Fixpoint subst (x : BDDvar) (bex be : bool_expr) {struct be} : bool_expr :=
  match be with
  | Zero => Zero
  | One => One
  | Var y => if Neqb x y then bex else be
  | Neg be1 => Neg (subst x bex be1)
  | Or be1 be2 => Or (subst x bex be1) (subst x bex be2)
  | ANd be1 be2 => ANd (subst x bex be1) (subst x bex be2)
  | Impl be1 be2 => Impl (subst x bex be1) (subst x bex be2)
  | Iff be1 be2 => Iff (subst x bex be1) (subst x bex be2)
  end.

(* Specifications: *)
Lemma subst_ok : forall (be bex : bool_expr) (x : BDDvar), bool_fun_eq (bool_fun_of_bool_expr (subst x bex be)) (bool_fun_subst x (bool_fun_of_bool_expr bex) (bool_fun_of_bool_expr be)).