2 ^ (- n)
 apply pow_gt_1.n:t
H:n < 0
1 < 2
n:t
H:n < 0
0 < - n order'.n:t
H:n < 0
0 < - n now apply opp_pos_neg.
Qed.

Lemma shiftl_0_r : forall a, a << 0 == a.forall a : t, a << 0 == a
Proof.forall a : t, a << 0 == a
 intros.a:t
a << 0 == a rewrite shiftl_mul_pow2 by order.a:t
a * 2 ^ 0 == a now nzsimpl.
Qed.

Lemma shiftr_0_r : forall a, a >> 0 == a.forall a : t, a >> 0 == a
Proof.forall a : t, a >> 0 == a
 intros.a:t
a >> 0 == a now rewrite <- shiftl_opp_r, opp_0, shiftl_0_r.
Qed.

Lemma shiftl_0_l : forall n, 0 << n == 0.forall n : t, 0 << n == 0
Proof.forall n : t, 0 << n == 0
 intros.n:t
0 << n == 0
 destruct (le_ge_cases 0 n).n:t
H:0 <= n
0 << n == 0
n:t
H:n <= 0
0 << n == 0
 rewrite shiftl_mul_pow2 by trivial.n:t
H:0 <= n
0 * 2 ^ n == 0
n:t
H:n <= 0
0 << n == 0 now nzsimpl.n:t
H:n <= 0
0 << n == 0
 rewrite shiftl_div_pow2 by trivial.n:t
H:n <= 0
0 / 2 ^ (- n) == 0
 rewrite <- opp_nonneg_nonpos in H.n:t
H:0 <= - n
0 / 2 ^ (- n) == 0 nzsimpl; order_nz.
Qed.

Lemma shiftr_0_l : forall n, 0 >> n == 0.forall n : t, 0 >> n == 0
Proof.forall n : t, 0 >> n == 0
 intros.n:t
0 >> n == 0 now rewrite <- shiftl_opp_r, shiftl_0_l.
Qed.

Lemma shiftl_eq_0_iff : forall a n, 0<=n -> (a << n == 0 <-> a == 0).forall a n : t, 0 <= n -> a << n == 0 <-> a == 0
Proof.forall a n : t, 0 <= n -> a << n == 0 <-> a == 0
 intros a n Hn.a, n:t
Hn:0 <= n
a << n == 0 <-> a == 0
 rewrite shiftl_mul_pow2 by trivial.a, n:t
Hn:0 <= n
a * 2 ^ n == 0 <-> a == 0 rewrite eq_mul_0.a, n:t
Hn:0 <= n
a == 0 \/ 2 ^ n == 0 <-> a == 0 split.a, n:t
Hn:0 <= n
a == 0 \/ 2 ^ n == 0 -> a == 0
a, n:t
Hn:0 <= n
a == 0 -> a == 0 \/ 2 ^ n == 0
 intros [H | H]; trivial.a, n:t
Hn:0 <= n
H:2 ^ n == 0
a == 0
a, n:t
Hn:0 <= n
a == 0 -> a == 0 \/ 2 ^ n == 0 contradict H; order_nz.a, n:t
Hn:0 <= n
a == 0 -> a == 0 \/ 2 ^ n == 0
 intros H.a, n:t
Hn:0 <= n
H:a == 0
a == 0 \/ 2 ^ n == 0 now left.
Qed.

Lemma shiftr_eq_0_iff : forall a n,
 a >> n == 0 <-> a==0 \/ (0<a /\ log2 a < n).forall a n : t,
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
Proof.forall a n : t,
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 intros a n.a, n:t
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 destruct (le_gt_cases 0 n) as [Hn|Hn].a, n:t
Hn:0 <= n
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 rewrite shiftr_div_pow2, div_small_iff by order_nz.a, n:t
Hn:0 <= n
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 destruct (lt_trichotomy a 0) as [LT|[EQ|LT]].a, n:t
Hn:0 <= n
LT:a < 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
EQ:a == 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 split.a, n:t
Hn:0 <= n
LT:a < 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 ->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:a < 0
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:0 <= n
EQ:a == 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 intros [(H,_)|(H,H')].a, n:t
Hn:0 <= n
LT:a < 0
H:0 <= a
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:a < 0
H:2 ^ n < a
H':a <= 0
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:a < 0
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:0 <= n
EQ:a == 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n order.a, n:t
Hn:0 <= n
LT:a < 0
H:2 ^ n < a
H':a <= 0
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:a < 0
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:0 <= n
EQ:a == 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n generalize (pow_nonneg 2 n le_0_2); order.a, n:t
Hn:0 <= n
LT:a < 0
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:0 <= n
EQ:a == 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 intros [H|(H,H')]; order.a, n:t
Hn:0 <= n
EQ:a == 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 rewrite EQ.a, n:t
Hn:0 <= n
EQ:a == 0
0 <= 0 < 2 ^ n \/ 2 ^ n < 0 <= 0 <->
0 == 0 \/ 0 < 0 /\ log2 0 < n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n split.a, n:t
Hn:0 <= n
EQ:a == 0
0 <= 0 < 2 ^ n \/ 2 ^ n < 0 <= 0 ->
0 == 0 \/ 0 < 0 /\ log2 0 < n
a, n:t
Hn:0 <= n
EQ:a == 0
0 == 0 \/ 0 < 0 /\ log2 0 < n ->
0 <= 0 < 2 ^ n \/ 2 ^ n < 0 <= 0
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n now left.a, n:t
Hn:0 <= n
EQ:a == 0
0 == 0 \/ 0 < 0 /\ log2 0 < n ->
0 <= 0 < 2 ^ n \/ 2 ^ n < 0 <= 0
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n intros _; left.a, n:t
Hn:0 <= n
EQ:a == 0
0 <= 0 < 2 ^ n
a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n split; order_pos.a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 <->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 split.a, n:t
Hn:0 <= n
LT:0 < a
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0 ->
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n intros [(H,H')|(H,H')]; right.a, n:t
Hn:0 <= n
LT:0 < a
H:0 <= a
H':a < 2 ^ n
0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
H:2 ^ n < a
H':a <= 0
0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n split; trivial.a, n:t
Hn:0 <= n
LT:0 < a
H:0 <= a
H':a < 2 ^ n
log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
H:2 ^ n < a
H':a <= 0
0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
  apply log2_lt_pow2; trivial.a, n:t
Hn:0 <= n
LT:0 < a
H:2 ^ n < a
H':a <= 0
0 < a /\ log2 a < n
a, n:t
Hn:0 <= n
LT:0 < a
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
  generalize (pow_nonneg 2 n le_0_2); order.a, n:t
Hn:0 <= n
LT:0 < a
a == 0 \/ 0 < a /\ log2 a < n ->
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 intros [H|(H,H')].a, n:t
Hn:0 <= n
LT:0 < a
H:a == 0
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:0 <= n
LT, H:0 < a
H':log2 a < n
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n order.a, n:t
Hn:0 <= n
LT, H:0 < a
H':log2 a < n
0 <= a < 2 ^ n \/ 2 ^ n < a <= 0
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n left.a, n:t
Hn:0 <= n
LT, H:0 < a
H':log2 a < n
0 <= a < 2 ^ n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 split.a, n:t
Hn:0 <= n
LT, H:0 < a
H':log2 a < n
0 <= a
a, n:t
Hn:0 <= n
LT, H:0 < a
H':log2 a < n
a < 2 ^ n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n order.a, n:t
Hn:0 <= n
LT, H:0 < a
H':log2 a < n
a < 2 ^ n
a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n now apply log2_lt_pow2.a, n:t
Hn:n < 0
a >> n == 0 <-> a == 0 \/ 0 < a /\ log2 a < n
 rewrite shiftr_mul_pow2 by order.a, n:t
Hn:n < 0
a * 2 ^ (- n) == 0 <-> a == 0 \/ 0 < a /\ log2 a < n rewrite eq_mul_0.a, n:t
Hn:n < 0
a == 0 \/ 2 ^ (- n) == 0 <->
a == 0 \/ 0 < a /\ log2 a < n
 split; intros [H|H].a, n:t
Hn:n < 0
H:a == 0
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
H:2 ^ (- n) == 0
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
H:a == 0
a == 0 \/ 2 ^ (- n) == 0
a, n:t
Hn:n < 0
H:0 < a /\ log2 a < n
a == 0 \/ 2 ^ (- n) == 0
 now left.a, n:t
Hn:n < 0
H:2 ^ (- n) == 0
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Hn:n < 0
H:a == 0
a == 0 \/ 2 ^ (- n) == 0
a, n:t
Hn:n < 0
H:0 < a /\ log2 a < n
a == 0 \/ 2 ^ (- n) == 0
 elim (pow_nonzero 2 (-n)); try apply opp_nonneg_nonpos; order'.a, n:t
Hn:n < 0
H:a == 0
a == 0 \/ 2 ^ (- n) == 0
a, n:t
Hn:n < 0
H:0 < a /\ log2 a < n
a == 0 \/ 2 ^ (- n) == 0
 now left.a, n:t
Hn:n < 0
H:0 < a /\ log2 a < n
a == 0 \/ 2 ^ (- n) == 0
 destruct H.a, n:t
Hn:n < 0
H:0 < a
H0:log2 a < n
a == 0 \/ 2 ^ (- n) == 0 generalize (log2_nonneg a); order.
Qed.

Lemma shiftr_eq_0 : forall a n, 0<=a -> log2 a < n -> a >> n == 0.forall a n : t, 0 <= a -> log2 a < n -> a >> n == 0
Proof.forall a n : t, 0 <= a -> log2 a < n -> a >> n == 0
 intros a n Ha H.a, n:t
Ha:0 <= a
H:log2 a < n
a >> n == 0 apply shiftr_eq_0_iff.a, n:t
Ha:0 <= a
H:log2 a < n
a == 0 \/ 0 < a /\ log2 a < n
 le_elim Ha.a, n:t
Ha:0 < a
H:log2 a < n
a == 0 \/ 0 < a /\ log2 a < n
a, n:t
Ha:0 == a
H:log2 a < n
a == 0 \/ 0 < a /\ log2 a < n right.a, n:t
Ha:0 < a
H:log2 a < n
0 < a /\ log2 a < n
a, n:t
Ha:0 == a
H:log2 a < n
a == 0 \/ 0 < a /\ log2 a < n now split.a, n:t
Ha:0 == a
H:log2 a < n
a == 0 \/ 0 < a /\ log2 a < n now left.
Qed.

Properties of div2.

Lemma div2_div : forall a, div2 a == a/2.forall a : t, div2 a == a / 2
Proof.forall a : t, div2 a == a / 2
 intros.a:t
div2 a == a / 2 rewrite div2_spec, shiftr_div_pow2.a:t
a / 2 ^ 1 == a / 2
a:t
0 <= 1 now nzsimpl.a:t
0 <= 1 order'.
Qed.

Instance div2_wd : Proper (eq==>eq) div2.Proper (eq ==> eq) div2
Proof.Proper (eq ==> eq) div2
 intros a a' Ha.a, a':t
Ha:a == a'
div2 a == div2 a' now rewrite 2 div2_div, Ha.
Qed.

Lemma div2_odd : forall a, a == 2*(div2 a) + odd a.forall a : t, a == 2 * div2 a + odd a
Proof.forall a : t, a == 2 * div2 a + odd a
 intros a.a:t
a == 2 * div2 a + odd a rewrite div2_div, <- bit0_odd, bit0_mod.a:t
a == 2 * (a / 2) + a mod 2
 apply div_mod.a:t
2 ~= 0 order'.
Qed.

Properties of lxor and others, directly deduced from properties of xorb and others.

Instance lxor_wd : Proper (eq ==> eq ==> eq) lxor.Proper (eq ==> eq ==> eq) lxor
Proof.Proper (eq ==> eq ==> eq) lxor
 intros a a' Ha b b' Hb.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
lxor a b == lxor a' b' bitwise.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
m:t
Hm:0 <= m
xorb a.[m] b.[m] = xorb a'.[m] b'.[m] now rewrite Ha, Hb.
Qed.

Instance land_wd : Proper (eq ==> eq ==> eq) land.Proper (eq ==> eq ==> eq) land
Proof.Proper (eq ==> eq ==> eq) land
 intros a a' Ha b b' Hb.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
land a b == land a' b' bitwise.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
m:t
Hm:0 <= m
a.[m] && b.[m] = a'.[m] && b'.[m] now rewrite Ha, Hb.
Qed.

Instance lor_wd : Proper (eq ==> eq ==> eq) lor.Proper (eq ==> eq ==> eq) lor
Proof.Proper (eq ==> eq ==> eq) lor
 intros a a' Ha b b' Hb.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
lor a b == lor a' b' bitwise.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
m:t
Hm:0 <= m
a.[m] || b.[m] = a'.[m] || b'.[m] now rewrite Ha, Hb.
Qed.

Instance ldiff_wd : Proper (eq ==> eq ==> eq) ldiff.Proper (eq ==> eq ==> eq) ldiff
Proof.Proper (eq ==> eq ==> eq) ldiff
 intros a a' Ha b b' Hb.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
ldiff a b == ldiff a' b' bitwise.a, a':t
Ha:a == a'
b, b':t
Hb:b == b'
m:t
Hm:0 <= m
a.[m] && negb b.[m] = a'.[m] && negb b'.[m] now rewrite Ha, Hb.
Qed.

Lemma lxor_eq : forall a a', lxor a a' == 0 -> a == a'.forall a a' : t, lxor a a' == 0 -> a == a'
Proof.forall a a' : t, lxor a a' == 0 -> a == a'
 intros a a' H.a, a':t
H:lxor a a' == 0
a == a' bitwise.a, a':t
H:lxor a a' == 0
m:t
Hm:0 <= m
a.[m] = a'.[m] apply xorb_eq.a, a':t
H:lxor a a' == 0
m:t
Hm:0 <= m
xorb a.[m] a'.[m] = false
 now rewrite <- lxor_spec, H, bits_0.
Qed.

Lemma lxor_nilpotent : forall a, lxor a a == 0.forall a : t, lxor a a == 0
Proof.forall a : t, lxor a a == 0
 intros.a:t
lxor a a == 0 bitwise.a, m:t
Hm:0 <= m
xorb a.[m] a.[m] = false apply xorb_nilpotent.
Qed.

Lemma lxor_eq_0_iff : forall a a', lxor a a' == 0 <-> a == a'.forall a a' : t, lxor a a' == 0 <-> a == a'
Proof.forall a a' : t, lxor a a' == 0 <-> a == a'
 split.a, a':t
lxor a a' == 0 -> a == a'
a, a':t
a == a' -> lxor a a' == 0 apply lxor_eq.a, a':t
a == a' -> lxor a a' == 0 intros EQ; rewrite EQ; apply lxor_nilpotent.
Qed.

Lemma lxor_0_l : forall a, lxor 0 a == a.forall a : t, lxor 0 a == a
Proof.forall a : t, lxor 0 a == a
 intros.a:t
lxor 0 a == a bitwise.a, m:t
Hm:0 <= m
xorb false a.[m] = a.[m] apply xorb_false_l.
Qed.

Lemma lxor_0_r : forall a, lxor a 0 == a.forall a : t, lxor a 0 == a
Proof.forall a : t, lxor a 0 == a
 intros.a:t
lxor a 0 == a bitwise.a, m:t
Hm:0 <= m
xorb a.[m] false = a.[m] apply xorb_false_r.
Qed.

Lemma lxor_comm : forall a b, lxor a b == lxor b a.forall a b : t, lxor a b == lxor b a
Proof.forall a b : t, lxor a b == lxor b a
 intros.a, b:t
lxor a b == lxor b a bitwise.a, b, m:t
Hm:0 <= m
xorb a.[m] b.[m] = xorb b.[m] a.[m] apply xorb_comm.
Qed.

Lemma lxor_assoc :
 forall a b c, lxor (lxor a b) c == lxor a (lxor b c).forall a b c : t,
lxor (lxor a b) c == lxor a (lxor b c)
Proof.forall a b c : t,
lxor (lxor a b) c == lxor a (lxor b c)
 intros.a, b, c:t
lxor (lxor a b) c == lxor a (lxor b c) bitwise.a, b, c, m:t
Hm:0 <= m
xorb (xorb a.[m] b.[m]) c.[m] =
xorb a.[m] (xorb b.[m] c.[m]) apply xorb_assoc.
Qed.

Lemma lor_0_l : forall a, lor 0 a == a.forall a : t, lor 0 a == a
Proof.forall a : t, lor 0 a == a
 intros.a:t
lor 0 a == a bitwise.a, m:t
Hm:0 <= m
false || a.[m] = a.[m] trivial.
Qed.

Lemma lor_0_r : forall a, lor a 0 == a.forall a : t, lor a 0 == a
Proof.forall a : t, lor a 0 == a
 intros.a:t
lor a 0 == a bitwise.a, m:t
Hm:0 <= m
a.[m] || false = a.[m] apply orb_false_r.
Qed.

Lemma lor_comm : forall a b, lor a b == lor b a.forall a b : t, lor a b == lor b a
Proof.forall a b : t, lor a b == lor b a
 intros.a, b:t
lor a b == lor b a bitwise.a, b, m:t
Hm:0 <= m
a.[m] || b.[m] = b.[m] || a.[m] apply orb_comm.
Qed.

Lemma lor_assoc :
 forall a b c, lor a (lor b c) == lor (lor a b) c.forall a b c : t, lor a (lor b c) == lor (lor a b) c
Proof.forall a b c : t, lor a (lor b c) == lor (lor a b) c
 intros.a, b, c:t
lor a (lor b c) == lor (lor a b) c bitwise.a, b, c, m:t
Hm:0 <= m
a.[m] || (b.[m] || c.[m]) = a.[m] || b.[m] || c.[m] apply orb_assoc.
Qed.

Lemma lor_diag : forall a, lor a a == a.forall a : t, lor a a == a
Proof.forall a : t, lor a a == a
 intros.a:t
lor a a == a bitwise.a, m:t
Hm:0 <= m
a.[m] || a.[m] = a.[m] apply orb_diag.
Qed.

Lemma lor_eq_0_l : forall a b, lor a b == 0 -> a == 0.forall a b : t, lor a b == 0 -> a == 0
Proof.forall a b : t, lor a b == 0 -> a == 0
 intros a b H.a, b:t
H:lor a b == 0
a == 0 bitwise.a, b:t
H:lor a b == 0
m:t
Hm:0 <= m
a.[m] = false
 apply (orb_false_iff a.[m] b.[m]).a, b:t
H:lor a b == 0
m:t
Hm:0 <= m
a.[m] || b.[m] = false
 now rewrite <- lor_spec, H, bits_0.
Qed.

