ofe.v 49.2 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
3
Set Primitive Projections.
Robbert Krebbers's avatar
Robbert Krebbers committed
4

5
(** This files defines (a shallow embedding of) the category of OFEs:
6 7 8 9
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
Jacques-Henri Jourdan's avatar
Jacques-Henri Jourdan committed
10
    This makes writing such functions much easier. It turns out that it many
11 12 13
    cases, we do not even need non-expansiveness.
*)

Robbert Krebbers's avatar
Robbert Krebbers committed
14 15
(** Unbundeled version *)
Class Dist A := dist : nat  relation A.
16
Instance: Params (@dist) 3.
17 18
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
19
Hint Extern 0 (_ {_} _) => reflexivity.
20
Hint Extern 0 (_ {_} _) => symmetry; assumption.
21 22
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
23

24
Tactic Notation "ofe_subst" ident(x) :=
25
  repeat match goal with
26
  | _ => progress simplify_eq/=
27 28 29
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
30
Tactic Notation "ofe_subst" :=
31
  repeat match goal with
32
  | _ => progress simplify_eq/=
33 34
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
35
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
36

37 38 39 40 41
Record OfeMixin A `{Equiv A, Dist A} := {
  mixin_equiv_dist x y : x  y   n, x {n} y;
  mixin_dist_equivalence n : Equivalence (dist n);
  mixin_dist_S n x y : x {S n} y  x {n} y
}.
Robbert Krebbers's avatar
Robbert Krebbers committed
42 43

(** Bundeled version *)
44
Structure ofeT := OfeT {
45 46 47
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
48
  ofe_mixin : OfeMixin ofe_car
Robbert Krebbers's avatar
Robbert Krebbers committed
49
}.
50
Arguments OfeT _ {_ _} _.
51 52 53 54 55 56 57
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
58

59 60 61
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
62
different places (see for example the constructors [CmraT] and [UcmraT] in the
63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

84
(** Lifting properties from the mixin *)
85 86
Section ofe_mixin.
  Context {A : ofeT}.
87
  Implicit Types x y : A.
88
  Lemma equiv_dist x y : x  y   n, x {n} y.
89
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
90
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
91
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
92
  Lemma dist_S n x y : x {S n} y  x {n} y.
93 94
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
95

Robbert Krebbers's avatar
Robbert Krebbers committed
96 97
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption.

98 99 100 101 102 103
(** Discrete OFEs and discrete OFE elements *)
Class Discrete {A : ofeT} (x : A) := discrete y : x {0} y  x  y.
Arguments discrete {_} _ {_} _ _.
Hint Mode Discrete + ! : typeclass_instances.
Instance: Params (@Discrete) 1.

104
Class OfeDiscrete (A : ofeT) := ofe_discrete_discrete (x : A) :> Discrete x.
105 106 107 108 109 110 111 112 113

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

114
Program Definition chain_map {A B : ofeT} (f : A  B)
115
    `{!NonExpansive f} (c : chain A) : chain B :=
116 117 118
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

119 120 121 122 123 124
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
125

126
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
127 128 129
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

130 131 132 133 134 135 136 137
Program Definition chain_const {A : ofeT} (a : A) : chain A :=
  {| chain_car n := a |}.
Next Obligation. by intros A a n i _. Qed.

Lemma compl_chain_const {A : ofeT} `{!Cofe A} (a : A) :
  compl (chain_const a)  a.
Proof. apply equiv_dist=>n. by rewrite conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
138
(** General properties *)
139
Section ofe.
140
  Context {A : ofeT}.
141
  Implicit Types x y : A.
142
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
143 144
  Proof.
    split.
145 146
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
147
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
148
  Qed.
149
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
150 151
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
152 153
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
154
  Qed.
155
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
156
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
157
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
158 159 160
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
161 162
  Global Instance Discrete_proper : Proper (() ==> iff) (@Discrete A).
  Proof. intros x y Hxy. rewrite /Discrete. by setoid_rewrite Hxy. Qed.
163

