Section lt_spec.
Inductive ct: comparison -> comparison -> comparison -> Prop :=
| ct_xxx: forall x, ct x  x  x
| ct_xex: forall x, ct x  Eq x
| ct_exx: forall x, ct Eq x  x
| ct_glx: forall x, ct Gt Lt x
| ct_lgx: forall x, ct Lt Gt x.
End lt_spec.
Instance lt_strorder : StrictOrder lt.
Local Instance compare_compat_1 : Proper (eq==>Logic.eq==>Logic.eq) compare.
Instance compare_compat : Proper (eq==>eq==>Logic.eq) compare.
Local Instance lt_compat : Proper (eq==>eq==>iff) lt.
(** Specification of [add] *)
(** Specification of [remove] *)
(** Specification of [singleton] *)
(** Specification of [union] *)
(** Specification of [inter] *)
(** Specification of [diff] *)
(** Specification of [fold] *)
(** Specification of [cardinal] *)
(** Specification of [filter] *)

Lemma filter_spec: forall s x f, @compat_bool elt E.eq f ->
(In x (filter f s) <-> In x s /\ f x = true).