ofe.v 48 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
Robbert Krebbers's avatar
Robbert Krebbers committed
3

4
(** This files defines (a shallow embedding of) the category of OFEs:
5
6
7
8
9
10
11
12
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
    This makes writing such functions much easier. It turns out that it many 
    cases, we do not even need non-expansiveness.
*)

Robbert Krebbers's avatar
Robbert Krebbers committed
13
14
(** Unbundeled version *)
Class Dist A := dist : nat  relation A.
15
Instance: Params (@dist) 3.
16
17
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
18
Hint Extern 0 (_ {_} _) => reflexivity.
19
Hint Extern 0 (_ {_} _) => symmetry; assumption.
20
21
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
22

23
Tactic Notation "ofe_subst" ident(x) :=
24
  repeat match goal with
25
  | _ => progress simplify_eq/=
26
27
28
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
29
Tactic Notation "ofe_subst" :=
30
  repeat match goal with
31
  | _ => progress simplify_eq/=
32
33
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
34
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
35

Ralf Jung's avatar
Ralf Jung committed
36
37
38
39
40
41
42
43
Section mixin.
  Local Set Primitive Projections.
  Record OfeMixin A `{Equiv A, Dist A} := {
    mixin_equiv_dist x y : x  y   n, x {n} y;
    mixin_dist_equivalence n : Equivalence (dist n);
    mixin_dist_S n x y : x {S n} y  x {n} y
  }.
End mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
44
45

(** Bundeled version *)
46
47
48
49
50
Structure ofeT := OfeT' {
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
  ofe_mixin : OfeMixin ofe_car;
51
  _ : Type
Robbert Krebbers's avatar
Robbert Krebbers committed
52
}.
53
54
55
56
57
58
59
60
61
Arguments OfeT' _ {_ _} _ _.
Notation OfeT A m := (OfeT' A m A).
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
62

63
64
65
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
66
different places (see for example the constructors [CmraT] and [UcmraT] in the
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

88
(** Lifting properties from the mixin *)
89
90
Section ofe_mixin.
  Context {A : ofeT}.
91
  Implicit Types x y : A.
92
  Lemma equiv_dist x y : x  y   n, x {n} y.
93
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
94
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
95
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
96
  Lemma dist_S n x y : x {S n} y  x {n} y.
97
98
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
99

Robbert Krebbers's avatar
Robbert Krebbers committed
100
101
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption.

102
103
104
105
106
107
(** Discrete OFEs and discrete OFE elements *)
Class Discrete {A : ofeT} (x : A) := discrete y : x {0} y  x  y.
Arguments discrete {_} _ {_} _ _.
Hint Mode Discrete + ! : typeclass_instances.
Instance: Params (@Discrete) 1.

108
Class OfeDiscrete (A : ofeT) := ofe_discrete_discrete (x : A) :> Discrete x.
109
110
111
112
113
114
115
116
117

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

118
Program Definition chain_map {A B : ofeT} (f : A  B)
119
    `{!NonExpansive f} (c : chain A) : chain B :=
120
121
122
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

123
124
125
126
127
128
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
129

130
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
131
132
133
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

134
135
136
137
138
139
140
141
Program Definition chain_const {A : ofeT} (a : A) : chain A :=
  {| chain_car n := a |}.
Next Obligation. by intros A a n i _. Qed.

Lemma compl_chain_const {A : ofeT} `{!Cofe A} (a : A) :
  compl (chain_const a)  a.
Proof. apply equiv_dist=>n. by rewrite conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
142
(** General properties *)
143
Section ofe.
144
  Context {A : ofeT}.
145
  Implicit Types x y : A.
146
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
147
148
  Proof.
    split.
149
150
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
151
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
152
  Qed.
153
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
154
155
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
156
157
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
158
  Qed.
159
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
160
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
161
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
162
163
164
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
165
166
  Global Instance Discrete_proper : Proper (() ==> iff) (@Discrete A).
  Proof. intros x y Hxy. rewrite /Discrete. by setoid_rewrite Hxy. Qed.
167

Robbert Krebbers's avatar
Robbert Krebbers committed
168
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
169
  Proof. induction 2; eauto using dist_S. Qed.
170
171
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
172
173
  Instance ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f | 100.
Robbert Krebbers's avatar
Robbert Krebbers committed
174
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
175
  Instance ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
Robbert Krebbers's avatar
Robbert Krebbers committed
176
177
178
    Proper (() ==> () ==> ()) f | 100.
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
179
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
180
  Qed.
181

