| avols = avols0, err = err0, ebm-cons(avols1), ebm-cons(avols0), avols1 ⊆ avols0, ⌊err0⌋ ∨ err0 = ESUCCESS ⊦ ⟪if err ≠ ESUCCESS then avols := ?⟫ (err = ESUCCESS → ebm-cons(avols)) |
avols = avols0, err = err0, ebm-cons(avols0), ebm-cons(avols1), avols1 ⊆ avols0, ⌊err0⌋ ∨ err0 = ESUCCESS ⊦ ⟪avols := ?⟫ (err = ESUCCESS → ebm-cons(avols)), err = ESUCCESS
avols = avols0, err = ESUCCESS, err = err0, ebm-cons(avols0), ebm-cons(avols1), avols1 ⊆ avols0, ⌊err0⌋ ∨ err0 = ESUCCESS ⊦ ⟪skip⟫ (err = ESUCCESS → ebm-cons(avols))