(* ========================================================
          ALWAYS (multi-)sets
==========================================================*)

(* s1 - s2: *)

Fixpoint set_minus(s1 s2:set){struct s1}:set:=
 match s1 with
     Vs => Vs
   | Is s0 x =>
       if exds_dec s2 x then set_minus s0 s2
       else Is (set_minus s0 s2) x
 end.

(* Specifications: *)
Lemma not_exds_minus: forall(s1 s2:set)(z:dart), ~ exds s1 z -> ~ exds (set_minus s1 s2) z.
Lemma exds_set_minus: forall(s1 s2:set)(z:dart), exds s1 z -> ~exds s2 z -> exds (set_minus s1 s2) z.
Lemma not_exds_set_minus: forall(s1 s2:set)(z:dart), exds s2 z -> ~exds (set_minus s1 s2) z.
Lemma exds_set_minus_eq:forall(s1 s2:set)(z:dart), (exds s1 z /\ ~exds s2 z) <-> exds (set_minus s1 s2) z.