Fixpoint elements' (x: tree) (base: list key) : list key :=
  match x with
  | EE => base
  | T _ t1 k t2 => elements' t1 (cons k (elements' t2 base))
 end.

(* Specifications: *)
Lemma elements'_interp : forall s x l, SetoidList.InA E.eq x (elements' s l) <-> interp s x \/ InA E.eq x l.
Lemma union'_spec : forall s s' x, valid s -> valid s' -> (interp (union' s s') x <-> interp s x \/ interp s' x).
Lemma filter'_spec : forall s x f, compatb f -> valid s -> (interp (filter' f s) x <-> interp s x /\ f x = true).
Lemma choose'_spec1 : forall s x, searchtree None None s -> choose' s = Some x -> interp s x.
Lemma choose'_spec2 : forall s, choose' s = None -> s=EE.
Lemma delmin_eq: forall s x (v: searchtree None None s), choose' s = Some x -> delete'_min s = Some (x, delete x s).
Lemma delete_min_valid: forall s, valid s -> match delete'_min s with | Some (_, s0) => valid s0 | None => True end.
Lemma member_compat: forall s, valid s -> Proper (E.eq ==> Logic.eq) (fun k : key => member k s).
Lemma inter'_spec : forall s s' x, valid s -> valid s' -> (interp (inter' s s') x <-> interp s x /\ interp s' x).
Lemma diff'_spec : forall s s' x, valid s -> valid s' -> (interp (diff' s s') x <-> interp s x /\ ~ interp s' x).
Lemma interp_dec: forall s x, {interp s x}+{~interp s x}.