182
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
183
184
185
186
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
    apply chain_cauchy. omega.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
187

188
  Lemma discrete_iff n (x : A) `{!Discrete x} y : x  y  x {n} y.
189
  Proof.
190
    split; intros; auto. apply (discrete _), dist_le with n; auto with lia.
191
  Qed.
192
  Lemma discrete_iff_0 n (x : A) `{!Discrete x} y : x {0} y  x {n} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
193
  Proof.
194
    split=> ?. by apply equiv_dist, (discrete _). eauto using dist_le with lia.
Robbert Krebbers's avatar
Robbert Krebbers committed
195
  Qed.
196
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
197

198
(** Contractive functions *)
199
Definition dist_later `{Dist A} (n : nat) (x y : A) : Prop :=
200
  match n with 0 => True | S n => x {n} y end.
201
Arguments dist_later _ _ !_ _ _ /.
202

203
Global Instance dist_later_equivalence (A : ofeT) n : Equivalence (@dist_later A _ n).
204
205
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

206
207
208
Lemma dist_dist_later {A : ofeT} n (x y : A) : dist n x y  dist_later n x y.
Proof. intros Heq. destruct n; first done. exact: dist_S. Qed.

209
210
211
212
213
214
215
216
217
218
219
Lemma dist_later_dist {A : ofeT} n (x y : A) : dist_later (S n) x y  dist n x y.
Proof. done. Qed.

(* We don't actually need this lemma (as our tactics deal with this through
   other means), but technically speaking, this is the reason why
   pre-composing a non-expansive function to a contractive function
   preserves contractivity. *)
Lemma ne_dist_later {A B : ofeT} (f : A  B) :
  NonExpansive f   n, Proper (dist_later n ==> dist_later n) f.
Proof. intros Hf [|n]; last exact: Hf. hnf. by intros. Qed.

220
Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
221

222
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
223
224
Proof. by intros n y1 y2. Qed.

225
Section contractive.
226
  Local Set Default Proof Using "Type*".
227
228
229
230
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
231
  Proof. by apply (_ : Contractive f). Qed.
232
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
233
  Proof. intros. by apply (_ : Contractive f). Qed.
234

235
236
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
237
238
239
240
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

241
242
Ltac f_contractive :=
  match goal with
Robbert Krebbers's avatar
Robbert Krebbers committed
243
244
245
  | |- ?f _ {_} ?f _ => simple apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (_ ==> dist_later _ ==> _) f)
246
247
  end;
  try match goal with
248
  | |- @dist_later ?A _ ?n ?x ?y =>
249
         destruct n as [|n]; [exact I|change (@dist A _ n x y)]
250
  end;
Robbert Krebbers's avatar
Robbert Krebbers committed
251
  try simple apply reflexivity.
252

Robbert Krebbers's avatar
Robbert Krebbers committed
253
254
Ltac solve_contractive :=
  solve_proper_core ltac:(fun _ => first [f_contractive | f_equiv]).
Robbert Krebbers's avatar
Robbert Krebbers committed
255

Robbert Krebbers's avatar
Robbert Krebbers committed
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
(** Limit preserving predicates *)
Class LimitPreserving `{!Cofe A} (P : A  Prop) : Prop :=
  limit_preserving (c : chain A) : ( n, P (c n))  P (compl c).
Hint Mode LimitPreserving + + ! : typeclass_instances.

Section limit_preserving.
  Context `{Cofe A}.
  (* These are not instances as they will never fire automatically...
     but they can still be helpful in proving things to be limit preserving. *)

  Lemma limit_preserving_ext (P Q : A  Prop) :
    ( x, P x  Q x)  LimitPreserving P  LimitPreserving Q.
  Proof. intros HP Hlimit c ?. apply HP, Hlimit=> n; by apply HP. Qed.

  Global Instance limit_preserving_const (P : Prop) : LimitPreserving (λ _, P).
  Proof. intros c HP. apply (HP 0). Qed.

273
  Lemma limit_preserving_discrete (P : A  Prop) :
Robbert Krebbers's avatar
Robbert Krebbers committed
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
    Proper (dist 0 ==> impl) P  LimitPreserving P.
  Proof. intros PH c Hc. by rewrite (conv_compl 0). Qed.

