Fixpoint beq (s1 s2: t) : bool :=
match s1, s2 with
| Nil, Nil => true
| Cons l1 h1 t1, Cons l2 h2 t2 => zeq l1 l2 && zeq h1 h2 && beq t1 t2
| _, _ => false
end.

Lemma beq_spec:
forall s1, ok s1 -> forall s2, ok s2 ->
(beq s1 s2 = true <-> (forall x, In x s1 <-> In x s2)).