Lemma lor_eq_0_iff : forall a b, lor a b == 0 <-> a == 0 /\ b == 0.forall a b : t, lor a b == 0 <-> a == 0 /\ b == 0
Proof.forall a b : t, lor a b == 0 <-> a == 0 /\ b == 0
 intros a b.a, b:t
lor a b == 0 <-> a == 0 /\ b == 0 split.a, b:t
lor a b == 0 -> a == 0 /\ b == 0
a, b:t
a == 0 /\ b == 0 -> lor a b == 0
 split.a, b:t
H:lor a b == 0
a == 0
a, b:t
H:lor a b == 0
b == 0
a, b:t
a == 0 /\ b == 0 -> lor a b == 0 now apply lor_eq_0_l in H.a, b:t
H:lor a b == 0
b == 0
a, b:t
a == 0 /\ b == 0 -> lor a b == 0
 rewrite lor_comm in H.a, b:t
H:lor b a == 0
b == 0
a, b:t
a == 0 /\ b == 0 -> lor a b == 0 now apply lor_eq_0_l in H.a, b:t
a == 0 /\ b == 0 -> lor a b == 0
 intros (EQ,EQ').a, b:t
EQ:a == 0
EQ':b == 0
lor a b == 0 now rewrite EQ, lor_0_l.
Qed.

Lemma land_0_l : forall a, land 0 a == 0.forall a : t, land 0 a == 0
Proof.forall a : t, land 0 a == 0
 intros.a:t
land 0 a == 0 bitwise.a, m:t
Hm:0 <= m
false && a.[m] = false trivial.
Qed.

Lemma land_0_r : forall a, land a 0 == 0.forall a : t, land a 0 == 0
Proof.forall a : t, land a 0 == 0
 intros.a:t
land a 0 == 0 bitwise.a, m:t
Hm:0 <= m
a.[m] && false = false apply andb_false_r.
Qed.

Lemma land_comm : forall a b, land a b == land b a.forall a b : t, land a b == land b a
Proof.forall a b : t, land a b == land b a
 intros.a, b:t
land a b == land b a bitwise.a, b, m:t
Hm:0 <= m
a.[m] && b.[m] = b.[m] && a.[m] apply andb_comm.
Qed.

Lemma land_assoc :
 forall a b c, land a (land b c) == land (land a b) c.forall a b c : t,
land a (land b c) == land (land a b) c
Proof.forall a b c : t,
land a (land b c) == land (land a b) c
 intros.a, b, c:t
land a (land b c) == land (land a b) c bitwise.a, b, c, m:t
Hm:0 <= m
a.[m] && (b.[m] && c.[m]) = a.[m] && b.[m] && c.[m] apply andb_assoc.
Qed.

Lemma land_diag : forall a, land a a == a.forall a : t, land a a == a
Proof.forall a : t, land a a == a
 intros.a:t
land a a == a bitwise.a, m:t
Hm:0 <= m
a.[m] && a.[m] = a.[m] apply andb_diag.
Qed.

Lemma ldiff_0_l : forall a, ldiff 0 a == 0.forall a : t, ldiff 0 a == 0
Proof.forall a : t, ldiff 0 a == 0
 intros.a:t
ldiff 0 a == 0 bitwise.a, m:t
Hm:0 <= m
false && negb a.[m] = false trivial.
Qed.

Lemma ldiff_0_r : forall a, ldiff a 0 == a.forall a : t, ldiff a 0 == a
Proof.forall a : t, ldiff a 0 == a
 intros.a:t
ldiff a 0 == a bitwise.a, m:t
Hm:0 <= m
a.[m] && negb false = a.[m] now rewrite andb_true_r.
Qed.

Lemma ldiff_diag : forall a, ldiff a a == 0.forall a : t, ldiff a a == 0
Proof.forall a : t, ldiff a a == 0
 intros.a:t
ldiff a a == 0 bitwise.a, m:t
Hm:0 <= m
a.[m] && negb a.[m] = false apply andb_negb_r.
Qed.

Lemma lor_land_distr_l : forall a b c,
 lor (land a b) c == land (lor a c) (lor b c).forall a b c : t,
lor (land a b) c == land (lor a c) (lor b c)
Proof.forall a b c : t,
lor (land a b) c == land (lor a c) (lor b c)
 intros.a, b, c:t
lor (land a b) c == land (lor a c) (lor b c) bitwise.a, b, c, m:t
Hm:0 <= m
a.[m] && b.[m] || c.[m] =
(a.[m] || c.[m]) && (b.[m] || c.[m]) apply orb_andb_distrib_l.
Qed.

Lemma lor_land_distr_r : forall a b c,
 lor a (land b c) == land (lor a b) (lor a c).forall a b c : t,
lor a (land b c) == land (lor a b) (lor a c)
Proof.forall a b c : t,
lor a (land b c) == land (lor a b) (lor a c)
 intros.a, b, c:t
lor a (land b c) == land (lor a b) (lor a c) bitwise.a, b, c, m:t
Hm:0 <= m
a.[m] || b.[m] && c.[m] =
(a.[m] || b.[m]) && (a.[m] || c.[m]) apply orb_andb_distrib_r.
Qed.

Lemma land_lor_distr_l : forall a b c,
 land (lor a b) c == lor (land a c) (land b c).forall a b c : t,
land (lor a b) c == lor (land a c) (land b c)
Proof.forall a b c : t,
land (lor a b) c == lor (land a c) (land b c)
 intros.a, b, c:t
land (lor a b) c == lor (land a c) (land b c) bitwise.a, b, c, m:t
Hm:0 <= m
(a.[m] || b.[m]) && c.[m] =
a.[m] && c.[m] || b.[m] && c.[m] apply andb_orb_distrib_l.
Qed.

Lemma land_lor_distr_r : forall a b c,
 land a (lor b c) == lor (land a b) (land a c).forall a b c : t,
land a (lor b c) == lor (land a b) (land a c)
Proof.forall a b c : t,
land a (lor b c) == lor (land a b) (land a c)
 intros.a, b, c:t
land a (lor b c) == lor (land a b) (land a c) bitwise.a, b, c, m:t
Hm:0 <= m
a.[m] && (b.[m] || c.[m]) =
a.[m] && b.[m] || a.[m] && c.[m] apply andb_orb_distrib_r.
Qed.

Lemma ldiff_ldiff_l : forall a b c,
 ldiff (ldiff a b) c == ldiff a (lor b c).forall a b c : t,
ldiff (ldiff a b) c == ldiff a (lor b c)
Proof.forall a b c : t,
ldiff (ldiff a b) c == ldiff a (lor b c)
 intros.a, b, c:t
ldiff (ldiff a b) c == ldiff a (lor b c) bitwise.a, b, c, m:t
Hm:0 <= m
a.[m] && negb b.[m] && negb c.[m] =
a.[m] && negb (b.[m] || c.[m]) now rewrite negb_orb, andb_assoc.
Qed.

Lemma lor_ldiff_and : forall a b,
 lor (ldiff a b) (land a b) == a.forall a b : t, lor (ldiff a b) (land a b) == a
Proof.forall a b : t, lor (ldiff a b) (land a b) == a
 intros.a, b:t
lor (ldiff a b) (land a b) == a bitwise.a, b, m:t
Hm:0 <= m
a.[m] && negb b.[m] || a.[m] && b.[m] = a.[m]
 now rewrite <- andb_orb_distrib_r, orb_comm, orb_negb_r, andb_true_r.
Qed.

Lemma land_ldiff : forall a b,
 land (ldiff a b) b == 0.forall a b : t, land (ldiff a b) b == 0
Proof.forall a b : t, land (ldiff a b) b == 0
 intros.a, b:t
land (ldiff a b) b == 0 bitwise.a, b, m:t
Hm:0 <= m
a.[m] && negb b.[m] && b.[m] = false
 now rewrite <-andb_assoc, (andb_comm (negb _)), andb_negb_r, andb_false_r.
Qed.

Properties of setbit and clearbit

Definition setbit a n := lor a (1 << n).
Definition clearbit a n := ldiff a (1 << n).

Lemma setbit_spec' : forall a n, setbit a n == lor a (2^n).forall a n : t, setbit a n == lor a (2 ^ n)
Proof.forall a n : t, setbit a n == lor a (2 ^ n)
 intros.a, n:t
setbit a n == lor a (2 ^ n) unfold setbit.a, n:t
lor a (1 << n) == lor a (2 ^ n) now rewrite shiftl_1_l.
Qed.

Lemma clearbit_spec' : forall a n, clearbit a n == ldiff a (2^n).forall a n : t, clearbit a n == ldiff a (2 ^ n)
Proof.forall a n : t, clearbit a n == ldiff a (2 ^ n)
 intros.a, n:t
clearbit a n == ldiff a (2 ^ n) unfold clearbit.a, n:t
ldiff a (1 << n) == ldiff a (2 ^ n) now rewrite shiftl_1_l.
Qed.

Instance setbit_wd : Proper (eq==>eq==>eq) setbit.Proper (eq ==> eq ==> eq) setbit
Proof.Proper (eq ==> eq ==> eq) setbit unfold setbit.Proper (eq ==> eq ==> eq)
  (fun a n : t => lor a (1 << n)) solve_proper. Qed.

Instance clearbit_wd : Proper (eq==>eq==>eq) clearbit.Proper (eq ==> eq ==> eq) clearbit
Proof.Proper (eq ==> eq ==> eq) clearbit unfold clearbit.Proper (eq ==> eq ==> eq)
  (fun a n : t => ldiff a (1 << n)) solve_proper. Qed.

Lemma pow2_bits_true : forall n, 0<=n -> (2^n).[n] = true.forall n : t, 0 <= n -> (2 ^ n).[n] = true
Proof.forall n : t, 0 <= n -> (2 ^ n).[n] = true
 intros.n:t
H:0 <= n
(2 ^ n).[n] = true rewrite <- (mul_1_l (2^n)).n:t
H:0 <= n
(1 * 2 ^ n).[n] = true
 now rewrite mul_pow2_bits, sub_diag, bit0_odd, odd_1.
Qed.

Lemma pow2_bits_false : forall n m, n~=m -> (2^n).[m] = false.forall n m : t, n ~= m -> (2 ^ n).[m] = false
Proof.forall n m : t, n ~= m -> (2 ^ n).[m] = false
 intros.n, m:t
H:n ~= m
(2 ^ n).[m] = false
 destruct (le_gt_cases 0 n); [|now rewrite pow_neg_r, bits_0].n, m:t
H:n ~= m
H0:0 <= n
(2 ^ n).[m] = false
 destruct (le_gt_cases n m).n, m:t
H:n ~= m
H0:0 <= n
H1:n <= m
(2 ^ n).[m] = false
n, m:t
H:n ~= m
H0:0 <= n
H1:m < n
(2 ^ n).[m] = false
 rewrite <- (mul_1_l (2^n)), mul_pow2_bits; trivial.n, m:t
H:n ~= m
H0:0 <= n
H1:n <= m
1.[m - n] = false
n, m:t
H:n ~= m
H0:0 <= n
H1:m < n
(2 ^ n).[m] = false
 rewrite <- (succ_pred (m-n)), <- div2_bits.n, m:t
H:n ~= m
H0:0 <= n
H1:n <= m
(1 / 2).[P (m - n)] = false
n, m:t
H:n ~= m
H0:0 <= n
H1:n <= m
0 <= P (m - n)
n, m:t
H:n ~= m
H0:0 <= n
H1:m < n
(2 ^ n).[m] = false
 now rewrite div_small, bits_0 by (split; order').n, m:t
H:n ~= m
H0:0 <= n
H1:n <= m
0 <= P (m - n)
n, m:t
H:n ~= m
H0:0 <= n
H1:m < n
(2 ^ n).[m] = false
 rewrite <- lt_succ_r, succ_pred, lt_0_sub.n, m:t
H:n ~= m
H0:0 <= n
H1:n <= m
n < m
n, m:t
H:n ~= m
H0:0 <= n
H1:m < n
(2 ^ n).[m] = false order.n, m:t
H:n ~= m
H0:0 <= n
H1:m < n
(2 ^ n).[m] = false
 rewrite <- (mul_1_l (2^n)), mul_pow2_bits_low; trivial.
Qed.

Lemma pow2_bits_eqb : forall n m, 0<=n -> (2^n).[m] = eqb n m.forall n m : t, 0 <= n -> (2 ^ n).[m] = (n =? m)
Proof.forall n m : t, 0 <= n -> (2 ^ n).[m] = (n =? m)
 intros n m Hn.n, m:t
Hn:0 <= n
(2 ^ n).[m] = (n =? m) apply eq_true_iff_eq.n, m:t
Hn:0 <= n
(2 ^ n).[m] = true <-> (n =? m) = true rewrite eqb_eq.n, m:t
Hn:0 <= n
(2 ^ n).[m] = true <-> n == m split.n, m:t
Hn:0 <= n
(2 ^ n).[m] = true -> n == m
n, m:t
Hn:0 <= n
n == m -> (2 ^ n).[m] = true
 destruct (eq_decidable n m) as [H|H].n, m:t
Hn:0 <= n
H:n == m
(2 ^ n).[m] = true -> n == m
n, m:t
Hn:0 <= n
H:n ~= m
(2 ^ n).[m] = true -> n == m
n, m:t
Hn:0 <= n
n == m -> (2 ^ n).[m] = true trivial.n, m:t
Hn:0 <= n
H:n ~= m
(2 ^ n).[m] = true -> n == m
n, m:t
Hn:0 <= n
n == m -> (2 ^ n).[m] = true
 now rewrite (pow2_bits_false _ _ H).n, m:t
Hn:0 <= n
n == m -> (2 ^ n).[m] = true
 intros EQ.n, m:t
Hn:0 <= n
EQ:n == m
(2 ^ n).[m] = true rewrite EQ.n, m:t
Hn:0 <= n
EQ:n == m
(2 ^ m).[m] = true apply pow2_bits_true; order.
Qed.

Lemma setbit_eqb : forall a n m, 0<=n ->
 (setbit a n).[m] = eqb n m || a.[m].forall a n m : t,
0 <= n -> (setbit a n).[m] = (n =? m) || a.[m]
Proof.forall a n m : t,
0 <= n -> (setbit a n).[m] = (n =? m) || a.[m]
 intros.a, n, m:t
H:0 <= n
(setbit a n).[m] = (n =? m) || a.[m] now rewrite setbit_spec', lor_spec, pow2_bits_eqb, orb_comm.
Qed.

Lemma setbit_iff : forall a n m, 0<=n ->
 ((setbit a n).[m] = true <-> n==m \/ a.[m] = true).forall a n m : t,
0 <= n ->
(setbit a n).[m] = true <-> n == m \/ a.[m] = true
Proof.forall a n m : t,
0 <= n ->
(setbit a n).[m] = true <-> n == m \/ a.[m] = true
 intros.a, n, m:t
H:0 <= n
(setbit a n).[m] = true <-> n == m \/ a.[m] = true now rewrite setbit_eqb, orb_true_iff, eqb_eq.
Qed.

Lemma setbit_eq : forall a n, 0<=n -> (setbit a n).[n] = true.forall a n : t, 0 <= n -> (setbit a n).[n] = true
Proof.forall a n : t, 0 <= n -> (setbit a n).[n] = true
 intros.a, n:t
H:0 <= n
(setbit a n).[n] = true apply setbit_iff; trivial.a, n:t
H:0 <= n
n == n \/ a.[n] = true now left.
Qed.

Lemma setbit_neq : forall a n m, 0<=n -> n~=m ->
 (setbit a n).[m] = a.[m].forall a n m : t,
0 <= n -> n ~= m -> (setbit a n).[m] = a.[m]
Proof.forall a n m : t,
0 <= n -> n ~= m -> (setbit a n).[m] = a.[m]
 intros a n m Hn H.a, n, m:t
Hn:0 <= n
H:n ~= m
(setbit a n).[m] = a.[m] rewrite setbit_eqb; trivial.a, n, m:t
Hn:0 <= n
H:n ~= m
(n =? m) || a.[m] = a.[m]
 rewrite <- eqb_eq in H.a, n, m:t
Hn:0 <= n
H:(n =? m) <> true
(n =? m) || a.[m] = a.[m] apply not_true_is_false in H.a, n, m:t
Hn:0 <= n
H:(n =? m) = false
(n =? m) || a.[m] = a.[m] now rewrite H.
Qed.

Lemma clearbit_eqb : forall a n m,
 (clearbit a n).[m] = a.[m] && negb (eqb n m).forall a n m : t,
(clearbit a n).[m] = a.[m] && negb (n =? m)
Proof.forall a n m : t,
(clearbit a n).[m] = a.[m] && negb (n =? m)
 intros.a, n, m:t
(clearbit a n).[m] = a.[m] && negb (n =? m)
 destruct (le_gt_cases 0 m); [| now rewrite 2 testbit_neg_r].a, n, m:t
H:0 <= m
(clearbit a n).[m] = a.[m] && negb (n =? m)
 rewrite clearbit_spec', ldiff_spec.a, n, m:t
H:0 <= m
a.[m] && negb (2 ^ n).[m] = a.[m] && negb (n =? m) f_equal.a, n, m:t
H:0 <= m
negb (2 ^ n).[m] = negb (n =? m) f_equal.a, n, m:t
H:0 <= m
(2 ^ n).[m] = (n =? m)
 destruct (le_gt_cases 0 n) as [Hn|Hn].a, n, m:t
H:0 <= m
Hn:0 <= n
(2 ^ n).[m] = (n =? m)
a, n, m:t
H:0 <= m
Hn:n < 0
(2 ^ n).[m] = (n =? m)
 now apply pow2_bits_eqb.a, n, m:t
H:0 <= m
Hn:n < 0
(2 ^ n).[m] = (n =? m)
 symmetry.a, n, m:t
H:0 <= m
Hn:n < 0
(n =? m) = (2 ^ n).[m] rewrite pow_neg_r, bits_0, <- not_true_iff_false, eqb_eq; order.
Qed.

