Definition lock_coherence' tp PHI m (mcompat : mem_compatible_with tp m PHI) :=
lock_coherence
(lset tp) PHI
(restrPermMap
(mem_compatible_locks_ltwritable
(mem_compatible_forget mcompat))).
Definition env_coherence {Z} Jspec (ge : genv) (Gamma : funspecs) PHI :=
matchfunspecs ge Gamma PHI /\
exists prog CS V,
@semax_prog {|OK_ty := Z; OK_spec := Jspec|} CS prog V Gamma /\
ge = globalenv prog /\
app_pred
(funassert (Delta_types V Gamma (Tpointer Tvoid noattr :: nil))
(empty_environ ge)) PHI.
Inductive state_invariant Gamma (n : nat) : cm_state -> Prop :=
| state_invariant_c
(m : mem) (tr : event_trace) (sch : schedule) (tp : jstate ge) (PHI : rmap)
(lev : level PHI = n)
(envcoh : env_coherence Jspec ge Gamma PHI)
(mcompat : mem_compatible_with tp m PHI)
(extcompat : joins (ghost_of PHI) (Some (ext_ref tt, NoneP) :: nil))
(lock_sparse : lock_sparsity (lset tp))
(lock_coh : lock_coherence' tp PHI m mcompat)
(safety : threads_safety m tp PHI mcompat n)
(wellformed : threads_wellformed tp)
(uniqkrun :  unique_Krun tp sch)
: state_invariant Gamma n (m, (tr, sch, tp)).

(* Schedule irrelevance of the invariant *)
Lemma state_invariant_sch_irr Gamma n m i tr sch sch' tp :
state_invariant Gamma n (m, (tr, i :: sch, tp)) ->
state_invariant Gamma n (m, (tr, i :: sch', tp)).