Notation "s #1" := (fst s) (at level 9, format "s '#1'") : pair_scope.Notation "s #2" := (snd s) (at level 9, format "s '#2'") : pair_scope.Local Notation int := I.t.Definition key := X.t.(** * Trees *)

(** * Trees

   The fifth field of [Node] is the height of the tree *)

#[universes(template)]
Inductive tree {elt : Type} :=
  | Leaf : tree
  | Node : tree -> key -> elt -> tree -> int -> tree.(** * Trees *)

(** * Trees

   The fifth field of [Node] is the height of the tree *)

#[universes(template)]
Inductive tree {elt : Type} :=
  | Leaf : tree
  | Node : tree -> key -> elt -> tree -> int -> tree.(** * Trees *)

(** * Trees

   The fifth field of [Node] is the height of the tree *)

#[universes(template)]
Inductive tree {elt : Type} :=
  | Leaf : tree
  | Node : tree -> key -> elt -> tree -> int -> tree.Notation t := tree.Implicit Types m : t.(** * Basic functions on trees: height and cardinal *)

Definition height (m : t) : int :=
  match m with
  | Leaf => 0
  | Node _ _ _ _ h => h
  end.Fixpoint cardinal (m : t) : nat :=
  match m with
   | Leaf => 0%nat
   | Node l _ _ r _ => S (cardinal l + cardinal r)
  end.(** * Empty Map *)

Definition empty : t := Leaf.(** * Emptyness test *)

Definition is_empty m := match m with Leaf => true | _ => false end.(** * Membership *)

(** The [mem] function is deciding membership. It exploits the [bst] property
    to achieve logarithmic complexity. *)

Fixpoint mem x m : bool :=
   match m with
     |  Leaf => false
     |  Node l y _ r _ => match X.compare x y with
             | LT _ => mem x l
             | EQ _ => true
             | GT _ => mem x r
         end
   end.Fixpoint find x m : option elt :=
   match m with
     |  Leaf => None
     |  Node l y d r _ => match X.compare x y with
             | LT _ => find x l
             | EQ _ => Some d
             | GT _ => find x r
         end
   end.(** * Helper functions *)

(** [create l x r] creates a node, assuming [l] and [r]
    to be balanced and [|height l - height r| <= 2]. *)

Definition create l x e r :=
   Node l x e r (max (height l) (height r) + 1).(** [bal l x e r] acts as [create], but performs one step of
    rebalancing if necessary, i.e. assumes [|height l - height r| <= 3]. *)

Definition assert_false := create.Definition bal l x d r :=
  let hl := height l in
  let hr := height r in
  if gt_le_dec hl (hr+2) then
    match l with
     | Leaf => assert_false l x d r
     | Node ll lx ld lr _ =>
       if ge_lt_dec (height ll) (height lr) then
         create ll lx ld (create lr x d r)
       else
         match lr with
          | Leaf => assert_false l x d r
          | Node lrl lrx lrd lrr _ =>
              create (create ll lx ld lrl) lrx lrd (create lrr x d r)
         end
    end
  else
    if gt_le_dec hr (hl+2) then
      match r with
       | Leaf => assert_false l x d r
       | Node rl rx rd rr _ =>
         if ge_lt_dec (height rr) (height rl) then
            create (create l x d rl) rx rd rr
         else
           match rl with
            | Leaf => assert_false l x d r
            | Node rll rlx rld rlr _ =>
                create (create l x d rll) rlx rld (create rlr rx rd rr)
           end
      end
    else
      create l x d r.(** * Insertion *)

Fixpoint add x d m :=
  match m with
   | Leaf => Node Leaf x d Leaf 1
   | Node l y d' r h =>
      match X.compare x y with
         | LT _ => bal (add x d l) y d' r
         | EQ _ => Node l y d r h
         | GT _ => bal l y d' (add x d r)
      end
  end.(** * Extraction of minimum binding

  Morally, [remove_min] is to be applied to a non-empty tree
  [t = Node l x e r h]. Since we can't deal here with [assert false]
  for [t=Leaf], we pre-unpack [t] (and forget about [h]).
*)

