source: src/ASM/Util.ma @ 1071

include "basics/list.ma".
include "basics/types.ma".
include "arithmetics/nat.ma".

include "ASM/JMCoercions.ma".

(* let's implement a daemon not used by automation *)
inductive DAEMONXXX: Type[0] ≝ K1DAEMONXXX: DAEMONXXX | K2DAEMONXXX: DAEMONXXX.
axiom IMPOSSIBLE: K1DAEMONXXX = K2DAEMONXXX.
example daemon: False. generalize in match IMPOSSIBLE; #IMPOSSIBLE destruct(IMPOSSIBLE) qed.
example not_implemented: False. cases daemon qed.

notation > "hvbox('let' 〈ident x,ident y〉 ≝ t 'in' s)"
 with precedence 10
for @{ match $t with [ pair ${ident x} ${ident y} ⇒ $s ] }.

definition ltb ≝
  λm, n: nat.
    leb (S m) n.
    
definition geb ≝
  λm, n: nat.
    ltb n m.

definition gtb ≝
  λm, n: nat.
    leb n m.

(* dpm: unless I'm being stupid, this isn't defined in the stdlib? *)
let rec eq_nat (n: nat) (m: nat) on n: bool ≝
  match n with
  [ O ⇒ match m with [ O ⇒ true | _ ⇒ false ]
  | S n' ⇒ match m with [ S m' ⇒ eq_nat n' m' | _ ⇒ false ]
  ].
  
let rec fold_left2
  (A: Type[0]) (B: Type[0]) (C: Type[0]) (f: A → B → C → A) (accu: A)
  (left: list B) (right: list C) (proof: |left| = |right|)
    on left: A ≝
  match left return λx. |x| = |right| → A with
  [ nil ⇒ λnil_prf.
    match right return λx. |[ ]| = |x| → A with
    [ nil ⇒ λnil_nil_prf. accu
    | cons hd tl ⇒ λcons_nil_absrd. ?
    ] nil_prf
  | cons hd tl ⇒ λcons_prf.
    match right return λx. |hd::tl| = |x| → A with
    [ nil ⇒ λcons_nil_absrd. ?
    | cons hd' tl' ⇒ λcons_cons_prf.
        fold_left2 …  f (f accu hd hd') tl tl' ?
    ] cons_prf
  ] proof.
  [ 1: normalize in cons_nil_absrd;
       destruct(cons_nil_absrd)
  | 2: normalize in cons_nil_absrd;
       destruct(cons_nil_absrd)
  | 3: normalize in cons_cons_prf;
       @injective_S
       assumption
  ]
qed.

let rec remove_n_first_internal
  (i: nat) (A: Type[0]) (l: list A) (n: nat)
    on l ≝
  match l with
  [ nil ⇒ [ ]
  | cons hd tl ⇒
    match eq_nat i n with
    [ true ⇒ l
    | _ ⇒ remove_n_first_internal (S i) A tl n
    ]
  ].

definition remove_n_first ≝
  λA: Type[0].
  λn: nat.
  λl: list A.
    remove_n_first_internal 0 A l n.
    
let rec foldi_from_until_internal
  (A: Type[0]) (i: nat) (res: ?) (rem: list A) (m: nat) (f: nat → list A → A → list A)
    on rem ≝
  match rem with
  [ nil ⇒ res
  | cons e tl ⇒
    match geb i m with
    [ true ⇒ res
    | _ ⇒ foldi_from_until_internal A (S i) (f i res e) tl m f
    ]
  ].

definition foldi_from_until ≝
  λA: Type[0].
  λn: nat.
  λm: nat.
  λf: ?.
  λa: ?.
  λl: ?.
    foldi_from_until_internal A 0 a (remove_n_first A n l) m f.

definition foldi_from ≝
  λA: Type[0].
  λn.
  λf.
  λa.
  λl.
    foldi_from_until A n (|l|) f a l.

definition foldi_until ≝
  λA: Type[0].
  λm.
  λf.
  λa.
  λl.
    foldi_from_until A 0 m f a l.

definition foldi ≝
  λA: Type[0].
  λf.
  λa.
  λl.
    foldi_from_until A 0 (|l|) f a l.