  Lemma limit_preserving_and (P1 P2 : A  Prop) :
    LimitPreserving P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof. intros Hlim1 Hlim2 c Hc. split. apply Hlim1, Hc. apply Hlim2, Hc. Qed.

  Lemma limit_preserving_impl (P1 P2 : A  Prop) :
    Proper (dist 0 ==> impl) P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof.
    intros Hlim1 Hlim2 c Hc HP1. apply Hlim2=> n; apply Hc.
    eapply Hlim1, HP1. apply dist_le with n; last lia. apply (conv_compl n).
  Qed.

  Lemma limit_preserving_forall {B} (P : B  A  Prop) :
    ( y, LimitPreserving (P y)) 
    LimitPreserving (λ x,  y, P y x).
  Proof. intros Hlim c Hc y. by apply Hlim. Qed.
End limit_preserving.

Robbert Krebbers's avatar
Robbert Krebbers committed
296
(** Fixpoint *)
297
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
298
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
299
Next Obligation.
300
  intros A ? f ? n.
301
  induction n as [|n IH]=> -[|i] //= ?; try omega.
302
303
  - apply (contractive_0 f).
  - apply (contractive_S f), IH; auto with omega.
Robbert Krebbers's avatar
Robbert Krebbers committed
304
Qed.
305

306
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
307
  `{!Contractive f} : A := compl (fixpoint_chain f).
308
309
310
Definition fixpoint_aux : seal (@fixpoint_def). by eexists. Qed.
Definition fixpoint {A AC AiH} f {Hf} := unseal fixpoint_aux A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := seal_eq fixpoint_aux.
Robbert Krebbers's avatar
Robbert Krebbers committed
311
312

Section fixpoint.
313
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
314

315
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
316
  Proof.
317
318
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
319
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
320
  Qed.
321
322
323

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
324
325
326
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
327
328
  Qed.

329
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
330
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
331
  Proof.
332
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
333
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
334
335
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
336
  Qed.
337
338
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
339
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
340
341

  Lemma fixpoint_ind (P : A  Prop) :
342
    Proper (() ==> impl) P 
343
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
344
    LimitPreserving P 
345
346
347
348
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
Robbert Krebbers's avatar
Robbert Krebbers committed
349
350
    { intros n. rewrite /chcar. induction n as [|n IH]=> -[|i] //=;
        eauto using contractive_0, contractive_S with omega. }
351
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
Robbert Krebbers's avatar
Robbert Krebbers committed
352
353
354
355
    assert (f fp2  fp2).
    { apply equiv_dist=>n. rewrite /fp2 (conv_compl n) /= /chcar.
      induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S. }
    rewrite -(fixpoint_unique fp2) //.
Robbert Krebbers's avatar
Robbert Krebbers committed
356
    apply Hlim=> n /=. by apply Nat_iter_ind.
357
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
358
359
End fixpoint.

Robbert Krebbers's avatar
Robbert Krebbers committed
360

361
362
363
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
364

365
Section fixpointK.
366
  Local Set Default Proof Using "Type*".
367
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
  Context {f_contractive : Contractive (Nat.iter k f)} {f_ne : NonExpansive f}.
  (* Note than f_ne is crucial here:  there are functions f such that f^2 is contractive,
     but f is not non-expansive.
     Consider for example f: SPred → SPred (where SPred is "downclosed sets of natural numbers").
     Define f (using informative excluded middle) as follows:
     f(N) = N  (where N is the set of all natural numbers)
     f({0, ..., n}) = {0, ... n-1}  if n is even (so n-1 is at least -1, in which case we return the empty set)
     f({0, ..., n}) = {0, ..., n+2} if n is odd
     In other words, if we consider elements of SPred as ordinals, then we decreaste odd finite
     ordinals by 1 and increase even finite ordinals by 2.
     f is not non-expansive:  Consider f({0}) = ∅ and f({0,1}) = f({0,1,2,3}).
     The arguments are clearly 0-equal, but the results are not.

