(*************************************************************************)
(** ** Additional Exercises                                              *)
(*************************************************************************)

(* Specifications: *)
(** Step through the proof that free variables are not introduced by substitution.  This proof actually is very automatable ([simpl in *; auto.] takes care of all but the var_f case), but the explicit proof below demonstrates two parts of the finite set library. These two parts are the tactic [destruct_notin] and the lemma [notin_union], both defined in the module [FSetWeakNotin].  Before stepping through this proof, you should go to that module to read about those definitions and see what other finite set reasoning is available.  *)
Lemma fv_exp_subst_exp_notin : forall x y u e,
x `notin` fv_exp e ->
x `notin` fv_exp u ->
x `notin` fv_exp ([y ~> u]e).