Robbert Krebbers's avatar
Robbert Krebbers committed
164
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
165
  Proof. induction 2; eauto using dist_S. Qed.
166 167
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
168 169
  Instance ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f | 100.
Robbert Krebbers's avatar
Robbert Krebbers committed
170
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
171
  Instance ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
Robbert Krebbers's avatar
Robbert Krebbers committed
172 173 174
    Proper (() ==> () ==> ()) f | 100.
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
175
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
176
  Qed.
177

178
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
179 180 181 182
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
    apply chain_cauchy. omega.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
183

184
  Lemma discrete_iff n (x : A) `{!Discrete x} y : x  y  x {n} y.
185
  Proof.
186
    split; intros; auto. apply (discrete _), dist_le with n; auto with lia.
187
  Qed.
188
  Lemma discrete_iff_0 n (x : A) `{!Discrete x} y : x {0} y  x {n} y.
189
  Proof. by rewrite -!discrete_iff. Qed.
190
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
191

192
(** Contractive functions *)
193
Definition dist_later `{Dist A} (n : nat) (x y : A) : Prop :=
194
  match n with 0 => True | S n => x {n} y end.
195
Arguments dist_later _ _ !_ _ _ /.
196

197
Global Instance dist_later_equivalence (A : ofeT) n : Equivalence (@dist_later A _ n).
198 199
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

200 201 202
Lemma dist_dist_later {A : ofeT} n (x y : A) : dist n x y  dist_later n x y.
Proof. intros Heq. destruct n; first done. exact: dist_S. Qed.

203 204 205 206 207 208 209 210 211 212 213
Lemma dist_later_dist {A : ofeT} n (x y : A) : dist_later (S n) x y  dist n x y.
Proof. done. Qed.

(* We don't actually need this lemma (as our tactics deal with this through
   other means), but technically speaking, this is the reason why
   pre-composing a non-expansive function to a contractive function
   preserves contractivity. *)
Lemma ne_dist_later {A B : ofeT} (f : A  B) :
  NonExpansive f   n, Proper (dist_later n ==> dist_later n) f.
Proof. intros Hf [|n]; last exact: Hf. hnf. by intros. Qed.

214
Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
215

216
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
217 218
Proof. by intros n y1 y2. Qed.

219
Section contractive.
220
  Local Set Default Proof Using "Type*".
221 222 223 224
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
225
  Proof. by apply (_ : Contractive f). Qed.
226
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
227
  Proof. intros. by apply (_ : Contractive f). Qed.
228

229 230
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
231 232 233 234
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

235 236
Ltac f_contractive :=
  match goal with
Robbert Krebbers's avatar
Robbert Krebbers committed
237 238 239
  | |- ?f _ {_} ?f _ => simple apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (_ ==> dist_later _ ==> _) f)
240 241
  end;
  try match goal with
242
  | |- @dist_later ?A _ ?n ?x ?y =>
243
         destruct n as [|n]; [exact I|change (@dist A _ n x y)]
244
  end;
Robbert Krebbers's avatar
Robbert Krebbers committed
245
  try simple apply reflexivity.
246

Robbert Krebbers's avatar
Robbert Krebbers committed
247 248
Ltac solve_contractive :=
  solve_proper_core ltac:(fun _ => first [f_contractive | f_equiv]).
Robbert Krebbers's avatar
Robbert Krebbers committed
249

Robbert Krebbers's avatar
Robbert Krebbers committed
250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266
(** Limit preserving predicates *)
Class LimitPreserving `{!Cofe A} (P : A  Prop) : Prop :=
  limit_preserving (c : chain A) : ( n, P (c n))  P (compl c).
Hint Mode LimitPreserving + + ! : typeclass_instances.

Section limit_preserving.
  Context `{Cofe A}.
  (* These are not instances as they will never fire automatically...
     but they can still be helpful in proving things to be limit preserving. *)

  Lemma limit_preserving_ext (P Q : A  Prop) :
    ( x, P x  Q x)  LimitPreserving P  LimitPreserving Q.
  Proof. intros HP Hlimit c ?. apply HP, Hlimit=> n; by apply HP. Qed.

  Global Instance limit_preserving_const (P : Prop) : LimitPreserving (λ _, P).
  Proof. intros c HP. apply (HP 0). Qed.