     Now consider g := f^2. We have
     g(N) = N
     g({0, ..., n}) = {0, ... n+1}  if n is even
     g({0, ..., n}) = {0, ..., n+4} if n is odd
     g is contractive.  All outputs contain 0, so they are all 0-equal.
     Now consider two n-equal inputs. We have to show that the outputs are n+1-equal.
     Either they both do not contain n in which case they have to be fully equal and
     hence so are the results.  Or else they both contain n, so the results will
     both contain n+1, so the results are n+1-equal.
   *)
391
392

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
393
  Local Existing Instance f_proper.
394

395
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
396
  Proof.
397
398
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
399
400
  Qed.

401
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
402
  Proof.
403
404
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
405
406
  Qed.

407
  Section fixpointK_ne.
408
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
409
    Context {g_ne : NonExpansive g}.
410

411
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
412
    Proof.
413
414
415
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
416
417
    Qed.

418
419
420
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
421
422
423
424

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
425
    LimitPreserving P 
Ralf Jung's avatar
Ralf Jung committed
426
427
    P (fixpointK k f).
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
428
    intros. rewrite /fixpointK. apply fixpoint_ind; eauto.
Robbert Krebbers's avatar
Robbert Krebbers committed
429
    intros; apply Nat_iter_ind; auto.
Ralf Jung's avatar
Ralf Jung committed
430
  Qed.
431
End fixpointK.
432

Robbert Krebbers's avatar
Robbert Krebbers committed
433
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
434
Section fixpointAB.
435
436
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
478
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
479

Ralf Jung's avatar
Ralf Jung committed
480
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
512
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
513

514
(** Function space *)
515
(* We make [ofe_fun] a definition so that we can register it as a canonical
516
structure. *)
517
Definition ofe_fun (A : Type) (B : ofeT) := A  B.
518

519
520
521
522
523
Section ofe_fun.
  Context {A : Type} {B : ofeT}.
  Instance ofe_fun_equiv : Equiv (ofe_fun A B) := λ f g,  x, f x  g x.
  Instance ofe_fun_dist : Dist (ofe_fun A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_fun_ofe_mixin : OfeMixin (ofe_fun A B).
524
525
526
527
528
529
530
531
532
533
  Proof.
    split.
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
    - intros n; split.
      + by intros f x.
      + by intros f g ? x.
      + by intros f g h ?? x; trans (g x).
    - by intros n f g ? x; apply dist_S.
  Qed.
534
  Canonical Structure ofe_funC := OfeT (ofe_fun A B) ofe_fun_ofe_mixin.
535

536
537
538
539
540
541
542
543
544
  Program Definition ofe_fun_chain `(c : chain ofe_funC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Global Program Instance ofe_fun_cofe `{Cofe B} : Cofe ofe_funC :=
    { compl c x := compl (ofe_fun_chain c x) }.
  Next Obligation. intros ? n c x. apply (conv_compl n (ofe_fun_chain c x)). Qed.
End ofe_fun.

Arguments ofe_funC : clear implicits.
545
Notation "A -c> B" :=
546
547
  (ofe_funC A B) (at level 99, B at level 200, right associativity).
Instance ofe_fun_inhabited {A} {B : ofeT} `{Inhabited B} :
548
549
  Inhabited (A -c> B) := populate (λ _, inhabitant).

550
(** Non-expansive function space *)
551
552
Record ofe_mor (A B : ofeT) : Type := CofeMor {
  ofe_mor_car :> A  B;
553
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
554
555
}.
Arguments CofeMor {_ _} _ {_}.
556
557
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
558

559
560
561
562
Notation "'λne' x .. y , t" :=
  (@CofeMor _ _ (λ x, .. (@CofeMor _ _ (λ y, t) _) ..) _)
  (at level 200, x binder, y binder, right associativity).

563
564
565
566
567
568
569
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
570
571
  Proof.
    split.
572
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
573
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
574
    - intros n; split.
575
576
      + by intros f x.
      + by intros f g ? x.
577
      + by intros f g h ?? x; trans (g x).
578
    - by intros n f g ? x; apply dist_S.
579
  Qed.
580
581
582
583
584
585
586
587
588
589
590
  Canonical Structure ofe_morC := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.

