(* Minus x y computes x - y and returns whether x >= y (e.g., if the subtraction did not need to truncate) *)
Definition Subtract_Rel : pRel (sigNat^+) bool 2 :=
fun tin '(b, tout) =>
forall (x y : nat),
tin [@Fin0] ≃ x
-> tin [@Fin1] ≃ y
-> tout [@Fin0] ≃ x - y
/\ isVoid tout [@Fin1]
/\ b = (y <=? x).
Definition Subtract :pTM (sigNat^+) bool 2:=
While (
If(CaseNat @ [|Fin1|])
(If (CaseNat @ [|Fin0|])
(Return Nop None)
(Return (Reset _ @ [|Fin1|]) (Some false)) )
(Return (Reset _ @ [|Fin1|]) (Some true))
).

Theorem Subtract_SpecT:
{ f : UpToC (fun x => x + 1) & forall (x y : nat),
TripleT ≃≃([],[|Contains _ x;Contains _ y|])
(f (y)) Subtract
(fun b => ≃≃([b = (y <=? x)],
([|Contains _ (x-y);Void|])))}.