ofe.v 44.9 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
Robbert Krebbers's avatar
Robbert Krebbers committed
3

4
(** This files defines (a shallow embedding of) the category of OFEs:
5 6 7 8 9 10 11 12
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
    This makes writing such functions much easier. It turns out that it many 
    cases, we do not even need non-expansiveness.
*)

Robbert Krebbers's avatar
Robbert Krebbers committed
13 14
(** Unbundeled version *)
Class Dist A := dist : nat  relation A.
15
Instance: Params (@dist) 3.
16 17
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
18
Hint Extern 0 (_ {_} _) => reflexivity.
19
Hint Extern 0 (_ {_} _) => symmetry; assumption.
20 21
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
22

23
Tactic Notation "ofe_subst" ident(x) :=
24
  repeat match goal with
25
  | _ => progress simplify_eq/=
26 27 28
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
29
Tactic Notation "ofe_subst" :=
30
  repeat match goal with
31
  | _ => progress simplify_eq/=
32 33
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
34
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
35

36
Record OfeMixin A `{Equiv A, Dist A} := {
37
  mixin_equiv_dist x y : x  y   n, x {n} y;
38
  mixin_dist_equivalence n : Equivalence (dist n);
39
  mixin_dist_S n x y : x {S n} y  x {n} y
Robbert Krebbers's avatar
Robbert Krebbers committed
40 41 42
}.

(** Bundeled version *)
43 44 45 46 47
Structure ofeT := OfeT' {
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
  ofe_mixin : OfeMixin ofe_car;
48
  _ : Type
Robbert Krebbers's avatar
Robbert Krebbers committed
49
}.
50 51 52 53 54 55 56 57 58
Arguments OfeT' _ {_ _} _ _.
Notation OfeT A m := (OfeT' A m A).
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
59

60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
different places (see for example the constructors [CMRAT] and [UCMRAT] in the
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

85
(** Lifting properties from the mixin *)
86 87
Section ofe_mixin.
  Context {A : ofeT}.
88
  Implicit Types x y : A.
89
  Lemma equiv_dist x y : x  y   n, x {n} y.
90
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
91
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
92
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
93
  Lemma dist_S n x y : x {S n} y  x {n} y.
94 95
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
96

Robbert Krebbers's avatar
Robbert Krebbers committed
97 98
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption.

99
(** Discrete OFEs and Timeless elements *)
Ralf Jung's avatar
Ralf Jung committed
100
(* TODO: On paper, We called these "discrete elements". I think that makes
Ralf Jung's avatar
Ralf Jung committed
101
   more sense. *)
102 103 104
Class Timeless {A : ofeT} (x : A) := timeless y : x {0} y  x  y.
Arguments timeless {_} _ {_} _ _.
Hint Mode Timeless + ! : typeclass_instances.
105
Instance: Params (@Timeless) 1.
106

107 108 109 110 111 112 113 114 115 116
Class Discrete (A : ofeT) := discrete_timeless (x : A) :> Timeless x.

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

117
Program Definition chain_map {A B : ofeT} (f : A  B)
118
    `{!NonExpansive f} (c : chain A) : chain B :=
119 120 121
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

122 123 124 125 126 127
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
128

129
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
130 131 132
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
133
(** General properties *)
134
Section ofe.
135
  Context {A : ofeT}.
136
  Implicit Types x y : A.
137
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
138 139
  Proof.
    split.
140 141
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
142
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
143
  Qed.
144
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
145 146
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
147 148
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
149
  Qed.
150
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
151
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
152
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
153 154 155
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
156 157 158
  Global Instance Timeless_proper : Proper (() ==> iff) (@Timeless A).
  Proof. intros x y Hxy. rewrite /Timeless. by setoid_rewrite Hxy. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
159
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
160
  Proof. induction 2; eauto using dist_S. Qed.
161 162
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
163 164
  Instance ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f | 100.
Robbert Krebbers's avatar
Robbert Krebbers committed
165
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
166
  Instance ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
Robbert Krebbers's avatar
Robbert Krebbers committed
167 168 169
    Proper (() ==> () ==> ()) f | 100.
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
170
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
171
  Qed.
172

