Definition BDDsubst (cfg : BDDconfig) (ul : list ad) 
  (node1 : ad) (x : BDDvar) (node2 : ad) :=
  match BDDvar_make gc cfg ul x with
  | (cfg1, nodex) =>
      match BDDiff gc cfg1 (nodex :: ul) nodex node2 with
      | (cfg2, node3) =>
          match BDDimpl gc cfg2 (node3 :: ul) node3 node1 with
          | (cfg3, node4) => BDDuniv cfg3 (node4 :: ul) x node4
          end
      end
  end.

Lemma BDDsubst_list_OK : used_list_OK (fst (BDDsubst cfg ul node1 x node2)) ul.