Section lt_spec.
Inductive ct: comparison -> comparison -> comparison -> Prop :=
| ct_xxx: forall x, ct x  x  x
| ct_xex: forall x, ct x  Eq x
| ct_exx: forall x, ct Eq x  x
| ct_glx: forall x, ct Gt Lt x
| ct_lgx: forall x, ct Lt Gt x.
End lt_spec.
Instance lt_strorder : StrictOrder lt.
Local Instance compare_compat_1 : Proper (eq==>Logic.eq==>Logic.eq) compare.
Instance compare_compat : Proper (eq==>eq==>Logic.eq) compare.
Local Instance lt_compat : Proper (eq==>eq==>iff) lt.
(** Specification of [add] *)
(** Specification of [remove] *)
(** Specification of [singleton] *)
(** Specification of [union] *)
(** Specification of [inter] *)
(** Specification of [diff] *)
(** Specification of [fold] *)
(** Specification of [cardinal] *)
(** Specification of [filter] *)

Lemma xfilter_spec: forall f s x i,
In x (xfilter f s i) <-> In x s /\ f (i@x) = true.