173
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
174 175 176 177
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
    apply chain_cauchy. omega.
  Qed.
178 179
  Lemma timeless_iff n (x : A) `{!Timeless x} y : x  y  x {n} y.
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
180
    split; intros; auto. apply (timeless _), dist_le with n; auto with lia.
181
  Qed.
182
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
183

184
(** Contractive functions *)
185 186 187 188 189 190 191 192
Definition dist_later {A : ofeT} (n : nat) (x y : A) : Prop :=
  match n with 0 => True | S n => x {n} y end.
Arguments dist_later _ !_ _ _ /.

Global Instance dist_later_equivalence A n : Equivalence (@dist_later A n).
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
193

194
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
195 196
Proof. by intros n y1 y2. Qed.

197
Section contractive.
198
  Local Set Default Proof Using "Type*".
199 200 201 202
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
203
  Proof. by apply (_ : Contractive f). Qed.
204
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
205
  Proof. intros. by apply (_ : Contractive f). Qed.
206

207 208
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
209 210 211 212
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

213 214 215 216 217 218 219
Ltac f_contractive :=
  match goal with
  | |- ?f _ {_} ?f _ => apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => apply (_ : Proper (_ ==> dist_later _ ==> _) f)
  end;
  try match goal with
220 221
  | |- @dist_later ?A ?n ?x ?y =>
         destruct n as [|n]; [done|change (@dist A _ n x y)]
222 223 224 225 226 227
  end;
  try reflexivity.

Ltac solve_contractive :=
  preprocess_solve_proper;
  solve [repeat (first [f_contractive|f_equiv]; try eassumption)].
Robbert Krebbers's avatar
Robbert Krebbers committed
228

Robbert Krebbers's avatar
Robbert Krebbers committed
229
(** Fixpoint *)
230
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
231
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
232
Next Obligation.
233
  intros A ? f ? n.
234
  induction n as [|n IH]=> -[|i] //= ?; try omega.
235 236
  - apply (contractive_0 f).
  - apply (contractive_S f), IH; auto with omega.
Robbert Krebbers's avatar
Robbert Krebbers committed
237
Qed.
238

239
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
240
  `{!Contractive f} : A := compl (fixpoint_chain f).
241 242 243
Definition fixpoint_aux : seal (@fixpoint_def). by eexists. Qed.
Definition fixpoint {A AC AiH} f {Hf} := unseal fixpoint_aux A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := seal_eq fixpoint_aux.
Robbert Krebbers's avatar
Robbert Krebbers committed
244 245

Section fixpoint.
246
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
247

248
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
249
  Proof.
250 251
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
252
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
253
  Qed.
254 255 256

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
257 258 259
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
260 261
  Qed.

262
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
263
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
264
  Proof.
265
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
266
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
267 268
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
269
  Qed.
270 271
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
272
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
273 274

  Lemma fixpoint_ind (P : A  Prop) :
275
    Proper (() ==> impl) P 
276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
    ( x, P x)  ( x, P x  P (f x)) 
    ( (c : chain A), ( n, P (c n))  P (compl c)) 
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
    { intros n. induction n as [|n IH]=> -[|i] //= ?; try omega.
      - apply (contractive_0 f).
      - apply (contractive_S f), IH; auto with omega. }
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
    rewrite -(fixpoint_unique fp2); first by apply Hlim; induction n; apply Hincr.
    apply equiv_dist=>n.
    rewrite /fp2 (conv_compl n) /= /chcar.
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
291 292
End fixpoint.

293 294 295
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
296

297
Section fixpointK.
298
  Local Set Default Proof Using "Type*".
299 300
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
  Context `{f_contractive : !Contractive (Nat.iter k f)}.
301
  (* TODO: Can we get rid of this assumption, derive it from contractivity? *)
302
  Context {f_ne : NonExpansive f}.
303 304 305

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
  Existing Instance f_proper.
306

307
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
308
  Proof.
309 310
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
311 312
  Qed.

