Fixpoint partition_aux (f: key -> bool) (s: tree)
   (nl1 nl2: positive *  list key) :  (positive * list key) * (positive * list key) :=
 match s with
 | T _ sl k sr => match partition_aux f sr nl1 nl2
    with (nl1', nl2') =>
                    if f k then partition_aux f sl (Psucc (fst nl1'), k:: snd nl1') nl2'
                            else partition_aux f sl nl1' (Psucc (fst nl2'), k:: snd nl2')
    end
 | EE => (nl1,nl2)
 end.

(* Specifications: *)
Lemma partition_aux_lemma1: forall f s lo hi, searchtree lo hi s -> forall nl1' nl2' nl1 nl2, (nl1',nl2') = partition_aux f s nl1 nl2 -> (hi=None -> snd nl1 = nil /\ snd nl2 = nil) -> HdRel' Kle hi (snd nl1) -> HdRel' Kle hi (snd nl2) -> Sorted K.lt (snd nl1) -> Sorted K.lt (snd nl2) -> S (length (snd nl1)) = nat_of_P (fst nl1) -> S (length (snd nl2)) = nat_of_P (fst nl2) -> HdRel' K.lt lo (snd nl1') /\ HdRel' K.lt lo (snd nl2') /\ Sorted K.lt (snd nl1') /\ Sorted K.lt (snd nl2') /\ S (length (snd nl1')) = nat_of_P (fst nl1') /\ S (length (snd nl2')) = nat_of_P (fst nl2').