Towards imperative modules: reasoning about invariants and sharing of mutable state