313
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
314
  Proof.
315 316
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
317 318
  Qed.

319
  Section fixpointK_ne.
320
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
321
    Context {g_ne : NonExpansive g}.
322

323
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
324
    Proof.
325 326 327
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
328 329
    Qed.

330 331 332
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
333 334 335 336 337 338 339 340 341 342

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
    ( (c : chain A), ( n, P (c n))  P (compl c)) 
    P (fixpointK k f).
  Proof.
    intros ? Hst Hincr Hlim. rewrite /fixpointK. eapply fixpoint_ind; [done..| |done].
    clear- Hincr. intros. induction k; first done. simpl. auto.
  Qed.
343
End fixpointK.
344

Robbert Krebbers's avatar
Robbert Krebbers committed
345
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
346
Section fixpointAB.
347 348
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
390
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
391

Ralf Jung's avatar
Ralf Jung committed
392
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
424
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
425

426
(** Function space *)
427
(* We make [ofe_fun] a definition so that we can register it as a canonical
428
structure. *)
429
Definition ofe_fun (A : Type) (B : ofeT) := A  B.
430

431 432 433 434 435
Section ofe_fun.
  Context {A : Type} {B : ofeT}.
  Instance ofe_fun_equiv : Equiv (ofe_fun A B) := λ f g,  x, f x  g x.
  Instance ofe_fun_dist : Dist (ofe_fun A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_fun_ofe_mixin : OfeMixin (ofe_fun A B).
436 437 438 439 440 441 442 443 444 445
  Proof.
    split.
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
    - intros n; split.
      + by intros f x.
      + by intros f g ? x.
      + by intros f g h ?? x; trans (g x).
    - by intros n f g ? x; apply dist_S.
  Qed.
446
  Canonical Structure ofe_funC := OfeT (ofe_fun A B) ofe_fun_ofe_mixin.
447

448 449 450 451 452 453 454 455 456
  Program Definition ofe_fun_chain `(c : chain ofe_funC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Global Program Instance ofe_fun_cofe `{Cofe B} : Cofe ofe_funC :=
    { compl c x := compl (ofe_fun_chain c x) }.
  Next Obligation. intros ? n c x. apply (conv_compl n (ofe_fun_chain c x)). Qed.
End ofe_fun.

Arguments ofe_funC : clear implicits.
457
Notation "A -c> B" :=
458 459
  (ofe_funC A B) (at level 99, B at level 200, right associativity).
Instance ofe_fun_inhabited {A} {B : ofeT} `{Inhabited B} :
460 461
  Inhabited (A -c> B) := populate (λ _, inhabitant).

462
(** Non-expansive function space *)
463 464
Record ofe_mor (A B : ofeT) : Type := CofeMor {
  ofe_mor_car :> A  B;
465
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
466 467
}.
Arguments CofeMor {_ _} _ {_}.
468 469
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
470

471 472 473 474
Notation "'λne' x .. y , t" :=
  (@CofeMor _ _ (λ x, .. (@CofeMor _ _ (λ y, t) _) ..) _)
  (at level 200, x binder, y binder, right associativity).

475 476 477 478 479 480 481
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
482 483
  Proof.
    split.
484
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
485
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
486
    - intros n; split.
487 488
      + by intros f x.
      + by intros f g ? x.
489
      + by intros f g h ?? x; trans (g x).
490
    - by intros n f g ? x; apply dist_S.
491
  Qed.
492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508
  Canonical Structure ofe_morC := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.

