Fixpoint partition_aux (f: key -> bool) (s: tree)
(nl1 nl2: positive *  list key) :  (positive * list key) * (positive * list key) :=
match s with
| T _ sl k sr => match partition_aux f sr nl1 nl2
with (nl1', nl2') =>
if f k then partition_aux f sl (Psucc (fst nl1'), k:: snd nl1') nl2'
else partition_aux f sl nl1' (Psucc (fst nl2'), k:: snd nl2')
end
| EE => (nl1,nl2)
end.

(* Specifications: *)
Lemma partition_aux_lemma1:
forall f s lo hi, searchtree lo hi s ->
forall nl1' nl2' nl1 nl2,
(nl1',nl2') = partition_aux f s nl1 nl2 ->
(hi=None -> snd nl1 = nil /\ snd nl2 = nil) ->
HdRel' Kle hi (snd nl1) ->
HdRel' Kle hi (snd nl2) ->
Sorted K.lt (snd nl1) ->
Sorted K.lt (snd nl2) ->
S (length (snd nl1)) = nat_of_P (fst nl1) ->
S (length (snd nl2)) = nat_of_P (fst nl2) ->
HdRel' K.lt lo (snd nl1') /\  HdRel' K.lt lo (snd nl2') /\
Sorted K.lt (snd nl1') /\ Sorted K.lt (snd nl2') /\
S (length (snd nl1')) = nat_of_P (fst nl1') /\
S (length (snd nl2')) = nat_of_P (fst nl2').