Fixpoint remove_min l x d r : t*(key*elt) :=
  match l with
    | Leaf => (r,(x,d))
    | Node ll lx ld lr lh =>
       let (l',m) := remove_min ll lx ld lr in
       (bal l' x d r, m)
  end.(** * Merging two trees

  [merge t1 t2] builds the union of [t1] and [t2] assuming all elements
  of [t1] to be smaller than all elements of [t2], and
  [|height t1 - height t2| <= 2].
*)

Definition merge s1 s2 :=  match s1,s2 with
  | Leaf, _ => s2
  | _, Leaf => s1
  | _, Node l2 x2 d2 r2 h2 =>
    match remove_min l2 x2 d2 r2 with
      (s2',(x,d)) => bal s1 x d s2'
    end
end.(** * Deletion *)

Fixpoint remove x m := match m with
  | Leaf => Leaf
  | Node l y d r h =>
      match X.compare x y with
         | LT _ => bal (remove x l) y d r
         | EQ _ => merge l r
         | GT _ => bal l y d (remove x r)
      end
   end.(** * join

    Same as [bal] but does not assume anything regarding heights of [l]
    and [r].
*)

Fixpoint join l : key -> elt -> t -> t :=
  match l with
    | Leaf => add
    | Node ll lx ld lr lh => fun x d =>
       fix join_aux (r:t) : t := match r with
          | Leaf =>  add x d l
          | Node rl rx rd rr rh =>
               if gt_le_dec lh (rh+2) then bal ll lx ld (join lr x d r)
               else if gt_le_dec rh (lh+2) then bal (join_aux rl) rx rd rr
               else create l x d r
          end
  end.(** * Splitting

    [split x m] returns a triple [(l, o, r)] where
    - [l] is the set of elements of [m] that are [< x]
    - [r] is the set of elements of [m] that are [> x]
    - [o] is the result of [find x m].
*)

Record triple := mktriple { t_left:t; t_opt:option elt; t_right:t }.(** * Splitting

    [split x m] returns a triple [(l, o, r)] where
    - [l] is the set of elements of [m] that are [< x]
    - [r] is the set of elements of [m] that are [> x]
    - [o] is the result of [find x m].
*)

Record triple := mktriple { t_left:t; t_opt:option elt; t_right:t }.(** * Splitting

    [split x m] returns a triple [(l, o, r)] where
    - [l] is the set of elements of [m] that are [< x]
    - [r] is the set of elements of [m] that are [> x]
    - [o] is the result of [find x m].
*)

Record triple := mktriple { t_left:t; t_opt:option elt; t_right:t }.(** * Splitting

    [split x m] returns a triple [(l, o, r)] where
    - [l] is the set of elements of [m] that are [< x]
    - [r] is the set of elements of [m] that are [> x]
    - [o] is the result of [find x m].
*)

Record triple := mktriple { t_left:t; t_opt:option elt; t_right:t }.(** * Splitting

    [split x m] returns a triple [(l, o, r)] where
    - [l] is the set of elements of [m] that are [< x]
    - [r] is the set of elements of [m] that are [> x]
    - [o] is the result of [find x m].
*)

Record triple := mktriple { t_left:t; t_opt:option elt; t_right:t }.Notation "<< l , b , r >>" := (mktriple l b r) (at level 9).Fixpoint split x m : triple := match m with
  | Leaf => << Leaf, None, Leaf >>
  | Node l y d r h =>
     match X.compare x y with
      | LT _ => let (ll,o,rl) := split x l in << ll, o, join rl y d r >>
      | EQ _ => << l, Some d, r >>
      | GT _ => let (rl,o,rr) := split x r in << join l y d rl, o, rr >>
     end
 end.(** * Concatenation

   Same as [merge] but does not assume anything about heights.
*)

