reserve x,y,z,c for object,
  f for Function of 2-tuples_on BOOLEAN, BOOLEAN;
reserve s for State of 2GatesCircuit(x,y,c,f);

theorem
  c <> [<*x,y*>, '&'] implies for s being State of 2GatesCircuit(x,y,c,
  '&') for a1,a2,a3 being Element of BOOLEAN st a1 = s.x & a2 = s.y & a3 = s.c
  holds (Following(s,2)).2GatesCircOutput(x,y,c,'&') = a1 '&' a2 '&' a3
proof
  set f = '&';
  assume
A1: c <> [<*x,y*>, f];
  let s be State of 2GatesCircuit(x,y,c,f);
  let a1,a2,a3 be Element of BOOLEAN;
  assume a1 = s.x & a2 = s.y & a3 = s.c;
  hence (Following(s,2)).2GatesCircOutput(x,y,c,f) = f.<*f.<*a1, a2*>, a3*> by
A1,Th62
    .= f.<*a1 '&' a2, a3*> by Def5
    .= a1 '&' a2 '&' a3 by Def5;
end;
