ofe.v 65.8 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
3
Set Primitive Projections.
Robbert Krebbers's avatar
Robbert Krebbers committed
4

5
(** This files defines (a shallow embedding of) the category of OFEs:
6 7 8 9
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
Jacques-Henri Jourdan's avatar
Jacques-Henri Jourdan committed
10
    This makes writing such functions much easier. It turns out that it many
11 12 13
    cases, we do not even need non-expansiveness.
*)

Paolo G. Giarrusso's avatar
Paolo G. Giarrusso committed
14
(** Unbundled version *)
Robbert Krebbers's avatar
Robbert Krebbers committed
15
Class Dist A := dist : nat  relation A.
16
Instance: Params (@dist) 3 := {}.
17 18
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
19 20 21
Notation "x ≡{ n }@{ A }≡ y" := (dist (A:=A) n x y)
  (at level 70, n at next level, only parsing).

Tej Chajed's avatar
Tej Chajed committed
22 23
Hint Extern 0 (_ {_} _) => reflexivity : core.
Hint Extern 0 (_ {_} _) => symmetry; assumption : core.
24 25
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
26

27
Tactic Notation "ofe_subst" ident(x) :=
28
  repeat match goal with
29
  | _ => progress simplify_eq/=
30 31 32
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
33
Tactic Notation "ofe_subst" :=
34
  repeat match goal with
35
  | _ => progress simplify_eq/=
36 37
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
38
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
39

40 41 42 43 44
Record OfeMixin A `{Equiv A, Dist A} := {
  mixin_equiv_dist x y : x  y   n, x {n} y;
  mixin_dist_equivalence n : Equivalence (dist n);
  mixin_dist_S n x y : x {S n} y  x {n} y
}.
Robbert Krebbers's avatar
Robbert Krebbers committed
45

Paolo G. Giarrusso's avatar
Paolo G. Giarrusso committed
46
(** Bundled version *)
47
Structure ofeT := OfeT {
48 49 50
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
51
  ofe_mixin : OfeMixin ofe_car
Robbert Krebbers's avatar
Robbert Krebbers committed
52
}.
53
Arguments OfeT _ {_ _} _.
54 55 56 57 58 59 60
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
61

62 63 64
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
65
different places (see for example the constructors [CmraT] and [UcmraT] in the
66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

87
(** Lifting properties from the mixin *)
88 89
Section ofe_mixin.
  Context {A : ofeT}.
90
  Implicit Types x y : A.
91
  Lemma equiv_dist x y : x  y   n, x {n} y.
92
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
93
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
94
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
95
  Lemma dist_S n x y : x {S n} y  x {n} y.
96 97
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
98

Tej Chajed's avatar
Tej Chajed committed
99
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption : core.
Robbert Krebbers's avatar
Robbert Krebbers committed
100

101 102 103 104
(** Discrete OFEs and discrete OFE elements *)
Class Discrete {A : ofeT} (x : A) := discrete y : x {0} y  x  y.
Arguments discrete {_} _ {_} _ _.
Hint Mode Discrete + ! : typeclass_instances.
105
Instance: Params (@Discrete) 1 := {}.
106

107
Class OfeDiscrete (A : ofeT) := ofe_discrete_discrete (x : A) :> Discrete x.
108 109 110 111 112 113 114 115 116

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

117
Program Definition chain_map {A B : ofeT} (f : A  B)
118
    `{!NonExpansive f} (c : chain A) : chain B :=
119 120 121
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

122 123 124 125 126 127
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
Robbert Krebbers's avatar
Robbert Krebbers committed
128
Hint Mode Cofe ! : typeclass_instances.
129

130
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
131 132 133
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

134 135 136 137 138 139 140 141
Program Definition chain_const {A : ofeT} (a : A) : chain A :=
  {| chain_car n := a |}.
Next Obligation. by intros A a n i _. Qed.

Lemma compl_chain_const {A : ofeT} `{!Cofe A} (a : A) :
  compl (chain_const a)  a.
Proof. apply equiv_dist=>n. by rewrite conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
142
(** General properties *)
143
Section ofe.
144
  Context {A : ofeT}.
145
  Implicit Types x y : A.
146
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
147 148
  Proof.
    split.
149 150
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
151
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
152
  Qed.
153
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
154 155
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
156 157
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
158
  Qed.
159
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
160
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
161
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
162 163 164
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
165 166
  Global Instance Discrete_proper : Proper (() ==> iff) (@Discrete A).
  Proof. intros x y Hxy. rewrite /Discrete. by setoid_rewrite Hxy. Qed.
167