Definition concat m1 m2 :=
   match m1, m2 with
      | Leaf, _ => m2
      | _ , Leaf => m1
      | _, Node l2 x2 d2 r2 _ =>
            let (m2',xd) := remove_min l2 x2 d2 r2 in
            join m1 xd#1 xd#2 m2'
   end.(** * Elements *)

(** [elements_tree_aux acc t] catenates the elements of [t] in infix
    order to the list [acc] *)

Fixpoint elements_aux (acc : list (key*elt)) m : list (key*elt) :=
  match m with
   | Leaf => acc
   | Node l x d r _ => elements_aux ((x,d) :: elements_aux acc r) l
  end.(** then [elements] is an instantiation with an empty [acc] *)

Definition elements := elements_aux nil.(** * Fold *)

Fixpoint fold (A : Type) (f : key -> elt -> A -> A) (m : t) : A -> A :=
 fun a => match m with
  | Leaf => a
  | Node l x d r _ => fold f r (f x d (fold f l a))
 end.(** ** Enumeration of the elements of a tree *)

Inductive enumeration :=
 | End : enumeration
 | More : key -> elt -> t -> enumeration -> enumeration.(** ** Enumeration of the elements of a tree *)

Inductive enumeration :=
 | End : enumeration
 | More : key -> elt -> t -> enumeration -> enumeration.(** ** Enumeration of the elements of a tree *)

Inductive enumeration :=
 | End : enumeration
 | More : key -> elt -> t -> enumeration -> enumeration.(** [cons m e] adds the elements of tree [m] on the head of
    enumeration [e]. *)

Fixpoint cons m e : enumeration :=
 match m with
  | Leaf => e
  | Node l x d r h => cons l (More x d r e)
 end.(** One step of comparison of elements *)

Definition equal_more x1 d1 (cont:enumeration->bool) e2 :=
 match e2 with
 | End => false
 | More x2 d2 r2 e2 =>
     match X.compare x1 x2 with
      | EQ _ => cmp d1 d2 &&& cont (cons r2 e2)
      | _ => false
     end
 end.(** Comparison of left tree, middle element, then right tree *)

Fixpoint equal_cont m1 (cont:enumeration->bool) e2 :=
 match m1 with
  | Leaf => cont e2
  | Node l1 x1 d1 r1 _ =>
     equal_cont l1 (equal_more x1 d1 (equal_cont r1 cont)) e2
  end.(** Initial continuation *)

Definition equal_end e2 := match e2 with End => true | _ => false end.(** The complete comparison *)

Definition equal m1 m2 := equal_cont m1 equal_end (cons m2 End).Notation "t #l" := (t_left t) (at level 9, format "t '#l'").Notation "t #o" := (t_opt t) (at level 9, format "t '#o'").Notation "t #r" := (t_right t) (at level 9, format "t '#r'").(** * Map *)

Fixpoint map (elt elt' : Type)(f : elt -> elt')(m : t elt) : t elt' :=
  match m with
   | Leaf _   => Leaf _
   | Node l x d r h => Node (map f l) x (f d) (map f r) h
  end.(* * Mapi *)

Fixpoint mapi (elt elt' : Type)(f : key -> elt -> elt')(m : t elt) : t elt' :=
  match m with
   | Leaf _ => Leaf _
   | Node l x d r h => Node (mapi f l) x (f x d) (mapi f r) h
  end.(** * Map with removal *)

Fixpoint map_option (elt elt' : Type)(f : key -> elt -> option elt')(m : t elt)
  : t elt' :=
  match m with
   | Leaf _ => Leaf _
   | Node l x d r h =>
      match f x d with
       | Some d' => join (map_option f l) x d' (map_option f r)
       | None => concat (map_option f l) (map_option f r)
      end
  end.Fixpoint map2_opt m1 m2 :=
 match m1, m2 with
  | Leaf _, _ => mapr m2
  | _, Leaf _ => mapl m1
  | Node l1 x1 d1 r1 h1, _ =>
     let (l2',o2,r2') := split x1 m2 in
     match f x1 d1 o2 with
      | Some e => join (map2_opt l1 l2') x1 e (map2_opt r1 r2')
      | None => concat (map2_opt l1 l2') (map2_opt r1 r2')
     end
 end.Definition map2 : t elt -> t elt' -> t elt'' :=
 map2_opt
   (fun _ d o => f (Some d) o)
   (map_option (fun _ d => f (Some d) None))
   (map_option (fun _ d' => f None (Some d'))).(** ** Occurrence in a tree *)