definition hd_safe ≝
  λA: Type[0].
  λl: list A.
  λproof: 0 < |l|.
  match l return λx. 0 < |x| → A with
  [ nil ⇒ λnil_absrd. ?
  | cons hd tl ⇒ λcons_prf. hd
  ] proof.
  normalize in nil_absrd;
  cases(not_le_Sn_O 0)
  #HYP
  cases(HYP nil_absrd)
qed.

definition tail_safe ≝
  λA: Type[0].
  λl: list A.
  λproof: 0 < |l|.
  match l return λx. 0 < |x| → list A with
  [ nil ⇒ λnil_absrd. ?
  | cons hd tl ⇒ λcons_prf. tl
  ] proof.
  normalize in nil_absrd;
  cases(not_le_Sn_O 0)
  #HYP
  cases(HYP nil_absrd)
qed.

let rec split
  (A: Type[0]) (l: list A) (index: nat) (proof: index < |l|)
    on index ≝
  match index return λx. x < |l| → (list A) × (list A) with
  [ O ⇒ λzero_prf. 〈[], l〉
  | S index' ⇒ λsucc_prf.
    match l return λx. S index' < |x| → (list A) × (list A) with
    [ nil ⇒ λnil_absrd. ?
    | cons hd tl ⇒ λcons_prf.
      let 〈l1, l2〉 ≝ split A tl index' ? in
        〈hd :: l1, l2〉
    ] succ_prf
  ] proof.
  [1: normalize in nil_absrd;
      cases(not_le_Sn_O (S index'))
      #HYP
      cases(HYP nil_absrd)
  |2: normalize in cons_prf;
      normalize
      @le_S_S_to_le
      assumption
  ]
qed.

let rec nth_safe
  (elt_type: Type[0]) (index: nat) (the_list: list elt_type)
  (proof: index < | the_list |)
    on index ≝
  match index return λs. s < | the_list | → elt_type with
  [ O ⇒
    match the_list return λt. 0 < | t | → elt_type with
    [ nil        ⇒ λnil_absurd. ?
    | cons hd tl ⇒ λcons_proof. hd
    ]
  | S index' ⇒
    match the_list return λt. S index' < | t | → elt_type with
    [ nil ⇒ λnil_absurd. ?
    | cons hd tl ⇒
      λcons_proof. nth_safe elt_type index' tl ?
    ]
  ] proof.
  [ normalize in nil_absurd;
    cases (not_le_Sn_O 0)
    #ABSURD
    elim (ABSURD nil_absurd)
  | normalize in nil_absurd;
    cases (not_le_Sn_O (S index'))
    #ABSURD
    elim (ABSURD nil_absurd)
  | normalize in cons_proof
    @le_S_S_to_le
    assumption
  ]
qed.

definition last_safe ≝
  λelt_type: Type[0].
  λthe_list: list elt_type.
  λproof   : 0 < | the_list |.
    nth_safe elt_type (|the_list| - 1) the_list ?.
  normalize /2/
qed.

let rec reduce 
  (A: Type[0]) (B: Type[0]) (left: list A) (right: list B) on left ≝
  match left with
  [ nil ⇒ 〈〈[ ], [ ]〉, 〈[ ], right〉〉
  | cons hd tl ⇒
    match right with
    [ nil ⇒ 〈〈[ ], left〉, 〈[ ], [ ]〉〉
    | cons hd' tl' ⇒
      let 〈cleft, cright〉 ≝ reduce A B tl tl' in
      let 〈commonl, restl〉 ≝ cleft in
      let 〈commonr, restr〉 ≝ cright in
        〈〈hd :: commonl, restl〉, 〈hd' :: commonr, restr〉〉
    ]
  ].

(*
axiom reduce_strong:
  ∀A: Type[0].
  ∀left: list A.
  ∀right: list A.
    Σret: ((list A) × (list A)) × ((list A) × (list A)). | \fst (\fst ret) | = | \fst (\snd ret) |.
*)

let rec reduce_strong
  (A: Type[0]) (B: Type[0]) (left: list A) (right: list B)
    on left : Σret: ((list A) × (list A)) × ((list B) × (list B)). |\fst (\fst ret)| = |\fst (\snd ret)|  ≝
  match left with
  [ nil ⇒ 〈〈[ ], [ ]〉, 〈[ ], right〉〉
  | cons hd tl ⇒
    match right with
    [ nil ⇒ 〈〈[ ], left〉, 〈[ ], [ ]〉〉
    | cons hd' tl' ⇒
      let 〈cleft, cright〉 ≝ reduce_strong A B tl tl' in
      let 〈commonl, restl〉 ≝ cleft in
      let 〈commonr, restr〉 ≝ cright in
        〈〈hd :: commonl, restl〉, 〈hd' :: commonr, restr〉〉
    ]
  ].
  [ 1: normalize %
  | 2: normalize %
  | 3: normalize
       generalize in match (sig2 … (reduce_strong A B tl tl1));
       >p2 >p3 >p4 normalize in ⊢ (% → ?)
       #HYP //
  ]
qed. 
    