267
  Lemma limit_preserving_discrete (P : A  Prop) :
Robbert Krebbers's avatar
Robbert Krebbers committed
268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289
    Proper (dist 0 ==> impl) P  LimitPreserving P.
  Proof. intros PH c Hc. by rewrite (conv_compl 0). Qed.

  Lemma limit_preserving_and (P1 P2 : A  Prop) :
    LimitPreserving P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof. intros Hlim1 Hlim2 c Hc. split. apply Hlim1, Hc. apply Hlim2, Hc. Qed.

  Lemma limit_preserving_impl (P1 P2 : A  Prop) :
    Proper (dist 0 ==> impl) P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof.
    intros Hlim1 Hlim2 c Hc HP1. apply Hlim2=> n; apply Hc.
    eapply Hlim1, HP1. apply dist_le with n; last lia. apply (conv_compl n).
  Qed.

  Lemma limit_preserving_forall {B} (P : B  A  Prop) :
    ( y, LimitPreserving (P y)) 
    LimitPreserving (λ x,  y, P y x).
  Proof. intros Hlim c Hc y. by apply Hlim. Qed.
End limit_preserving.

Robbert Krebbers's avatar
Robbert Krebbers committed
290
(** Fixpoint *)
291
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
292
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
293
Next Obligation.
294
  intros A ? f ? n.
295
  induction n as [|n IH]=> -[|i] //= ?; try omega.
296 297
  - apply (contractive_0 f).
  - apply (contractive_S f), IH; auto with omega.
Robbert Krebbers's avatar
Robbert Krebbers committed
298
Qed.
299

300
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
301
  `{!Contractive f} : A := compl (fixpoint_chain f).
302 303 304
Definition fixpoint_aux : seal (@fixpoint_def). by eexists. Qed.
Definition fixpoint {A AC AiH} f {Hf} := unseal fixpoint_aux A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := seal_eq fixpoint_aux.
Robbert Krebbers's avatar
Robbert Krebbers committed
305 306

Section fixpoint.
307
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
308

309
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
310
  Proof.
311 312
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
313
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
314
  Qed.
315 316 317

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
318 319 320
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
321 322
  Qed.

323
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
324
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
325
  Proof.
326
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
327
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
328 329
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
330
  Qed.
331 332
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
333
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
334 335

  Lemma fixpoint_ind (P : A  Prop) :
336
    Proper (() ==> impl) P 
337
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
338
    LimitPreserving P 
339 340 341 342
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
Robbert Krebbers's avatar
Robbert Krebbers committed
343 344
    { intros n. rewrite /chcar. induction n as [|n IH]=> -[|i] //=;
        eauto using contractive_0, contractive_S with omega. }
345
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
Robbert Krebbers's avatar
Robbert Krebbers committed
346 347 348 349
    assert (f fp2  fp2).
    { apply equiv_dist=>n. rewrite /fp2 (conv_compl n) /= /chcar.
      induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S. }
    rewrite -(fixpoint_unique fp2) //.
Robbert Krebbers's avatar
Robbert Krebbers committed
350
    apply Hlim=> n /=. by apply Nat_iter_ind.
351
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
352 353
End fixpoint.

Robbert Krebbers's avatar
Robbert Krebbers committed
354

355 356 357
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
358

359
Section fixpointK.
360
  Local Set Default Proof Using "Type*".
361
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384
  Context {f_contractive : Contractive (Nat.iter k f)} {f_ne : NonExpansive f}.
  (* Note than f_ne is crucial here:  there are functions f such that f^2 is contractive,
     but f is not non-expansive.
     Consider for example f: SPred → SPred (where SPred is "downclosed sets of natural numbers").
     Define f (using informative excluded middle) as follows:
     f(N) = N  (where N is the set of all natural numbers)
     f({0, ..., n}) = {0, ... n-1}  if n is even (so n-1 is at least -1, in which case we return the empty set)
     f({0, ..., n}) = {0, ..., n+2} if n is odd
     In other words, if we consider elements of SPred as ordinals, then we decreaste odd finite
     ordinals by 1 and increase even finite ordinals by 2.
     f is not non-expansive:  Consider f({0}) = ∅ and f({0,1}) = f({0,1,2,3}).
     The arguments are clearly 0-equal, but the results are not.