Inductive MapsTo (x : key)(e : elt) : t elt -> Prop :=
  | MapsRoot : forall l r h y,
      X.eq x y -> MapsTo x e (Node l y e r h)
  | MapsLeft : forall l r h y e',
      MapsTo x e l -> MapsTo x e (Node l y e' r h)
  | MapsRight : forall l r h y e',
      MapsTo x e r -> MapsTo x e (Node l y e' r h).(** ** Occurrence in a tree *)

Inductive MapsTo (x : key)(e : elt) : t elt -> Prop :=
  | MapsRoot : forall l r h y,
      X.eq x y -> MapsTo x e (Node l y e r h)
  | MapsLeft : forall l r h y e',
      MapsTo x e l -> MapsTo x e (Node l y e' r h)
  | MapsRight : forall l r h y e',
      MapsTo x e r -> MapsTo x e (Node l y e' r h).(** ** Occurrence in a tree *)

Inductive MapsTo (x : key)(e : elt) : t elt -> Prop :=
  | MapsRoot : forall l r h y,
      X.eq x y -> MapsTo x e (Node l y e r h)
  | MapsLeft : forall l r h y e',
      MapsTo x e l -> MapsTo x e (Node l y e' r h)
  | MapsRight : forall l r h y e',
      MapsTo x e r -> MapsTo x e (Node l y e' r h).(** ** Occurrence in a tree *)

Inductive MapsTo (x : key)(e : elt) : t elt -> Prop :=
  | MapsRoot : forall l r h y,
      X.eq x y -> MapsTo x e (Node l y e r h)
  | MapsLeft : forall l r h y e',
      MapsTo x e l -> MapsTo x e (Node l y e' r h)
  | MapsRight : forall l r h y e',
      MapsTo x e r -> MapsTo x e (Node l y e' r h).Inductive In (x : key) : t elt -> Prop :=
  | InRoot : forall l r h y e,
      X.eq x y -> In x (Node l y e r h)
  | InLeft : forall l r h y e',
      In x l -> In x (Node l y e' r h)
  | InRight : forall l r h y e',
      In x r -> In x (Node l y e' r h).Inductive In (x : key) : t elt -> Prop :=
  | InRoot : forall l r h y e,
      X.eq x y -> In x (Node l y e r h)
  | InLeft : forall l r h y e',
      In x l -> In x (Node l y e' r h)
  | InRight : forall l r h y e',
      In x r -> In x (Node l y e' r h).Inductive In (x : key) : t elt -> Prop :=
  | InRoot : forall l r h y e,
      X.eq x y -> In x (Node l y e r h)
  | InLeft : forall l r h y e',
      In x l -> In x (Node l y e' r h)
  | InRight : forall l r h y e',
      In x r -> In x (Node l y e' r h).Inductive In (x : key) : t elt -> Prop :=
  | InRoot : forall l r h y e,
      X.eq x y -> In x (Node l y e r h)
  | InLeft : forall l r h y e',
      In x l -> In x (Node l y e' r h)
  | InRight : forall l r h y e',
      In x r -> In x (Node l y e' r h).Definition In0 k m := exists e:elt, MapsTo k e m.(** ** Binary search trees *)

(** [lt_tree x s]: all elements in [s] are smaller than [x]
   (resp. greater for [gt_tree]) *)

Definition lt_tree x m := forall y, In y m -> X.lt y x.Definition gt_tree x m := forall y, In y m -> X.lt x y.(** [bst t] : [t] is a binary search tree *)

Inductive bst : t elt -> Prop :=
  | BSLeaf : bst (Leaf _)
  | BSNode : forall x e l r h, bst l -> bst r ->
     lt_tree x l -> gt_tree x r -> bst (Node l x e r h).(** [bst t] : [t] is a binary search tree *)