Robbert Krebbers's avatar
Robbert Krebbers committed
168
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
169
  Proof. induction 2; eauto using dist_S. Qed.
170 171
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
172 173
  Instance ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f | 100.
Robbert Krebbers's avatar
Robbert Krebbers committed
174
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
175
  Instance ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
Robbert Krebbers's avatar
Robbert Krebbers committed
176 177 178
    Proper (() ==> () ==> ()) f | 100.
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
179
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
180
  Qed.
181

182
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
183 184
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
Ralf Jung's avatar
Ralf Jung committed
185
    apply chain_cauchy. lia.
186
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
187

188
  Lemma discrete_iff n (x : A) `{!Discrete x} y : x  y  x {n} y.
189
  Proof.
190
    split; intros; auto. apply (discrete _), dist_le with n; auto with lia.
191
  Qed.
192
  Lemma discrete_iff_0 n (x : A) `{!Discrete x} y : x {0} y  x {n} y.
193
  Proof. by rewrite -!discrete_iff. Qed.
194
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
195

196
(** Contractive functions *)
197
Definition dist_later `{Dist A} (n : nat) (x y : A) : Prop :=
198
  match n with 0 => True | S n => x {n} y end.
199
Arguments dist_later _ _ !_ _ _ /.
200

201
Global Instance dist_later_equivalence (A : ofeT) n : Equivalence (@dist_later A _ n).
202 203
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

204 205 206
Lemma dist_dist_later {A : ofeT} n (x y : A) : dist n x y  dist_later n x y.
Proof. intros Heq. destruct n; first done. exact: dist_S. Qed.

207 208 209 210 211 212 213 214 215 216 217
Lemma dist_later_dist {A : ofeT} n (x y : A) : dist_later (S n) x y  dist n x y.
Proof. done. Qed.

(* We don't actually need this lemma (as our tactics deal with this through
   other means), but technically speaking, this is the reason why
   pre-composing a non-expansive function to a contractive function
   preserves contractivity. *)
Lemma ne_dist_later {A B : ofeT} (f : A  B) :
  NonExpansive f   n, Proper (dist_later n ==> dist_later n) f.
Proof. intros Hf [|n]; last exact: Hf. hnf. by intros. Qed.

218
Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
219

220
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
221 222
Proof. by intros n y1 y2. Qed.

223
Section contractive.
224
  Local Set Default Proof Using "Type*".
225 226 227 228
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
229
  Proof. by apply (_ : Contractive f). Qed.
230
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
231
  Proof. intros. by apply (_ : Contractive f). Qed.
232

233 234
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
235 236 237 238
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

239 240
Ltac f_contractive :=
  match goal with
Robbert Krebbers's avatar
Robbert Krebbers committed
241 242 243
  | |- ?f _ {_} ?f _ => simple apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (_ ==> dist_later _ ==> _) f)
244 245
  end;
  try match goal with
246
  | |- @dist_later ?A _ ?n ?x ?y =>
247
         destruct n as [|n]; [exact I|change (@dist A _ n x y)]
248
  end;
Robbert Krebbers's avatar
Robbert Krebbers committed
249
  try simple apply reflexivity.
250

Robbert Krebbers's avatar
Robbert Krebbers committed
251 252
Ltac solve_contractive :=
  solve_proper_core ltac:(fun _ => first [f_contractive | f_equiv]).
Robbert Krebbers's avatar
Robbert Krebbers committed
253

Robbert Krebbers's avatar
Robbert Krebbers committed
254 255 256 257 258 259 260 261 262 263 264 265 266 267
(** Limit preserving predicates *)
Class LimitPreserving `{!Cofe A} (P : A  Prop) : Prop :=
  limit_preserving (c : chain A) : ( n, P (c n))  P (compl c).
Hint Mode LimitPreserving + + ! : typeclass_instances.

Section limit_preserving.
  Context `{Cofe A}.
  (* These are not instances as they will never fire automatically...
     but they can still be helpful in proving things to be limit preserving. *)

  Lemma limit_preserving_ext (P Q : A  Prop) :
    ( x, P x  Q x)  LimitPreserving P  LimitPreserving Q.
  Proof. intros HP Hlimit c ?. apply HP, Hlimit=> n; by apply HP. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
268
  Global Instance limit_preserving_const (P : Prop) : LimitPreserving (λ _ : A, P).
Robbert Krebbers's avatar
Robbert Krebbers committed
269 270
  Proof. intros c HP. apply (HP 0). Qed.

271
  Lemma limit_preserving_discrete (P : A  Prop) :
Robbert Krebbers's avatar
Robbert Krebbers committed
272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291
    Proper (dist 0 ==> impl) P  LimitPreserving P.
  Proof. intros PH c Hc. by rewrite (conv_compl 0). Qed.

