let rec fixpoint sf sn p =
match sf,sn with
| (_,x')::sf , (_,y)::sn ->
F.p_implies
(F.p_eq (F.var x') (F.var y))
(fixpoint sf sn p)
| [] , [] -> p
| _ -> Wp_parameters.fatal "inconsistent domains in fixpoint substitutions"