Inductive bst : t elt -> Prop :=
  | BSLeaf : bst (Leaf _)
  | BSNode : forall x e l r h, bst l -> bst r ->
     lt_tree x l -> gt_tree x r -> bst (Node l x e r h).(** [bst t] : [t] is a binary search tree *)

Inductive bst : t elt -> Prop :=
  | BSLeaf : bst (Leaf _)
  | BSNode : forall x e l r h, bst l -> bst r ->
     lt_tree x l -> gt_tree x r -> bst (Node l x e r h).Module MX := OrderedTypeFacts X.Module PX := KeyOrderedType X.Module L := FMapList.Raw X.#[local] Ltac caseq :=
match goal with [ |- context [match ?t with _ => _ end] ] =>
  let cmp := fresh in
  let H := fresh in
  remember t as cmp eqn:H; symmetry in H; destruct cmp
end.

(* Specifications: *)
Lemma mem_ind [elt : Type] [x : X.t] [P : t elt -> bool -> Prop] : (forall m : t elt, m = Leaf elt -> P (Leaf elt) false) -> (forall (m l : t elt) (y : key) (_x : elt) (r : t elt) (_x0 : int), m = Node l y _x r _x0 -> forall _x1 : X.lt x y, X.compare x y = LT _x1 -> P l (mem x l) -> P (Node l y _x r _x0) (mem x l)) -> (forall (m l : t elt) (y : key) (_x : elt) (r : t elt) (_x0 : int), m = Node l y _x r _x0 -> forall _x1 : X.eq x y, X.compare x y = EQ _x1 -> P (Node l y _x r _x0) true) -> (forall (m l : t elt) (y : key) (_x : elt) (r : t elt) (_x0 : int), m = Node l y _x r _x0 -> forall _x1 : X.lt y x, X.compare x y = GT _x1 -> P r (mem x r) -> P (Node l y _x r _x0) (mem x r)) -> forall m : t elt, P m (mem x m).
Lemma find_ind [elt : Type] [x : X.t] [P : t elt -> option elt -> Prop] : (forall m : t elt, m = Leaf elt -> P (Leaf elt) None) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.lt x y, X.compare x y = LT _x0 -> P l (find x l) -> P (Node l y d r _x) (find x l)) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.eq x y, X.compare x y = EQ _x0 -> P (Node l y d r _x) (Some d)) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.lt y x, X.compare x y = GT _x0 -> P r (find x r) -> P (Node l y d r _x) (find x r)) -> forall m : t elt, P m (find x m).
Lemma bal_ind [elt : Type] [P : t elt -> key -> elt -> t elt -> t elt -> Prop] : (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl > hr + 2, gt_le_dec hl (hr + 2) = left _x -> l = Leaf elt -> P (Leaf elt) x d r (assert_false l x d r)) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl > hr + 2, gt_le_dec hl (hr + 2) = left _x -> forall (ll : t elt) (lx : key) (ld : elt) (lr : t elt) (_x0 : int), l = Node ll lx ld lr _x0 -> forall _x1 : height ll >= height lr, ge_lt_dec (height ll) (height lr) = left _x1 -> P (Node ll lx ld lr _x0) x d r (create ll lx ld (create lr x d r))) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl > hr + 2, gt_le_dec hl (hr + 2) = left _x -> forall (ll : t elt) (lx : key) (ld : elt) (lr : t elt) (_x0 : int), l = Node ll lx ld lr _x0 -> forall _x1 : height ll < height lr, ge_lt_dec (height ll) (height lr) = right _x1 -> lr = Leaf elt -> P (Node ll lx ld (Leaf elt) _x0) x d r (assert_false l x d r)) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl > hr + 2, gt_le_dec hl (hr + 