let rec map2_opt
  (A: Type[0]) (B: Type[0]) (C: Type[0]) (f: A → B → C)
  (left: list A) (right: list B) on left ≝
  match left with
  [ nil ⇒
    match right with
    [ nil ⇒ Some ? (nil C)
    | _ ⇒ None ?
    ]
  | cons hd tl ⇒
    match right with
    [ nil ⇒ None ?
    | cons hd' tl' ⇒
      match map2_opt A B C f tl tl' with
      [ None ⇒ None ?
      | Some tail ⇒ Some ? (f hd hd' :: tail)
      ]
    ]
  ].

let rec map2
  (A: Type[0]) (B: Type[0]) (C: Type[0]) (f: A → B → C)
  (left: list A) (right: list B) (proof: | left | = | right |) on left ≝
  match left return λx. | x | = | right | → list C with
  [ nil ⇒
    match right return λy. | [] | = | y | → list C with
    [ nil ⇒ λnil_prf. nil C
    | _ ⇒ λcons_absrd. ?
    ]
  | cons hd tl ⇒
    match right return λy. | hd::tl | = | y | → list C with
    [ nil ⇒ λnil_absrd. ?
    | cons hd' tl' ⇒ λcons_prf. (f hd hd') :: map2 A B C f tl tl' ?
    ]
  ] proof.
  [1: normalize in cons_absrd;
      destruct(cons_absrd)
  |2: normalize in nil_absrd;
      destruct(nil_absrd)
  |3: normalize in cons_prf;
      destruct(cons_prf)
      assumption
  ]
qed.

let rec map3
  (A: Type[0]) (B: Type[0]) (C: Type[0]) (D: Type[0]) (f: A → B → C → D)
  (left: list A) (centre: list B) (right: list C)
  (prflc: |left| = |centre|) (prfcr: |centre| = |right|) on left ≝
  match left return λx. |x| = |centre| → list D with
  [ nil ⇒ λnil_prf.
    match centre return λx. |x| = |right| → list D with
    [ nil ⇒ λnil_nil_prf.
      match right return λx. |nil ?| = |x| → list D with
      [ nil        ⇒ λnil_nil_nil_prf. nil D
      | cons hd tl ⇒ λcons_nil_nil_absrd. ?
      ] nil_nil_prf
    | cons hd tl ⇒ λnil_cons_absrd. ?
    ] prfcr
  | cons hd tl ⇒ λcons_prf.
    match centre return λx. |x| = |right| → list D with
    [ nil ⇒ λcons_nil_absrd. ?
    | cons hd' tl' ⇒ λcons_cons_prf.
      match right return λx. |right| = |x| → |cons ? hd' tl'| = |x| → list D with
      [ nil ⇒ λrefl_prf. λcons_cons_nil_absrd. ?
      | cons hd'' tl'' ⇒ λrefl_prf. λcons_cons_cons_prf.
        (f hd hd' hd'') :: (map3 A B C D f tl tl' tl'' ? ?)
      ] (refl ? (|right|)) cons_cons_prf
    ] prfcr
  ] prflc.
  [ 1: normalize in cons_nil_nil_absrd;
       destruct(cons_nil_nil_absrd)
  | 2: generalize in match nil_cons_absrd;
       <prfcr <nil_prf #HYP
       normalize in HYP;
       destruct(HYP)
  | 3: generalize in match cons_nil_absrd;
       <prfcr <cons_prf #HYP
       normalize in HYP;
       destruct(HYP)
  | 4: normalize in cons_cons_nil_absrd;
       destruct(cons_cons_nil_absrd)
  | 5: normalize in cons_cons_cons_prf;
       destruct(cons_cons_cons_prf)
       assumption
  | 6: generalize in match cons_cons_cons_prf;
       <refl_prf <prfcr <cons_prf #HYP
       normalize in HYP;
       destruct(HYP)
       @sym_eq assumption
  ]
qed.
  
