End NilEmpty.
(** Decimal/String conversions where [Nil] is ["0"] *)
Module NilZero.
Definition string_of_uint (d:uint) :=
match d with
| Nil => "0"
| _ => NilEmpty.string_of_uint d
end.
Definition uint_of_string s :=
match s with
| EmptyString => None
| _ => NilEmpty.uint_of_string s
end.
Definition string_of_int (d:int) :=
match d with
| Pos d => string_of_uint d
| Neg d => String "-" (string_of_uint d)
end.
Definition int_of_string s :=
match s with
| EmptyString => None
| String a s' =>
if Ascii.eqb a "-" then option_map Neg (uint_of_string s')
else option_map Pos (uint_of_string s)
end.
(** Corresponding proofs *)

(* Specifications: *)
Lemma uint_of_string_nonnil s : uint_of_string s <> Some Nil.
Lemma sus s d :
uint_of_string s = Some d -> string_of_uint d = s.
Lemma usu d :
d<>Nil -> uint_of_string (string_of_uint d) = Some d.
Lemma usu_nil :
uint_of_string (string_of_uint Nil) = Some Decimal.zero.
Lemma usu_gen d :
uint_of_string (string_of_uint d) = Some d \/
uint_of_string (string_of_uint d) = Some Decimal.zero.
Lemma isi d :
d<>Pos Nil -> d<>Neg Nil ->
int_of_string (string_of_int d) = Some d.
Lemma isi_posnil :
int_of_string (string_of_int (Pos Nil)) = Some (Pos Decimal.zero).