Lemma clearbit_iff : forall a n m,
 (clearbit a n).[m] = true <-> a.[m] = true /\ n~=m.forall a n m : t,
(clearbit a n).[m] = true <-> a.[m] = true /\ n ~= m
Proof.forall a n m : t,
(clearbit a n).[m] = true <-> a.[m] = true /\ n ~= m
 intros.a, n, m:t
(clearbit a n).[m] = true <-> a.[m] = true /\ n ~= m rewrite clearbit_eqb, andb_true_iff, <- eqb_eq.a, n, m:t
a.[m] = true /\ negb (n =? m) = true <->
a.[m] = true /\ (n =? m) <> true
 now rewrite negb_true_iff, not_true_iff_false.
Qed.

Lemma clearbit_eq : forall a n, (clearbit a n).[n] = false.forall a n : t, (clearbit a n).[n] = false
Proof.forall a n : t, (clearbit a n).[n] = false
 intros.a, n:t
(clearbit a n).[n] = false rewrite clearbit_eqb, (proj2 (eqb_eq _ _) (eq_refl n)).a, n:t
a.[n] && negb true = false
 apply andb_false_r.
Qed.

Lemma clearbit_neq : forall a n m, n~=m ->
 (clearbit a n).[m] = a.[m].forall a n m : t, n ~= m -> (clearbit a n).[m] = a.[m]
Proof.forall a n m : t, n ~= m -> (clearbit a n).[m] = a.[m]
 intros a n m H.a, n, m:t
H:n ~= m
(clearbit a n).[m] = a.[m] rewrite clearbit_eqb.a, n, m:t
H:n ~= m
a.[m] && negb (n =? m) = a.[m]
 rewrite <- eqb_eq in H.a, n, m:t
H:(n =? m) <> true
a.[m] && negb (n =? m) = a.[m] apply not_true_is_false in H.a, n, m:t
H:(n =? m) = false
a.[m] && negb (n =? m) = a.[m] rewrite H.a, n, m:t
H:(n =? m) = false
a.[m] && negb false = a.[m]
 apply andb_true_r.
Qed.

Shifts of bitwise operations

Lemma shiftl_lxor : forall a b n,
 (lxor a b) << n == lxor (a << n) (b << n).forall a b n : t,
lxor a b << n == lxor (a << n) (b << n)
Proof.forall a b n : t,
lxor a b << n == lxor (a << n) (b << n)
 intros.a, b, n:t
lxor a b << n == lxor (a << n) (b << n) bitwise.a, b, n, m:t
Hm:0 <= m
(lxor a b << n).[m] = xorb (a << n).[m] (b << n).[m] now rewrite !shiftl_spec, lxor_spec.
Qed.

Lemma shiftr_lxor : forall a b n,
 (lxor a b) >> n == lxor (a >> n) (b >> n).forall a b n : t,
lxor a b >> n == lxor (a >> n) (b >> n)
Proof.forall a b n : t,
lxor a b >> n == lxor (a >> n) (b >> n)
 intros.a, b, n:t
lxor a b >> n == lxor (a >> n) (b >> n) bitwise.a, b, n, m:t
Hm:0 <= m
(lxor a b >> n).[m] = xorb (a >> n).[m] (b >> n).[m] now rewrite !shiftr_spec, lxor_spec.
Qed.

Lemma shiftl_land : forall a b n,
 (land a b) << n == land (a << n) (b << n).forall a b n : t,
land a b << n == land (a << n) (b << n)
Proof.forall a b n : t,
land a b << n == land (a << n) (b << n)
 intros.a, b, n:t
land a b << n == land (a << n) (b << n) bitwise.a, b, n, m:t
Hm:0 <= m
(land a b << n).[m] = (a << n).[m] && (b << n).[m] now rewrite !shiftl_spec, land_spec.
Qed.

Lemma shiftr_land : forall a b n,
 (land a b) >> n == land (a >> n) (b >> n).forall a b n : t,
land a b >> n == land (a >> n) (b >> n)
Proof.forall a b n : t,
land a b >> n == land (a >> n) (b >> n)
 intros.a, b, n:t
land a b >> n == land (a >> n) (b >> n) bitwise.a, b, n, m:t
Hm:0 <= m
(land a b >> n).[m] = (a >> n).[m] && (b >> n).[m] now rewrite !shiftr_spec, land_spec.
Qed.

Lemma shiftl_lor : forall a b n,
 (lor a b) << n == lor (a << n) (b << n).forall a b n : t,
lor a b << n == lor (a << n) (b << n)
Proof.forall a b n : t,
lor a b << n == lor (a << n) (b << n)
 intros.a, b, n:t
lor a b << n == lor (a << n) (b << n) bitwise.a, b, n, m:t
Hm:0 <= m
(lor a b << n).[m] = (a << n).[m] || (b << n).[m] now rewrite !shiftl_spec, lor_spec.
Qed.

Lemma shiftr_lor : forall a b n,
 (lor a b) >> n == lor (a >> n) (b >> n).forall a b n : t,
lor a b >> n == lor (a >> n) (b >> n)
Proof.forall a b n : t,
lor a b >> n == lor (a >> n) (b >> n)
 intros.a, b, n:t
lor a b >> n == lor (a >> n) (b >> n) bitwise.a, b, n, m:t
Hm:0 <= m
(lor a b >> n).[m] = (a >> n).[m] || (b >> n).[m] now rewrite !shiftr_spec, lor_spec.
Qed.

Lemma shiftl_ldiff : forall a b n,
 (ldiff a b) << n == ldiff (a << n) (b << n).forall a b n : t,
ldiff a b << n == ldiff (a << n) (b << n)
Proof.forall a b n : t,
ldiff a b << n == ldiff (a << n) (b << n)
 intros.a, b, n:t
ldiff a b << n == ldiff (a << n) (b << n) bitwise.a, b, n, m:t
Hm:0 <= m
(ldiff a b << n).[m] =
(a << n).[m] && negb (b << n).[m] now rewrite !shiftl_spec, ldiff_spec.
Qed.

Lemma shiftr_ldiff : forall a b n,
 (ldiff a b) >> n == ldiff (a >> n) (b >> n).forall a b n : t,
ldiff a b >> n == ldiff (a >> n) (b >> n)
Proof.forall a b n : t,
ldiff a b >> n == ldiff (a >> n) (b >> n)
 intros.a, b, n:t
ldiff a b >> n == ldiff (a >> n) (b >> n) bitwise.a, b, n, m:t
Hm:0 <= m
(ldiff a b >> n).[m] =
(a >> n).[m] && negb (b >> n).[m] now rewrite !shiftr_spec, ldiff_spec.
Qed.

For integers, we do have a binary complement function

Definition lnot a := P (-a).

Instance lnot_wd : Proper (eq==>eq) lnot.Proper (eq ==> eq) lnot
Proof.Proper (eq ==> eq) lnot unfold lnot.Proper (eq ==> eq) (fun a : t => P (- a)) solve_proper. Qed.

Lemma lnot_spec : forall a n, 0<=n -> (lnot a).[n] = negb a.[n].forall a n : t, 0 <= n -> (lnot a).[n] = negb a.[n]
Proof.forall a n : t, 0 <= n -> (lnot a).[n] = negb a.[n]
 intros.a, n:t
H:0 <= n
(lnot a).[n] = negb a.[n] unfold lnot.a, n:t
H:0 <= n
(P (- a)).[n] = negb a.[n] rewrite <- (opp_involutive a) at 2.a, n:t
H:0 <= n
(P (- a)).[n] = negb (- - a).[n]
 rewrite bits_opp, negb_involutive; trivial.
Qed.

Lemma lnot_involutive : forall a, lnot (lnot a) == a.forall a : t, lnot (lnot a) == a
Proof.forall a : t, lnot (lnot a) == a
 intros a.a:t
lnot (lnot a) == a bitwise.a, m:t
Hm:0 <= m
(lnot (lnot a)).[m] = a.[m] now rewrite 2 lnot_spec, negb_involutive.
Qed.

Lemma lnot_0 : lnot 0 == -1.lnot 0 == -1
Proof.lnot 0 == -1
 unfold lnot.P (- 0) == -1 now rewrite opp_0, <- sub_1_r, sub_0_l.
Qed.

Lemma lnot_m1 : lnot (-1) == 0.lnot (-1) == 0
Proof.lnot (-1) == 0
 unfold lnot.P (- -1) == 0 now rewrite opp_involutive, one_succ, pred_succ.
Qed.

Complement and other operations

Lemma lor_m1_r : forall a, lor a (-1) == -1.forall a : t, lor a (-1) == -1
Proof.forall a : t, lor a (-1) == -1
 intros.a:t
lor a (-1) == -1 bitwise.a, m:t
Hm:0 <= m
a.[m] || (-1).[m] = (-1).[m] now rewrite bits_m1, orb_true_r.
Qed.

Lemma lor_m1_l : forall a, lor (-1) a == -1.forall a : t, lor (-1) a == -1
Proof.forall a : t, lor (-1) a == -1
 intros.a:t
lor (-1) a == -1 now rewrite lor_comm, lor_m1_r.
Qed.

Lemma land_m1_r : forall a, land a (-1) == a.forall a : t, land a (-1) == a
Proof.forall a : t, land a (-1) == a
 intros.a:t
land a (-1) == a bitwise.a, m:t
Hm:0 <= m
a.[m] && (-1).[m] = a.[m] now rewrite bits_m1, andb_true_r.
Qed.

Lemma land_m1_l : forall a, land (-1) a == a.forall a : t, land (-1) a == a
Proof.forall a : t, land (-1) a == a
 intros.a:t
land (-1) a == a now rewrite land_comm, land_m1_r.
Qed.

Lemma ldiff_m1_r : forall a, ldiff a (-1) == 0.forall a : t, ldiff a (-1) == 0
Proof.forall a : t, ldiff a (-1) == 0
 intros.a:t
ldiff a (-1) == 0 bitwise.a, m:t
Hm:0 <= m
a.[m] && negb (-1).[m] = false now rewrite bits_m1, andb_false_r.
Qed.

Lemma ldiff_m1_l : forall a, ldiff (-1) a == lnot a.forall a : t, ldiff (-1) a == lnot a
Proof.forall a : t, ldiff (-1) a == lnot a
 intros.a:t
ldiff (-1) a == lnot a bitwise.a, m:t
Hm:0 <= m
(-1).[m] && negb a.[m] = (lnot a).[m] now rewrite lnot_spec, bits_m1.
Qed.

Lemma lor_lnot_diag : forall a, lor a (lnot a) == -1.forall a : t, lor a (lnot a) == -1
Proof.forall a : t, lor a (lnot a) == -1
 intros a.a:t
lor a (lnot a) == -1 bitwise.a, m:t
Hm:0 <= m
a.[m] || (lnot a).[m] = (-1).[m] rewrite lnot_spec, bits_m1; trivial.a, m:t
Hm:0 <= m
a.[m] || negb a.[m] = true
 now destruct a.[m].
Qed.

Lemma add_lnot_diag : forall a, a + lnot a == -1.forall a : t, a + lnot a == -1
Proof.forall a : t, a + lnot a == -1
 intros a.a:t
a + lnot a == -1 unfold lnot.a:t
a + P (- a) == -1
 now rewrite add_pred_r, add_opp_r, sub_diag, one_succ, opp_succ, opp_0.
Qed.

Lemma ldiff_land : forall a b, ldiff a b == land a (lnot b).forall a b : t, ldiff a b == land a (lnot b)
Proof.forall a b : t, ldiff a b == land a (lnot b)
 intros.a, b:t
ldiff a b == land a (lnot b) bitwise.a, b, m:t
Hm:0 <= m
a.[m] && negb b.[m] = a.[m] && (lnot b).[m] now rewrite lnot_spec.
Qed.

Lemma land_lnot_diag : forall a, land a (lnot a) == 0.forall a : t, land a (lnot a) == 0
Proof.forall a : t, land a (lnot a) == 0
 intros.a:t
land a (lnot a) == 0 now rewrite <- ldiff_land, ldiff_diag.
Qed.

Lemma lnot_lor : forall a b, lnot (lor a b) == land (lnot a) (lnot b).forall a b : t,
lnot (lor a b) == land (lnot a) (lnot b)
Proof.forall a b : t,
lnot (lor a b) == land (lnot a) (lnot b)
 intros a b.a, b:t
lnot (lor a b) == land (lnot a) (lnot b) bitwise.a, b, m:t
Hm:0 <= m
(lnot (lor a b)).[m] = (lnot a).[m] && (lnot b).[m] now rewrite !lnot_spec, lor_spec, negb_orb.
Qed.

Lemma lnot_land : forall a b, lnot (land a b) == lor (lnot a) (lnot b).forall a b : t,
lnot (land a b) == lor (lnot a) (lnot b)
Proof.forall a b : t,
lnot (land a b) == lor (lnot a) (lnot b)
 intros a b.a, b:t
lnot (land a b) == lor (lnot a) (lnot b) bitwise.a, b, m:t
Hm:0 <= m
(lnot (land a b)).[m] = (lnot a).[m] || (lnot b).[m] now rewrite !lnot_spec, land_spec, negb_andb.
Qed.

Lemma lnot_ldiff : forall a b, lnot (ldiff a b) == lor (lnot a) b.forall a b : t, lnot (ldiff a b) == lor (lnot a) b
Proof.forall a b : t, lnot (ldiff a b) == lor (lnot a) b
 intros a b.a, b:t
lnot (ldiff a b) == lor (lnot a) b bitwise.a, b, m:t
Hm:0 <= m
(lnot (ldiff a b)).[m] = (lnot a).[m] || b.[m]
 now rewrite !lnot_spec, ldiff_spec, negb_andb, negb_involutive.
Qed.

Lemma lxor_lnot_lnot : forall a b, lxor (lnot a) (lnot b) == lxor a b.forall a b : t, lxor (lnot a) (lnot b) == lxor a b
Proof.forall a b : t, lxor (lnot a) (lnot b) == lxor a b
 intros a b.a, b:t
lxor (lnot a) (lnot b) == lxor a b bitwise.a, b, m:t
Hm:0 <= m
xorb (lnot a).[m] (lnot b).[m] = xorb a.[m] b.[m] now rewrite !lnot_spec, xorb_negb_negb.
Qed.

Lemma lnot_lxor_l : forall a b, lnot (lxor a b) == lxor (lnot a) b.forall a b : t, lnot (lxor a b) == lxor (lnot a) b
Proof.forall a b : t, lnot (lxor a b) == lxor (lnot a) b
 intros a b.a, b:t
lnot (lxor a b) == lxor (lnot a) b bitwise.a, b, m:t
Hm:0 <= m
(lnot (lxor a b)).[m] = xorb (lnot a).[m] b.[m] now rewrite !lnot_spec, !lxor_spec, negb_xorb_l.
Qed.

Lemma lnot_lxor_r : forall a b, lnot (lxor a b) == lxor a (lnot b).forall a b : t, lnot (lxor a b) == lxor a (lnot b)
Proof.forall a b : t, lnot (lxor a b) == lxor a (lnot b)
 intros a b.a, b:t
lnot (lxor a b) == lxor a (lnot b) bitwise.a, b, m:t
Hm:0 <= m
(lnot (lxor a b)).[m] = xorb a.[m] (lnot b).[m] now rewrite !lnot_spec, !lxor_spec, negb_xorb_r.
Qed.

Lemma lxor_m1_r : forall a, lxor a (-1) == lnot a.forall a : t, lxor a (-1) == lnot a
Proof.forall a : t, lxor a (-1) == lnot a
 intros.a:t
lxor a (-1) == lnot a now rewrite <- (lxor_0_r (lnot a)), <- lnot_m1, lxor_lnot_lnot.
Qed.

Lemma lxor_m1_l : forall a, lxor (-1) a == lnot a.forall a : t, lxor (-1) a == lnot a
Proof.forall a : t, lxor (-1) a == lnot a
 intros.a:t
lxor (-1) a == lnot a now rewrite lxor_comm, lxor_m1_r.
Qed.

Lemma lxor_lor : forall a b, land a b == 0 ->
 lxor a b == lor a b.forall a b : t, land a b == 0 -> lxor a b == lor a b
Proof.forall a b : t, land a b == 0 -> lxor a b == lor a b
 intros a b H.a, b:t
H:land a b == 0
lxor a b == lor a b bitwise.a, b:t
H:land a b == 0
m:t
Hm:0 <= m
xorb a.[m] b.[m] = a.[m] || b.[m]
 assert (a.[m] && b.[m] = false)
   by now rewrite <- land_spec, H, bits_0.a, b:t
H:land a b == 0
m:t
Hm:0 <= m
H0:a.[m] && b.[m] = false
xorb a.[m] b.[m] = a.[m] || b.[m]
 now destruct a.[m], b.[m].
Qed.

Lemma lnot_shiftr : forall a n, 0<=n -> lnot (a >> n) == (lnot a) >> n.forall a n : t, 0 <= n -> lnot (a >> n) == lnot a >> n
Proof.forall a n : t, 0 <= n -> lnot (a >> n) == lnot a >> n
 intros a n Hn.a, n:t
Hn:0 <= n
lnot (a >> n) == lnot a >> n bitwise.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
(lnot (a >> n)).[m] = (lnot a >> n).[m]
 now rewrite lnot_spec, 2 shiftr_spec, lnot_spec by order_pos.
Qed.

(ones n) is 2^n-1, the number with n digits 1

Definition ones n := P (1<<n).

Instance ones_wd : Proper (eq==>eq) ones.Proper (eq ==> eq) ones
Proof.Proper (eq ==> eq) ones unfold ones.Proper (eq ==> eq) (fun n : t => P (1 << n)) solve_proper. Qed.

Lemma ones_equiv : forall n, ones n == P (2^n).forall n : t, ones n == P (2 ^ n)
Proof.forall n : t, ones n == P (2 ^ n)
 intros.n:t
ones n == P (2 ^ n) unfold ones.n:t
P (1 << n) == P (2 ^ n)
 destruct (le_gt_cases 0 n).n:t
H:0 <= n
P (1 << n) == P (2 ^ n)
n:t
H:n < 0
P (1 << n) == P (2 ^ n)
 now rewrite shiftl_mul_pow2, mul_1_l.n:t
H:n < 0
P (1 << n) == P (2 ^ n)
 f_equiv.n:t
H:n < 0
1 << n == 2 ^ n rewrite pow_neg_r; trivial.n:t
H:n < 0
1 << n == 0
 rewrite <- shiftr_opp_r.n:t
H:n < 0
1 >> (- n) == 0 apply shiftr_eq_0_iff.n:t
H:n < 0
1 == 0 \/ 0 < 1 /\ log2 1 < - n right; split.n:t
H:n < 0
0 < 1
n:t
H:n < 0
log2 1 < - n
 order'.n:t
H:n < 0
log2 1 < - n rewrite log2_1.n:t
H:n < 0
0 < - n now apply opp_pos_neg.
Qed.