     Now consider g := f^2. We have
     g(N) = N
     g({0, ..., n}) = {0, ... n+1}  if n is even
     g({0, ..., n}) = {0, ..., n+4} if n is odd
     g is contractive.  All outputs contain 0, so they are all 0-equal.
     Now consider two n-equal inputs. We have to show that the outputs are n+1-equal.
     Either they both do not contain n in which case they have to be fully equal and
     hence so are the results.  Or else they both contain n, so the results will
     both contain n+1, so the results are n+1-equal.
   *)
385 386

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
387
  Local Existing Instance f_proper.
388

389
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
390
  Proof.
391 392
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
393 394
  Qed.

395
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
396
  Proof.
397 398
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
399 400
  Qed.

401
  Section fixpointK_ne.
402
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
403
    Context {g_ne : NonExpansive g}.
404

405
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
406
    Proof.
407 408 409
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
410 411
    Qed.

412 413 414
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
415 416 417 418

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
419
    LimitPreserving P 
Ralf Jung's avatar
Ralf Jung committed
420 421
    P (fixpointK k f).
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
422
    intros. rewrite /fixpointK. apply fixpoint_ind; eauto.
Robbert Krebbers's avatar
Robbert Krebbers committed
423
    intros; apply Nat_iter_ind; auto.
Ralf Jung's avatar
Ralf Jung committed
424
  Qed.
425
End fixpointK.
426

Robbert Krebbers's avatar
Robbert Krebbers committed
427
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
428
Section fixpointAB.
429 430
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
472
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
473

Ralf Jung's avatar
Ralf Jung committed
474
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
506
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
507

508
(** Non-expansive function space *)
509 510
Record ofe_mor (A B : ofeT) : Type := CofeMor {
  ofe_mor_car :> A  B;
511
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
512 513
}.
Arguments CofeMor {_ _} _ {_}.
514 515
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
516

517 518 519 520
Notation "'λne' x .. y , t" :=
  (@CofeMor _ _ (λ x, .. (@CofeMor _ _ (λ y, t) _) ..) _)
  (at level 200, x binder, y binder, right associativity).

521 522 523 524 525 526 527
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
528 529
  Proof.
    split.
530
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
531
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
532
    - intros n; split.
533 534
      + by intros f x.
      + by intros f g ? x.
535
      + by intros f g h ?? x; trans (g x).
536
    - by intros n f g ? x; apply dist_S.
537
  Qed.
538 539 540 541 542 543 544 545 546 547 548
  Canonical Structure ofe_morC := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.

  Program Definition ofe_mor_chain (c : chain ofe_morC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morC := λ c,
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
Jacques-Henri Jourdan's avatar
Typo  
Jacques-Henri Jourdan committed
549
  Global Program Instance ofe_mor_cofe `{Cofe B} : Cofe ofe_morC :=
550 551 552 553 554
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
555

556 557 558
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
559 560 561
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
562
  Proof. done. Qed.
563
End ofe_mor.
564

565
Arguments ofe_morC : clear implicits.
566
Notation "A -n> B" :=
567 568
  (ofe_morC A B) (at level 99, B at level 200, right associativity).
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
569
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
570

571
(** Identity and composition and constant function *)
Robbert Krebbers's avatar
Robbert Krebbers committed
572 573
Definition cid {A} : A -n> A := CofeMor id.
Instance: Params (@cid) 1.
574
Definition cconst {A B : ofeT} (x : B) : A -n> B := CofeMor (const x).
575
Instance: Params (@cconst) 2.
576

Robbert Krebbers's avatar
Robbert Krebbers committed
577 578 579 580
Definition ccompose {A B C}
  (f : B -n> C) (g : A -n> B) : A -n> C := CofeMor (f  g).
Instance: Params (@ccompose) 3.
Infix "◎" := ccompose (at level 40, left associativity).
581 582 583
Global Instance ccompose_ne {A B C} :
  NonExpansive2 (@ccompose A B C).
Proof. intros n ?? Hf g1 g2 Hg x. rewrite /= (Hg x) (Hf (g2 x)) //. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
584