lemma eq_rect_Type0_r :
  ∀A: Type[0].
  ∀a:A.
  ∀P: ∀x:A. eq ? x a → Type[0]. P a (refl A a) → ∀x: A.∀p:eq ? x a. P x p.
  #A #a #P #H #x #p
  generalize in match H
  generalize in match P
  cases p
  //
qed.
  
let rec safe_nth (A: Type[0]) (n: nat) (l: list A) (p: n < length A l) on n: A ≝
  match n return λo. o < length A l → A with
  [ O ⇒
    match l return λm. 0 < length A m → A with
    [ nil ⇒ λabsd1. ?
    | cons hd tl ⇒ λprf1. hd
    ]
  | S n' ⇒
    match l return λm. S n' < length A m → A with
    [ nil ⇒ λabsd2. ?
    | cons hd tl ⇒ λprf2. safe_nth A n' tl ?
    ]
  ] ?.
  [ 1:
    @ p
  | 4:
    normalize in prf2
    normalize
    @ le_S_S_to_le
    assumption
  | 2:
    normalize in absd1;
    cases (not_le_Sn_O O)
    # H
    elim (H absd1)
  | 3:
    normalize in absd2;
    cases (not_le_Sn_O (S n'))
    # H
    elim (H absd2)
  ]
qed.
  
let rec nub_by_internal (A: Type[0]) (f: A → A → bool) (l: list A) (n: nat) on n ≝
  match n with
  [ O ⇒
    match l with
    [ nil ⇒ [ ]
    | cons hd tl ⇒ l
    ]
  | S n ⇒
    match l with
    [ nil ⇒ [ ]
    | cons hd tl ⇒
      hd :: nub_by_internal A f (filter ? (λy. notb (f y hd)) tl) n
    ]
  ].
  
definition nub_by ≝
  λA: Type[0].
  λf: A → A → bool.
  λl: list A.
    nub_by_internal A f l (length ? l).
  
let rec member (A: Type[0]) (eq: A → A → bool) (a: A) (l: list A) on l ≝
  match l with
  [ nil ⇒ false
  | cons hd tl ⇒ orb (eq a hd) (member A eq a tl)
  ].
  
let rec take (A: Type[0]) (n: nat) (l: list A) on n: list A ≝
  match n with
  [ O ⇒ [ ]
  | S n ⇒
    match l with
    [ nil ⇒ [ ]
    | cons hd tl ⇒ hd :: take A n tl
    ]
  ].
  
let rec drop (A: Type[0]) (n: nat) (l: list A) on n ≝
  match n with
  [ O ⇒ l
  | S n ⇒
    match l with
    [ nil ⇒ [ ]
    | cons hd tl ⇒ drop A n tl
    ]
  ].
  
definition list_split ≝
  λA: Type[0].
  λn: nat.
  λl: list A.
    〈take A n l, drop A n l〉.
  
let rec mapi_internal (A: Type[0]) (B: Type[0]) (n: nat) (f: nat → A → B)
                      (l: list A) on l: list B ≝
  match l with
  [ nil ⇒ nil ?
  | cons hd tl ⇒ (f n hd) :: (mapi_internal A B (n + 1) f tl)
  ].  

definition mapi ≝
  λA, B: Type[0].
  λf: nat → A → B.
  λl: list A.
    mapi_internal A B 0 f l.

let rec zip_pottier
  (A: Type[0]) (B: Type[0]) (left: list A) (right: list B)
    on left ≝
  match left with
  [ nil ⇒ [ ]
  | cons hd tl ⇒
    match right with
    [ nil ⇒ [ ]
    | cons hd' tl' ⇒ 〈hd, hd'〉 :: zip_pottier A B tl tl'
    ]
  ].