  Program Definition ofe_mor_chain (c : chain ofe_morC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morC := λ c,
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
Jacques-Henri Jourdan's avatar
Typo    
Jacques-Henri Jourdan committed
591
  Global Program Instance ofe_mor_cofe `{Cofe B} : Cofe ofe_morC :=
592
593
594
595
596
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
597

598
599
600
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
601
602
603
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
604
  Proof. done. Qed.
605
End ofe_mor.
606

607
Arguments ofe_morC : clear implicits.
608
Notation "A -n> B" :=
609
610
  (ofe_morC A B) (at level 99, B at level 200, right associativity).
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
611
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
612

613
(** Identity and composition and constant function *)
Robbert Krebbers's avatar
Robbert Krebbers committed
614
615
Definition cid {A} : A -n> A := CofeMor id.
Instance: Params (@cid) 1.
616
Definition cconst {A B : ofeT} (x : B) : A -n> B := CofeMor (const x).
617
Instance: Params (@cconst) 2.
618

Robbert Krebbers's avatar
Robbert Krebbers committed
619
620
621
622
Definition ccompose {A B C}
  (f : B -n> C) (g : A -n> B) : A -n> C := CofeMor (f  g).
Instance: Params (@ccompose) 3.
Infix "◎" := ccompose (at level 40, left associativity).
623
624
625
Global Instance ccompose_ne {A B C} :
  NonExpansive2 (@ccompose A B C).
Proof. intros n ?? Hf g1 g2 Hg x. rewrite /= (Hg x) (Hf (g2 x)) //. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
626

Ralf Jung's avatar
Ralf Jung committed
627
(* Function space maps *)
628
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
629
  (h : A -n> B) : A' -n> B' := g  h  f.
630
631
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
632
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
633

634
635
Definition ofe_morC_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := CofeMor (ofe_mor_map f g).
636
637
Instance ofe_morC_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morC_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
638
Proof.
639
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
640
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
641
642
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
643
(** unit *)
644
645
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
646
  Definition unit_ofe_mixin : OfeMixin unit.
647
  Proof. by repeat split; try exists 0. Qed.
648
  Canonical Structure unitC : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
649

650
651
  Global Program Instance unit_cofe : Cofe unitC := { compl x := () }.
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
652

653
  Global Instance unit_ofe_discrete : OfeDiscrete unitC.
Robbert Krebbers's avatar
Robbert Krebbers committed
654
  Proof. done. Qed.
655
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
656
657

(** Product *)
658
Section product.
659
  Context {A B : ofeT}.
660
661
662

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
663
664
665
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
666
  Definition prod_ofe_mixin : OfeMixin (A * B).
667
668
  Proof.
    split.
669
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
670
      rewrite !equiv_dist; naive_solver.
671
672
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
673
  Qed.
674
675
676
677
678
679
680
681
682
  Canonical Structure prodC : ofeT := OfeT (A * B) prod_ofe_mixin.

  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodC :=
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

683
684
685
  Global Instance prod_discrete (x : A * B) :
    Discrete (x.1)  Discrete (x.2)  Discrete x.
  Proof. by intros ???[??]; split; apply (discrete _). Qed.
686
687
  Global Instance prod_ofe_discrete :
    OfeDiscrete A  OfeDiscrete B  OfeDiscrete prodC.
688
  Proof. intros ?? [??]; apply _. Qed.
689
690
691
692
693
End product.

Arguments prodC : clear implicits.
Typeclasses Opaque prod_dist.

694
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
695
696
697
698
699
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
Definition prodC_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodC A B -n> prodC A' B' := CofeMor (prod_map f g).
700
701
702
Instance prodC_map_ne {A A' B B'} :
  NonExpansive2 (@prodC_map A A' B B').
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
703

704
705
(** Functors *)
Structure cFunctor := CFunctor {
706
  cFunctor_car : ofeT  ofeT  ofeT;
707
708
  cFunctor_map {A1 A2 B1 B2} :
    ((A2 -n> A1) * (B1 -n> B2))  cFunctor_car A1 B1 -n> cFunctor_car A2 B2;
709
710
  cFunctor_ne {A1 A2 B1 B2} :
    NonExpansive (@cFunctor_map A1 A2 B1 B2);
711
  cFunctor_id {A B : ofeT} (x : cFunctor_car A B) :
712
713
714
715
716
    cFunctor_map (cid,cid) x  x;
  cFunctor_compose {A1 A2 A3 B1 B2 B3}
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
    cFunctor_map (fg, g'f') x  cFunctor_map (g,g') (cFunctor_map (f,f') x)
}.
717
Existing Instance cFunctor_ne.
718
719
Instance: Params (@cFunctor_map) 5.