  Program Definition ofe_mor_chain (c : chain ofe_morC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morC := λ c,
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
  Global Program Instance ofe_more_cofe `{Cofe B} : Cofe ofe_morC :=
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
509

510 511 512
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
513 514 515
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
516
  Proof. done. Qed.
517
End ofe_mor.
518

519
Arguments ofe_morC : clear implicits.
520
Notation "A -n> B" :=
521 522
  (ofe_morC A B) (at level 99, B at level 200, right associativity).
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
523
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
524

525
(** Identity and composition and constant function *)
Robbert Krebbers's avatar
Robbert Krebbers committed
526 527
Definition cid {A} : A -n> A := CofeMor id.
Instance: Params (@cid) 1.
528
Definition cconst {A B : ofeT} (x : B) : A -n> B := CofeMor (const x).
529
Instance: Params (@cconst) 2.
530

Robbert Krebbers's avatar
Robbert Krebbers committed
531 532 533 534 535
Definition ccompose {A B C}
  (f : B -n> C) (g : A -n> B) : A -n> C := CofeMor (f  g).
Instance: Params (@ccompose) 3.
Infix "◎" := ccompose (at level 40, left associativity).
Lemma ccompose_ne {A B C} (f1 f2 : B -n> C) (g1 g2 : A -n> B) n :
536
  f1 {n} f2  g1 {n} g2  f1  g1 {n} f2  g2.
Robbert Krebbers's avatar
Robbert Krebbers committed
537
Proof. by intros Hf Hg x; rewrite /= (Hg x) (Hf (g2 x)). Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
538

Ralf Jung's avatar
Ralf Jung committed
539
(* Function space maps *)
540
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
541
  (h : A -n> B) : A' -n> B' := g  h  f.
542 543
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
544
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
545

546 547
Definition ofe_morC_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := CofeMor (ofe_mor_map f g).
548 549
Instance ofe_morC_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morC_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
550
Proof.
551
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
552
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
553 554
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
555
(** unit *)
556 557
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
558
  Definition unit_ofe_mixin : OfeMixin unit.
559
  Proof. by repeat split; try exists 0. Qed.
560
  Canonical Structure unitC : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
561

562 563
  Global Program Instance unit_cofe : Cofe unitC := { compl x := () }.
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
564 565

  Global Instance unit_discrete_cofe : Discrete unitC.
Robbert Krebbers's avatar
Robbert Krebbers committed
566
  Proof. done. Qed.
567
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
568 569

(** Product *)
570
Section product.
571
  Context {A B : ofeT}.
572 573 574

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
575 576 577
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
578
  Definition prod_ofe_mixin : OfeMixin (A * B).
579 580
  Proof.
    split.
581
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
582
      rewrite !equiv_dist; naive_solver.
583 584
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
585
  Qed.
586 587 588 589 590 591 592 593 594
  Canonical Structure prodC : ofeT := OfeT (A * B) prod_ofe_mixin.

  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodC :=
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

595 596 597
  Global Instance prod_timeless (x : A * B) :
    Timeless (x.1)  Timeless (x.2)  Timeless x.
  Proof. by intros ???[??]; split; apply (timeless _). Qed.
598 599
  Global Instance prod_discrete_cofe : Discrete A  Discrete B  Discrete prodC.
  Proof. intros ?? [??]; apply _. Qed.
600 601 602 603 604
End product.

Arguments prodC : clear implicits.
Typeclasses Opaque prod_dist.

605
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
606 607 608 609 610
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
Definition prodC_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodC A B -n> prodC A' B' := CofeMor (prod_map f g).
611 612 613
Instance prodC_map_ne {A A' B B'} :
  NonExpansive2 (@prodC_map A A' B B').
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
614

615 616
(** Functors *)
Structure cFunctor := CFunctor {
617
  cFunctor_car : ofeT  ofeT  ofeT;
618 619
  cFunctor_map {A1 A2 B1 B2} :
    ((A2 -n> A1) * (B1 -n> B2))  cFunctor_car A1 B1 -n> cFunctor_car A2 B2;
620 621
  cFunctor_ne {A1 A2 B1 B2} :
    NonExpansive (@cFunctor_map A1 A2 B1 B2);
622
  cFunctor_id {A B : ofeT} (x : cFunctor_car A B) :
623 624 625 626 627
    cFunctor_map (cid,cid) x  x;
  cFunctor_compose {A1 A2 A3 B1 B2 B3}
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
    cFunctor_map (fg, g'f') x  cFunctor_map (g,g') (cFunctor_map (f,f') x)
}.
628
Existing Instance cFunctor_ne.
629 630
Instance: Params (@cFunctor_map) 5.