let rec zip_safe
  (A: Type[0]) (B: Type[0]) (left: list A) (right: list B) (prf: |left| = |right|)
    on left ≝
  match left return λx. |x| = |right| → list (A × B) with
  [ nil ⇒ λnil_prf.
    match right return λx. |[ ]| = |x| → list (A × B) with
    [ nil ⇒ λnil_nil_prf. [ ]
    | cons hd tl ⇒ λnil_cons_absrd. ?
    ] nil_prf
  | cons hd tl ⇒ λcons_prf.
    match right return λx. |hd::tl| = |x| → list (A × B) with
    [ nil ⇒ λcons_nil_absrd. ?
    | cons hd' tl' ⇒ λcons_cons_prf. 〈hd, hd'〉 :: zip_safe A B tl tl' ?
    ] cons_prf
  ] prf.
  [ 1: normalize in nil_cons_absrd;
       destruct(nil_cons_absrd)
  | 2: normalize in cons_nil_absrd;
       destruct(cons_nil_absrd)
  | 3: normalize in cons_cons_prf;
       @injective_S
       assumption
  ]
qed.

let rec zip (A: Type[0]) (B: Type[0]) (l: list A) (r: list B) on l: option (list (A × B)) ≝
  match l with
  [ nil ⇒ Some ? (nil (A × B))
  | cons hd tl ⇒
    match r with
    [ nil ⇒ None ?
    | cons hd' tl' ⇒
      match zip ? ? tl tl' with
      [ None ⇒ None ?
      | Some tail ⇒ Some ? (〈hd, hd'〉 :: tail)
      ]
    ]
  ].

let rec foldl (A: Type[0]) (B: Type[0]) (f: A → B → A) (a: A) (l: list B) on l ≝
  match l with
  [ nil ⇒ a
  | cons hd tl ⇒ foldl A B f (f a hd) tl
  ].

lemma foldl_step:
 ∀A:Type[0].
  ∀B: Type[0].
   ∀H: A → B → A.
    ∀acc: A.
     ∀pre: list B.
      ∀hd:B.
       foldl A B H acc (pre@[hd]) = (H (foldl A B H acc pre) hd).
 #A #B #H #acc #pre generalize in match acc; -acc; elim pre
  [ normalize; //
  | #hd #tl #IH #acc #X normalize; @IH ]
qed.

lemma foldl_append:
 ∀A:Type[0].
  ∀B: Type[0].
   ∀H: A → B → A.
    ∀acc: A.
     ∀suff,pre: list B.
      foldl A B H acc (pre@suff) = (foldl A B H (foldl A B H acc pre) suff).
 #A #B #H #acc #suff elim suff
  [ #pre >append_nil %
  | #hd #tl #IH #pre whd in ⊢ (???%) <(foldl_step … H ??) applyS (IH (pre@[hd])) ] 
qed.

definition flatten ≝
  λA: Type[0].
  λl: list (list A).
    foldr ? ? (append ?) [ ] l.

let rec rev (A: Type[0]) (l: list A) on l ≝ 
  match l with
  [ nil ⇒ nil A
  | cons hd tl ⇒ (rev A tl) @ [ hd ]
  ].

lemma append_length:
  ∀A: Type[0].
  ∀l, r: list A.
    |(l @ r)| = |l| + |r|.
  #A #L #R
  elim L
  [ %
  | #HD #TL #IH
    normalize >IH %
  ]
qed.

lemma append_nil:
  ∀A: Type[0].
  ∀l: list A.
    l @ [ ] = l.
  #A #L
  elim L //
qed.

lemma rev_append:
  ∀A: Type[0].
  ∀l, r: list A.
    rev A (l @ r) = rev A r @ rev A l.
  #A #L #R
  elim L
  [ normalize >append_nil %
  | #HD #TL #IH
    normalize >IH
    @associative_append
  ]
qed.

lemma rev_length:
  ∀A: Type[0].
  ∀l: list A.
    |rev A l| = |l|.
  #A #L
  elim L
  [ %
  | #HD #TL #IH
    normalize
    >(append_length A (rev A TL) [HD])
    normalize /2/
  ]
qed.
    
notation > "'if' term 19 e 'then' term 19 t 'else' term 48 f" non associative with precedence 19
 for @{ match $e in bool with [ true ⇒ $t | false ⇒ $f]  }.
notation < "hvbox('if' \nbsp term 19 e \nbsp break 'then' \nbsp term 19 t \nbsp break 'else' \nbsp term 48 f \nbsp)" non associative with precedence 19
 for @{ match $e with [ true ⇒ $t | false ⇒ $f]  }.

