Definition valid (x: tree) := searchtree None None x /\
                                  (exists n, is_redblack x Red n).(*  NOW FOR THE HARD PART, DELETION!
   Here we follow the deletion algorithm of Stefan Kahrs (2001),
  and in particular,
  http://www.cs.kent.ac.uk/people/staff/smk/redblack/Untyped.hs
*)

Ltac hax :=
  repeat (auto; try solve [repeat constructor; auto];
             match goal with
             | H: is_redblack _ Red _ |- _ => inv H
              | H: is_redblack _ _ 0 |- _ => inv H
             | H: is_redblack _ _ (S _) |- _ => inv H
             | H: infrared _ 0 |- _ => inv H
             | H: infrared _ (S _) |- _ => inv H
             end).

(* Specifications: *)
Lemma balance'_shape: forall n tl k tr, (is_redblack tl Black n /\ infrared tr n \/ infrared tl n /\ is_redblack tr Black n) -> is_redblack (balance' tl k tr) Black (S n).
Lemma searchtree_balance': forall s1 t s2 lo hi, searchtree lo (Some t) s1 -> searchtree (Some t) hi s2 -> searchtree lo hi (balance' s1 t s2).
Lemma searchtree_append_aux: forall n tl tr, size tl + size tr < n -> forall lo k hi, searchtree lo (Some k) tl -> searchtree (Some k) hi tr -> searchtree lo hi (append(tl,tr)).
Lemma searchtree_append: forall tl tr lo k hi, searchtree lo (Some k) tl -> searchtree (Some k) hi tr-> searchtree lo hi (append(tl,tr)).
Lemma searchtree_sub1: forall t lo hi, searchtree lo hi t -> searchtree lo hi (sub1 t).
Lemma del_is_searchtree: forall x t lo hi, searchtree lo hi t -> searchtree lo hi (del x t).