Ralf Jung's avatar
Ralf Jung committed
585
(* Function space maps *)
586
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
587
  (h : A -n> B) : A' -n> B' := g  h  f.
588 589
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
590
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
591

592 593
Definition ofe_morC_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := CofeMor (ofe_mor_map f g).
594 595
Instance ofe_morC_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morC_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
596
Proof.
597
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
598
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
599 600
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
601
(** unit *)
602 603
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
604
  Definition unit_ofe_mixin : OfeMixin unit.
605
  Proof. by repeat split; try exists 0. Qed.
606
  Canonical Structure unitC : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
607

608 609
  Global Program Instance unit_cofe : Cofe unitC := { compl x := () }.
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
610

611
  Global Instance unit_ofe_discrete : OfeDiscrete unitC.
Robbert Krebbers's avatar
Robbert Krebbers committed
612
  Proof. done. Qed.
613
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
614 615

(** Product *)
616
Section product.
617
  Context {A B : ofeT}.
618 619 620

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
621 622 623
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
624
  Definition prod_ofe_mixin : OfeMixin (A * B).
625 626
  Proof.
    split.
627
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
628
      rewrite !equiv_dist; naive_solver.
629 630
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
631
  Qed.
632 633 634 635 636 637 638 639 640
  Canonical Structure prodC : ofeT := OfeT (A * B) prod_ofe_mixin.

  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodC :=
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

641 642 643
  Global Instance prod_discrete (x : A * B) :
    Discrete (x.1)  Discrete (x.2)  Discrete x.
  Proof. by intros ???[??]; split; apply (discrete _). Qed.
644 645
  Global Instance prod_ofe_discrete :
    OfeDiscrete A  OfeDiscrete B  OfeDiscrete prodC.
646
  Proof. intros ?? [??]; apply _. Qed.
647 648 649 650 651
End product.

Arguments prodC : clear implicits.
Typeclasses Opaque prod_dist.

652
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
653 654 655 656 657
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
Definition prodC_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodC A B -n> prodC A' B' := CofeMor (prod_map f g).
658 659 660
Instance prodC_map_ne {A A' B B'} :
  NonExpansive2 (@prodC_map A A' B B').
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
661

662 663
(** Functors *)
Structure cFunctor := CFunctor {
664
  cFunctor_car : ofeT  ofeT  ofeT;
665 666
  cFunctor_map {A1 A2 B1 B2} :
    ((A2 -n> A1) * (B1 -n> B2))  cFunctor_car A1 B1 -n> cFunctor_car A2 B2;
667 668
  cFunctor_ne {A1 A2 B1 B2} :
    NonExpansive (@cFunctor_map A1 A2 B1 B2);
669
  cFunctor_id {A B : ofeT} (x : cFunctor_car A B) :
670 671 672 673 674
    cFunctor_map (cid,cid) x  x;
  cFunctor_compose {A1 A2 A3 B1 B2 B3}
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
    cFunctor_map (fg, g'f') x  cFunctor_map (g,g') (cFunctor_map (f,f') x)
}.
675
Existing Instance cFunctor_ne.
676 677
Instance: Params (@cFunctor_map) 5.

678 679 680
Delimit Scope cFunctor_scope with CF.
Bind Scope cFunctor_scope with cFunctor.

681 682 683
Class cFunctorContractive (F : cFunctor) :=
  cFunctor_contractive A1 A2 B1 B2 :> Contractive (@cFunctor_map F A1 A2 B1 B2).

684
Definition cFunctor_diag (F: cFunctor) (A: ofeT) : ofeT := cFunctor_car F A A.
685 686
Coercion cFunctor_diag : cFunctor >-> Funclass.