2) = left _x -> forall (ll : t elt) (lx : key) (ld : elt) (lr : t elt) (_x0 : int), l = Node ll lx ld lr _x0 -> forall _x1 : height ll < height lr, ge_lt_dec (height ll) (height lr) = right _x1 -> forall (lrl : t elt) (lrx : key) (lrd : elt) (lrr : t elt) (_x2 : int), lr = Node lrl lrx lrd lrr _x2 -> P (Node ll lx ld (Node lrl lrx lrd lrr _x2) _x0) x d r (create (create ll lx ld lrl) lrx lrd (create lrr x d r))) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl <= hr + 2, gt_le_dec hl (hr + 2) = right _x -> forall _x0 : hr > hl + 2, gt_le_dec hr (hl + 2) = left _x0 -> r = Leaf elt -> P l x d (Leaf elt) (assert_false l x d r)) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl <= hr + 2, gt_le_dec hl (hr + 2) = right _x -> forall _x0 : hr > hl + 2, gt_le_dec hr (hl + 2) = left _x0 -> forall (rl : t elt) (rx : key) (rd : elt) (rr : t elt) (_x1 : int), r = Node rl rx rd rr _x1 -> forall _x2 : height rr >= height rl, ge_lt_dec (height rr) (height rl) = left _x2 -> P l x d (Node rl rx rd rr _x1) (create (create l x d rl) rx rd rr)) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl <= hr + 2, gt_le_dec hl (hr + 2) = right _x -> forall _x0 : hr > hl + 2, gt_le_dec hr (hl + 2) = left _x0 -> forall (rl : t elt) (rx : key) (rd : elt) (rr : t elt) (_x1 : int), r = Node rl rx rd rr _x1 -> forall _x2 : height rr < height rl, ge_lt_dec (height rr) (height rl) = right _x2 -> rl = Leaf elt -> P l x d (Node (Leaf elt) rx rd rr _x1) (assert_false l x d r)) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl <= hr + 2, gt_le_dec hl (hr + 2) = right _x -> forall _x0 : hr > hl + 2, gt_le_dec hr (hl + 2) = left _x0 -> forall (rl : t elt) (rx : key) (rd : elt) (rr : t elt) (_x1 : int), r = Node rl rx rd rr _x1 -> forall _x2 : height rr < height rl, ge_lt_dec (height rr) (height rl) = right _x2 -> forall (rll : t elt) (rlx : key) (rld : elt) (rlr : t elt) (_x3 : int), rl = Node rll rlx rld rlr _x3 -> P l x d (Node (Node rll rlx rld rlr _x3) rx rd rr _x1) (create (create l x d rll) rlx rld (create rlr rx rd rr))) -> (forall (l : t elt) (x : key) (d : elt) (r : t elt), let hl := height l in let hr := height r in forall _x : hl <= hr + 2, gt_le_dec hl (hr + 2) = right _x -> forall _x0 : hr <= hl + 2, gt_le_dec hr (hl + 2) = right _x0 -> P l x d r (create l x d r)) -> forall (l : t elt) (x : key) (d : elt) (r : t elt), P l x d r (bal l x d r).
Lemma add_ind [elt : Type] [x : key] [d : elt] [P : t elt -> t elt -> Prop] : (forall m : t elt, m = Leaf elt -> P (Leaf elt) (Node (Leaf elt) x d (Leaf elt) 1)) -> (forall (m l : t elt) (y : key) (d' : elt) (r : t elt) (h : int), m = Node l y d' r h -> forall _x : X.lt x y, X.compare x y = LT _x -> P l (add x d l) -> P (Node l y d' r h) (bal (add x d l) y d' r)) -> (forall (m l : t elt) (y : key) (d' : elt) (r : t elt) (h : int), m = Node l y d' r h -> forall _x : X.eq x y, X.compare x y = EQ _x -> P (Node l y d' r h) (Node l y d r h)) -> (forall (m l : t elt) (y : key) (d' : elt) (r : t elt) (h : int), m = Node l y d' r h -> forall _x : X.lt y x, X.compare x y = GT _x -> P r (add x d r) -> P (Node l y d' r h) (bal l y d' (add x d r))) -> forall m : t elt, P m (add x d m).
