ofe.v 47 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
Robbert Krebbers's avatar
Robbert Krebbers committed
3

4
(** This files defines (a shallow embedding of) the category of OFEs:
5 6 7 8 9 10 11 12
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
    This makes writing such functions much easier. It turns out that it many 
    cases, we do not even need non-expansiveness.
*)

Robbert Krebbers's avatar
Robbert Krebbers committed
13 14
(** Unbundeled version *)
Class Dist A := dist : nat  relation A.
15
Instance: Params (@dist) 3.
16 17
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
18
Hint Extern 0 (_ {_} _) => reflexivity.
19
Hint Extern 0 (_ {_} _) => symmetry; assumption.
20 21
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
22

23
Tactic Notation "ofe_subst" ident(x) :=
24
  repeat match goal with
25
  | _ => progress simplify_eq/=
26 27 28
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
29
Tactic Notation "ofe_subst" :=
30
  repeat match goal with
31
  | _ => progress simplify_eq/=
32 33
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
34
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
35

36
Record OfeMixin A `{Equiv A, Dist A} := {
37
  mixin_equiv_dist x y : x  y   n, x {n} y;
38
  mixin_dist_equivalence n : Equivalence (dist n);
39
  mixin_dist_S n x y : x {S n} y  x {n} y
Robbert Krebbers's avatar
Robbert Krebbers committed
40 41 42
}.

(** Bundeled version *)
43 44 45 46 47
Structure ofeT := OfeT' {
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
  ofe_mixin : OfeMixin ofe_car;
48
  _ : Type
Robbert Krebbers's avatar
Robbert Krebbers committed
49
}.
50 51 52 53 54 55 56 57 58
Arguments OfeT' _ {_ _} _ _.
Notation OfeT A m := (OfeT' A m A).
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
59

60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
different places (see for example the constructors [CMRAT] and [UCMRAT] in the
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

85
(** Lifting properties from the mixin *)
86 87
Section ofe_mixin.
  Context {A : ofeT}.
88
  Implicit Types x y : A.
89
  Lemma equiv_dist x y : x  y   n, x {n} y.
90
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
91
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
92
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
93
  Lemma dist_S n x y : x {S n} y  x {n} y.
94 95
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
96

Robbert Krebbers's avatar
Robbert Krebbers committed
97 98
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption.

99
(** Discrete OFEs and Timeless elements *)
Ralf Jung's avatar
Ralf Jung committed
100
(* TODO: On paper, We called these "discrete elements". I think that makes
Ralf Jung's avatar
Ralf Jung committed
101
   more sense. *)
102 103 104
Class Timeless {A : ofeT} (x : A) := timeless y : x {0} y  x  y.
Arguments timeless {_} _ {_} _ _.
Hint Mode Timeless + ! : typeclass_instances.
105
Instance: Params (@Timeless) 1.
106

107 108 109 110 111 112 113 114 115 116
Class Discrete (A : ofeT) := discrete_timeless (x : A) :> Timeless x.

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

117
Program Definition chain_map {A B : ofeT} (f : A  B)
118
    `{!NonExpansive f} (c : chain A) : chain B :=
119 120 121
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

122 123 124 125 126 127
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
128

129
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
130 131 132
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

133 134 135 136 137 138 139 140
Program Definition chain_const {A : ofeT} (a : A) : chain A :=
  {| chain_car n := a |}.
Next Obligation. by intros A a n i _. Qed.

Lemma compl_chain_const {A : ofeT} `{!Cofe A} (a : A) :
  compl (chain_const a)  a.
Proof. apply equiv_dist=>n. by rewrite conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
141
(** General properties *)
142
Section ofe.
143
  Context {A : ofeT}.
144
  Implicit Types x y : A.
145
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
146 147
  Proof.
    split.
148 149
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
150
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
151
  Qed.
152
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
153 154
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
155 156
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
157
  Qed.
158
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
159
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
160
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
161 162 163
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
164 165 166
  Global Instance Timeless_proper : Proper (() ==> iff) (@Timeless A).
  Proof. intros x y Hxy. rewrite /Timeless. by setoid_rewrite Hxy. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
167
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
168
  Proof. induction 2; eauto using dist_S. Qed.
169 170
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
171 172
  Instance ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f | 100.
Robbert Krebbers's avatar
Robbert Krebbers committed
173
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
174
  Instance ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
Robbert Krebbers's avatar
Robbert Krebbers committed
175 176 177
    Proper (() ==> () ==> ()) f | 100.
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
178
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
179
  Qed.
180

