Fixpoint replacel (be : bool_expr) (lx ly : list ad) {struct ly} :
bool_expr :=
match lx, ly with
| nil, _ => be
| _ :: _, nil => (* error *)  be
| x :: lx', y :: ly' => replace x y (replacel be lx' ly')
end.
Fixpoint bool_fun_replacel (bf : bool_fun) (lx ly : list ad) {struct ly} :
bool_fun :=
match lx, ly with
| nil, _ => bf
| _ :: _, nil => (* error *)  bf
| x :: lx', y :: ly' => bool_fun_replace x y (bool_fun_replacel bf lx' ly')
end.

(* Specifications: *)
Lemma replacel_OK :
forall (lx ly : list ad) (be : bool_expr),
bool_fun_eq (bool_fun_of_bool_expr (replacel be lx ly))
(bool_fun_replacel (bool_fun_of_bool_expr be) lx ly).