Lemma remove_min_ind [elt : Type] [P : t elt -> key -> elt -> t elt -> t elt * (key * elt) -> Prop] : (forall (l : t elt) (x : key) (d : elt) (r : t elt), l = Leaf elt -> P (Leaf elt) x d r (r, (x, d))) -> (forall (l : t elt) (x : key) (d : elt) (r ll : t elt) (lx : key) (ld : elt) (lr : t elt) (_x : int), l = Node ll lx ld lr _x -> P ll lx ld lr (remove_min ll lx ld lr) -> forall (l' : t elt) (m : key * elt), remove_min ll lx ld lr = (l', m) -> P (Node ll lx ld lr _x) x d r (bal l' x d r, m)) -> forall (l : t elt) (x : key) (d : elt) (r : t elt), P l x d r (remove_min l x d r).
Lemma merge_ind [elt : Type] [P : t elt -> t elt -> t elt -> Prop] : (forall s1 s2 : t elt, s1 = Leaf elt -> P (Leaf elt) s2 s2) -> (forall (s1 s2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int), s1 = Node _x _x0 _x1 _x2 _x3 -> s2 = Leaf elt -> P (Node _x _x0 _x1 _x2 _x3) (Leaf elt) s1) -> (forall (s1 s2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int), s1 = Node _x _x0 _x1 _x2 _x3 -> forall (l2 : t elt) (x2 : key) (d2 : elt) (r2 : t elt) (_x4 : int), s2 = Node l2 x2 d2 r2 _x4 -> forall (s2' : t elt) (p : key * elt), remove_min l2 x2 d2 r2 = (s2', p) -> forall (x : key) (d : elt), p = (x, d) -> P (Node _x _x0 _x1 _x2 _x3) (Node l2 x2 d2 r2 _x4) (bal s1 x d s2')) -> forall s1 s2 : t elt, P s1 s2 (merge s1 s2).
Lemma remove_ind [elt : Type] [x : X.t] [P : t elt -> t elt -> Prop] : (forall m : t elt, m = Leaf elt -> P (Leaf elt) (Leaf elt)) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.lt x y, X.compare x y = LT _x0 -> P l (remove x l) -> P (Node l y d r _x) (bal (remove x l) y d r)) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.eq x y, X.compare x y = EQ _x0 -> P (Node l y d r _x) (merge l r)) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.lt y x, X.compare x y = GT _x0 -> P r (remove x r) -> P (Node l y d r _x) (bal l y d (remove x r))) -> forall m : t elt, P m (remove x m).
Lemma concat_ind [elt : Type] [P : t elt -> t elt -> t elt -> Prop] : (forall m1 m2 : t elt, m1 = Leaf elt -> P (Leaf elt) m2 m2) -> (forall (m1 m2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int), m1 = Node _x _x0 _x1 _x2 _x3 -> m2 = Leaf elt -> P (Node _x _x0 _x1 _x2 _x3) (Leaf elt) m1) -> (forall (m1 m2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int), m1 = Node _x _x0 _x1 _x2 _x3 -> forall (l2 : t elt) (x2 : key) (d2 : elt) (r2 : t elt) (_x4 : int), m2 = Node l2 x2 d2 r2 _x4 -> forall (m2' : t elt) (xd : key * elt), remove_min l2 x2 d2 r2 = (m2', xd) -> P (Node _x _x0 _x1 _x2 _x3) (Node l2 x2 d2 r2 _x4) (join m1 xd#1 xd#2 m2')) -> forall m1 m2 : t elt, P m1 m2 (concat m1 m2).
