Definition DONEbody := (a::s::nil,  Go DONE (Var a::Var s::nil)).Definition myprog : program :=
   (START, STARTbody):: (LOOP,  LOOPbody) :: (DONE,   DONEbody) :: nil.Definition STARTspec : funspec := (a::nil,
               fun s => allocpool (eval (Var a) s)).Definition DONEspec: funspec := (a::s::nil,
               fun s' => lseg (eval (Var s) s') (eval (Const 0) s') * allocpool (eval (Var a) s')).Definition LOOPspec: funspec :=  (a::s::p::r::nil,
              fun s' => lseg (eval (Var s) s') (eval (Var p) s')
               * lseg (eval (Var p) s') (eval (Const 0) s')
               * allocpool (eval (Var a) s')
               && cont DONEspec (eval (Var r) s')).Definition myspec := (START, STARTspec):: ((LOOP, LOOPspec) :: (DONE, DONEspec) :: nil).

(* Specifications: *)
Lemma prove_START: semax_body myspec STARTspec STARTbody.
Lemma prove_LOOP: semax_body myspec LOOPspec LOOPbody.
Lemma prove_DONE: semax_body myspec DONEspec DONEbody.
Lemma prove_myspec: semax_func myspec myprog myspec.
Lemma myprog_safe: forall n, run myprog n <> None.