Fixpoint BDDreplacel (cfg : BDDconfig) (ul : list ad) 
 (node : ad) (lx ly : list BDDvar) {struct ly} : BDDconfig * ad :=
  match lx, ly with
  | nil, _ => (cfg, node)
  | _ :: _, nil => (cfg, node)
  | x :: lx', y :: ly' =>
      match BDDreplacel cfg ul node lx' ly' with
      | (cfg1, node1) => BDDreplace cfg1 (node1 :: ul) node1 x y
      end
  end.

(* Specifications: *)
Lemma BDDreplacel_lemma : forall (lx ly : list ad) (cfg : BDDconfig) (ul : list ad) (node : ad), BDDconfig_OK cfg -> used_list_OK cfg ul -> used_node' cfg ul node -> ad_list_neq lx ly = true -> BDDconfig_OK (fst (BDDreplacel cfg ul node lx ly)) /\ config_node_OK (fst (BDDreplacel cfg ul node lx ly)) (snd (BDDreplacel cfg ul node lx ly)) /\ used_nodes_preserved cfg (fst (BDDreplacel cfg ul node lx ly)) ul /\ bool_fun_eq (bool_fun_of_BDD (fst (BDDreplacel cfg ul node lx ly)) (snd (BDDreplacel cfg ul node lx ly))) (bool_fun_replacel (bool_fun_of_BDD cfg node) lx ly).
Lemma BDDreplacel_config_OK : BDDconfig_OK (fst (BDDreplacel cfg ul node lx ly)).
Lemma BDDreplacel_node_OK : config_node_OK (fst (BDDreplacel cfg ul node lx ly)) (snd (BDDreplacel cfg ul node lx ly)).
Lemma BDDreplacel_used_nodes_preserved : used_nodes_preserved cfg (fst (BDDreplacel cfg ul node lx ly)) ul.
Lemma BDDreplacel_list_OK : used_list_OK (fst (BDDreplacel cfg ul node lx ly)) ul.
Lemma BDDreplacel_list_OK_cons : used_list_OK (fst (BDDreplacel cfg ul node lx ly)) (snd (BDDreplacel cfg ul node lx ly) :: ul).
Lemma BDDreplacel_is_replacel : bool_fun_eq (bool_fun_of_BDD (fst (BDDreplacel cfg ul node lx ly)) (snd (BDDreplacel cfg ul node lx ly))) (bool_fun_replacel (bool_fun_of_BDD cfg node) lx ly).