let rec fold_left_i_aux (A: Type[0]) (B: Type[0])
                        (f: nat → A → B → A) (x: A) (i: nat) (l: list B) on l ≝
  match l with
    [ nil ⇒ x
    | cons hd tl ⇒ fold_left_i_aux A B f (f i x hd) (S i) tl
    ].

definition fold_left_i ≝ λA,B,f,x. fold_left_i_aux A B f x O.

notation "hvbox(t⌈o ↦ h⌉)"
  with precedence 45
  for @{ match (? : $o=$h) with [ refl ⇒ $t ] }.

definition function_apply ≝
  λA, B: Type[0].
  λf: A → B.
  λa: A.
    f a.
    
notation "f break $ x"
  left associative with precedence 99
  for @{ 'function_apply $f $x }.
  
interpretation "Function application" 'function_apply f x = (function_apply ? ? f x).

let rec iterate (A: Type[0]) (f: A → A) (a: A) (n: nat) on n ≝
  match n with
    [ O ⇒ a
    | S o ⇒ f (iterate A f a o)
    ].

(* Yeah, I probably ought to do something more general... *)
notation "hvbox(\langle term 19 a, break term 19 b, break term 19 c\rangle)" 
with precedence 90 for @{ 'triple $a $b $c}.
interpretation "Triple construction" 'triple x y z = (pair ? ? (pair ? ? x y) z).

notation "hvbox(\langle term 19 a, break term 19 b, break term 19 c, break term 19 d\rangle)"
with precedence 90 for @{ 'quadruple $a $b $c $d}.
interpretation "Quadruple construction" 'quadruple w x y z = (pair ? ? (pair ? ? w x) (pair ? ? y z)).

notation > "hvbox('let' 〈ident w,ident x,ident y,ident z〉 ≝ t 'in' s)"
 with precedence 10
for @{ match $t with [ pair ${fresh wx} ${fresh yz} ⇒ match ${fresh wx} with [ pair ${ident w} ${ident x} ⇒ match ${fresh yz} with [ pair ${ident y} ${ident z} ⇒ $s ] ] ] }.

notation > "hvbox('let' 〈ident x,ident y,ident z〉 ≝ t 'in' s)"
 with precedence 10
for @{ match $t with [ pair ${fresh xy} ${ident z} ⇒ match ${fresh xy} with [ pair ${ident x} ${ident y} ⇒ $s ] ] }.

notation < "hvbox('let' \nbsp hvbox(〈ident x,ident y〉\nbsp ≝ break t \nbsp 'in' \nbsp) break s)"
 with precedence 10
for @{ match $t with [ pair (${ident x}:$ignore) (${ident y}:$ignora) ⇒ $s ] }.

axiom pair_elim':
  ∀A,B,C: Type[0].
  ∀T: A → B → C.
  ∀p.
  ∀P: A×B → C → Prop.
    (∀lft, rgt. p = 〈lft,rgt〉 → P 〈lft,rgt〉 (T lft rgt)) →
      P p (let 〈lft, rgt〉 ≝ p in T lft rgt).

axiom pair_elim'':
  ∀A,B,C,C': Type[0].
  ∀T: A → B → C.
  ∀T': A → B → C'.
  ∀p.
  ∀P: A×B → C → C' → Prop.
    (∀lft, rgt. p = 〈lft,rgt〉 → P 〈lft,rgt〉 (T lft rgt) (T' lft rgt)) →
      P p (let 〈lft, rgt〉 ≝ p in T lft rgt) (let 〈lft, rgt〉 ≝ p in T' lft rgt).

lemma pair_destruct_1:
 ∀A,B.∀a:A.∀b:B.∀c. 〈a,b〉 = c → a = \fst c.
 #A #B #a #b *; /2/
qed.

lemma pair_destruct_2:
 ∀A,B.∀a:A.∀b:B.∀c. 〈a,b〉 = c → b = \snd c.
 #A #B #a #b *; /2/
qed.


notation "⊥" with precedence 90
  for @{ match ? in False with [ ] }.

let rec exclusive_disjunction (b: bool) (c: bool) on b ≝
  match b with
    [ true ⇒
      match c with
        [ false ⇒ true
        | true ⇒ false
        ]
    | false ⇒
      match c with
        [ false ⇒ false
        | true ⇒ true
        ]
    ].

