err = err1, ⌊err1⌋ ⊦ ⟨if err = ESUCCESS then avols := ∅ else avols := ?⟩ (avols1 = avols ∧ err1 = err)