Definition elt := X.t.Definition t := list elt.Definition empty : t := nil.Definition is_empty (l : t) : bool := if l then true else false.Fixpoint mem (x : elt) (s : t) : bool :=
    match s with
    | nil => false
    | y :: l =>
           if X.eq_dec x y then true else mem x l
    end.Fixpoint add (x : elt) (s : t) : t :=
    match s with
    | nil => x :: nil
    | y :: l =>
        if X.eq_dec x y then s else y :: add x l
    end.Definition singleton (x : elt) : t := x :: nil.Fixpoint remove (x : elt) (s : t) : t :=
    match s with
    | nil => nil
    | y :: l =>
        if X.eq_dec x y then l else y :: remove x l
    end.Definition fold (B : Type) (f : elt -> B -> B) : t -> B -> B :=
    fold_left (flip f).Definition union (s : t) : t -> t := fold add s.Definition diff (s s' : t) : t := fold remove s' s.Definition inter (s s': t) : t :=
    fold (fun x s => if mem x s' then add x s else s) s nil.Definition subset (s s' : t) : bool := is_empty (diff s s').Definition equal (s s' : t) : bool := andb (subset s s') (subset s' s).Fixpoint filter (f : elt -> bool) (s : t) : t :=
    match s with
    | nil => nil
    | x :: l => if f x then x :: filter f l else filter f l
    end.Fixpoint for_all (f : elt -> bool) (s : t) : bool :=
    match s with
    | nil => true
    | x :: l => if f x then for_all f l else false
    end.Fixpoint exists_ (f : elt -> bool) (s : t) : bool :=
    match s with
    | nil => false
    | x :: l => if f x then true else exists_ f l
    end.Fixpoint partition (f : elt -> bool) (s : t) : t * t :=
    match s with
    | nil => (nil, nil)
    | x :: l =>
        let (s1, s2) := partition f l in
        if f x then (x :: s1, s2) else (s1, x :: s2)
    end.Definition cardinal (s : t) : nat := length s.Definition elements (s : t) : list elt := s.Definition choose (s : t) : option elt :=
     match s with
      | nil => None
      | x::_ => Some x
     end.Notation NoDup := (NoDupA X.eq).Notation In := (InA X.eq).Definition IsOk := NoDup.Class Ok (s:t) : Prop := ok : NoDup s.Class Ok (s:t) : Prop := ok : NoDup s.Instance NoDup_Ok s (nd : NoDup s) : Ok s := { ok := nd }.Ltac inv_ok := match goal with
   | H:Ok (_ :: _) |- _ => inversion_clear H; inv_ok
   | H:Ok nil |- _ => clear H; inv_ok
   | H:NoDup ?l |- _ => change (Ok l) in H; inv_ok
   | _ => idtac
  end.Ltac inv := invlist InA; inv_ok.Ltac constructors := repeat constructor.Fixpoint isok l := match l with
   | nil => true
   | a::l => negb (mem a l) && isok l
  end.Definition Equal s s' := forall a : elt, In a s <-> In a s'.Definition Subset s s' := forall a : elt, In a s -> In a s'.Definition Empty s := forall a : elt, ~ In a s.Definition For_all (P : elt -> Prop) s := forall x, In x s -> P x.Definition Exists (P : elt -> Prop) s := exists x, In x s /\ P x.

(* Specifications: *)
Lemma In_compat : Proper (X.eq==>eq==>iff) In.
Lemma mem_spec : forall s x `{Ok s}, mem x s = true <-> In x s.
Lemma isok_iff : forall l, Ok l <-> isok l = true.