Fixpoint split_tok1 (n:nat) (x:ShareTree) {struct x} : ShareTree :=
      match x with
      | Node (Leaf true)  t2 =>
          match n with
          | O    => Node (Leaf true) (Leaf false)
          | S n' => Node (Leaf true) (split_tok1 n' t2)
          end
      | Node (Leaf false) t2 => Node (Leaf false) (split_tok1 n t2)
      | _ => Leaf false
      end.Fixpoint split_tok2 (n:nat) (x:ShareTree) {struct x} : ShareTree :=
      match x with
      | Node (Leaf true)  t2 =>
          match n with
          | O    => Node (Leaf false) t2
          | S n' => Node (Leaf false) (split_tok2 n' t2)
          end
      | Node (Leaf false) t2 => Node (Leaf false) (split_tok2 n t2)
      | _ => x
      end.

(* Specifications: *)
Lemma split_tok_lub : forall tok n, shareTreeEq tok (union_tree (split_tok1 n tok) (split_tok2 n tok)).
Lemma split_tok_glb : forall tok n, shareTreeOrd (intersect_tree (split_tok1 n tok) (split_tok2 n tok)) (Leaf false).
Lemma split_tok1_correct : forall tok n m, isToken' tok m -> gt m n -> isToken' (split_tok1 n tok) (S n).
Lemma split_tok2_correct : forall tok n m, isToken' tok m -> gt m n -> isToken' (mkCanon (split_tok2 n tok)) (m - (S n)).