181
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
182 183 184 185
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
    apply chain_cauchy. omega.
  Qed.
186 187
  Lemma timeless_iff n (x : A) `{!Timeless x} y : x  y  x {n} y.
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
188
    split; intros; auto. apply (timeless _), dist_le with n; auto with lia.
189
  Qed.
190
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
191

192
(** Contractive functions *)
193 194 195 196 197 198 199
Definition dist_later {A : ofeT} (n : nat) (x y : A) : Prop :=
  match n with 0 => True | S n => x {n} y end.
Arguments dist_later _ !_ _ _ /.

Global Instance dist_later_equivalence A n : Equivalence (@dist_later A n).
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

200 201 202
Lemma dist_dist_later {A : ofeT} n (x y : A) : dist n x y  dist_later n x y.
Proof. intros Heq. destruct n; first done. exact: dist_S. Qed.

203 204 205 206 207 208 209 210 211 212 213
Lemma dist_later_dist {A : ofeT} n (x y : A) : dist_later (S n) x y  dist n x y.
Proof. done. Qed.

(* We don't actually need this lemma (as our tactics deal with this through
   other means), but technically speaking, this is the reason why
   pre-composing a non-expansive function to a contractive function
   preserves contractivity. *)
Lemma ne_dist_later {A B : ofeT} (f : A  B) :
  NonExpansive f   n, Proper (dist_later n ==> dist_later n) f.
Proof. intros Hf [|n]; last exact: Hf. hnf. by intros. Qed.

214
Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
215

216
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
217 218
Proof. by intros n y1 y2. Qed.

219
Section contractive.
220
  Local Set Default Proof Using "Type*".
221 222 223 224
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
225
  Proof. by apply (_ : Contractive f). Qed.
226
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
227
  Proof. intros. by apply (_ : Contractive f). Qed.
228

229 230
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
231 232 233 234
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

235 236 237 238 239 240 241
Ltac f_contractive :=
  match goal with
  | |- ?f _ {_} ?f _ => apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => apply (_ : Proper (_ ==> dist_later _ ==> _) f)
  end;
  try match goal with
242
  | |- @dist_later ?A ?n ?x ?y =>
243
         destruct n as [|n]; [exact I|change (@dist A _ n x y)]
244 245 246
  end;
  try reflexivity.

Ralf Jung's avatar
Ralf Jung committed
247
Ltac solve_contractive := solve_proper_core ltac:(fun _ => first [f_contractive | f_equiv]).
Robbert Krebbers's avatar
Robbert Krebbers committed
248

Robbert Krebbers's avatar
Robbert Krebbers committed
249
(** Fixpoint *)
250
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
251
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
252
Next Obligation.
253
  intros A ? f ? n.
254
  induction n as [|n IH]=> -[|i] //= ?; try omega.
255 256
  - apply (contractive_0 f).
  - apply (contractive_S f), IH; auto with omega.
Robbert Krebbers's avatar
Robbert Krebbers committed
257
Qed.
258

259
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
260
  `{!Contractive f} : A := compl (fixpoint_chain f).
261 262 263
Definition fixpoint_aux : seal (@fixpoint_def). by eexists. Qed.
Definition fixpoint {A AC AiH} f {Hf} := unseal fixpoint_aux A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := seal_eq fixpoint_aux.
Robbert Krebbers's avatar
Robbert Krebbers committed
264 265

Section fixpoint.
266
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
267

268
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
269
  Proof.
270 271
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
272
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
273
  Qed.
274 275 276

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
277 278 279
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
280 281
  Qed.

