| ⌊err1⌋ ⊦ ⟨choose err0 with ⌊err0⌋ ∨ err0 = ESUCCESS in err := err0; if err = ESUCCESS then avols := ∅ else avols := ?⟩ (avols1 = avols ∧ err1 = err) |
⌊err1⌋ ⊦ ∃ err0. (⌊err0⌋ ∨ err0 = ESUCCESS) ∧ ⟨err := err0; if err = ESUCCESS then avols := ∅ else avols := ?⟩ (avols1 = avols ∧ err1 = err)