Fixpoint beq (s1 s2: t) : bool :=
  match s1, s2 with
  | Nil, Nil => true
  | Cons l1 h1 t1, Cons l2 h2 t2 => zeq l1 l2 && zeq h1 h2 && beq t1 t2
  | _, _ => false
  end.

(* Specifications: *)
Lemma beq_spec: forall s1, ok s1 -> forall s2, ok s2 -> (beq s1 s2 = true <-> (forall x, In x s1 <-> In x s2)).