282
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
283
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
284
  Proof.
285
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
286
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
287 288
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
289
  Qed.
290 291
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
292
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
293 294

  Lemma fixpoint_ind (P : A  Prop) :
295
    Proper (() ==> impl) P 
296 297 298 299 300 301 302 303 304 305 306 307 308 309 310
    ( x, P x)  ( x, P x  P (f x)) 
    ( (c : chain A), ( n, P (c n))  P (compl c)) 
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
    { intros n. induction n as [|n IH]=> -[|i] //= ?; try omega.
      - apply (contractive_0 f).
      - apply (contractive_S f), IH; auto with omega. }
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
    rewrite -(fixpoint_unique fp2); first by apply Hlim; induction n; apply Hincr.
    apply equiv_dist=>n.
    rewrite /fp2 (conv_compl n) /= /chcar.
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
311 312
End fixpoint.

313 314 315
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
316

317
Section fixpointK.
318
  Local Set Default Proof Using "Type*".
319
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342
  Context {f_contractive : Contractive (Nat.iter k f)} {f_ne : NonExpansive f}.
  (* Note than f_ne is crucial here:  there are functions f such that f^2 is contractive,
     but f is not non-expansive.
     Consider for example f: SPred → SPred (where SPred is "downclosed sets of natural numbers").
     Define f (using informative excluded middle) as follows:
     f(N) = N  (where N is the set of all natural numbers)
     f({0, ..., n}) = {0, ... n-1}  if n is even (so n-1 is at least -1, in which case we return the empty set)
     f({0, ..., n}) = {0, ..., n+2} if n is odd
     In other words, if we consider elements of SPred as ordinals, then we decreaste odd finite
     ordinals by 1 and increase even finite ordinals by 2.
     f is not non-expansive:  Consider f({0}) = ∅ and f({0,1}) = f({0,1,2,3}).
     The arguments are clearly 0-equal, but the results are not.

     Now consider g := f^2. We have
     g(N) = N
     g({0, ..., n}) = {0, ... n+1}  if n is even
     g({0, ..., n}) = {0, ..., n+4} if n is odd
     g is contractive.  All outputs contain 0, so they are all 0-equal.
     Now consider two n-equal inputs. We have to show that the outputs are n+1-equal.
     Either they both do not contain n in which case they have to be fully equal and
     hence so are the results.  Or else they both contain n, so the results will
     both contain n+1, so the results are n+1-equal.
   *)
343 344

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
345
  Local Existing Instance f_proper.
346

347
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
348
  Proof.
349 350
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
351 352
  Qed.

353
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
354
  Proof.
355 356
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
357 358
  Qed.

359
  Section fixpointK_ne.
360
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
361
    Context {g_ne : NonExpansive g}.
362

363
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
364
    Proof.
365 366 367
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
368 369
    Qed.

370 371 372
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
373 374 375 376 377 378 379 380 381 382

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
    ( (c : chain A), ( n, P (c n))  P (compl c)) 
    P (fixpointK k f).
  Proof.
    intros ? Hst Hincr Hlim. rewrite /fixpointK. eapply fixpoint_ind; [done..| |done].
    clear- Hincr. intros. induction k; first done. simpl. auto.
  Qed.
383
End fixpointK.
384

Robbert Krebbers's avatar
Robbert Krebbers committed
385
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
386
Section fixpointAB.
387 388
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
430
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
431

Ralf Jung's avatar
Ralf Jung committed
432
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
464
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
465

466
(** Function space *)
467
(* We make [ofe_fun] a definition so that we can register it as a canonical
468
structure. *)
469
Definition ofe_fun (A : Type) (B : ofeT) := A  B.
470

471 472 473 474 475
Section ofe_fun.
  Context {A : Type} {B : ofeT}.
  Instance ofe_fun_equiv : Equiv (ofe_fun A B) := λ f g,  x, f x  g x.
  Instance ofe_fun_dist : Dist (ofe_fun A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_fun_ofe_mixin : OfeMixin (ofe_fun A B).
476 477 478 479 480 481 482 483 484 485
  Proof.
    split.
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
    - intros n; split.
      + by intros f x.
      + by intros f g ? x.
      + by intros f g h ?? x; trans (g x).
    - by intros n f g ? x; apply dist_S.
  Qed.
486
  Canonical Structure ofe_funC := OfeT (ofe_fun A B) ofe_fun_ofe_mixin.
487

488 489 490 491 492 493 494 495 496
  Program Definition ofe_fun_chain `(c : chain ofe_funC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Global Program Instance ofe_fun_cofe `{Cofe B} : Cofe ofe_funC :=
    { compl c x := compl (ofe_fun_chain c x) }.
  Next Obligation. intros ? n c x. apply (conv_compl n (ofe_fun_chain c x)). Qed.
End ofe_fun.