631 632 633
Delimit Scope cFunctor_scope with CF.
Bind Scope cFunctor_scope with cFunctor.

634 635 636
Class cFunctorContractive (F : cFunctor) :=
  cFunctor_contractive A1 A2 B1 B2 :> Contractive (@cFunctor_map F A1 A2 B1 B2).

637
Definition cFunctor_diag (F: cFunctor) (A: ofeT) : ofeT := cFunctor_car F A A.
638 639
Coercion cFunctor_diag : cFunctor >-> Funclass.

640
Program Definition constCF (B : ofeT) : cFunctor :=
641 642
  {| cFunctor_car A1 A2 := B; cFunctor_map A1 A2 B1 B2 f := cid |}.
Solve Obligations with done.
643
Coercion constCF : ofeT >-> cFunctor.
644

645
Instance constCF_contractive B : cFunctorContractive (constCF B).
646
Proof. rewrite /cFunctorContractive; apply _. Qed.
647 648 649 650

Program Definition idCF : cFunctor :=
  {| cFunctor_car A1 A2 := A2; cFunctor_map A1 A2 B1 B2 f := f.2 |}.
Solve Obligations with done.
651
Notation "∙" := idCF : cFunctor_scope.
652

653 654 655 656 657
Program Definition prodCF (F1 F2 : cFunctor) : cFunctor := {|
  cFunctor_car A B := prodC (cFunctor_car F1 A B) (cFunctor_car F2 A B);
  cFunctor_map A1 A2 B1 B2 fg :=
    prodC_map (cFunctor_map F1 fg) (cFunctor_map F2 fg)
|}.
658 659 660
Next Obligation.
  intros ?? A1 A2 B1 B2 n ???; by apply prodC_map_ne; apply cFunctor_ne.
Qed.
661 662 663 664 665
Next Obligation. by intros F1 F2 A B [??]; rewrite /= !cFunctor_id. Qed.
Next Obligation.
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [??]; simpl.
  by rewrite !cFunctor_compose.
Qed.
666
Notation "F1 * F2" := (prodCF F1%CF F2%CF) : cFunctor_scope.
667

668 669 670 671 672 673 674 675
Instance prodCF_contractive F1 F2 :
  cFunctorContractive F1  cFunctorContractive F2 
  cFunctorContractive (prodCF F1 F2).
Proof.
  intros ?? A1 A2 B1 B2 n ???;
    by apply prodC_map_ne; apply cFunctor_contractive.
Qed.

676 677 678
Instance compose_ne {A} {B B' : ofeT} (f : B -n> B') :
  NonExpansive (compose f : (A -c> B)  A -c> B').
Proof. intros n g g' Hf x; simpl. by rewrite (Hf x). Qed.
679

680
Definition ofe_funC_map {A B B'} (f : B -n> B') : (A -c> B) -n> (A -c> B') :=
681
  @CofeMor (_ -c> _) (_ -c> _) (compose f) _.
682 683 684
Instance ofe_funC_map_ne {A B B'} :
  NonExpansive (@ofe_funC_map A B B').
Proof. intros n f f' Hf g x. apply Hf. Qed.
685

686 687 688
Program Definition ofe_funCF (T : Type) (F : cFunctor) : cFunctor := {|
  cFunctor_car A B := ofe_funC T (cFunctor_car F A B);
  cFunctor_map A1 A2 B1 B2 fg := ofe_funC_map (cFunctor_map F fg)
689 690
|}.
Next Obligation.
691
  intros ?? A1 A2 B1 B2 n ???; by apply ofe_funC_map_ne; apply cFunctor_ne.
692 693 694 695 696 697
Qed.
Next Obligation. intros F1 F2 A B ??. by rewrite /= /compose /= !cFunctor_id. Qed.
Next Obligation.
  intros T F A1 A2 A3 B1 B2 B3 f g f' g' ??; simpl.
  by rewrite !cFunctor_compose.
Qed.
698
Notation "T -c> F" := (ofe_funCF T%type F%CF) : cFunctor_scope.
699

