Local Open Scope logic.
Declare Module Semax : SEMAX.
(* Remark:  "Declare Module" is a hack. We want to emphasize that the client proofs (in lseg.v, client_lemmas.v, and sample_program.v) can be done independently of the model.v that implements the Module Semax.  The correct way to do this in Coq is to use a parameterized Module (that is, a Functor), which is not difficult but in this example we wanted to avoid a heavyweight use of the module system. *)
Definition next e1 e2: mpred := !! (e1 > 0) && mapsto e1 e2.
Definition listempty (lp: adr*adr) : mpred :=
!! (fst lp = snd lp) && emp.
Definition listrep' (R: adr*adr -> mpred) (lp: adr*adr) : mpred :=
listcons' R lp || listempty lp.
Definition listrep : adr*adr -> mpred := HORec listrep'.
Definition lseg (e1 e2: adr) : mpred := listrep (e1,e2).

Lemma lseg_cons: (* U2 *)
forall x y z, x<>z -> next x y * lseg y z |-- lseg x z.