(* dpm: conflicts with library definitions
interpretation "Nat less than" 'lt m n = (ltb m n).
interpretation "Nat greater than" 'gt m n = (gtb m n).
interpretation "Nat greater than eq" 'geq m n = (geb m n).
*)

let rec division_aux (m: nat) (n : nat) (p: nat) ≝
  match ltb n (S p) with
    [ true ⇒ O
    | false ⇒
      match m with
        [ O ⇒ O
        | (S q) ⇒ S (division_aux q (n - (S p)) p)
        ]
    ].
    
definition division ≝
  λm, n: nat.
    match n with
      [ O ⇒ S m
      | S o ⇒ division_aux m m o
      ].
      
notation "hvbox(n break ÷ m)"
  right associative with precedence 47
  for @{ 'division $n $m }.
  
interpretation "Nat division" 'division n m = (division n m).

let rec modulus_aux (m: nat) (n: nat) (p: nat) ≝
  match leb n p with
    [ true ⇒ n
    | false ⇒
      match m with
        [ O ⇒ n
        | S o ⇒ modulus_aux o (n - (S p)) p
        ]
    ].
    
definition modulus ≝
  λm, n: nat.
    match n with
      [ O ⇒ m
      | S o ⇒ modulus_aux m m o
      ].
    
notation "hvbox(n break 'mod' m)"
  right associative with precedence 47
  for @{ 'modulus $n $m }.
  
interpretation "Nat modulus" 'modulus m n = (modulus m n).

definition divide_with_remainder ≝
  λm, n: nat.
    pair ? ? (m ÷ n) (modulus m n).
    
let rec exponential (m: nat) (n: nat) on n ≝
  match n with
    [ O ⇒ S O
    | S o ⇒ m * exponential m o
    ].

interpretation "Nat exponential" 'exp n m = (exponential n m).
    
notation "hvbox(a break ⊎ b)"
 left associative with precedence 50
for @{ 'disjoint_union $a $b }.
interpretation "sum" 'disjoint_union A B = (Sum A B).

theorem less_than_or_equal_monotone:
  ∀m, n: nat.
    m ≤ n → (S m) ≤ (S n).
 #m #n #H
 elim H
 /2/
qed.

theorem less_than_or_equal_b_complete:
  ∀m, n: nat.
    leb m n = false → ¬(m ≤ n).
 #m;
 elim m;
 normalize
 [ #n #H
   destruct
 | #y #H1 #z
   cases z
   normalize
   [ #H
     /2/
   | /3/
   ]
 ]
qed.

theorem less_than_or_equal_b_correct:
  ∀m, n: nat.
    leb m n = true → m ≤ n.
 #m
 elim m
 //
 #y #H1 #z
 cases z
 normalize
 [ #H
   destruct
 | #n #H lapply (H1 … H) /2/
 ]
qed.

definition less_than_or_equal_b_elim:
 ∀m, n: nat.
 ∀P: bool → Type[0].
   (m ≤ n → P true) → (¬(m ≤ n) → P false) → P (leb m n).
 #m #n #P #H1 #H2;
 lapply (less_than_or_equal_b_correct m n)
 lapply (less_than_or_equal_b_complete m n)
 cases (leb m n)
 /3/
qed.

lemma inclusive_disjunction_true:
  ∀b, c: bool.
    (orb b c) = true → b = true ∨ c = true.
  # b
  # c
  elim b
  [ normalize
    # H
    @ or_introl
    %
  | normalize
    /2/
  ]
qed.

lemma conjunction_true:
  ∀b, c: bool.
    andb b c = true → b = true ∧ c = true.
  # b
  # c
  elim b
  normalize
  [ /2/
  | # K
    destruct
  ]
qed.

lemma eq_true_false: false=true → False.
 # K
 destruct
qed.

lemma inclusive_disjunction_b_true: ∀b. orb b true = true.
 # b
 cases b
 %
qed.

definition bool_to_Prop ≝
 λb. match b with [ true ⇒ True | false ⇒ False ].

coercion bool_to_Prop: ∀b:bool. Prop ≝ bool_to_Prop on _b:bool to Type[0]. 

lemma eq_false_to_notb: ∀b. b = false → ¬ b.
 *; /2/
qed.

lemma length_append:
 ∀A.∀l1,l2:list A.
  |l1 @ l2| = |l1| + |l2|.
 #A #l1 elim l1
  [ //
  | #hd #tl #IH #l2 normalize <IH //]
qed.