Fixpoint subst (x : BDDvar) (bex be : bool_expr) {struct be} : bool_expr :=
match be with
| Zero => Zero
| One => One
| Var y => if Neqb x y then bex else be
| Neg be1 => Neg (subst x bex be1)
| Or be1 be2 => Or (subst x bex be1) (subst x bex be2)
| ANd be1 be2 => ANd (subst x bex be1) (subst x bex be2)
| Impl be1 be2 => Impl (subst x bex be1) (subst x bex be2)
| Iff be1 be2 => Iff (subst x bex be1) (subst x bex be2)
end.

(* Specifications: *)
Lemma subst_ok :
forall (be bex : bool_expr) (x : BDDvar),
bool_fun_eq (bool_fun_of_bool_expr (subst x bex be))
(bool_fun_subst x (bool_fun_of_bool_expr bex) (bool_fun_of_bool_expr be)).