(* Implementation and proof of Red-Black Trees, matching the Coq Library MSets interface. Author:  Andrew W. Appel, 2011.  The design decisions behind this implementation are described here: Efficient Verified Red-Black Trees, by Andrew W. Appel, September 2011. http://www.cs.princeton.edu/~appel/papers/redblack.pdf  Additional suggested reading: Red-Black Trees in a Functional Setting by Chris Okasaki. Journal of Functional Programming, 9(4):471-477, July 1999. http://www.eecs.usma.edu/webs/people/okasaki/jfp99redblack.pdf  Red-black trees with types, by Stefan Kahrs. Journal of Functional Programming, 11(4), 425-432, 2001.  Functors for Proofs and Programs, by J.-C. Filliatre and P. Letouzey. ESOP'04: European Symposium on Programming, pp. 370-384, 2004. http://www.lri.fr/~filliatr/ftp/publis/fpp.ps.gz  *)
Require MSets.
Require Coq.Structures.Orders.
Require Coq.Structures.OrdersFacts.
Require Omega.
Module Type MSetPlus.
Include MSetInterface.S.
Parameter delete_min : t -> option (elt * t).

(* Specifications: *)
Axiom delete_min_spec1: forall (s: t) k s',
delete_min s = Some (k,s') <->
(min_elt s = Some k /\ remove k s = s').
Axiom delete_min_spec2: forall s, delete_min s = None <-> Empty s.
Parameter mem_add: elt -> t -> option t.
Axiom mem_add_spec:
forall x s, mem_add x s = if mem x s then None else Some (add x s).