Fixpoint inter (s1 s2: t) {struct s1} : t :=
  let fix intr (s2: t) : t :=
    match s1, s2 with
    | Nil, _ => Nil
    | _, Nil => Nil
    | Cons l1 h1 s1', Cons l2 h2 s2' =>
        if zle h1 l2 then inter s1' s2
        else if zle h2 l1 then intr s2'
        else if zle l1 l2 then
          if zle h2 h1 then Cons l2 h2 (intr s2') else Cons l2 h1 (inter s1' s2)
        else
          if zle h1 h2 then Cons l1 h1 (inter s1' s2) else Cons l1 h2 (intr s2')
    end
  in intr s2.

(* Specifications: *)
Lemma In_inter: forall x s1, ok s1 -> forall s2, ok s2 -> (In x (inter s1 s2) <-> In x s1 /\ In x s2).
Lemma inter_ok: forall s1, ok s1 -> forall s2, ok s2 -> ok (inter s1 s2).