  Lemma limit_preserving_and (P1 P2 : A  Prop) :
    LimitPreserving P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof. intros Hlim1 Hlim2 c Hc. split. apply Hlim1, Hc. apply Hlim2, Hc. Qed.

  Lemma limit_preserving_impl (P1 P2 : A  Prop) :
    Proper (dist 0 ==> impl) P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof.
    intros Hlim1 Hlim2 c Hc HP1. apply Hlim2=> n; apply Hc.
    eapply Hlim1, HP1. apply dist_le with n; last lia. apply (conv_compl n).
  Qed.

  Lemma limit_preserving_forall {B} (P : B  A  Prop) :
    ( y, LimitPreserving (P y)) 
    LimitPreserving (λ x,  y, P y x).
  Proof. intros Hlim c Hc y. by apply Hlim. Qed.
292 293 294 295 296 297 298

  Lemma limit_preserving_equiv `{!Cofe B} (f g : A  B) :
    NonExpansive f  NonExpansive g  LimitPreserving (λ x, f x  g x).
  Proof.
    intros Hf Hg c Hc. apply equiv_dist=> n.
    by rewrite -!compl_chain_map !conv_compl /= Hc.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
299 300
End limit_preserving.

Robbert Krebbers's avatar
Robbert Krebbers committed
301
(** Fixpoint *)
302
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
303
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
304
Next Obligation.
305
  intros A ? f ? n.
Ralf Jung's avatar
Ralf Jung committed
306
  induction n as [|n IH]=> -[|i] //= ?; try lia.
307
  - apply (contractive_0 f).
Ralf Jung's avatar
Ralf Jung committed
308
  - apply (contractive_S f), IH; auto with lia.
Robbert Krebbers's avatar
Robbert Krebbers committed
309
Qed.
310

311
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
312
  `{!Contractive f} : A := compl (fixpoint_chain f).
313
Definition fixpoint_aux : seal (@fixpoint_def). Proof. by eexists. Qed.
314 315
Definition fixpoint {A AC AiH} f {Hf} := fixpoint_aux.(unseal) A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := fixpoint_aux.(seal_eq).
Robbert Krebbers's avatar
Robbert Krebbers committed
316 317

Section fixpoint.
318
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
319

320
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
321
  Proof.
322 323
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
324
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
325
  Qed.
326 327 328

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
329 330 331
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
332 333
  Qed.

334
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
335
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
336
  Proof.
337
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
338
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
339 340
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
341
  Qed.
342 343
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
344
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
345 346

  Lemma fixpoint_ind (P : A  Prop) :
347
    Proper (() ==> impl) P 
348
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
349
    LimitPreserving P 
350 351 352 353
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
Robbert Krebbers's avatar
Robbert Krebbers committed
354
    { intros n. rewrite /chcar. induction n as [|n IH]=> -[|i] //=;
Ralf Jung's avatar
Ralf Jung committed
355
        eauto using contractive_0, contractive_S with lia. }
356
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
Robbert Krebbers's avatar
Robbert Krebbers committed
357 358 359 360
    assert (f fp2  fp2).
    { apply equiv_dist=>n. rewrite /fp2 (conv_compl n) /= /chcar.
      induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S. }
    rewrite -(fixpoint_unique fp2) //.
Robbert Krebbers's avatar
Robbert Krebbers committed
361
    apply Hlim=> n /=. by apply Nat_iter_ind.
362
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
363 364
End fixpoint.

Robbert Krebbers's avatar
Robbert Krebbers committed
365

366 367 368
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
369

370
Section fixpointK.
371
  Local Set Default Proof Using "Type*".
372
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395
  Context {f_contractive : Contractive (Nat.iter k f)} {f_ne : NonExpansive f}.
  (* Note than f_ne is crucial here:  there are functions f such that f^2 is contractive,
     but f is not non-expansive.
     Consider for example f: SPred → SPred (where SPred is "downclosed sets of natural numbers").
     Define f (using informative excluded middle) as follows:
     f(N) = N  (where N is the set of all natural numbers)
     f({0, ..., n}) = {0, ... n-1}  if n is even (so n-1 is at least -1, in which case we return the empty set)
     f({0, ..., n}) = {0, ..., n+2} if n is odd
     In other words, if we consider elements of SPred as ordinals, then we decreaste odd finite
     ordinals by 1 and increase even finite ordinals by 2.
     f is not non-expansive:  Consider f({0}) = ∅ and f({0,1}) = f({0,1,2,3}).
     The arguments are clearly 0-equal, but the results are not.

