Fixpoint In_queue_before_data (d d1 : data) (q : queue data) {struct q} :
 Prop :=
  match q with
  | empty => True
  | input d' q' =>
      if eq_data_dec d' d1
      then False
      else d' = d \/ In_queue_before_data d d1 q'
  end.(* same except that I pass a predicate to recognise d1 *)

Fixpoint In_queue_before (d : data) (f1 : data -> bool) 
 (q : queue data) {struct q} : Prop :=
  match q with
  | empty => True
  | input d' q' =>
      if eq_bool_dec (f1 d')
      then False
      else d' = d \/ In_queue_before d f1 q'
  end.Definition is_inc_dec (m : Message) :=
  match m with
  | inc_dec _ => true
  | _ => false
  end.Inductive alternate : queue Message -> Prop :=
  | alt_null : alternate (empty Message)
  | alt_any_alt :
      forall (qm : queue Message) (m : Message),
      (forall s : Site, m <> inc_dec s) ->
      alternate qm -> alternate (input Message m qm)
  | alt_inc_dec :
      forall (qm : queue Message) (s0 : Site),
      alternate qm ->
      In_queue_before Message dec is_inc_dec qm ->
      alternate (input Message (inc_dec s0) qm).Inductive alternate : queue Message -> Prop :=
  | alt_null : alternate (empty Message)
  | alt_any_alt :
      forall (qm : queue Message) (m : Message),
      (forall s : Site, m <> inc_dec s) ->
      alternate qm -> alternate (input Message m qm)
  | alt_inc_dec :
      forall (qm : queue Message) (s0 : Site),
      alternate qm ->
      In_queue_before Message dec is_inc_dec qm ->
      alternate (input Message (inc_dec s0) qm).Inductive alternate : queue Message -> Prop :=
  | alt_null : alternate (empty Message)
  | alt_any_alt :
      forall (qm : queue Message) (m : Message),
      (forall s : Site, m <> inc_dec s) ->
      alternate qm -> alternate (input Message m qm)
  | alt_inc_dec :
      forall (qm : queue Message) (s0 : Site),
      alternate qm ->
      In_queue_before Message dec is_inc_dec qm ->
      alternate (input Message (inc_dec s0) qm).Inductive alternate : queue Message -> Prop :=
  | alt_null : alternate (empty Message)
  | alt_any_alt :
      forall (qm : queue Message) (m : Message),
      (forall s : Site, m <> inc_dec s) ->
      alternate qm -> alternate (input Message m qm)
  | alt_inc_dec :
      forall (qm : queue Message) (s0 : Site),
      alternate qm ->
      In_queue_before Message dec is_inc_dec qm ->
      alternate (input Message (inc_dec s0) qm).

(* Specifications: *)
Lemma dec_is_not_inc : forall s : Site, dec <> inc_dec s.