Inductive SearchTree' : key -> tree -> key -> Prop :=
| ST_E : forall lo hi, lo <= hi -> SearchTree' lo E hi
| ST_T: forall lo l k v r hi,
    SearchTree' lo l k ->
    SearchTree' (S k) r hi ->
    SearchTree' lo (T l k v r) hi.Inductive SearchTree' : key -> tree -> key -> Prop :=
| ST_E : forall lo hi, lo <= hi -> SearchTree' lo E hi
| ST_T: forall lo l k v r hi,
    SearchTree' lo l k ->
    SearchTree' (S k) r hi ->
    SearchTree' lo (T l k v r) hi.Inductive SearchTree' : key -> tree -> key -> Prop :=
| ST_E : forall lo hi, lo <= hi -> SearchTree' lo E hi
| ST_T: forall lo l k v r hi,
    SearchTree' lo l k ->
    SearchTree' (S k) r hi ->
    SearchTree' lo (T l k v r) hi.Inductive SearchTree: tree -> Prop :=
| ST_intro: forall t hi, SearchTree' 0 t hi -> SearchTree t.Inductive SearchTree: tree -> Prop :=
| ST_intro: forall t hi, SearchTree' 0 t hi -> SearchTree t.

(* Specifications: *)
Lemma SearchTree'_le: forall lo t hi, @SearchTree' lo t hi -> lo <= hi.
Theorem elements_slow_elements: elements = slow_elements.
Lemma slow_elements_range: forall k v lo t hi, SearchTree' lo t hi -> In (k,v) (slow_elements t) -> lo <= k < hi.
Lemma In_decidable: forall (al: list (key*V)) (i: key), (exists v, In (i,v) al) \/ (~exists v, In (i,v) al).
Lemma list2map_app_left: forall (al bl: list (key*V)) (i: key) v, In (i,v) al -> list2map (al++bl) i = list2map al i.
Lemma list2map_app_right: forall (al bl: list (key*V)) (i: key), ~(exists v, In (i,v) al) -> list2map (al++bl) i = list2map bl i.
Lemma list2map_not_in_default: forall (al: list (key*V)) (i: key), ~(exists v, In (i,v) al) -> list2map al i = default.
Theorem empty_tree_SearchTree: SearchTree empty_tree.