law u32_sub_exact

bend-mathlib@0.8.1.0 · u32.bend:636

import Base
import bend-mathlib@0.8.1.0/nat.bend as MNat

636# U32 subtraction is exact without underflow: b <= a implies to_nat (a - b) = a - b.
637law u32_sub_exact:
638  for a: U32
639  for b: U32
640  for h: MNat.le(U32.to_nat(b), U32.to_nat(a))
641  {U32.to_nat(U32.sub(a, b)) == Nat.sub(U32.to_nat(a), U32.to_nat(b)) : Nat}