     Now consider g := f^2. We have
     g(N) = N
     g({0, ..., n}) = {0, ... n+1}  if n is even
     g({0, ..., n}) = {0, ..., n+4} if n is odd
     g is contractive.  All outputs contain 0, so they are all 0-equal.
     Now consider two n-equal inputs. We have to show that the outputs are n+1-equal.
     Either they both do not contain n in which case they have to be fully equal and
     hence so are the results.  Or else they both contain n, so the results will
     both contain n+1, so the results are n+1-equal.
   *)
396 397

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
398
  Local Existing Instance f_proper.
399

400
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
401
  Proof.
402 403
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
404 405
  Qed.

406
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
407
  Proof.
408 409
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
410 411
  Qed.

412
  Section fixpointK_ne.
413
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
414
    Context {g_ne : NonExpansive g}.
415

416
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
417
    Proof.
418 419 420
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
421 422
    Qed.

423 424 425
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
426 427 428 429

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
430
    LimitPreserving P 
Ralf Jung's avatar
Ralf Jung committed
431 432
    P (fixpointK k f).
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
433
    intros. rewrite /fixpointK. apply fixpoint_ind; eauto.
Robbert Krebbers's avatar
Robbert Krebbers committed
434
    intros; apply Nat_iter_ind; auto.
Ralf Jung's avatar
Ralf Jung committed
435
  Qed.
436
End fixpointK.
437

Robbert Krebbers's avatar
Robbert Krebbers committed
438
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
439
Section fixpointAB.
440 441
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
483
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
484

Ralf Jung's avatar
Ralf Jung committed
485
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
517
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
518

519
(** Non-expansive function space *)
520
Record ofe_mor (A B : ofeT) : Type := OfeMor {
521
  ofe_mor_car :> A  B;
522
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
523
}.
524
Arguments OfeMor {_ _} _ {_}.
525 526
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
527

528
Notation "'λne' x .. y , t" :=
529
  (@OfeMor _ _ (λ x, .. (@OfeMor _ _ (λ y, t) _) ..) _)
530 531
  (at level 200, x binder, y binder, right associativity).

532 533 534 535 536 537 538
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
539 540
  Proof.
    split.
541
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
542
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
543
    - intros n; split.
544 545
      + by intros f x.
      + by intros f g ? x.
546
      + by intros f g h ?? x; trans (g x).
547
    - by intros n f g ? x; apply dist_S.
548
  Qed.
549
  Canonical Structure ofe_morO := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.
550

551
  Program Definition ofe_mor_chain (c : chain ofe_morO)
552 553
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
554
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morO := λ c,
555 556 557 558 559
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
560
  Global Program Instance ofe_mor_cofe `{Cofe B} : Cofe ofe_morO :=
561 562 563 564 565
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
566

567 568 569
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
570 571 572
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
573
  Proof. done. Qed.
574
End ofe_mor.
575

576
Arguments ofe_morO : clear implicits.
577
Notation "A -n> B" :=
578
  (ofe_morO A B) (at level 99, B at level 200, right associativity).
579
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
580
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
581

582
(** Identity and composition and constant function *)
583
Definition cid {A} : A -n> A := OfeMor id.
584
Instance: Params (@cid) 1 := {}.
585
Definition cconst {A B : ofeT} (x : B) : A -n> B := OfeMor (const x).
586
Instance: Params (@cconst) 2 := {}.
587

Robbert Krebbers's avatar
Robbert Krebbers committed
588
Definition ccompose {A B C}
589
  (f : B -n> C) (g : A -n> B) : A -n> C := OfeMor (f  g).
590
Instance: Params (@ccompose) 3 := {}.
Robbert Krebbers's avatar
Robbert Krebbers committed
591
Infix "◎" := ccompose (at level 40, left associativity).
592 593 594
Global Instance ccompose_ne {A B C} :
  NonExpansive2 (@ccompose A B C).
Proof. intros n ?? Hf g1 g2 Hg x. rewrite /= (Hg x) (Hf (g2 x)) //. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
595

Ralf Jung's avatar
Ralf Jung committed
596
(* Function space maps *)
597
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
598
  (h : A -n> B) : A' -n> B' := g  h  f.
599 600
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
601
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
602

603 604 605 606
Definition ofe_morO_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := OfeMor (ofe_mor_map f g).
Instance ofe_morO_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morO_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
607
Proof.
608
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
609
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
610 611
Qed.