Arguments ofe_funC : clear implicits.
497
Notation "A -c> B" :=
498 499
  (ofe_funC A B) (at level 99, B at level 200, right associativity).
Instance ofe_fun_inhabited {A} {B : ofeT} `{Inhabited B} :
500 501
  Inhabited (A -c> B) := populate (λ _, inhabitant).

502
(** Non-expansive function space *)
503 504
Record ofe_mor (A B : ofeT) : Type := CofeMor {
  ofe_mor_car :> A  B;
505
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
506 507
}.
Arguments CofeMor {_ _} _ {_}.
508 509
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
510

511 512 513 514
Notation "'λne' x .. y , t" :=
  (@CofeMor _ _ (λ x, .. (@CofeMor _ _ (λ y, t) _) ..) _)
  (at level 200, x binder, y binder, right associativity).

515 516 517 518 519 520 521
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
522 523
  Proof.
    split.
524
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
525
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
526
    - intros n; split.
527 528
      + by intros f x.
      + by intros f g ? x.
529
      + by intros f g h ?? x; trans (g x).
530
    - by intros n f g ? x; apply dist_S.
531
  Qed.
532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548
  Canonical Structure ofe_morC := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.

  Program Definition ofe_mor_chain (c : chain ofe_morC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morC := λ c,
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
  Global Program Instance ofe_more_cofe `{Cofe B} : Cofe ofe_morC :=
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
549

550 551 552
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
553 554 555
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
556
  Proof. done. Qed.
557
End ofe_mor.
558

559
Arguments ofe_morC : clear implicits.
560
Notation "A -n> B" :=
561 562
  (ofe_morC A B) (at level 99, B at level 200, right associativity).
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
563
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
564

565
(** Identity and composition and constant function *)
Robbert Krebbers's avatar
Robbert Krebbers committed
566 567
Definition cid {A} : A -n> A := CofeMor id.
Instance: Params (@cid) 1.
568
Definition cconst {A B : ofeT} (x : B) : A -n> B := CofeMor (const x).
569
Instance: Params (@cconst) 2.
570

Robbert Krebbers's avatar
Robbert Krebbers committed
571 572 573 574 575
Definition ccompose {A B C}
  (f : B -n> C) (g : A -n> B) : A -n> C := CofeMor (f  g).
Instance: Params (@ccompose) 3.
Infix "◎" := ccompose (at level 40, left associativity).
Lemma ccompose_ne {A B C} (f1 f2 : B -n> C) (g1 g2 : A -n> B) n :
576
  f1 {n} f2  g1 {n} g2  f1  g1 {n} f2  g2.
Robbert Krebbers's avatar
Robbert Krebbers committed
577
Proof. by intros Hf Hg x; rewrite /= (Hg x) (Hf (g2 x)). Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
578

Ralf Jung's avatar
Ralf Jung committed
579
(* Function space maps *)
580
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
581
  (h : A -n> B) : A' -n> B' := g  h  f.
582 583
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
584
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
585

586 587
Definition ofe_morC_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := CofeMor (ofe_mor_map f g).
588 589
Instance ofe_morC_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morC_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
590
Proof.
591
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
592
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
593 594
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
595
(** unit *)
596 597
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
598
  Definition unit_ofe_mixin : OfeMixin unit.
599
  Proof. by repeat split; try exists 0. Qed.
600
  Canonical Structure unitC : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
601

602 603
  Global Program Instance unit_cofe : Cofe unitC := { compl x := () }.
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
604 605

  Global Instance unit_discrete_cofe : Discrete unitC.
Robbert Krebbers's avatar
Robbert Krebbers committed
606
  Proof. done. Qed.
607
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
608 609

(** Product *)
610
Section product.
611
  Context {A B : ofeT}.
612 613 614

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
615 616 617
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
618
  Definition prod_ofe_mixin : OfeMixin (A * B).
619 620
  Proof.
    split.
621
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
622
      rewrite !equiv_dist; naive_solver.
623 624
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
625
  Qed.
626 627 628 629 630 631 632 633 634
  Canonical Structure prodC : ofeT := OfeT (A * B) prod_ofe_mixin.

