Definition choose_spec1 :
    forall (s : t) (x : elt), choose s = Some x -> In x s := min_elt_spec1.Definition choose_spec2 :
    forall s : t, choose s = None -> Empty s := min_elt_spec3.

Lemma cardinal_spec : forall (s : t) (Hs : Ok s), cardinal s = length (elements s).