720
721
722
Delimit Scope cFunctor_scope with CF.
Bind Scope cFunctor_scope with cFunctor.

723
724
725
Class cFunctorContractive (F : cFunctor) :=
  cFunctor_contractive A1 A2 B1 B2 :> Contractive (@cFunctor_map F A1 A2 B1 B2).

726
Definition cFunctor_diag (F: cFunctor) (A: ofeT) : ofeT := cFunctor_car F A A.
727
728
Coercion cFunctor_diag : cFunctor >-> Funclass.

729
Program Definition constCF (B : ofeT) : cFunctor :=
730
731
  {| cFunctor_car A1 A2 := B; cFunctor_map A1 A2 B1 B2 f := cid |}.
Solve Obligations with done.
732
Coercion constCF : ofeT >-> cFunctor.
733

734
Instance constCF_contractive B : cFunctorContractive (constCF B).
735
Proof. rewrite /cFunctorContractive; apply _. Qed.
736
737
738
739

Program Definition idCF : cFunctor :=
  {| cFunctor_car A1 A2 := A2; cFunctor_map A1 A2 B1 B2 f := f.2 |}.
Solve Obligations with done.
740
Notation "∙" := idCF : cFunctor_scope.
741

742
743
744
745
746
Program Definition prodCF (F1 F2 : cFunctor) : cFunctor := {|
  cFunctor_car A B := prodC (cFunctor_car F1 A B) (cFunctor_car F2 A B);
  cFunctor_map A1 A2 B1 B2 fg :=
    prodC_map (cFunctor_map F1 fg) (cFunctor_map F2 fg)
|}.
747
748
749
Next Obligation.
  intros ?? A1 A2 B1 B2 n ???; by apply prodC_map_ne; apply cFunctor_ne.
Qed.
750
751
752
753
754
Next Obligation. by intros F1 F2 A B [??]; rewrite /= !cFunctor_id. Qed.
Next Obligation.
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [??]; simpl.
  by rewrite !cFunctor_compose.
Qed.
755
Notation "F1 * F2" := (prodCF F1%CF F2%CF) : cFunctor_scope.
756

757
758
759
760
761
762
763
764
Instance prodCF_contractive F1 F2 :
  cFunctorContractive F1  cFunctorContractive F2 
  cFunctorContractive (prodCF F1 F2).
Proof.
  intros ?? A1 A2 B1 B2 n ???;
    by apply prodC_map_ne; apply cFunctor_contractive.
Qed.

765
766
767
Instance compose_ne {A} {B B' : ofeT} (f : B -n> B') :
  NonExpansive (compose f : (A -c> B)  A -c> B').
Proof. intros n g g' Hf x; simpl. by rewrite (Hf x). Qed.
768

769
Definition ofe_funC_map {A B B'} (f : B -n> B') : (A -c> B) -n> (A -c> B') :=
770
  @CofeMor (_ -c> _) (_ -c> _) (compose f) _.
771
772
773
Instance ofe_funC_map_ne {A B B'} :
  NonExpansive (@ofe_funC_map A B B').
Proof. intros n f f' Hf g x. apply Hf. Qed.
774

775
776
777
Program Definition ofe_funCF (T : Type) (F : cFunctor) : cFunctor := {|
  cFunctor_car A B := ofe_funC T (cFunctor_car F A B);
  cFunctor_map A1 A2 B1 B2 fg := ofe_funC_map (cFunctor_map F fg)
778
779
|}.
Next Obligation.
780
  intros ?? A1 A2 B1 B2 n ???; by apply ofe_funC_map_ne; apply cFunctor_ne.
781
782
783
784
785
786
Qed.
Next Obligation. intros F1 F2 A B ??. by rewrite /= /compose /= !cFunctor_id. Qed.
Next Obligation.
  intros T F A1 A2 A3 B1 B2 B3 f g f' g' ??; simpl.
  by rewrite !cFunctor_compose.
Qed.
787
Notation "T -c> F" := (ofe_funCF T%type F%CF) : cFunctor_scope.
788

789
790
Instance ofe_funCF_contractive (T : Type) (F : cFunctor) :
  cFunctorContractive F  cFunctorContractive (ofe_funCF T F).
791
792
Proof.
  intros ?? A1 A2 B1 B2 n ???;
793