612
(** * Unit type *)
613 614
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
615
  Definition unit_ofe_mixin : OfeMixin unit.
616
  Proof. by repeat split; try exists 0. Qed.
617
  Canonical Structure unitO : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
618

619
  Global Program Instance unit_cofe : Cofe unitO := { compl x := () }.
620
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
621

622
  Global Instance unit_ofe_discrete : OfeDiscrete unitO.
Robbert Krebbers's avatar
Robbert Krebbers committed
623
  Proof. done. Qed.
624
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
625

626
(** * Empty type *)
627 628 629 630 631 632 633 634 635 636 637 638 639
Section empty.
  Instance Empty_set_dist : Dist Empty_set := λ _ _ _, True.
  Definition Empty_set_ofe_mixin : OfeMixin Empty_set.
  Proof. by repeat split; try exists 0. Qed.
  Canonical Structure Empty_setO : ofeT := OfeT Empty_set Empty_set_ofe_mixin.

  Global Program Instance Empty_set_cofe : Cofe Empty_setO := { compl x := x 0 }.
  Next Obligation. by repeat split; try exists 0. Qed.

  Global Instance Empty_set_ofe_discrete : OfeDiscrete Empty_setO.
  Proof. done. Qed.
End empty.

640
(** * Product type *)
641
Section product.
642
  Context {A B : ofeT}.
643 644 645

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
646 647 648
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
649
  Definition prod_ofe_mixin : OfeMixin (A * B).
650 651
  Proof.
    split.
652
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
653
      rewrite !equiv_dist; naive_solver.
654 655
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
656
  Qed.
657
  Canonical Structure prodO : ofeT := OfeT (A * B) prod_ofe_mixin.
658

659
  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodO :=
660 661 662 663 664 665
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

666 667 668
  Global Instance prod_discrete (x : A * B) :
    Discrete (x.1)  Discrete (x.2)  Discrete x.
  Proof. by intros ???[??]; split; apply (discrete _). Qed.
669
  Global Instance prod_ofe_discrete :
670
    OfeDiscrete A  OfeDiscrete B  OfeDiscrete prodO.
671
  Proof. intros ?? [??]; apply _. Qed.
672 673
End product.

674
Arguments prodO : clear implicits.
675 676
Typeclasses Opaque prod_dist.

677
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
678 679 680
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
681 682 683 684
Definition prodO_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodO A B -n> prodO A' B' := OfeMor (prod_map f g).
Instance prodO_map_ne {A A' B B'} :
  NonExpansive2 (@prodO_map A A' B B').
685
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
686

687
(** * COFE → OFE Functors *)
688 689 690 691
Record oFunctor := OFunctor {
  oFunctor_car :  A `{!Cofe A} B `{!Cofe B}, ofeT;
  oFunctor_map `{!Cofe A1, !Cofe A2, !Cofe B1, !Cofe B2} :
    ((A2 -n> A1) * (B1 -n> B2))  oFunctor_car A1 B1 -n> oFunctor_car A2 B2;
692
  oFunctor_map_ne `{!Cofe A1, !Cofe A2, !Cofe B1, !Cofe B2} :
693
    NonExpansive (@oFunctor_map A1 _ A2 _ B1 _ B2 _);
694
  oFunctor_map_id `{!Cofe A, !Cofe B} (x : oFunctor_car A B) :
695
    oFunctor_map (cid,cid) x  x;
696
  oFunctor_map_compose `{!Cofe A1, !Cofe A2, !Cofe A3, !Cofe B1, !Cofe B2, !Cofe B3}
697
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
698
    oFunctor_map (fg, g'f') x  oFunctor_map (g,g') (oFunctor_map (f,f') x)
699
}.
700
Existing Instance oFunctor_map_ne.
701
Instance: Params (@oFunctor_map) 9 := {}.
702

703 704
Delimit Scope oFunctor_scope with OF.
Bind Scope oFunctor_scope with oFunctor.
705

706
Class oFunctorContractive (F : oFunctor) :=
707
  oFunctor_map_contractive `{!Cofe A1, !Cofe A2, !Cofe B1, !Cofe B2} :>
708 709
    Contractive (@oFunctor_map F A1 _ A2 _ B1 _ B2 _).
Hint Mode oFunctorContractive ! : typeclass_instances.
710

Robbert Krebbers's avatar
Robbert Krebbers committed
711 712
(** Not a coercion due to the [Cofe] type class argument, and to avoid
ambiguous coercion paths, see https://gitlab.mpi-sws.org/iris/iris/issues/240. *)
713
Definition oFunctor_apply (F: oFunctor) (A: ofeT) `{!Cofe A} : ofeT :=
714
  oFunctor_car F A A.
715

716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740