Lemma ones_add : forall n m, 0<=n -> 0<=m ->
 ones (m+n) == 2^m * ones n + ones m.forall n m : t,
0 <= n ->
0 <= m -> ones (m + n) == 2 ^ m * ones n + ones m
Proof.forall n m : t,
0 <= n ->
0 <= m -> ones (m + n) == 2 ^ m * ones n + ones m
 intros n m Hn Hm.n, m:t
Hn:0 <= n
Hm:0 <= m
ones (m + n) == 2 ^ m * ones n + ones m rewrite !ones_equiv.n, m:t
Hn:0 <= n
Hm:0 <= m
P (2 ^ (m + n)) == 2 ^ m * P (2 ^ n) + P (2 ^ m)
 rewrite <- !sub_1_r, mul_sub_distr_l, mul_1_r, <- pow_add_r by trivial.n, m:t
Hn:0 <= n
Hm:0 <= m
2 ^ (m + n) - 1 == 2 ^ (m + n) - 2 ^ m + (2 ^ m - 1)
 rewrite add_sub_assoc, sub_add.n, m:t
Hn:0 <= n
Hm:0 <= m
2 ^ (m + n) - 1 == 2 ^ (m + n) - 1 reflexivity.
Qed.

Lemma ones_div_pow2 : forall n m, 0<=m<=n -> ones n / 2^m == ones (n-m).forall n m : t,
0 <= m <= n -> ones n / 2 ^ m == ones (n - m)
Proof.forall n m : t,
0 <= m <= n -> ones n / 2 ^ m == ones (n - m)
 intros n m (Hm,H).n, m:t
Hm:0 <= m
H:m <= n
ones n / 2 ^ m == ones (n - m) symmetry.n, m:t
Hm:0 <= m
H:m <= n
ones (n - m) == ones n / 2 ^ m apply div_unique with (ones m).n, m:t
Hm:0 <= m
H:m <= n
0 <= ones m < 2 ^ m \/ 2 ^ m < ones m <= 0
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 left.n, m:t
Hm:0 <= m
H:m <= n
0 <= ones m < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m rewrite ones_equiv.n, m:t
Hm:0 <= m
H:m <= n
0 <= P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m split.n, m:t
Hm:0 <= m
H:m <= n
0 <= P (2 ^ m)
n, m:t
Hm:0 <= m
H:m <= n
P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 rewrite <- lt_succ_r, succ_pred.n, m:t
Hm:0 <= m
H:m <= n
0 < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m order_pos.n, m:t
Hm:0 <= m
H:m <= n
P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 now rewrite <- le_succ_l, succ_pred.n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 rewrite <- (sub_add m n) at 1.n, m:t
Hm:0 <= m
H:m <= n
ones (n - m + m) == 2 ^ m * ones (n - m) + ones m rewrite (add_comm _ m).n, m:t
Hm:0 <= m
H:m <= n
ones (m + (n - m)) == 2 ^ m * ones (n - m) + ones m
 apply ones_add; trivial.n, m:t
Hm:0 <= m
H:m <= n
0 <= n - m now apply le_0_sub.
Qed.

Lemma ones_mod_pow2 : forall n m, 0<=m<=n -> (ones n) mod (2^m) == ones m.forall n m : t,
0 <= m <= n -> ones n mod 2 ^ m == ones m
Proof.forall n m : t,
0 <= m <= n -> ones n mod 2 ^ m == ones m
 intros n m (Hm,H).n, m:t
Hm:0 <= m
H:m <= n
ones n mod 2 ^ m == ones m symmetry.n, m:t
Hm:0 <= m
H:m <= n
ones m == ones n mod 2 ^ m apply mod_unique with (ones (n-m)).n, m:t
Hm:0 <= m
H:m <= n
0 <= ones m < 2 ^ m \/ 2 ^ m < ones m <= 0
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 left.n, m:t
Hm:0 <= m
H:m <= n
0 <= ones m < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m rewrite ones_equiv.n, m:t
Hm:0 <= m
H:m <= n
0 <= P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m split.n, m:t
Hm:0 <= m
H:m <= n
0 <= P (2 ^ m)
n, m:t
Hm:0 <= m
H:m <= n
P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 rewrite <- lt_succ_r, succ_pred.n, m:t
Hm:0 <= m
H:m <= n
0 < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m order_pos.n, m:t
Hm:0 <= m
H:m <= n
P (2 ^ m) < 2 ^ m
n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 now rewrite <- le_succ_l, succ_pred.n, m:t
Hm:0 <= m
H:m <= n
ones n == 2 ^ m * ones (n - m) + ones m
 rewrite <- (sub_add m n) at 1.n, m:t
Hm:0 <= m
H:m <= n
ones (n - m + m) == 2 ^ m * ones (n - m) + ones m rewrite (add_comm _ m).n, m:t
Hm:0 <= m
H:m <= n
ones (m + (n - m)) == 2 ^ m * ones (n - m) + ones m
 apply ones_add; trivial.n, m:t
Hm:0 <= m
H:m <= n
0 <= n - m now apply le_0_sub.
Qed.

Lemma ones_spec_low : forall n m, 0<=m<n -> (ones n).[m] = true.forall n m : t, 0 <= m < n -> (ones n).[m] = true
Proof.forall n m : t, 0 <= m < n -> (ones n).[m] = true
 intros n m (Hm,H).n, m:t
Hm:0 <= m
H:m < n
(ones n).[m] = true apply testbit_true; trivial.n, m:t
Hm:0 <= m
H:m < n
(ones n / 2 ^ m) mod 2 == 1
 rewrite ones_div_pow2 by (split; order).n, m:t
Hm:0 <= m
H:m < n
ones (n - m) mod 2 == 1
 rewrite <- (pow_1_r 2).n, m:t
Hm:0 <= m
H:m < n
ones (n - m) mod 2 ^ 1 == 1 rewrite ones_mod_pow2.n, m:t
Hm:0 <= m
H:m < n
ones 1 == 1
n, m:t
Hm:0 <= m
H:m < n
0 <= 1 <= n - m
 rewrite ones_equiv.n, m:t
Hm:0 <= m
H:m < n
P (2 ^ 1) == 1
n, m:t
Hm:0 <= m
H:m < n
0 <= 1 <= n - m now nzsimpl'.n, m:t
Hm:0 <= m
H:m < n
0 <= 1 <= n - m
 split.n, m:t
Hm:0 <= m
H:m < n
0 <= 1
n, m:t
Hm:0 <= m
H:m < n
1 <= n - m order'.n, m:t
Hm:0 <= m
H:m < n
1 <= n - m apply le_add_le_sub_r.n, m:t
Hm:0 <= m
H:m < n
1 + m <= n nzsimpl.n, m:t
Hm:0 <= m
H:m < n
S m <= n now apply le_succ_l.
Qed.

Lemma ones_spec_high : forall n m, 0<=n<=m -> (ones n).[m] = false.forall n m : t, 0 <= n <= m -> (ones n).[m] = false
Proof.forall n m : t, 0 <= n <= m -> (ones n).[m] = false
 intros n m (Hn,H).n, m:t
Hn:0 <= n
H:n <= m
(ones n).[m] = false le_elim Hn.n, m:t
Hn:0 < n
H:n <= m
(ones n).[m] = false
n, m:t
Hn:0 == n
H:n <= m
(ones n).[m] = false
 apply bits_above_log2; rewrite ones_equiv.n, m:t
Hn:0 < n
H:n <= m
0 <= P (2 ^ n)
n, m:t
Hn:0 < n
H:n <= m
log2 (P (2 ^ n)) < m
n, m:t
Hn:0 == n
H:n <= m
(ones n).[m] = false
 rewrite <-lt_succ_r, succ_pred; order_pos.n, m:t
Hn:0 < n
H:n <= m
log2 (P (2 ^ n)) < m
n, m:t
Hn:0 == n
H:n <= m
(ones n).[m] = false
 rewrite log2_pred_pow2; trivial.n, m:t
Hn:0 < n
H:n <= m
P n < m
n, m:t
Hn:0 == n
H:n <= m
(ones n).[m] = false now rewrite <-le_succ_l, succ_pred.n, m:t
Hn:0 == n
H:n <= m
(ones n).[m] = false
 rewrite ones_equiv.n, m:t
Hn:0 == n
H:n <= m
(P (2 ^ n)).[m] = false now rewrite <- Hn, pow_0_r, one_succ, pred_succ, bits_0.
Qed.

Lemma ones_spec_iff : forall n m, 0<=n ->
 ((ones n).[m] = true <-> 0<=m<n).forall n m : t,
0 <= n -> (ones n).[m] = true <-> 0 <= m < n
Proof.forall n m : t,
0 <= n -> (ones n).[m] = true <-> 0 <= m < n
 intros n m Hn.n, m:t
Hn:0 <= n
(ones n).[m] = true <-> 0 <= m < n split.n, m:t
Hn:0 <= n
(ones n).[m] = true -> 0 <= m < n
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true intros H.n, m:t
Hn:0 <= n
H:(ones n).[m] = true
0 <= m < n
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true
 destruct (lt_ge_cases m 0) as [Hm|Hm].n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:m < 0
0 <= m < n
n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:0 <= m
0 <= m < n
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true
  now rewrite testbit_neg_r in H.n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:0 <= m
0 <= m < n
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true
  split; trivial.n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:0 <= m
m < n
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true apply lt_nge.n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:0 <= m
~ n <= m
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true intro H'.n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:0 <= m
H':n <= m
False
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true rewrite ones_spec_high in H.n, m:t
Hn:0 <= n
H:false = true
Hm:0 <= m
H':n <= m
False
n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:0 <= m
H':n <= m
0 <= n <= m
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true
  discriminate.n, m:t
Hn:0 <= n
H:(ones n).[m] = true
Hm:0 <= m
H':n <= m
0 <= n <= m
n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true now split.n, m:t
Hn:0 <= n
0 <= m < n -> (ones n).[m] = true
 apply ones_spec_low.
Qed.

Lemma lor_ones_low : forall a n, 0<=a -> log2 a < n ->
 lor a (ones n) == ones n.forall a n : t,
0 <= a -> log2 a < n -> lor a (ones n) == ones n
Proof.forall a n : t,
0 <= a -> log2 a < n -> lor a (ones n) == ones n
 intros a n Ha H.a, n:t
Ha:0 <= a
H:log2 a < n
lor a (ones n) == ones n bitwise.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
a.[m] || (ones n).[m] = (ones n).[m] destruct (le_gt_cases n m).a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
a.[m] || (ones n).[m] = (ones n).[m]
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] || (ones n).[m] = (ones n).[m]
 rewrite ones_spec_high, bits_above_log2; try split; trivial.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
log2 a < m
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] || (ones n).[m] = (ones n).[m]
 now apply lt_le_trans with n.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] || (ones n).[m] = (ones n).[m]
 apply le_trans with (log2 a); order_pos.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] || (ones n).[m] = (ones n).[m]
 rewrite ones_spec_low, orb_true_r; try split; trivial.
Qed.

Lemma land_ones : forall a n, 0<=n -> land a (ones n) == a mod 2^n.forall a n : t,
0 <= n -> land a (ones n) == a mod 2 ^ n
Proof.forall a n : t,
0 <= n -> land a (ones n) == a mod 2 ^ n
 intros a n Hn.a, n:t
Hn:0 <= n
land a (ones n) == a mod 2 ^ n bitwise.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
a.[m] && (ones n).[m] = (a mod 2 ^ n).[m] destruct (le_gt_cases n m).a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
a.[m] && (ones n).[m] = (a mod 2 ^ n).[m]
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && (ones n).[m] = (a mod 2 ^ n).[m]
 rewrite ones_spec_high, mod_pow2_bits_high, andb_false_r;
  try split; trivial.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && (ones n).[m] = (a mod 2 ^ n).[m]
 rewrite ones_spec_low, mod_pow2_bits_low, andb_true_r;
  try split; trivial.
Qed.

Lemma land_ones_low : forall a n, 0<=a -> log2 a < n ->
 land a (ones n) == a.forall a n : t,
0 <= a -> log2 a < n -> land a (ones n) == a
Proof.forall a n : t,
0 <= a -> log2 a < n -> land a (ones n) == a
 intros a n Ha H.a, n:t
Ha:0 <= a
H:log2 a < n
land a (ones n) == a
 assert (Hn : 0<=n) by (generalize (log2_nonneg a); order).a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
land a (ones n) == a
 rewrite land_ones; trivial.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a mod 2 ^ n == a apply mod_small.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
0 <= a < 2 ^ n
 split; trivial.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
a < 2 ^ n
 apply log2_lt_cancel.a, n:t
Ha:0 <= a
H:log2 a < n
Hn:0 <= n
log2 a < log2 (2 ^ n) now rewrite log2_pow2.
Qed.

Lemma ldiff_ones_r : forall a n, 0<=n ->
 ldiff a (ones n) == (a >> n) << n.forall a n : t,
0 <= n -> ldiff a (ones n) == (a >> n) << n
Proof.forall a n : t,
0 <= n -> ldiff a (ones n) == (a >> n) << n
 intros a n Hn.a, n:t
Hn:0 <= n
ldiff a (ones n) == (a >> n) << n bitwise.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m] destruct (le_gt_cases n m).a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m]
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m]
 rewrite ones_spec_high, shiftl_spec_high, shiftr_spec; trivial.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
a.[m] && negb false = a.[m - n + n]
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
0 <= m - n
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
0 <= n <= m
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m]
 rewrite sub_add; trivial.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
a.[m] && negb false = a.[m]
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
0 <= m - n
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
0 <= n <= m
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m] apply andb_true_r.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
0 <= m - n
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
0 <= n <= m
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m]
 now apply le_0_sub.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:n <= m
0 <= n <= m
a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m]
 now split.a, n:t
Hn:0 <= n
m:t
Hm:0 <= m
H:m < n
a.[m] && negb (ones n).[m] = ((a >> n) << n).[m]
 rewrite ones_spec_low, shiftl_spec_low, andb_false_r;
  try split; trivial.
Qed.

Lemma ldiff_ones_r_low : forall a n, 0<=a -> log2 a < n ->
 ldiff a (ones n) == 0.forall a n : t,
0 <= a -> log2 a < n -> ldiff a (ones n) == 0
Proof.forall a n : t,
0 <= a -> log2 a < n -> ldiff a (ones n) == 0
 intros a n Ha H.a, n:t
Ha:0 <= a
H:log2 a < n
ldiff a (ones n) == 0 bitwise.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
a.[m] && negb (ones n).[m] = false destruct (le_gt_cases n m).a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
a.[m] && negb (ones n).[m] = false
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] && negb (ones n).[m] = false
 rewrite ones_spec_high, bits_above_log2; trivial.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
log2 a < m
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n <= m
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] && negb (ones n).[m] = false
 now apply lt_le_trans with n.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n <= m
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] && negb (ones n).[m] = false
 split; trivial.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] && negb (ones n).[m] = false now apply le_trans with (log2 a); order_pos.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
a.[m] && negb (ones n).[m] = false
 rewrite ones_spec_low, andb_false_r; try split; trivial.
Qed.

Lemma ldiff_ones_l_low : forall a n, 0<=a -> log2 a < n ->
 ldiff (ones n) a == lxor a (ones n).forall a n : t,
0 <= a ->
log2 a < n -> ldiff (ones n) a == lxor a (ones n)
Proof.forall a n : t,
0 <= a ->
log2 a < n -> ldiff (ones n) a == lxor a (ones n)
 intros a n Ha H.a, n:t
Ha:0 <= a
H:log2 a < n
ldiff (ones n) a == lxor a (ones n) bitwise.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
(ones n).[m] && negb a.[m] = xorb a.[m] (ones n).[m] destruct (le_gt_cases n m).a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
(ones n).[m] && negb a.[m] = xorb a.[m] (ones n).[m]
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
(ones n).[m] && negb a.[m] = xorb a.[m] (ones n).[m]
 rewrite ones_spec_high, bits_above_log2; trivial.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
log2 a < m
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n <= m
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
(ones n).[m] && negb a.[m] = xorb a.[m] (ones n).[m]
 now apply lt_le_trans with n.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n <= m
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
(ones n).[m] && negb a.[m] = xorb a.[m] (ones n).[m]
 split; trivial.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:n <= m
0 <= n
a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
(ones n).[m] && negb a.[m] = xorb a.[m] (ones n).[m] now apply le_trans with (log2 a); order_pos.a, n:t
Ha:0 <= a
H:log2 a < n
m:t
Hm:0 <= m
H0:m < n
(ones n).[m] && negb a.[m] = xorb a.[m] (ones n).[m]
 rewrite ones_spec_low, xorb_true_r; try split; trivial.
Qed.

