| avols = ∅, err = err0, err = ESUCCESS, ⌊err0⌋ ∨ err0 = ESUCCESS ⊦ ⟪if err = ESUCCESS then {v := default-volid; ebm_create_volume#(v, m; avols; err)}⟫ (err = ESUCCESS → default-volid ∈ avols ∧ v = default-volid ∧ ebm-cons(avols)) |
avols = ∅, err = ESUCCESS, err = err0, ⌊err0⌋ ∨ err0 = ESUCCESS ⊦ ⟪v := default-volid; ebm_create_volume#(v, m; avols; err)⟫ (err = ESUCCESS → default-volid ∈ avols ∧ v = default-volid ∧ ebm-cons(avols))