700 701
Instance ofe_funCF_contractive (T : Type) (F : cFunctor) :
  cFunctorContractive F  cFunctorContractive (ofe_funCF T F).
702 703
Proof.
  intros ?? A1 A2 B1 B2 n ???;
704
    by apply ofe_funC_map_ne; apply cFunctor_contractive.
705 706
Qed.

707
Program Definition ofe_morCF (F1 F2 : cFunctor) : cFunctor := {|
708
  cFunctor_car A B := cFunctor_car F1 B A -n> cFunctor_car F2 A B;
Ralf Jung's avatar
Ralf Jung committed
709
  cFunctor_map A1 A2 B1 B2 fg :=
710
    ofe_morC_map (cFunctor_map F1 (fg.2, fg.1)) (cFunctor_map F2 fg)
Ralf Jung's avatar
Ralf Jung committed
711
|}.
712 713
Next Obligation.
  intros F1 F2 A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
714
  apply ofe_morC_map_ne; apply cFunctor_ne; split; by apply Hfg.
715
Qed.
Ralf Jung's avatar
Ralf Jung committed
716
Next Obligation.
717 718
  intros F1 F2 A B [f ?] ?; simpl. rewrite /= !cFunctor_id.
  apply (ne_proper f). apply cFunctor_id.
Ralf Jung's avatar
Ralf Jung committed
719 720
Qed.
Next Obligation.
721 722
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [h ?] ?; simpl in *.
  rewrite -!cFunctor_compose. do 2 apply (ne_proper _). apply cFunctor_compose.
Ralf Jung's avatar
Ralf Jung committed
723
Qed.
724
Notation "F1 -n> F2" := (ofe_morCF F1%CF F2%CF) : cFunctor_scope.
Ralf Jung's avatar
Ralf Jung committed
725

726
Instance ofe_morCF_contractive F1 F2 :
727
  cFunctorContractive F1  cFunctorContractive F2 
728
  cFunctorContractive (ofe_morCF F1 F2).
729 730
Proof.
  intros ?? A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
731
  apply ofe_morC_map_ne; apply cFunctor_contractive; destruct n, Hfg; by split.
732 733
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
734 735
(** Sum *)
Section sum.
736
  Context {A B : ofeT}.
Robbert Krebbers's avatar
Robbert Krebbers committed
737 738

  Instance sum_dist : Dist (A + B) := λ n, sum_relation (dist n) (dist n).
739 740
  Global Instance inl_ne : NonExpansive (@inl A B) := _.
  Global Instance inr_ne : NonExpansive (@inr A B) := _.
Robbert Krebbers's avatar
Robbert Krebbers committed
741 742 743
  Global Instance inl_ne_inj : Inj (dist n) (dist n) (@inl A B) := _.
  Global Instance inr_ne_inj : Inj (dist n) (dist n) (@inr A B) := _.

744 745 746 747 748 749 750 751 752 753 754 755
  Definition sum_ofe_mixin : OfeMixin (A + B).
  Proof.
    split.
    - intros x y; split=> Hx.
      + destruct Hx=> n; constructor; by apply equiv_dist.
      + destruct (Hx 0); constructor; apply equiv_dist=> n; by apply (inj _).
    - apply _.
    - destruct 1; constructor; by apply dist_S.
  Qed.
  Canonical Structure sumC : ofeT := OfeT (A + B) sum_ofe_mixin.

  Program Definition inl_chain (c : chain sumC) (a : A) : chain A :=
Robbert Krebbers's avatar
Robbert Krebbers committed
756 757
    {| chain_car n := match c n return _ with inl a' => a' | _ => a end |}.
  Next Obligation. intros c a n i ?; simpl. by destruct (chain_cauchy c n i). Qed.