Bitwise operations and sign

Lemma shiftl_nonneg : forall a n, 0 <= (a << n) <-> 0 <= a.forall a n : t, 0 <= a << n <-> 0 <= a
Proof.forall a n : t, 0 <= a << n <-> 0 <= a
 intros a n.a, n:t
0 <= a << n <-> 0 <= a
 destruct (le_ge_cases 0 n) as [Hn|Hn].a, n:t
Hn:0 <= n
0 <= a << n <-> 0 <= a
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 (* 0<=n *)
 rewrite 2 bits_iff_nonneg_ex.a, n:t
Hn:0 <= n
(exists k : t,
   forall m : t, k < m -> (a << n).[m] = false) <->
(exists k : t, forall m : t, k < m -> a.[m] = false)
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a split; intros (k,Hk).a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> (a << n).[m] = false
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 exists (k-n).a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> (a << n).[m] = false
forall m : t, k - n < m -> a.[m] = false
a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a intros m Hm.a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> (a << n).[m0] = false
m:t
Hm:k - n < m
a.[m] = false
a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 destruct (le_gt_cases 0 m); [|now rewrite testbit_neg_r].a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> (a << n).[m0] = false
m:t
Hm:k - n < m
H:0 <= m
a.[m] = false
a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 rewrite <- (add_simpl_r m n), <- (shiftl_spec a n) by order_pos.a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> (a << n).[m0] = false
m:t
Hm:k - n < m
H:0 <= m
(a << n).[m + n] = false
a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 apply Hk.a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> (a << n).[m0] = false
m:t
Hm:k - n < m
H:0 <= m
k < m + n
a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a now apply lt_sub_lt_add_r.a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 exists (k+n).a, n:t
Hn:0 <= n
k:t
Hk:forall m : t, k < m -> a.[m] = false
forall m : t, k + n < m -> (a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a intros m Hm.a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
(a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 destruct (le_gt_cases 0 m); [|now rewrite testbit_neg_r].a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
H:0 <= m
(a << n).[m] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 rewrite shiftl_spec by trivial.a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
H:0 <= m
a.[m - n] = false
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a apply Hk.a, n:t
Hn:0 <= n
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
H:0 <= m
k < m - n
a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a now apply lt_add_lt_sub_r.a, n:t
Hn:n <= 0
0 <= a << n <-> 0 <= a
 (* n<=0*)
 rewrite <- shiftr_opp_r, 2 bits_iff_nonneg_ex.a, n:t
Hn:n <= 0
(exists k : t,
   forall m : t, k < m -> (a >> (- n)).[m] = false) <->
(exists k : t, forall m : t, k < m -> a.[m] = false) split; intros (k,Hk).a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 destruct (le_gt_cases 0 k).a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:0 <= k
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 exists (k-n).a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:0 <= k
forall m : t, k - n < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false intros m Hm.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t,
k < m0 -> (a >> (- n)).[m0] = false
H:0 <= k
m:t
Hm:k - n < m
a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false apply lt_sub_lt_add_r in Hm.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t,
k < m0 -> (a >> (- n)).[m0] = false
H:0 <= k
m:t
Hm:k < m + n
a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 rewrite <- (add_simpl_r m n), <- add_opp_r, <- (shiftr_spec a (-n)).a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t,
k < m0 -> (a >> (- n)).[m0] = false
H:0 <= k
m:t
Hm:k < m + n
(a >> (- n)).[m + n] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t,
k < m0 -> (a >> (- n)).[m0] = false
H:0 <= k
m:t
Hm:k < m + n
0 <= m + n
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 now apply Hk.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t,
k < m0 -> (a >> (- n)).[m0] = false
H:0 <= k
m:t
Hm:k < m + n
0 <= m + n
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false order.a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 assert (EQ : a >> (-n) == 0).a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
a >> (- n) == 0
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
EQ:a >> (- n) == 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
  apply bits_inj'.a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
forall n0 : t, 0 <= n0 -> (a >> (- n)).[n0] = 0.[n0]
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
EQ:a >> (- n) == 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false intros m Hm.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t,
k < m0 -> (a >> (- n)).[m0] = false
H:k < 0
m:t
Hm:0 <= m
(a >> (- n)).[m] = 0.[m]
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
EQ:a >> (- n) == 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false rewrite bits_0.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t,
k < m0 -> (a >> (- n)).[m0] = false
H:k < 0
m:t
Hm:0 <= m
(a >> (- n)).[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
EQ:a >> (- n) == 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false apply Hk; order.a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
EQ:a >> (- n) == 0
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 apply shiftr_eq_0_iff in EQ.a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
EQ:a == 0 \/ 0 < a /\ log2 a < - n
exists k0 : t, forall m : t, k0 < m -> a.[m] = false
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 rewrite <- bits_iff_nonneg_ex.a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> (a >> (- n)).[m] = false
H:k < 0
EQ:a == 0 \/ 0 < a /\ log2 a < - n
0 <= a
a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false destruct EQ as [EQ|[LT _]]; order.a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (a >> (- n)).[m] = false
 exists (k+n).a, n:t
Hn:n <= 0
k:t
Hk:forall m : t, k < m -> a.[m] = false
forall m : t, k + n < m -> (a >> (- n)).[m] = false intros m Hm.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
(a >> (- n)).[m] = false
 destruct (le_gt_cases 0 m); [|now rewrite testbit_neg_r].a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
H:0 <= m
(a >> (- n)).[m] = false
 rewrite shiftr_spec by trivial.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
H:0 <= m
a.[m + - n] = false apply Hk.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
H:0 <= m
k < m + - n
 rewrite add_opp_r.a, n:t
Hn:n <= 0
k:t
Hk:forall m0 : t, k < m0 -> a.[m0] = false
m:t
Hm:k + n < m
H:0 <= m
k < m - n now apply lt_add_lt_sub_r.
Qed.

Lemma shiftl_neg : forall a n, (a << n) < 0 <-> a < 0.forall a n : t, a << n < 0 <-> a < 0
Proof.forall a n : t, a << n < 0 <-> a < 0
 intros a n.a, n:t
a << n < 0 <-> a < 0 now rewrite 2 lt_nge, shiftl_nonneg.
Qed.

Lemma shiftr_nonneg : forall a n, 0 <= (a >> n) <-> 0 <= a.forall a n : t, 0 <= a >> n <-> 0 <= a
Proof.forall a n : t, 0 <= a >> n <-> 0 <= a
 intros.a, n:t
0 <= a >> n <-> 0 <= a rewrite <- shiftl_opp_r.a, n:t
0 <= a << (- n) <-> 0 <= a apply shiftl_nonneg.
Qed.

Lemma shiftr_neg : forall a n, (a >> n) < 0 <-> a < 0.forall a n : t, a >> n < 0 <-> a < 0
Proof.forall a n : t, a >> n < 0 <-> a < 0
 intros a n.a, n:t
a >> n < 0 <-> a < 0 now rewrite 2 lt_nge, shiftr_nonneg.
Qed.

Lemma div2_nonneg : forall a, 0 <= div2 a <-> 0 <= a.forall a : t, 0 <= div2 a <-> 0 <= a
Proof.forall a : t, 0 <= div2 a <-> 0 <= a
 intros.a:t
0 <= div2 a <-> 0 <= a rewrite div2_spec.a:t
0 <= a >> 1 <-> 0 <= a apply shiftr_nonneg.
Qed.

Lemma div2_neg : forall a, div2 a < 0 <-> a < 0.forall a : t, div2 a < 0 <-> a < 0
Proof.forall a : t, div2 a < 0 <-> a < 0
 intros a.a:t
div2 a < 0 <-> a < 0 now rewrite 2 lt_nge, div2_nonneg.
Qed.

Lemma lor_nonneg : forall a b, 0 <= lor a b <-> 0<=a /\ 0<=b.forall a b : t, 0 <= lor a b <-> 0 <= a /\ 0 <= b
Proof.forall a b : t, 0 <= lor a b <-> 0 <= a /\ 0 <= b
 intros a b.a, b:t
0 <= lor a b <-> 0 <= a /\ 0 <= b
 rewrite 3 bits_iff_nonneg_ex.a, b:t
(exists k : t,
   forall m : t, k < m -> (lor a b).[m] = false) <->
(exists k : t, forall m : t, k < m -> a.[m] = false) /\
(exists k : t, forall m : t, k < m -> b.[m] = false) split.a, b:t
(exists k : t,
   forall m : t, k < m -> (lor a b).[m] = false) ->
(exists k : t, forall m : t, k < m -> a.[m] = false) /\
(exists k : t, forall m : t, k < m -> b.[m] = false)
a, b:t
(exists k : t, forall m : t, k < m -> a.[m] = false) /\
(exists k : t, forall m : t, k < m -> b.[m] = false) ->
exists k : t,
  forall m : t, k < m -> (lor a b).[m] = false intros (k,Hk).a, b, k:t
Hk:forall m : t, k < m -> (lor a b).[m] = false
(exists k0 : t, forall m : t, k0 < m -> a.[m] = false) /\
(exists k0 : t, forall m : t, k0 < m -> b.[m] = false)
a, b:t
(exists k : t, forall m : t, k < m -> a.[m] = false) /\
(exists k : t, forall m : t, k < m -> b.[m] = false) ->
exists k : t,
  forall m : t, k < m -> (lor a b).[m] = false
 split; exists k; intros m Hm; apply (orb_false_elim a.[m] b.[m]);
  rewrite <- lor_spec; now apply Hk.a, b:t
(exists k : t, forall m : t, k < m -> a.[m] = false) /\
(exists k : t, forall m : t, k < m -> b.[m] = false) ->
exists k : t,
  forall m : t, k < m -> (lor a b).[m] = false
 intros ((k,Hk),(k',Hk')).a, b, k:t
Hk:forall m : t, k < m -> a.[m] = false
k':t
Hk':forall m : t, k' < m -> b.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (lor a b).[m] = false
 destruct (le_ge_cases k k'); [ exists k' | exists k ];
  intros m Hm; rewrite lor_spec, Hk, Hk'; trivial; order.
Qed.

Lemma lor_neg : forall a b, lor a b < 0 <-> a < 0 \/ b < 0.forall a b : t, lor a b < 0 <-> a < 0 \/ b < 0
Proof.forall a b : t, lor a b < 0 <-> a < 0 \/ b < 0
 intros a b.a, b:t
lor a b < 0 <-> a < 0 \/ b < 0 rewrite 3 lt_nge, lor_nonneg.a, b:t
~ (0 <= a /\ 0 <= b) <-> ~ 0 <= a \/ ~ 0 <= b split.a, b:t
~ (0 <= a /\ 0 <= b) -> ~ 0 <= a \/ ~ 0 <= b
a, b:t
~ 0 <= a \/ ~ 0 <= b -> ~ (0 <= a /\ 0 <= b)
  apply not_and.a, b:t
decidable (0 <= a)
a, b:t
~ 0 <= a \/ ~ 0 <= b -> ~ (0 <= a /\ 0 <= b) apply le_decidable.a, b:t
~ 0 <= a \/ ~ 0 <= b -> ~ (0 <= a /\ 0 <= b)
  now intros [H|H] (H',H'').
Qed.

Lemma lnot_nonneg : forall a, 0 <= lnot a <-> a < 0.forall a : t, 0 <= lnot a <-> a < 0
Proof.forall a : t, 0 <= lnot a <-> a < 0
 intros a; unfold lnot.a:t
0 <= P (- a) <-> a < 0
 now rewrite <- opp_succ, opp_nonneg_nonpos, le_succ_l.
Qed.

Lemma lnot_neg : forall a, lnot a < 0 <-> 0 <= a.forall a : t, lnot a < 0 <-> 0 <= a
Proof.forall a : t, lnot a < 0 <-> 0 <= a
 intros a.a:t
lnot a < 0 <-> 0 <= a now rewrite le_ngt, lt_nge, lnot_nonneg.
Qed.

Lemma land_nonneg : forall a b, 0 <= land a b <-> 0<=a \/ 0<=b.forall a b : t, 0 <= land a b <-> 0 <= a \/ 0 <= b
Proof.forall a b : t, 0 <= land a b <-> 0 <= a \/ 0 <= b
 intros a b.a, b:t
0 <= land a b <-> 0 <= a \/ 0 <= b
 now rewrite <- (lnot_involutive (land a b)), lnot_land, lnot_nonneg,
  lor_neg, !lnot_neg.
Qed.

Lemma land_neg : forall a b, land a b < 0 <-> a < 0 /\ b < 0.forall a b : t, land a b < 0 <-> a < 0 /\ b < 0
Proof.forall a b : t, land a b < 0 <-> a < 0 /\ b < 0
 intros a b.a, b:t
land a b < 0 <-> a < 0 /\ b < 0
 now rewrite <- (lnot_involutive (land a b)), lnot_land, lnot_neg,
  lor_nonneg, !lnot_nonneg.
Qed.

Lemma ldiff_nonneg : forall a b, 0 <= ldiff a b <-> 0<=a \/ b<0.forall a b : t, 0 <= ldiff a b <-> 0 <= a \/ b < 0
Proof.forall a b : t, 0 <= ldiff a b <-> 0 <= a \/ b < 0
 intros.a, b:t
0 <= ldiff a b <-> 0 <= a \/ b < 0 now rewrite ldiff_land, land_nonneg, lnot_nonneg.
Qed.

Lemma ldiff_neg : forall a b, ldiff a b < 0 <-> a<0 /\ 0<=b.forall a b : t, ldiff a b < 0 <-> a < 0 <= b
Proof.forall a b : t, ldiff a b < 0 <-> a < 0 <= b
 intros.a, b:t
ldiff a b < 0 <-> a < 0 <= b now rewrite ldiff_land, land_neg, lnot_neg.
Qed.

Lemma lxor_nonneg : forall a b, 0 <= lxor a b <-> (0<=a <-> 0<=b).forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
Proof.forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
 assert (H : forall a b, 0<=a -> 0<=b -> 0<=lxor a b).forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
  intros a b.a, b:t
0 <= a -> 0 <= b -> 0 <= lxor a b
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b) rewrite 3 bits_iff_nonneg_ex.a, b:t
(exists k : t, forall m : t, k < m -> a.[m] = false) ->
(exists k : t, forall m : t, k < m -> b.[m] = false) ->
exists k : t,
  forall m : t, k < m -> (lxor a b).[m] = false
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b) intros (k,Hk) (k', Hk').a, b, k:t
Hk:forall m : t, k < m -> a.[m] = false
k':t
Hk':forall m : t, k' < m -> b.[m] = false
exists k0 : t,
  forall m : t, k0 < m -> (lxor a b).[m] = false
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
  destruct (le_ge_cases k k'); [ exists k' | exists k];
   intros m Hm; rewrite lxor_spec, Hk, Hk'; trivial; order.H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
 assert (H' : forall a b, 0<=a -> b<0 -> lxor a b<0).H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
forall a b : t, 0 <= a -> b < 0 -> lxor a b < 0
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
H':forall a b : t, 0 <= a -> b < 0 -> lxor a b < 0
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
  intros a b.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
a, b:t
0 <= a -> b < 0 -> lxor a b < 0
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
H':forall a b : t, 0 <= a -> b < 0 -> lxor a b < 0
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b) rewrite bits_iff_nonneg_ex, 2 bits_iff_neg_ex.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
a, b:t
(exists k : t, forall m : t, k < m -> a.[m] = false) ->
(exists k : t, forall m : t, k < m -> b.[m] = true) ->
exists k : t,
  forall m : t, k < m -> (lxor a b).[m] = true
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
H':forall a b : t, 0 <= a -> b < 0 -> lxor a b < 0
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
  intros (k,Hk) (k', Hk').H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
a, b, k:t
Hk:forall m : t, k < m -> a.[m] = false
k':t
Hk':forall m : t, k' < m -> b.[m] = true
exists k0 : t,
  forall m : t, k0 < m -> (lxor a b).[m] = true
H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
H':forall a b : t, 0 <= a -> b < 0 -> lxor a b < 0
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
  destruct (le_ge_cases k k'); [ exists k' | exists k];
   intros m Hm; rewrite lxor_spec, Hk, Hk'; trivial; order.H:forall a b : t, 0 <= a -> 0 <= b -> 0 <= lxor a b
H':forall a b : t, 0 <= a -> b < 0 -> lxor a b < 0
forall a b : t, 0 <= lxor a b <-> (0 <= a <-> 0 <= b)
 intros a b.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= lxor a b <-> (0 <= a <-> 0 <= b)
 split.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= lxor a b -> 0 <= a <-> 0 <= b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b
 intros Hab.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
0 <= a <-> 0 <= b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b split.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
0 <= a -> 0 <= b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
0 <= b -> 0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b
 intros Ha.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
Ha:0 <= a
0 <= b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
0 <= b -> 0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b destruct (le_gt_cases 0 b) as [Hb|Hb]; trivial.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
Ha:0 <= a
Hb:b < 0
0 <= b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
0 <= b -> 0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b
  generalize (H' _ _ Ha Hb).H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
Ha:0 <= a
Hb:b < 0
lxor a b < 0 -> 0 <= b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
0 <= b -> 0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b order.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
0 <= b -> 0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b
 intros Hb.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
Hb:0 <= b
0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b destruct (le_gt_cases 0 a) as [Ha|Ha]; trivial.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
Hb:0 <= b
Ha:a < 0
0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b
  generalize (H' _ _ Hb Ha).H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
Hb:0 <= b
Ha:a < 0
lxor b a < 0 -> 0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b rewrite lxor_comm.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
Hab:0 <= lxor a b
Hb:0 <= b
Ha:a < 0
lxor a b < 0 -> 0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b order.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
0 <= a <-> 0 <= b -> 0 <= lxor a b
 intros E.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
0 <= lxor a b
 destruct (le_gt_cases 0 a) as [Ha|Ha].H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:0 <= a
0 <= lxor a b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
0 <= lxor a b apply H; trivial.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:0 <= a
0 <= b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
0 <= lxor a b apply E; trivial.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
0 <= lxor a b
 destruct (le_gt_cases 0 b) as [Hb|Hb].H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
Hb:0 <= b
0 <= lxor a b
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
Hb:b < 0
0 <= lxor a b apply H; trivial.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
Hb:0 <= b
0 <= a
H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
Hb:b < 0
0 <= lxor a b apply E; trivial.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
Hb:b < 0
0 <= lxor a b
 rewrite <- lxor_lnot_lnot.H:forall a0 b0 : t,
0 <= a0 -> 0 <= b0 -> 0 <= lxor a0 b0
H':forall a0 b0 : t,
0 <= a0 -> b0 < 0 -> lxor a0 b0 < 0
a, b:t
E:0 <= a <-> 0 <= b
Ha:a < 0
Hb:b < 0
0 <= lxor (lnot a) (lnot b) apply H; now apply lnot_nonneg.
Qed.

