Module Type ZBitsProp
(Import A : ZAxiomsSig')
(Import B : ZMulOrderProp A)
(Import C : ZParityProp A B)
(Import D : ZSgnAbsProp A B)
(Import E : ZPowProp A B C D)
(Import F : ZDivProp A B D)
(Import G : NZLog2Prop A A A B E).
Include BoolEqualityFacts A.
Ltac order_nz := try apply pow_nonzero; order'.
Ltac order_pos' := try apply abs_nonneg; order_pos.
Hint Rewrite div_0_l mod_0_l div_1_r mod_1_r : nz.
(** Some properties of power and division *)
(** An injection from bits [true] and [false] to numbers 1 and 0. We declare it as a (local) coercion for shorter statements. *)
Definition b2z (b:bool) := if b then 1 else 0.
Local Coercion b2z : bool >-> t.
Instance b2z_wd : Proper (Logic.eq ==> eq) b2z := _.
(** We can compact [testbit_odd_0] [testbit_even_0] [testbit_even_succ] [testbit_odd_succ] in only two lemmas. *)
(** Alternative characterisations of [testbit] *)
(** This concise equation could have been taken as specification for testbit in the interface, but it would have been hard to implement with little initial knowledge about div and mod *)
(** This characterisation that uses only basic operations and power was initially taken as specification for testbit. We describe [a] as having a low part and a high part, with the corresponding bit in the middle. This characterisation is moderatly complex to implement, but also moderately usable... *)
(** Results about the injection [b2z] *)
(** The specification of testbit by low and high parts is complete *)
(** All bits of number 0 are 0 *)
(** For negative numbers, we are actually doing two's complement *)
(** All bits of number (-1) are 1 *)
(** Various ways to refer to the lowest bit of a number *)
(** Hence testing a bit is equivalent to shifting and testing parity *)
(** [log2] gives the highest nonzero bit of positive numbers *)
(** Hence the number of bits of [a] is [1+log2 a] (see [Pos.size_nat] and [Pos.size]). *)
(** For negative numbers, things are the other ways around: log2 gives the highest zero bit (for numbers below -1). *)
(** Accessing a high enough bit of a number gives its sign *)
(** Testing bits after division or multiplication by a power of two *)
(** Selecting the low part of a number can be done by a modulo *)
(** We now prove that having the same bits implies equality. For that we use a notion of equality over functional streams of bits. *)
Definition eqf (f g:t -> bool) := forall n:t, f n = g n.
Instance eqf_equiv : Equivalence eqf.
Local Infix "===" := eqf (at level 70, no associativity).
Instance testbit_eqf : Proper (eq==>eqf) testbit.
(** Only zero corresponds to the always-false stream. *)
(** If two numbers produce the same stream of bits, they are equal. *)
(** In fact, checking the bits at positive indexes is enough. *)
Ltac bitwise := apply bits_inj'; intros ?m ?Hm; autorewrite with bitwise.
Hint Rewrite lxor_spec lor_spec land_spec ldiff_spec bits_0 : bitwise.
(** The streams of bits that correspond to a numbers are exactly the ones which are stationary after some point. *)
(** * Properties of shifts *)
(** First, a unified specification for [shiftl] : the [shiftl_spec] below (combined with [testbit_neg_r]) is equivalent to [shiftl_spec_low] and [shiftl_spec_high]. *)
(** A shiftl by a negative number is a shiftr, and vice-versa *)
(** Shifts correspond to multiplication or division by a power of two *)
(** Shifts are morphisms *)
Instance shiftr_wd : Proper (eq==>eq==>eq) shiftr.
Instance shiftl_wd : Proper (eq==>eq==>eq) shiftl.
(** We could also have specified shiftl with an addition on the left. *)
(** Chaining several shifts. The only case for which there isn't any simple expression is a true shiftr followed by a true shiftl. *)
(** shifts and constants *)
(** Properties of [div2]. *)
Instance div2_wd : Proper (eq==>eq) div2.
(** Properties of [lxor] and others, directly deduced from properties of [xorb] and others. *)
Instance lxor_wd : Proper (eq ==> eq ==> eq) lxor.
Instance land_wd : Proper (eq ==> eq ==> eq) land.
Instance lor_wd : Proper (eq ==> eq ==> eq) lor.
Instance ldiff_wd : Proper (eq ==> eq ==> eq) ldiff.

Lemma lxor_nilpotent : forall a, lxor a a == 0.