  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodC :=
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

635 636 637
  Global Instance prod_timeless (x : A * B) :
    Timeless (x.1)  Timeless (x.2)  Timeless x.
  Proof. by intros ???[??]; split; apply (timeless _). Qed.
638 639
  Global Instance prod_discrete_cofe : Discrete A  Discrete B  Discrete prodC.
  Proof. intros ?? [??]; apply _. Qed.
640 641 642 643 644
End product.

Arguments prodC : clear implicits.
Typeclasses Opaque prod_dist.

645
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
646 647 648 649 650
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
Definition prodC_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodC A B -n> prodC A' B' := CofeMor (prod_map f g).
651 652 653
Instance prodC_map_ne {A A' B B'} :
  NonExpansive2 (@prodC_map A A' B B').
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
654

655 656
(** Functors *)
Structure cFunctor := CFunctor {
657
  cFunctor_car : ofeT  ofeT  ofeT;
658 659
  cFunctor_map {A1 A2 B1 B2} :
    ((A2 -n> A1) * (B1 -n> B2))  cFunctor_car A1 B1 -n> cFunctor_car A2 B2;
660 661
  cFunctor_ne {A1 A2 B1 B2} :
    NonExpansive (@cFunctor_map A1 A2 B1 B2);
662
  cFunctor_id {A B : ofeT} (x : cFunctor_car A B) :
663 664 665 666 667
    cFunctor_map (cid,cid) x  x;
  cFunctor_compose {A1 A2 A3 B1 B2 B3}
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
    cFunctor_map (fg, g'f') x  cFunctor_map (g,g') (cFunctor_map (f,f') x)
}.
668
Existing Instance cFunctor_ne.
669 670
Instance: Params (@cFunctor_map) 5.

671 672 673
Delimit Scope cFunctor_scope with CF.
Bind Scope cFunctor_scope with cFunctor.

674 675 676
Class cFunctorContractive (F : cFunctor) :=
  cFunctor_contractive A1 A2 B1 B2 :> Contractive (@cFunctor_map F A1 A2 B1 B2).

677
Definition cFunctor_diag (F: cFunctor) (A: ofeT) : ofeT := cFunctor_car F A A.
678 679
Coercion cFunctor_diag : cFunctor >-> Funclass.

680
Program Definition constCF (B : ofeT) : cFunctor :=
681 682
  {| cFunctor_car A1 A2 := B; cFunctor_map A1 A2 B1 B2 f := cid |}.
Solve Obligations with done.
683
Coercion constCF : ofeT >-> cFunctor.
684

685
Instance constCF_contractive B : cFunctorContractive (constCF B).
686
Proof. rewrite /cFunctorContractive; apply _. Qed.
687 688 689 690

Program Definition idCF : cFunctor :=
  {| cFunctor_car A1 A2 := A2; cFunctor_map A1 A2 B1 B2 f := f.2 |}.
Solve Obligations with done.
691
Notation "∙" := idCF : cFunctor_scope.
692

693 694 695 696 697
Program Definition prodCF (F1 F2 : cFunctor) : cFunctor := {|
  cFunctor_car A B := prodC (cFunctor_car F1 A B) (cFunctor_car F2 A B);
  cFunctor_map A1 A2 B1 B2 fg :=
    prodC_map (cFunctor_map F1 fg) (cFunctor_map F2 fg)
|}.
698 699 700
Next Obligation.
  intros ?? A1 A2 B1 B2 n ???; by apply prodC_map_ne; apply cFunctor_ne.
Qed.
701 702 703 704 705
Next Obligation. by intros F1 F2 A B [??]; rewrite /= !cFunctor_id. Qed.
Next Obligation.
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [??]; simpl.
  by rewrite !cFunctor_compose.
Qed.
706
Notation "F1 * F2" := (prodCF F1%CF F2%CF) : cFunctor_scope.
707

708 709 710 711 712 713 714 715
Instance prodCF_contractive F1 F2 :
  cFunctorContractive F1  cFunctorContractive F2 
  cFunctorContractive (prodCF F1 F2).
Proof.
  intros ?? A1 A2 B1 B2 n ???;
    by apply prodC_map_ne; apply cFunctor_contractive.
Qed.