Bitwise operations and log2

Lemma log2_bits_unique : forall a n,
 a.[n] = true ->
 (forall m, n<m -> a.[m] = false) ->
 log2 a == n.forall a n : t,
a.[n] = true ->
(forall m : t, n < m -> a.[m] = false) -> log2 a == n
Proof.forall a n : t,
a.[n] = true ->
(forall m : t, n < m -> a.[m] = false) -> log2 a == n
 intros a n H H'.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
log2 a == n
 destruct (lt_trichotomy a 0) as [Ha|[Ha|Ha]].a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 (* a < 0 *)
 destruct (proj1 (bits_iff_neg_ex a) Ha) as (k,Hk).a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 destruct (le_gt_cases n k).a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:n <= k
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 specialize (Hk (S k) (lt_succ_diag_r _)).a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:a.[S k] = true
H0:n <= k
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 rewrite H' in Hk.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:false = true
H0:n <= k
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:a.[S k] = true
H0:n <= k
n < S k
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n discriminate.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:a.[S k] = true
H0:n <= k
n < S k
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n apply lt_succ_r; order.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 specialize (H' (S n) (lt_succ_diag_r _)).a, n:t
H:a.[n] = true
H':a.[S n] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 rewrite Hk in H'.a, n:t
H:a.[n] = true
H':true = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
log2 a == n
a, n:t
H:a.[n] = true
H':a.[S n] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
k < S n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n discriminate.a, n:t
H:a.[n] = true
H':a.[S n] = false
Ha:a < 0
k:t
Hk:forall m : t, k < m -> a.[m] = true
H0:k < n
k < S n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n apply lt_succ_r; order.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:a == 0
log2 a == n
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 (* a = 0 *)
 now rewrite Ha, bits_0 in H.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
log2 a == n
 (* 0 < a *)
 apply le_antisymm; apply le_ngt; intros LT.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
LT:n < log2 a
False
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
LT:log2 a < n
False
 specialize (H' _ LT).a, n:t
H:a.[n] = true
H':a.[log2 a] = false
Ha:0 < a
LT:n < log2 a
False
a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
LT:log2 a < n
False now rewrite bit_log2 in H'.a, n:t
H:a.[n] = true
H':forall m : t, n < m -> a.[m] = false
Ha:0 < a
LT:log2 a < n
False
 now rewrite bits_above_log2 in H by order.
Qed.

Lemma log2_shiftr : forall a n, 0<a -> log2 (a >> n) == max 0 (log2 a - n).forall a n : t,
0 < a -> log2 (a >> n) == max 0 (log2 a - n)
Proof.forall a n : t,
0 < a -> log2 (a >> n) == max 0 (log2 a - n)
 intros a n Ha.a, n:t
Ha:0 < a
log2 (a >> n) == max 0 (log2 a - n)
 destruct (le_gt_cases 0 (log2 a - n));
   [rewrite max_r | rewrite max_l]; try order.a, n:t
Ha:0 < a
H:0 <= log2 a - n
log2 (a >> n) == log2 a - n
a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0
 apply log2_bits_unique.a, n:t
Ha:0 < a
H:0 <= log2 a - n
(a >> n).[log2 a - n] = true
a, n:t
Ha:0 < a
H:0 <= log2 a - n
forall m : t, log2 a - n < m -> (a >> n).[m] = false
a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0
 now rewrite shiftr_spec, sub_add, bit_log2.a, n:t
Ha:0 < a
H:0 <= log2 a - n
forall m : t, log2 a - n < m -> (a >> n).[m] = false
a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0
 intros m Hm.a, n:t
Ha:0 < a
H:0 <= log2 a - n
m:t
Hm:log2 a - n < m
(a >> n).[m] = false
a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0
 destruct (le_gt_cases 0 m); [|now rewrite testbit_neg_r].a, n:t
Ha:0 < a
H:0 <= log2 a - n
m:t
Hm:log2 a - n < m
H0:0 <= m
(a >> n).[m] = false
a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0
 rewrite shiftr_spec; trivial.a, n:t
Ha:0 < a
H:0 <= log2 a - n
m:t
Hm:log2 a - n < m
H0:0 <= m
a.[m + n] = false
a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0 apply bits_above_log2; try order.a, n:t
Ha:0 < a
H:0 <= log2 a - n
m:t
Hm:log2 a - n < m
H0:0 <= m
log2 a < m + n
a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0
 now apply lt_sub_lt_add_r.a, n:t
Ha:0 < a
H:log2 a - n < 0
log2 (a >> n) == 0
 rewrite lt_sub_lt_add_r, add_0_l in H.a, n:t
Ha:0 < a
H:log2 a < n
log2 (a >> n) == 0
 apply log2_nonpos.a, n:t
Ha:0 < a
H:log2 a < n
a >> n <= 0 apply le_lteq; right.a, n:t
Ha:0 < a
H:log2 a < n
a >> n == 0
 apply shiftr_eq_0_iff.a, n:t
Ha:0 < a
H:log2 a < n
a == 0 \/ 0 < a /\ log2 a < n right.a, n:t
Ha:0 < a
H:log2 a < n
0 < a /\ log2 a < n now split.
Qed.

Lemma log2_shiftl : forall a n, 0<a -> 0<=n -> log2 (a << n) == log2 a + n.forall a n : t,
0 < a -> 0 <= n -> log2 (a << n) == log2 a + n
Proof.forall a n : t,
0 < a -> 0 <= n -> log2 (a << n) == log2 a + n
 intros a n Ha Hn.a, n:t
Ha:0 < a
Hn:0 <= n
log2 (a << n) == log2 a + n
 rewrite shiftl_mul_pow2, add_comm by trivial.a, n:t
Ha:0 < a
Hn:0 <= n
log2 (a * 2 ^ n) == n + log2 a
 now apply log2_mul_pow2.
Qed.

Lemma log2_shiftl' : forall a n, 0<a -> log2 (a << n) == max 0 (log2 a + n).forall a n : t,
0 < a -> log2 (a << n) == max 0 (log2 a + n)
Proof.forall a n : t,
0 < a -> log2 (a << n) == max 0 (log2 a + n)
 intros a n Ha.a, n:t
Ha:0 < a
log2 (a << n) == max 0 (log2 a + n)
 rewrite <- shiftr_opp_r, log2_shiftr by trivial.a, n:t
Ha:0 < a
max 0 (log2 a - - n) == max 0 (log2 a + n)
 destruct (le_gt_cases 0 (log2 a + n));
   [rewrite 2 max_r | rewrite 2 max_l]; rewrite ?sub_opp_r; try order.
Qed.

Lemma log2_lor : forall a b, 0<=a -> 0<=b ->
 log2 (lor a b) == max (log2 a) (log2 b).forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
Proof.forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
 assert (AUX : forall a b, 0<=a -> a<=b -> log2 (lor a b) == log2 b).forall a b : t,
0 <= a -> a <= b -> log2 (lor a b) == log2 b
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
  intros a b Ha H.a, b:t
Ha:0 <= a
H:a <= b
log2 (lor a b) == log2 b
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
  le_elim Ha; [|now rewrite <- Ha, lor_0_l].a, b:t
Ha:0 < a
H:a <= b
log2 (lor a b) == log2 b
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
  apply log2_bits_unique.a, b:t
Ha:0 < a
H:a <= b
(lor a b).[log2 b] = true
a, b:t
Ha:0 < a
H:a <= b
forall m : t, log2 b < m -> (lor a b).[m] = false
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
  now rewrite lor_spec, bit_log2, orb_true_r by order.a, b:t
Ha:0 < a
H:a <= b
forall m : t, log2 b < m -> (lor a b).[m] = false
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
  intros m Hm.a, b:t
Ha:0 < a
H:a <= b
m:t
Hm:log2 b < m
(lor a b).[m] = false
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b) assert (H' := log2_le_mono _ _ H).a, b:t
Ha:0 < a
H:a <= b
m:t
Hm:log2 b < m
H':log2 a <= log2 b
(lor a b).[m] = false
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
  now rewrite lor_spec, 2 bits_above_log2 by order.AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lor a b) == log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lor a b) == max (log2 a) (log2 b)
 (* main *)
 intros a b Ha Hb.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
log2 (lor a b) == max (log2 a) (log2 b) destruct (le_ge_cases a b) as [H|H].AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:a <= b
log2 (lor a b) == max (log2 a) (log2 b)
AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lor a b) == max (log2 a) (log2 b)
 rewrite max_r by now apply log2_le_mono.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:a <= b
log2 (lor a b) == log2 b
AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lor a b) == max (log2 a) (log2 b)
 now apply AUX.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lor a b) == max (log2 a) (log2 b)
 rewrite max_l by now apply log2_le_mono.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lor a b) == log2 a
 rewrite lor_comm.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lor a0 b0) == log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lor b a) == log2 a now apply AUX.
Qed.

Lemma log2_land : forall a b, 0<=a -> 0<=b ->
 log2 (land a b) <= min (log2 a) (log2 b).forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
Proof.forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
 assert (AUX : forall a b, 0<=a -> a<=b -> log2 (land a b) <= log2 a).forall a b : t,
0 <= a -> a <= b -> log2 (land a b) <= log2 a
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
  intros a b Ha Hb.a, b:t
Ha:0 <= a
Hb:a <= b
log2 (land a b) <= log2 a
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
  apply le_ngt.a, b:t
Ha:0 <= a
Hb:a <= b
~ log2 a < log2 (land a b)
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b) intros LT.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 (land a b)
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
  assert (H : 0 <= land a b) by (apply land_nonneg; now left).a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 (land a b)
H:0 <= land a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
  le_elim H.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 (land a b)
H:0 < land a b
False
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 (land a b)
H:0 == land a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
  generalize (bit_log2 (land a b) H).a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 (land a b)
H:0 < land a b
(land a b).[log2 (land a b)] = true -> False
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 (land a b)
H:0 == land a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
  now rewrite land_spec, bits_above_log2.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 (land a b)
H:0 == land a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
  rewrite <- H in LT.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 a < log2 0
H:0 == land a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b) apply log2_lt_cancel in LT; order.AUX:forall a b : t, 0 <= a -> a <= b -> log2 (land a b) <= log2 a
forall a b : t,
0 <= a ->
0 <= b -> log2 (land a b) <= min (log2 a) (log2 b)
 (* main *)
 intros a b Ha Hb.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
log2 (land a b) <= min (log2 a) (log2 b)
 destruct (le_ge_cases a b) as [H|H].AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:a <= b
log2 (land a b) <= min (log2 a) (log2 b)
AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (land a b) <= min (log2 a) (log2 b)
 rewrite min_l by now apply log2_le_mono.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:a <= b
log2 (land a b) <= log2 a
AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (land a b) <= min (log2 a) (log2 b) now apply AUX.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (land a b) <= min (log2 a) (log2 b)
 rewrite min_r by now apply log2_le_mono.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (land a b) <= log2 b rewrite land_comm.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (land a0 b0) <= log2 a0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (land b a) <= log2 b now apply AUX.
Qed.

Lemma log2_lxor : forall a b, 0<=a -> 0<=b ->
 log2 (lxor a b) <= max (log2 a) (log2 b).forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
Proof.forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
 assert (AUX : forall a b, 0<=a -> a<=b -> log2 (lxor a b) <= log2 b).forall a b : t,
0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  intros a b Ha Hb.a, b:t
Ha:0 <= a
Hb:a <= b
log2 (lxor a b) <= log2 b
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  apply le_ngt.a, b:t
Ha:0 <= a
Hb:a <= b
~ log2 b < log2 (lxor a b)
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b) intros LT.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  assert (H : 0 <= lxor a b) by (apply lxor_nonneg; split; order).a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 <= lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  le_elim H.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 < lxor a b
False
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 == lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  generalize (bit_log2 (lxor a b) H).a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 < lxor a b
(lxor a b).[log2 (lxor a b)] = true -> False
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 == lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  rewrite lxor_spec, 2 bits_above_log2; try order.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 < lxor a b
xorb false false = true -> False
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 < lxor a b
log2 a < log2 (lxor a b)
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 == lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b) discriminate.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 < lxor a b
log2 a < log2 (lxor a b)
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 == lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  apply le_lt_trans with (log2 b); trivial.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 < lxor a b
log2 a <= log2 b
a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 == lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b) now apply log2_le_mono.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 (lxor a b)
H:0 == lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
  rewrite <- H in LT.a, b:t
Ha:0 <= a
Hb:a <= b
LT:log2 b < log2 0
H:0 == lxor a b
False
AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b) apply log2_lt_cancel in LT; order.AUX:forall a b : t, 0 <= a -> a <= b -> log2 (lxor a b) <= log2 b
forall a b : t,
0 <= a ->
0 <= b -> log2 (lxor a b) <= max (log2 a) (log2 b)
 (* main *)
 intros a b Ha Hb.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
log2 (lxor a b) <= max (log2 a) (log2 b)
 destruct (le_ge_cases a b) as [H|H].AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:a <= b
log2 (lxor a b) <= max (log2 a) (log2 b)
AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lxor a b) <= max (log2 a) (log2 b)
 rewrite max_r by now apply log2_le_mono.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:a <= b
log2 (lxor a b) <= log2 b
AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lxor a b) <= max (log2 a) (log2 b) now apply AUX.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lxor a b) <= max (log2 a) (log2 b)
 rewrite max_l by now apply log2_le_mono.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lxor a b) <= log2 a rewrite lxor_comm.AUX:forall a0 b0 : t, 0 <= a0 -> a0 <= b0 -> log2 (lxor a0 b0) <= log2 b0
a, b:t
Ha:0 <= a
Hb:0 <= b
H:b <= a
log2 (lxor b a) <= log2 a now apply AUX.
Qed.

Bitwise operations and arithmetical operations

Notation xor3 a b c := (xorb (xorb a b) c).
Notation lxor3 a b c := (lxor (lxor a b) c).
Notation nextcarry a b c := ((a&&b) || (c && (a||b))).
Notation lnextcarry a b c := (lor (land a b) (land c (lor a b))).

Lemma add_bit0 : forall a b, (a+b).[0] = xorb a.[0] b.[0].forall a b : t, (a + b).[0] = xorb a.[0] b.[0]
Proof.forall a b : t, (a + b).[0] = xorb a.[0] b.[0]
 intros.a, b:t
(a + b).[0] = xorb a.[0] b.[0] now rewrite !bit0_odd, odd_add.
Qed.

Lemma add3_bit0 : forall a b c,
 (a+b+c).[0] = xor3 a.[0] b.[0] c.[0].forall a b c : t,
(a + b + c).[0] = xor3 a.[0] b.[0] c.[0]
Proof.forall a b c : t,
(a + b + c).[0] = xor3 a.[0] b.[0] c.[0]
 intros.a, b, c:t
(a + b + c).[0] = xor3 a.[0] b.[0] c.[0] now rewrite !add_bit0.
Qed.

Lemma add3_bits_div2 : forall (a0 b0 c0 : bool),
 (a0 + b0 + c0)/2 == nextcarry a0 b0 c0.forall a0 b0 c0 : bool,
(a0 + b0 + c0) / 2 == nextcarry a0 b0 c0
Proof.forall a0 b0 c0 : bool,
(a0 + b0 + c0) / 2 == nextcarry a0 b0 c0
 assert (H : 1+1 == 2) by now nzsimpl'.H:1 + 1 == 2
forall a0 b0 c0 : bool,
(a0 + b0 + c0) / 2 == nextcarry a0 b0 c0
 intros [|] [|] [|]; simpl; rewrite ?add_0_l, ?add_0_r, ?H;
  (apply div_same; order') || (apply div_small; split; order') || idtac.H:1 + 1 == 2
(2 + 1) / 2 == 1
 symmetry.H:1 + 1 == 2
1 == (2 + 1) / 2 apply div_unique with 1.H:1 + 1 == 2
0 <= 1 < 2 \/ 2 < 1 <= 0
H:1 + 1 == 2
2 + 1 == 2 * 1 + 1 left; split; order'.H:1 + 1 == 2
2 + 1 == 2 * 1 + 1 now nzsimpl'.
Qed.

Lemma add_carry_div2 : forall a b (c0:bool),
 (a + b + c0)/2 == a/2 + b/2 + nextcarry a.[0] b.[0] c0.forall (a b : t) (c0 : bool),
(a + b + c0) / 2 ==
a / 2 + b / 2 + nextcarry a.[0] b.[0] c0
Proof.forall (a b : t) (c0 : bool),
(a + b + c0) / 2 ==
a / 2 + b / 2 + nextcarry a.[0] b.[0] c0
 intros.a, b:t
c0:bool
(a + b + c0) / 2 ==
a / 2 + b / 2 + nextcarry a.[0] b.[0] c0
 rewrite <- add3_bits_div2.a, b:t
c0:bool
(a + b + c0) / 2 ==
a / 2 + b / 2 + (a.[0] + b.[0] + c0) / 2
 rewrite (add_comm ((a/2)+_)).a, b:t
c0:bool
(a + b + c0) / 2 ==
(a.[0] + b.[0] + c0) / 2 + (a / 2 + b / 2)
 rewrite <- div_add by order'.a, b:t
c0:bool
(a + b + c0) / 2 ==
(a.[0] + b.[0] + c0 + (a / 2 + b / 2) * 2) / 2
 f_equiv.a, b:t
c0:bool
a + b + c0 == a.[0] + b.[0] + c0 + (a / 2 + b / 2) * 2
 rewrite <- !div2_div, mul_comm, mul_add_distr_l.a, b:t
c0:bool
a + b + c0 ==
a.[0] + b.[0] + c0 + (2 * div2 a + 2 * div2 b)
 rewrite (div2_odd a), <- bit0_odd at 1.a, b:t
c0:bool
2 * div2 a + a.[0] + b + c0 ==
a.[0] + b.[0] + c0 + (2 * div2 a + 2 * div2 b)
 rewrite (div2_odd b), <- bit0_odd at 1.a, b:t
c0:bool
2 * div2 a + a.[0] + (2 * div2 b + b.[0]) + c0 ==
a.[0] + b.[0] + c0 + (2 * div2 a + 2 * div2 b)
 rewrite add_shuffle1.a, b:t
c0:bool
2 * div2 a + 2 * div2 b + (a.[0] + b.[0]) + c0 ==
a.[0] + b.[0] + c0 + (2 * div2 a + 2 * div2 b)
 rewrite <-(add_assoc _ _ c0).a, b:t
c0:bool
2 * div2 a + 2 * div2 b + (a.[0] + b.[0] + c0) ==
a.[0] + b.[0] + c0 + (2 * div2 a + 2 * div2 b) apply add_comm.
Qed.

The main result concerning addition: we express the bits of the sum in term of bits of a and b and of some carry stream which is also recursively determined by another equation.

