(* Minus x y computes x - y and returns whether x >= y (e.g., if the subtraction did not need to truncate) *)
Definition Subtract_Rel : pRel (sigNat^+) bool 2 :=
fun tin '(b, tout) =>
forall (x y : nat),
tin [@Fin0] ≃ x
-> tin [@Fin1] ≃ y
-> tout [@Fin0] ≃ x - y
/\ isVoid tout [@Fin1]
/\ b = (y <=? x).
Definition Subtract :pTM (sigNat^+) bool 2:=
While (
If(CaseNat @ [|Fin1|])
(If (CaseNat @ [|Fin0|])
(Return Nop None)
(Return (Reset _ @ [|Fin1|]) (Some false)) )
(Return (Reset _ @ [|Fin1|]) (Some true))
).

Lemma Subtract_Realise : Subtract ⊨ Subtract_Rel.