Fixpoint replacel (be : bool_expr) (lx ly : list ad) {struct ly} :
 bool_expr :=
  match lx, ly with
  | nil, _ => be
  | _ :: _, nil => (* error *)  be
  | x :: lx', y :: ly' => replace x y (replacel be lx' ly')
  end.Fixpoint bool_fun_replacel (bf : bool_fun) (lx ly : list ad) {struct ly} :
 bool_fun :=
  match lx, ly with
  | nil, _ => bf
  | _ :: _, nil => (* error *)  bf
  | x :: lx', y :: ly' => bool_fun_replace x y (bool_fun_replacel bf lx' ly')
  end.

(* Specifications: *)
Lemma replacel_OK : forall (lx ly : list ad) (be : bool_expr), bool_fun_eq (bool_fun_of_bool_expr (replacel be lx ly)) (bool_fun_replacel (bool_fun_of_bool_expr be) lx ly).