Lemma add_carry_bits_aux : forall n, 0<=n ->
 forall a b (c0:bool), -(2^n) <= a < 2^n -> -(2^n) <= b < 2^n ->
  exists c,
   a+b+c0 == lxor3 a b c /\ c/2 == lnextcarry a b c /\ c.[0] = c0.forall n : t,
0 <= n ->
forall (a b : t) (c0 : bool),
- 2 ^ n <= a < 2 ^ n ->
- 2 ^ n <= b < 2 ^ n ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
Proof.forall n : t,
0 <= n ->
forall (a b : t) (c0 : bool),
- 2 ^ n <= a < 2 ^ n ->
- 2 ^ n <= b < 2 ^ n ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 intros n Hn.n:t
Hn:0 <= n
forall (a b : t) (c0 : bool),
- 2 ^ n <= a < 2 ^ n ->
- 2 ^ n <= b < 2 ^ n ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 apply le_ind with (4:=Hn).n:t
Hn:0 <= n
Proper (eq ==> iff)
  (fun n0 : t =>
   forall (a b : t) (c0 : bool),
   - 2 ^ n0 <= a < 2 ^ n0 ->
   - 2 ^ n0 <= b < 2 ^ n0 ->
   exists c : t,
     a + b + c0 == lxor3 a b c /\
     c / 2 == lnextcarry a b c /\ c.[0] = c0)
n:t
Hn:0 <= n
forall (a b : t) (c0 : bool),
- 2 ^ 0 <= a < 2 ^ 0 ->
- 2 ^ 0 <= b < 2 ^ 0 ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 solve_proper.n:t
Hn:0 <= n
forall (a b : t) (c0 : bool),
- 2 ^ 0 <= a < 2 ^ 0 ->
- 2 ^ 0 <= b < 2 ^ 0 ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 (* base *)
 intros a b c0.n:t
Hn:0 <= n
a, b:t
c0:bool
- 2 ^ 0 <= a < 2 ^ 0 ->
- 2 ^ 0 <= b < 2 ^ 0 ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 rewrite !pow_0_r, !one_succ, !lt_succ_r, <- !one_succ.n:t
Hn:0 <= n
a, b:t
c0:bool
-1 <= a <= 0 ->
-1 <= b <= 0 ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 intros (Ha1,Ha2) (Hb1,Hb2).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 <= a
Ha2:a <= 0
Hb1:-1 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 le_elim Ha1; rewrite <- ?le_succ_l, ?succ_m1 in Ha1;
  le_elim Hb1; rewrite <- ?le_succ_l, ?succ_m1 in Hb1.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 (* base, a = 0, b = 0 *)
 exists c0.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
a + b + c0 == lxor3 a b c0 /\
c0 / 2 == lnextcarry a b c0 /\ c0.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite (le_antisymm _ _ Ha2 Ha1), (le_antisymm _ _ Hb2 Hb1).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
0 + 0 + c0 == lxor3 0 0 c0 /\
c0 / 2 == lnextcarry 0 0 c0 /\ c0.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite !add_0_l, !lxor_0_l, !lor_0_r, !land_0_r, !lor_0_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
c0 == c0 /\ c0 / 2 == 0 /\ c0.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite b2z_div2, b2z_bit0; now repeat split.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 (* base, a = 0, b = -1 *)
 exists (-c0).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
a + b + c0 == lxor3 a b (- c0) /\
- c0 / 2 == lnextcarry a b (- c0) /\ (- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 rewrite <- Hb1, (le_antisymm _ _ Ha2 Ha1).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
0 + -1 + c0 == lxor3 0 (-1) (- c0) /\
- c0 / 2 == lnextcarry 0 (-1) (- c0) /\
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 repeat split.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
0 + -1 + c0 == lxor3 0 (-1) (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 / 2 == lnextcarry 0 (-1) (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite add_0_l, lxor_0_l, lxor_m1_l.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
-1 + c0 == lnot (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 / 2 == lnextcarry 0 (-1) (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 unfold lnot.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
-1 + c0 == P (- - c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 / 2 == lnextcarry 0 (-1) (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 now rewrite opp_involutive, add_comm, add_opp_r, sub_1_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 / 2 == lnextcarry 0 (-1) (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite land_0_l, !lor_0_l, land_m1_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 / 2 == - c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 symmetry.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 == - c0 / 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 apply div_unique with c0.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
0 <= c0 < 2 \/ 2 < c0 <= 0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 == 2 * - c0 + c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 left; destruct c0; simpl; split; order'.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
- c0 == 2 * - c0 + c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
  now rewrite two_succ, mul_succ_l, mul_1_l, add_opp_r, sub_add.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:0 <= a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite bit0_odd, odd_opp; destruct c0; simpl; apply odd_1 || apply odd_0.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 (* base, a = -1, b = 0 *)
 exists (-c0).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
a + b + c0 == lxor3 a b (- c0) /\
- c0 / 2 == lnextcarry a b (- c0) /\ (- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 rewrite <- Ha1, (le_antisymm _ _ Hb2 Hb1).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
-1 + 0 + c0 == lxor3 (-1) 0 (- c0) /\
- c0 / 2 == lnextcarry (-1) 0 (- c0) /\
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 repeat split.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
-1 + 0 + c0 == lxor3 (-1) 0 (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 / 2 == lnextcarry (-1) 0 (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite add_0_r, lxor_0_r, lxor_m1_l.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
-1 + c0 == lnot (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 / 2 == lnextcarry (-1) 0 (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 unfold lnot.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
-1 + c0 == P (- - c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 / 2 == lnextcarry (-1) 0 (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 now rewrite opp_involutive, add_comm, add_opp_r, sub_1_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 / 2 == lnextcarry (-1) 0 (- c0)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite land_0_r, lor_0_r, lor_0_l, land_m1_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 / 2 == - c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 symmetry.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 == - c0 / 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 apply div_unique with c0.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
0 <= c0 < 2 \/ 2 < c0 <= 0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 == 2 * - c0 + c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 left; destruct c0; simpl; split; order'.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
- c0 == 2 * - c0 + c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
  now rewrite two_succ, mul_succ_l, mul_1_l, add_opp_r, sub_add.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:0 <= b
Hb2:b <= 0
(- c0).[0] = c0
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite bit0_odd, odd_opp; destruct c0; simpl; apply odd_1 || apply odd_0.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 (* base, a = -1, b = -1 *)
 exists (c0 + 2*(-1)).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
a + b + c0 == lxor3 a b (c0 + 2 * -1) /\
(c0 + 2 * -1) / 2 == lnextcarry a b (c0 + 2 * -1) /\
(c0 + 2 * -1).[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 rewrite <- Ha1, <- Hb1.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
-1 + -1 + c0 == lxor3 (-1) (-1) (c0 + 2 * -1) /\
(c0 + 2 * -1) / 2 ==
lnextcarry (-1) (-1) (c0 + 2 * -1) /\
(c0 + 2 * -1).[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 repeat split.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
-1 + -1 + c0 == lxor3 (-1) (-1) (c0 + 2 * -1)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1) / 2 ==
lnextcarry (-1) (-1) (c0 + 2 * -1)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1).[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite lxor_m1_l, lnot_m1, lxor_0_l.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
-1 + -1 + c0 == c0 + 2 * -1
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1) / 2 ==
lnextcarry (-1) (-1) (c0 + 2 * -1)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1).[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 now rewrite two_succ, mul_succ_l, mul_1_l, add_comm, add_assoc.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1) / 2 ==
lnextcarry (-1) (-1) (c0 + 2 * -1)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1).[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 rewrite land_m1_l, lor_m1_l.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1) / 2 == -1
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1).[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 apply add_b2z_double_div2.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha1:-1 == a
Ha2:a <= 0
Hb1:-1 == b
Hb2:b <= 0
(c0 + 2 * -1).[0] = c0
n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 apply add_b2z_double_bit0.n:t
Hn:0 <= n
forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 (* step *)
 clear n Hn.forall m : t,
0 <= m ->
(forall (a b : t) (c0 : bool),
 - 2 ^ m <= a < 2 ^ m ->
 - 2 ^ m <= b < 2 ^ m ->
 exists c : t,
   a + b + c0 == lxor3 a b c /\
   c / 2 == lnextcarry a b c /\ c.[0] = c0) ->
forall (a b : t) (c0 : bool),
- 2 ^ S m <= a < 2 ^ S m ->
- 2 ^ S m <= b < 2 ^ S m ->
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0 intros n Hn IH a b c0 Ha Hb.n:t
Hn:0 <= n
IH:forall (a0 b0 : t) (c1 : bool),
- 2 ^ n <= a0 < 2 ^ n ->
- 2 ^ n <= b0 < 2 ^ n ->
exists c : t,
  a0 + b0 + c1 == lxor3 a0 b0 c /\
  c / 2 == lnextcarry a0 b0 c /\ c.[0] = c1
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 set (c1:=nextcarry a.[0] b.[0] c0).n:t
Hn:0 <= n
IH:forall (a0 b0 : t) (c2 : bool),
- 2 ^ n <= a0 < 2 ^ n ->
- 2 ^ n <= b0 < 2 ^ n ->
exists c : t,
  a0 + b0 + c2 == lxor3 a0 b0 c /\
  c / 2 == lnextcarry a0 b0 c /\ c.[0] = c2
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 destruct (IH (a/2) (b/2) c1) as (c & IH1 & IH2 & Hc); clear IH.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= a / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0
 split.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= a / 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
a / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0
 apply div_le_lower_bound.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
0 < 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
2 * - 2 ^ n <= a
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
a / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 order'.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
2 * - 2 ^ n <= a
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
a / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 now rewrite mul_opp_r, <- pow_succ_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
a / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0
 apply div_lt_upper_bound.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
0 < 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
a < 2 * 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 order'.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
a < 2 * 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 now rewrite <- pow_succ_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0
 split.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
- 2 ^ n <= b / 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0
 apply div_le_lower_bound.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
0 < 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
2 * - 2 ^ n <= b
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 order'.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
2 * - 2 ^ n <= b
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 now rewrite mul_opp_r, <- pow_succ_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
b / 2 < 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0
 apply div_lt_upper_bound.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
0 < 2
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
b < 2 * 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 order'.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
b < 2 * 2 ^ n
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0 now rewrite <- pow_succ_r.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
exists c2 : t,
  a + b + c0 == lxor3 a b c2 /\
  c2 / 2 == lnextcarry a b c2 /\ c2.[0] = c0
 exists (c0 + 2*c).n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
a + b + c0 == lxor3 a b (c0 + 2 * c) /\
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c) /\
(c0 + 2 * c).[0] = c0 repeat split.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
a + b + c0 == lxor3 a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 (* step, add *)
 bitwise.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 le_elim Hm.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 < m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 rewrite <- (succ_pred m), lt_succ_r in Hm.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= P m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 rewrite <- (succ_pred m), <- !div2_bits, <- 2 lxor_spec by trivial.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= P m
((a + b + c0) / 2).[P m] =
(lxor3 (a / 2) (b / 2) ((c0 + 2 * c) / 2)).[P m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 f_equiv.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= P m
(a + b + c0) / 2 ==
lxor3 (a / 2) (b / 2) ((c0 + 2 * c) / 2)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 rewrite add_b2z_double_div2, <- IH1.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= P m
(a + b + c0) / 2 == a / 2 + b / 2 + c1
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0 apply add_carry_div2.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
(a + b + c0).[m] = xor3 a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 rewrite <- Hm.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
(a + b + c0).[0] = xor3 a.[0] b.[0] (c0 + 2 * c).[0]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 now rewrite add_b2z_double_bit0, add3_bit0, b2z_bit0.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c) / 2 == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 (* step, carry *)
 rewrite add_b2z_double_div2.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
c == lnextcarry a b (c0 + 2 * c)
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 bitwise.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 le_elim Hm.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 < m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 rewrite <- (succ_pred m), lt_succ_r in Hm.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= P m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 rewrite <- (succ_pred m), <- !div2_bits, IH2 by trivial.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= P m
(lnextcarry (a / 2) (b / 2) c).[P m] =
nextcarry (a / 2).[P m] (b / 2).[P m]
  ((c0 + 2 * c) / 2).[P m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 autorewrite with bitwise.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 <= P m
nextcarry (a / 2).[P m] (b / 2).[P m] c.[P m] =
nextcarry (a / 2).[P m] (b / 2).[P m]
  ((c0 + 2 * c) / 2).[P m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0 now rewrite add_b2z_double_div2.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
c.[m] = nextcarry a.[m] b.[m] (c0 + 2 * c).[m]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 rewrite <- Hm.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
m:t
Hm:0 == m
c.[0] = nextcarry a.[0] b.[0] (c0 + 2 * c).[0]
n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 now rewrite add_b2z_double_bit0.n:t
Hn:0 <= n
a, b:t
c0:bool
Ha:- 2 ^ S n <= a < 2 ^ S n
Hb:- 2 ^ S n <= b < 2 ^ S n
c1:=nextcarry a.[0] b.[0] c0:bool
c:t
IH1:a / 2 + b / 2 + c1 == lxor3 (a / 2) (b / 2) c
IH2:c / 2 == lnextcarry (a / 2) (b / 2) c
Hc:c.[0] = c1
(c0 + 2 * c).[0] = c0
 (* step, carry0 *)
 apply add_b2z_double_bit0.
Qed.

Lemma add_carry_bits : forall a b (c0:bool), exists c,
 a+b+c0 == lxor3 a b c /\ c/2 == lnextcarry a b c /\ c.[0] = c0.forall (a b : t) (c0 : bool),
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
Proof.forall (a b : t) (c0 : bool),
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 intros a b c0.a, b:t
c0:bool
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 set (n := max (abs a) (abs b)).a, b:t
c0:bool
n:=max (abs a) (abs b):t
exists c : t,
  a + b + c0 == lxor3 a b c /\
  c / 2 == lnextcarry a b c /\ c.[0] = c0
 apply (add_carry_bits_aux n).a, b:t
c0:bool
n:=max (abs a) (abs b):t
0 <= n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
 (* positivity *)
 unfold n.a, b:t
c0:bool
n:=max (abs a) (abs b):t
0 <= max (abs a) (abs b)
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
 destruct (le_ge_cases (abs a) (abs b));
  [rewrite max_r|rewrite max_l]; order_pos'.a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
 (* bound for a *)
 assert (Ha : abs a < 2^n).a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:abs a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
  apply lt_le_trans with (2^(abs a)).a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs a < 2 ^ abs a
a, b:t
c0:bool
n:=max (abs a) (abs b):t
2 ^ abs a <= 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:abs a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n apply pow_gt_lin_r; order_pos'.a, b:t
c0:bool
n:=max (abs a) (abs b):t
2 ^ abs a <= 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:abs a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
  apply pow_le_mono_r.a, b:t
c0:bool
n:=max (abs a) (abs b):t
0 < 2
a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs a <= n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:abs a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n order'.a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs a <= n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:abs a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n unfold n.a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs a <= max (abs a) (abs b)
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:abs a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
  destruct (le_ge_cases (abs a) (abs b));
   [rewrite max_r|rewrite max_l]; try order.a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:abs a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
 apply abs_lt in Ha.a, b:t
c0:bool
n:=max (abs a) (abs b):t
Ha:- 2 ^ n < a < 2 ^ n
- 2 ^ n <= a < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n destruct Ha; split; order.a, b:t
c0:bool
n:=max (abs a) (abs b):t
- 2 ^ n <= b < 2 ^ n
 (* bound for b *)
 assert (Hb : abs b < 2^n).a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs b < 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:abs b < 2 ^ n
- 2 ^ n <= b < 2 ^ n
  apply lt_le_trans with (2^(abs b)).a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs b < 2 ^ abs b
a, b:t
c0:bool
n:=max (abs a) (abs b):t
2 ^ abs b <= 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:abs b < 2 ^ n
- 2 ^ n <= b < 2 ^ n apply pow_gt_lin_r; order_pos'.a, b:t
c0:bool
n:=max (abs a) (abs b):t
2 ^ abs b <= 2 ^ n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:abs b < 2 ^ n
- 2 ^ n <= b < 2 ^ n
  apply pow_le_mono_r.a, b:t
c0:bool
n:=max (abs a) (abs b):t
0 < 2
a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs b <= n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:abs b < 2 ^ n
- 2 ^ n <= b < 2 ^ n order'.a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs b <= n
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:abs b < 2 ^ n
- 2 ^ n <= b < 2 ^ n unfold n.a, b:t
c0:bool
n:=max (abs a) (abs b):t
abs b <= max (abs a) (abs b)
a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:abs b < 2 ^ n
- 2 ^ n <= b < 2 ^ n
  destruct (le_ge_cases (abs a) (abs b));
   [rewrite max_r|rewrite max_l]; try order.a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:abs b < 2 ^ n
- 2 ^ n <= b < 2 ^ n
 apply abs_lt in Hb.a, b:t
c0:bool
n:=max (abs a) (abs b):t
Hb:- 2 ^ n < b < 2 ^ n
- 2 ^ n <= b < 2 ^ n destruct Hb; split; order.
Qed.

Particular case : the second bit of an addition

Lemma add_bit1 : forall a b,
 (a+b).[1] = xor3 a.[1] b.[1] (a.[0] && b.[0]).forall a b : t,
(a + b).[1] = xor3 a.[1] b.[1] (a.[0] && b.[0])
Proof.forall a b : t,
(a + b).[1] = xor3 a.[1] b.[1] (a.[0] && b.[0])
 intros a b.a, b:t
(a + b).[1] = xor3 a.[1] b.[1] (a.[0] && b.[0])
 destruct (add_carry_bits a b false) as (c & EQ1 & EQ2 & Hc).a, b, c:t
EQ1:a + b + false == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
(a + b).[1] = xor3 a.[1] b.[1] (a.[0] && b.[0])
 simpl in EQ1; rewrite add_0_r in EQ1.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
(a + b).[1] = xor3 a.[1] b.[1] (a.[0] && b.[0]) rewrite EQ1.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
(lxor3 a b c).[1] = xor3 a.[1] b.[1] (a.[0] && b.[0])
 autorewrite with bitwise.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
xor3 a.[1] b.[1] c.[1] =
xor3 a.[1] b.[1] (a.[0] && b.[0]) f_equal.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
c.[1] = a.[0] && b.[0]
 rewrite one_succ, <- div2_bits, EQ2 by order.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
(lnextcarry a b c).[0] = a.[0] && b.[0]
 autorewrite with bitwise.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
nextcarry a.[0] b.[0] c.[0] = a.[0] && b.[0]
 rewrite Hc.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
nextcarry a.[0] b.[0] false = a.[0] && b.[0] simpl.a, b, c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
a.[0] && b.[0] || false = a.[0] && b.[0] apply orb_false_r.
Qed.