716 717 718
Instance compose_ne {A} {B B' : ofeT} (f : B -n> B') :
  NonExpansive (compose f : (A -c> B)  A -c> B').
Proof. intros n g g' Hf x; simpl. by rewrite (Hf x). Qed.
719

720
Definition ofe_funC_map {A B B'} (f : B -n> B') : (A -c> B) -n> (A -c> B') :=
721
  @CofeMor (_ -c> _) (_ -c> _) (compose f) _.
722 723 724
Instance ofe_funC_map_ne {A B B'} :
  NonExpansive (@ofe_funC_map A B B').
Proof. intros n f f' Hf g x. apply Hf. Qed.
725

726 727 728
Program Definition ofe_funCF (T : Type) (F : cFunctor) : cFunctor := {|
  cFunctor_car A B := ofe_funC T (cFunctor_car F A B);
  cFunctor_map A1 A2 B1 B2 fg := ofe_funC_map (cFunctor_map F fg)
729 730
|}.
Next Obligation.
731
  intros ?? A1 A2 B1 B2 n ???; by apply ofe_funC_map_ne; apply cFunctor_ne.
732 733 734 735 736 737
Qed.
Next Obligation. intros F1 F2 A B ??. by rewrite /= /compose /= !cFunctor_id. Qed.
Next Obligation.
  intros T F A1 A2 A3 B1 B2 B3 f g f' g' ??; simpl.
  by rewrite !cFunctor_compose.
Qed.
738
Notation "T -c> F" := (ofe_funCF T%type F%CF) : cFunctor_scope.
739

740 741
Instance ofe_funCF_contractive (T : Type) (F : cFunctor) :
  cFunctorContractive F  cFunctorContractive (ofe_funCF T F).
742 743
Proof.
  intros ?? A1 A2 B1 B2 n ???;
744
    by apply ofe_funC_map_ne; apply cFunctor_contractive.
745 746
Qed.

747
Program Definition ofe_morCF (F1 F2 : cFunctor) : cFunctor := {|
748
  cFunctor_car A B := cFunctor_car F1 B A -n> cFunctor_car F2 A B;
Ralf Jung's avatar
Ralf Jung committed
749
  cFunctor_map A1 A2 B1 B2 fg :=
750
    ofe_morC_map (cFunctor_map F1 (fg.2, fg.1)) (cFunctor_map F2 fg)
Ralf Jung's avatar
Ralf Jung committed
751
|}.
752 753
Next Obligation.
  intros F1 F2 A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
754
  apply ofe_morC_map_ne; apply cFunctor_ne; split; by apply Hfg.
755
Qed.
Ralf Jung's avatar
Ralf Jung committed
756
Next Obligation.
757 758
  intros F1 F2 A B [f ?] ?; simpl. rewrite /= !cFunctor_id.
  apply (ne_proper f). apply cFunctor_id.
Ralf Jung's avatar
Ralf Jung committed
759 760
Qed.
Next Obligation.
761 762
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [h ?] ?; simpl in *.
  rewrite -!cFunctor_compose. do 2 apply (ne_proper _). apply cFunctor_compose.
Ralf Jung's avatar
Ralf Jung committed
763
Qed.
764
Notation "F1 -n> F2" := (ofe_morCF F1%CF F2%CF) : cFunctor_scope.
Ralf Jung's avatar
Ralf Jung committed
765

766
Instance ofe_morCF_contractive F1 F2 :
767
  cFunctorContractive F1  cFunctorContractive F2 
768
  cFunctorContractive (ofe_morCF F1 F2).
769 770
Proof.
  intros ?? A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
771
  apply ofe_morC_map_ne; apply cFunctor_contractive; destruct n, Hfg; by split.