687
Program Definition constCF (B : ofeT) : cFunctor :=
688 689
  {| cFunctor_car A1 A2 := B; cFunctor_map A1 A2 B1 B2 f := cid |}.
Solve Obligations with done.
690
Coercion constCF : ofeT >-> cFunctor.
691

692
Instance constCF_contractive B : cFunctorContractive (constCF B).
693
Proof. rewrite /cFunctorContractive; apply _. Qed.
694 695 696 697

Program Definition idCF : cFunctor :=
  {| cFunctor_car A1 A2 := A2; cFunctor_map A1 A2 B1 B2 f := f.2 |}.
Solve Obligations with done.
698
Notation "∙" := idCF : cFunctor_scope.
699

700 701 702 703 704
Program Definition prodCF (F1 F2 : cFunctor) : cFunctor := {|
  cFunctor_car A B := prodC (cFunctor_car F1 A B) (cFunctor_car F2 A B);
  cFunctor_map A1 A2 B1 B2 fg :=
    prodC_map (cFunctor_map F1 fg) (cFunctor_map F2 fg)
|}.
705 706 707
Next Obligation.
  intros ?? A1 A2 B1 B2 n ???; by apply prodC_map_ne; apply cFunctor_ne.
Qed.
708 709 710 711 712
Next Obligation. by intros F1 F2 A B [??]; rewrite /= !cFunctor_id. Qed.
Next Obligation.
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [??]; simpl.
  by rewrite !cFunctor_compose.
Qed.
713
Notation "F1 * F2" := (prodCF F1%CF F2%CF) : cFunctor_scope.
714

715 716 717 718 719 720 721 722
Instance prodCF_contractive F1 F2 :
  cFunctorContractive F1  cFunctorContractive F2 
  cFunctorContractive (prodCF F1 F2).
Proof.
  intros ?? A1 A2 B1 B2 n ???;
    by apply prodC_map_ne; apply cFunctor_contractive.
Qed.

723
Program Definition ofe_morCF (F1 F2 : cFunctor) : cFunctor := {|
724
  cFunctor_car A B := cFunctor_car F1 B A -n> cFunctor_car F2 A B;
Ralf Jung's avatar
Ralf Jung committed
725
  cFunctor_map A1 A2 B1 B2 fg :=
726
    ofe_morC_map (cFunctor_map F1 (fg.2, fg.1)) (cFunctor_map F2 fg)
Ralf Jung's avatar
Ralf Jung committed
727
|}.
728 729
Next Obligation.
  intros F1 F2 A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
730
  apply ofe_morC_map_ne; apply cFunctor_ne; split; by apply Hfg.
731
Qed.
Ralf Jung's avatar
Ralf Jung committed
732
Next Obligation.
733 734
  intros F1 F2 A B [f ?] ?; simpl. rewrite /= !cFunctor_id.
  apply (ne_proper f). apply cFunctor_id.
Ralf Jung's avatar
Ralf Jung committed
735 736
Qed.
Next Obligation.
737 738
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [h ?] ?; simpl in *.
  rewrite -!cFunctor_compose. do 2 apply (ne_proper _). apply cFunctor_compose.
Ralf Jung's avatar
Ralf Jung committed
739
Qed.
740
Notation "F1 -n> F2" := (ofe_morCF F1%CF F2%CF) : cFunctor_scope.
Ralf Jung's avatar
Ralf Jung committed
741

742
Instance ofe_morCF_contractive F1 F2 :
743
  cFunctorContractive F1  cFunctorContractive F2 
744
  cFunctorContractive (ofe_morCF F1 F2).
745 746
Proof.
  intros ?? A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
747
  apply ofe_morC_map_ne; apply cFunctor_contractive; destruct n, Hfg; by split.
748 749
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
750 751
(** Sum *)
Section sum.
752
  Context {A B : ofeT}.
Robbert Krebbers's avatar
Robbert Krebbers committed
753 754

  Instance sum_dist : Dist (A + B) := λ n, sum_relation (dist n) (dist n).
755 756
  Global Instance inl_ne : NonExpansive (@inl A B) := _.
  Global Instance inr_ne : NonExpansive (@inr A B) := _.
Robbert Krebbers's avatar
Robbert Krebbers committed
757 758 759
  Global Instance inl_ne_inj : Inj (dist n) (dist n) (@inl A B) := _.
  Global Instance inr_ne_inj : Inj (dist n) (dist n) (@