In an addition, there will be no carries iff there is no common bits in the numbers to add

Lemma nocarry_equiv : forall a b c,
 c/2 == lnextcarry a b c -> c.[0] = false ->
 (c == 0 <-> land a b == 0).forall a b c : t,
c / 2 == lnextcarry a b c ->
c.[0] = false -> c == 0 <-> land a b == 0
Proof.forall a b c : t,
c / 2 == lnextcarry a b c ->
c.[0] = false -> c == 0 <-> land a b == 0
 intros a b c H H'.a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
c == 0 <-> land a b == 0
 split.a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
c == 0 -> land a b == 0
a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
land a b == 0 -> c == 0 intros EQ; rewrite EQ in *.a, b, c:t
H:0 / 2 == lnextcarry a b 0
H':0.[0] = false
EQ:c == 0
land a b == 0
a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
land a b == 0 -> c == 0
 rewrite div_0_l in H by order'.a, b, c:t
H:0 == lnextcarry a b 0
H':0.[0] = false
EQ:c == 0
land a b == 0
a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
land a b == 0 -> c == 0
 symmetry in H.a, b, c:t
H:lnextcarry a b 0 == 0
H':0.[0] = false
EQ:c == 0
land a b == 0
a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
land a b == 0 -> c == 0 now apply lor_eq_0_l in H.a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
land a b == 0 -> c == 0
 intros EQ.a, b, c:t
H:c / 2 == lnextcarry a b c
H':c.[0] = false
EQ:land a b == 0
c == 0 rewrite EQ, lor_0_l in H.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
c == 0
 apply bits_inj'.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
forall n : t, 0 <= n -> c.[n] = 0.[n] intros n Hn.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
c.[n] = 0.[n] rewrite bits_0.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
c.[n] = false
 apply le_ind with (4:=Hn).a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
Proper (eq ==> iff) (fun n0 : t => c.[n0] = false)
a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
c.[0] = false
a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
forall m : t,
0 <= m -> c.[m] = false -> c.[S m] = false
 solve_proper.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
c.[0] = false
a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
forall m : t,
0 <= m -> c.[m] = false -> c.[S m] = false
 trivial.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
forall m : t,
0 <= m -> c.[m] = false -> c.[S m] = false
 clear n Hn.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
forall m : t,
0 <= m -> c.[m] = false -> c.[S m] = false intros n Hn IH.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
IH:c.[n] = false
c.[S n] = false
 rewrite <- div2_bits, H; trivial.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
IH:c.[n] = false
(land c (lor a b)).[n] = false
 autorewrite with bitwise.a, b, c:t
H:c / 2 == land c (lor a b)
H':c.[0] = false
EQ:land a b == 0
n:t
Hn:0 <= n
IH:c.[n] = false
c.[n] && (a.[n] || b.[n]) = false
 now rewrite IH.
Qed.

When there is no common bits, the addition is just a xor

Lemma add_nocarry_lxor : forall a b, land a b == 0 ->
 a+b == lxor a b.forall a b : t, land a b == 0 -> a + b == lxor a b
Proof.forall a b : t, land a b == 0 -> a + b == lxor a b
 intros a b H.a, b:t
H:land a b == 0
a + b == lxor a b
 destruct (add_carry_bits a b false) as (c & EQ1 & EQ2 & Hc).a, b:t
H:land a b == 0
c:t
EQ1:a + b + false == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
a + b == lxor a b
 simpl in EQ1; rewrite add_0_r in EQ1.a, b:t
H:land a b == 0
c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
a + b == lxor a b rewrite EQ1.a, b:t
H:land a b == 0
c:t
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
lxor3 a b c == lxor a b
 apply (nocarry_equiv a b c) in H; trivial.a, b, c:t
H:c == 0
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
lxor3 a b c == lxor a b
 rewrite H.a, b, c:t
H:c == 0
EQ1:a + b == lxor3 a b c
EQ2:c / 2 == lnextcarry a b c
Hc:c.[0] = false
lxor3 a b 0 == lxor a b now rewrite lxor_0_r.
Qed.

A null ldiff implies being smaller

Lemma ldiff_le : forall a b, 0<=b -> ldiff a b == 0 -> 0 <= a <= b.forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
Proof.forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 assert (AUX : forall n, 0<=n ->
          forall a b, 0 <= a < 2^n -> 0<=b -> ldiff a b == 0 -> a <= b).forall n : t,
0 <= n ->
forall a b : t,
0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 intros n Hn.n:t
Hn:0 <= n
forall a b : t,
0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b apply le_ind with (4:=Hn); clear n Hn.Proper (eq ==> iff)
  (fun n : t =>
   forall a b : t,
   0 <= a < 2 ^ n ->
   0 <= b -> ldiff a b == 0 -> a <= b)
forall a b : t,
0 <= a < 2 ^ 0 -> 0 <= b -> ldiff a b == 0 -> a <= b
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> 0 <= b -> ldiff a b == 0 -> a <= b) ->
forall a b : t,
0 <= a < 2 ^ S m -> 0 <= b -> ldiff a b == 0 -> a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 solve_proper.forall a b : t,
0 <= a < 2 ^ 0 -> 0 <= b -> ldiff a b == 0 -> a <= b
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> 0 <= b -> ldiff a b == 0 -> a <= b) ->
forall a b : t,
0 <= a < 2 ^ S m -> 0 <= b -> ldiff a b == 0 -> a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 intros a b Ha Hb _.a, b:t
Ha:0 <= a < 2 ^ 0
Hb:0 <= b
a <= b
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> 0 <= b -> ldiff a b == 0 -> a <= b) ->
forall a b : t,
0 <= a < 2 ^ S m -> 0 <= b -> ldiff a b == 0 -> a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b rewrite pow_0_r, one_succ, lt_succ_r in Ha.a, b:t
Ha:0 <= a <= 0
Hb:0 <= b
a <= b
forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> 0 <= b -> ldiff a b == 0 -> a <= b) ->
forall a b : t,
0 <= a < 2 ^ S m -> 0 <= b -> ldiff a b == 0 -> a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 setoid_replace a with 0 by (destruct Ha; order'); trivial.forall m : t,
0 <= m ->
(forall a b : t,
 0 <= a < 2 ^ m -> 0 <= b -> ldiff a b == 0 -> a <= b) ->
forall a b : t,
0 <= a < 2 ^ S m -> 0 <= b -> ldiff a b == 0 -> a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 intros n Hn IH a b (Ha,Ha') Hb H.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 assert (NEQ : 2 ~= 0) by order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a <= b
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 rewrite (div_mod a 2 NEQ), (div_mod b 2 NEQ).n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
2 * (a / 2) + a mod 2 <= 2 * (b / 2) + b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 apply add_le_mono.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
2 * (a / 2) <= 2 * (b / 2)
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 apply mul_le_mono_pos_l; try order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a / 2 <= b / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 apply IH.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
0 <= a / 2 < 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
0 <= b / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
ldiff (a / 2) (b / 2) == 0
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 split.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
0 <= a / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a / 2 < 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
0 <= b / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
ldiff (a / 2) (b / 2) == 0
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b apply div_pos; order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a / 2 < 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
0 <= b / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
ldiff (a / 2) (b / 2) == 0
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 apply div_lt_upper_bound; try order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a < 2 * 2 ^ n
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
0 <= b / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
ldiff (a / 2) (b / 2) == 0
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b now rewrite <- pow_succ_r.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
0 <= b / 2
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
ldiff (a / 2) (b / 2) == 0
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 apply div_pos; order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
ldiff (a / 2) (b / 2) == 0
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 rewrite <- (pow_1_r 2), <- 2 shiftr_div_pow2 by order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
ldiff (a >> 1) (b >> 1) == 0
n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 rewrite <- shiftr_ldiff, H, shiftr_div_pow2, pow_1_r, div_0_l; order'.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a mod 2 <= b mod 2
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 rewrite <- 2 bit0_mod.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:ldiff a b == 0
NEQ:2 ~= 0
a.[0] <= b.[0]
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 apply bits_inj_iff in H.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:testbit (ldiff a b) === testbit 0
NEQ:2 ~= 0
a.[0] <= b.[0]
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b specialize (H 0).n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:(ldiff a b).[0] = 0.[0]
NEQ:2 ~= 0
a.[0] <= b.[0]
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 rewrite ldiff_spec, bits_0 in H.n:t
Hn:0 <= n
IH:forall a0 b0 : t,
0 <= a0 < 2 ^ n ->
0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Ha:0 <= a
Ha':a < 2 ^ S n
Hb:0 <= b
H:a.[0] && negb b.[0] = false
NEQ:2 ~= 0
a.[0] <= b.[0]
AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 destruct a.[0], b.[0]; try discriminate; simpl; order'.AUX:forall n : t,
0 <= n ->
forall a b : t, 0 <= a < 2 ^ n -> 0 <= b -> ldiff a b == 0 -> a <= b
forall a b : t,
0 <= b -> ldiff a b == 0 -> 0 <= a <= b
 (* main *)
 intros a b Hb Hd.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
0 <= a <= b
 assert (Ha : 0<=a).AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
0 <= a
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
0 <= a <= b
  apply le_ngt; intros Ha'.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha':a < 0
False
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
0 <= a <= b apply (lt_irrefl 0).AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha':a < 0
0 < 0
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
0 <= a <= b rewrite <- Hd at 1.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha':a < 0
ldiff a b < 0
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
0 <= a <= b
  apply ldiff_neg.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha':a < 0
a < 0 <= b
AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
0 <= a <= b now split.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
0 <= a <= b
 split; trivial.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
a <= b apply (AUX a); try split; trivial.AUX:forall n : t,
0 <= n ->
forall a0 b0 : t, 0 <= a0 < 2 ^ n -> 0 <= b0 -> ldiff a0 b0 == 0 -> a0 <= b0
a, b:t
Hb:0 <= b
Hd:ldiff a b == 0
Ha:0 <= a
a < 2 ^ a apply pow_gt_lin_r; order'.
Qed.

Subtraction can be a ldiff when the opposite ldiff is null.

Lemma sub_nocarry_ldiff : forall a b, ldiff b a == 0 ->
 a-b == ldiff a b.forall a b : t, ldiff b a == 0 -> a - b == ldiff a b
Proof.forall a b : t, ldiff b a == 0 -> a - b == ldiff a b
 intros a b H.a, b:t
H:ldiff b a == 0
a - b == ldiff a b
 apply add_cancel_r with b.a, b:t
H:ldiff b a == 0
a - b + b == ldiff a b + b
 rewrite sub_add.a, b:t
H:ldiff b a == 0
a == ldiff a b + b
 symmetry.a, b:t
H:ldiff b a == 0
ldiff a b + b == a
 rewrite add_nocarry_lxor; trivial.a, b:t
H:ldiff b a == 0
lxor (ldiff a b) b == a
a, b:t
H:ldiff b a == 0
land (ldiff a b) b == 0
 bitwise.a, b:t
H:ldiff b a == 0
m:t
Hm:0 <= m
xorb (a.[m] && negb b.[m]) b.[m] = a.[m]
a, b:t
H:ldiff b a == 0
land (ldiff a b) b == 0
 apply bits_inj_iff in H.a, b:t
H:testbit (ldiff b a) === testbit 0
m:t
Hm:0 <= m
xorb (a.[m] && negb b.[m]) b.[m] = a.[m]
a, b:t
H:ldiff b a == 0
land (ldiff a b) b == 0 specialize (H m).a, b, m:t
H:(ldiff b a).[m] = 0.[m]
Hm:0 <= m
xorb (a.[m] && negb b.[m]) b.[m] = a.[m]
a, b:t
H:ldiff b a == 0
land (ldiff a b) b == 0
 rewrite ldiff_spec, bits_0 in H.a, b, m:t
H:b.[m] && negb a.[m] = false
Hm:0 <= m
xorb (a.[m] && negb b.[m]) b.[m] = a.[m]
a, b:t
H:ldiff b a == 0
land (ldiff a b) b == 0
 now destruct a.[m], b.[m].a, b:t
H:ldiff b a == 0
land (ldiff a b) b == 0
 apply land_ldiff.
Qed.

Adding numbers with no common bits cannot lead to a much bigger number

Lemma add_nocarry_lt_pow2 : forall a b n, land a b == 0 ->
 a < 2^n -> b < 2^n -> a+b < 2^n.forall a b n : t,
land a b == 0 ->
a < 2 ^ n -> b < 2 ^ n -> a + b < 2 ^ n
Proof.forall a b n : t,
land a b == 0 ->
a < 2 ^ n -> b < 2 ^ n -> a + b < 2 ^ n
 intros a b n H Ha Hb.a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
a + b < 2 ^ n
 destruct (le_gt_cases a 0) as [Ha'|Ha'].a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':a <= 0
a + b < 2 ^ n
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
a + b < 2 ^ n
 apply le_lt_trans with (0+b).a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':a <= 0
a + b <= 0 + b
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':a <= 0
0 + b < 2 ^ n
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
a + b < 2 ^ n now apply add_le_mono_r.a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':a <= 0
0 + b < 2 ^ n
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
a + b < 2 ^ n now nzsimpl.a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
a + b < 2 ^ n
 destruct (le_gt_cases b 0) as [Hb'|Hb'].a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':b <= 0
a + b < 2 ^ n
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
a + b < 2 ^ n
 apply le_lt_trans with (a+0).a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':b <= 0
a + b <= a + 0
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':b <= 0
a + 0 < 2 ^ n
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
a + b < 2 ^ n now apply add_le_mono_l.a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':b <= 0
a + 0 < 2 ^ n
a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
a + b < 2 ^ n now nzsimpl.a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
a + b < 2 ^ n
 rewrite add_nocarry_lxor by order.a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
lxor a b < 2 ^ n
 destruct (lt_ge_cases 0 (lxor a b)); [|apply le_lt_trans with 0; order_pos].a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
H0:0 < lxor a b
lxor a b < 2 ^ n
 apply log2_lt_pow2; trivial.a, b, n:t
H:land a b == 0
Ha:a < 2 ^ n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
H0:0 < lxor a b
log2 (lxor a b) < n
 apply log2_lt_pow2 in Ha; trivial.a, b, n:t
H:land a b == 0
Ha:log2 a < n
Hb:b < 2 ^ n
Ha':0 < a
Hb':0 < b
H0:0 < lxor a b
log2 (lxor a b) < n
 apply log2_lt_pow2 in Hb; trivial.a, b, n:t
H:land a b == 0
Ha:log2 a < n
Hb:log2 b < n
Ha':0 < a
Hb':0 < b
H0:0 < lxor a b
log2 (lxor a b) < n
 apply le_lt_trans with (max (log2 a) (log2 b)).a, b, n:t
H:land a b == 0
Ha:log2 a < n
Hb:log2 b < n
Ha':0 < a
Hb':0 < b
H0:0 < lxor a b
log2 (lxor a b) <= max (log2 a) (log2 b)
a, b, n:t
H:land a b == 0
Ha:log2 a < n
Hb:log2 b < n
Ha':0 < a
Hb':0 < b
H0:0 < lxor a b
max (log2 a) (log2 b) < n
 apply log2_lxor; order.a, b, n:t
H:land a b == 0
Ha:log2 a < n
Hb:log2 b < n
Ha':0 < a
Hb':0 < b
H0:0 < lxor a b
max (log2 a) (log2 b) < n
 destruct (le_ge_cases (log2 a) (log2 b));
  [rewrite max_r|rewrite max_l]; order.
Qed.

Lemma add_nocarry_mod_lt_pow2 : forall a b n, 0<=n -> land a b == 0 ->
 a mod 2^n + b mod 2^n < 2^n.forall a b n : t,
0 <= n ->
land a b == 0 -> a mod 2 ^ n + b mod 2 ^ n < 2 ^ n
Proof.forall a b n : t,
0 <= n ->
land a b == 0 -> a mod 2 ^ n + b mod 2 ^ n < 2 ^ n
 intros a b n Hn H.a, b, n:t
Hn:0 <= n
H:land a b == 0
a mod 2 ^ n + b mod 2 ^ n < 2 ^ n
 apply add_nocarry_lt_pow2.a, b, n:t
Hn:0 <= n
H:land a b == 0
land (a mod 2 ^ n) (b mod 2 ^ n) == 0
a, b, n:t
Hn:0 <= n
H:land a b == 0
a mod 2 ^ n < 2 ^ n
a, b, n:t
Hn:0 <= n
H:land a b == 0
b mod 2 ^ n < 2 ^ n
 bitwise.a, b, n:t
Hn:0 <= n
H:land a b == 0
m:t
Hm:0 <= m
(a mod 2 ^ n).[m] && (b mod 2 ^ n).[m] = false
a, b, n:t
Hn:0 <= n
H:land a b == 0
a mod 2 ^ n < 2 ^ n
a, b, n:t
Hn:0 <= n
H:land a b == 0
b mod 2 ^ n < 2 ^ n
 destruct (le_gt_cases n m).a, b, n:t
Hn:0 <= n
H:land a b == 0
m:t
Hm:0 <= m
H0:n <= m
(a mod 2 ^ n).[m] && (b mod 2 ^ n).[m] = false
a, b, n:t
Hn:0 <= n
H:land a b == 0
m:t
Hm:0 <= m
H0:m < n
(a mod 2 ^ n).[m] && (b mod 2 ^ n).[m] = false
a, b, n:t
Hn:0 <= n
H:land a b == 0
a mod 2 ^ n < 2 ^ n
a, b, n:t
Hn:0 <= n
H:land a b == 0
b mod 2 ^ n < 2 ^ n
 rewrite mod_pow2_bits_high; now split.a, b, n:t
Hn:0 <= n
H:land a b == 0
m:t
Hm:0 <= m
H0:m < n
(a mod 2 ^ n).[m] && (b mod 2 ^ n).[m] = false
a, b, n:t
Hn:0 <= n
H:land a b == 0
a mod 2 ^ n < 2 ^ n
a, b, n:t
Hn:0 <= n
H:land a b == 0
b mod 2 ^ n < 2 ^ n
 now rewrite !mod_pow2_bits_low, <- land_spec, H, bits_0.a, b, n:t
Hn:0 <= n
H:land a b == 0
a mod 2 ^ n < 2 ^ n
a, b, n:t
Hn:0 <= n
H:land a b == 0
b mod 2 ^ n < 2 ^ n
 apply mod_pos_bound; order_pos.a, b, n:t
Hn:0 <= n
H:land a b == 0
b mod 2 ^ n < 2 ^ n
 apply mod_pos_bound; order_pos.
Qed.

End ZBitsProp.