Lemma split_ind [elt : Type] [x : X.t] [P : t elt -> triple elt -> Prop] : (forall m : t elt, m = Leaf elt -> P (Leaf elt) << Leaf elt, None, Leaf elt >>) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.lt x y, X.compare x y = LT _x0 -> P l (split x l) -> forall (ll : t elt) (o : option elt) (rl : t elt), split x l = << ll, o, rl >> -> P (Node l y d r _x) << ll, o, join rl y d r >>) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.eq x y, X.compare x y = EQ _x0 -> P (Node l y d r _x) << l, Some d, r >>) -> (forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int), m = Node l y d r _x -> forall _x0 : X.lt y x, X.compare x y = GT _x0 -> P r (split x r) -> forall (rl : t elt) (o : option elt) (rr : t elt), split x r = << rl, o, rr >> -> P (Node l y d r _x) << join l y d rl, o, rr >>) -> forall m : t elt, P m (split x m).
Lemma map_option_ind [elt elt' : Type] [f : key -> elt -> option elt'] [P : t elt -> t elt' -> Prop] : (forall m : t elt, m = Leaf elt -> P (Leaf elt) (Leaf elt')) -> (forall (m l : t elt) (x : key) (d : elt) (r : t elt) (_x : int), m = Node l x d r _x -> forall d' : elt', f x d = Some d' -> P l (map_option f l) -> P r (map_option f r) -> P (Node l x d r _x) (join (map_option f l) x d' (map_option f r))) -> (forall (m l : t elt) (x : key) (d : elt) (r : t elt) (_x : int), m = Node l x d r _x -> f x d = None -> P l (map_option f l) -> P r (map_option f r) -> P (Node l x d r _x) (concat (map_option f l) (map_option f r))) -> forall m : t elt, P m (map_option f m).
Lemma map2_opt_ind [elt elt' elt'' : Type] [f : key -> elt -> option elt' -> option elt''] [mapl : t elt -> t elt''] [mapr : t elt' -> t elt''] [P : t elt -> t elt' -> t elt'' -> Prop] : (forall (m1 : t elt) (m2 : t elt'), m1 = Leaf elt -> P (Leaf elt) m2 (mapr m2)) -> (forall (m1 : t elt) (m2 : t elt') (l1 : t elt) (x1 : key) (d1 : elt) (r1 : t elt) (_x : int), m1 = Node l1 x1 d1 r1 _x -> m2 = Leaf elt' -> P (Node l1 x1 d1 r1 _x) (Leaf elt') (mapl m1)) -> (forall (m1 : t elt) (m2 : t elt') (l1 : t elt) (x1 : key) (d1 : elt) (r1 : t elt) (_x : int), m1 = Node l1 x1 d1 r1 _x -> forall (_x0 : t elt') (_x1 : key) (_x2 : elt') (_x3 : t elt') (_x4 : int), m2 = Node _x0 _x1 _x2 _x3 _x4 -> forall (l2' : t elt') (o2 : option elt') (r2' : t elt'), split x1 m2 = << l2', o2, r2' >> -> forall e : elt'', f x1 d1 o2 = Some e -> P l1 l2' (map2_opt f mapl mapr l1 l2') -> P r1 r2' (map2_opt f mapl mapr r1 r2') -> P (Node l1 x1 d1 r1 _x) (Node _x0 _x1 _x2 _x3 _x4) (join (map2_opt f mapl mapr l1 l2') x1 e (map2_opt f mapl mapr r1 r2'))) -> (forall (m1 : t elt) (m2 : t elt') (l1 : t elt) (x1 : key) (d1 : elt) (r1 : t elt) (_x : int), m1 = Node l1 x1 d1 r1 _x -> forall (_x0 : t elt') (_x1 : key) (_x2 : elt') (_x3 : t elt') (_x4 : int), m2 = Node _x0 _x1 _x2 _x3 _x4 -> forall (l2' : t elt') (o2 : option elt') (r2' : t elt'), split x1 m2 = << l2', o2, r2' >> -> f x1 d1 o2 = None -> P l1 l2' (map2_opt f mapl mapr l1 l2') -> P r1 r2' (map2_opt f mapl mapr r1 r2') -> P (Node l1 x1 d1 r1 _x) (Node _x0 _x1 _x2 _x3 _x4) (concat (map2_opt f mapl mapr l1 l2') (map2_opt f mapl mapr r1 r2'))) -> forall (m1 : t elt) (m2 : t elt'), P m1 m2 (map2_opt f mapl mapr m1 m2).