| m < # apebs, abs(pebs, apebs), mtd-cons(pebs), ubi-io-inv(apebs), ⌊err0⌋ ⊦ ⟨choose err0 with ⌊err0⌋ ∨ err0 = ESUCCESS in err := err0; if err = ESUCCESS then isbad := apebs[m].bad else isbad := ?⟩ ((isbad1 ↔ isbad) ∧ err0 = err) |
m < # apebs, abs(pebs, apebs), mtd-cons(pebs), ubi-io-inv(apebs), ⌊err1⌋ ⊦ ∃ err0. (⌊err0⌋ ∨ err0 = ESUCCESS) ∧ ⟨err := err0; if err = ESUCCESS then isbad := apebs[m].bad else isbad := ?⟩ ((isbad1 ↔ isbad) ∧ err1 = err)