ofe.v 49.3 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
Robbert Krebbers's avatar
Robbert Krebbers committed
3

4
(** This files defines (a shallow embedding of) the category of OFEs:
5 6 7 8 9 10 11 12
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
    This makes writing such functions much easier. It turns out that it many 
    cases, we do not even need non-expansiveness.
*)

Robbert Krebbers's avatar
Robbert Krebbers committed
13 14
(** Unbundeled version *)
Class Dist A := dist : nat  relation A.
15
Instance: Params (@dist) 3.
16 17
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
18
Hint Extern 0 (_ {_} _) => reflexivity.
19
Hint Extern 0 (_ {_} _) => symmetry; assumption.
20 21
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
22

23
Tactic Notation "ofe_subst" ident(x) :=
24
  repeat match goal with
25
  | _ => progress simplify_eq/=
26 27 28
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
29
Tactic Notation "ofe_subst" :=
30
  repeat match goal with
31
  | _ => progress simplify_eq/=
32 33
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
34
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
35

Ralf Jung's avatar
Ralf Jung committed
36 37 38 39 40 41 42 43
Section mixin.
  Local Set Primitive Projections.
  Record OfeMixin A `{Equiv A, Dist A} := {
    mixin_equiv_dist x y : x  y   n, x {n} y;
    mixin_dist_equivalence n : Equivalence (dist n);
    mixin_dist_S n x y : x {S n} y  x {n} y
  }.
End mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
44 45

(** Bundeled version *)
46 47 48 49 50
Structure ofeT := OfeT' {
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
  ofe_mixin : OfeMixin ofe_car;
51
  _ : Type
Robbert Krebbers's avatar
Robbert Krebbers committed
52
}.
53 54 55 56 57 58 59 60 61
Arguments OfeT' _ {_ _} _ _.
Notation OfeT A m := (OfeT' A m A).
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
62

63 64 65
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
66
different places (see for example the constructors [CmraT] and [UcmraT] in the
67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

88
(** Lifting properties from the mixin *)
89 90
Section ofe_mixin.
  Context {A : ofeT}.
91
  Implicit Types x y : A.
92
  Lemma equiv_dist x y : x  y   n, x {n} y.
93
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
94
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
95
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
96
  Lemma dist_S n x y : x {S n} y  x {n} y.
97 98
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
99

Robbert Krebbers's avatar
Robbert Krebbers committed
100 101
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption.

102 103 104 105 106 107
(** Discrete OFEs and discrete OFE elements *)
Class Discrete {A : ofeT} (x : A) := discrete y : x {0} y  x  y.
Arguments discrete {_} _ {_} _ _.
Hint Mode Discrete + ! : typeclass_instances.
Instance: Params (@Discrete) 1.

108
Class OfeDiscrete (A : ofeT) := ofe_discrete_discrete (x : A) :> Discrete x.
109 110 111 112 113 114 115 116 117

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

118
Program Definition chain_map {A B : ofeT} (f : A  B)
119
    `{!NonExpansive f} (c : chain A) : chain B :=
120 121 122
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

123 124 125 126 127 128
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
129

130
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
131 132 133
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

134 135 136 137 138 139 140 141
Program Definition chain_const {A : ofeT} (a : A) : chain A :=
  {| chain_car n := a |}.
Next Obligation. by intros A a n i _. Qed.

Lemma compl_chain_const {A : ofeT} `{!Cofe A} (a : A) :
  compl (chain_const a)  a.
Proof. apply equiv_dist=>n. by rewrite conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
142
(** General properties *)
143
Section ofe.
144
  Context {A : ofeT}.
145
  Implicit Types x y : A.
146
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
147 148
  Proof.
    split.
149 150
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
151
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
152
  Qed.
153
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
154 155
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
156 157
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
158
  Qed.
159
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
160
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
161
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
162 163 164
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
165 166
  Global Instance Discrete_proper : Proper (() ==> iff) (@Discrete A).
  Proof. intros x y Hxy. rewrite /Discrete. by setoid_rewrite Hxy. Qed.
167

Robbert Krebbers's avatar
Robbert Krebbers committed
168
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
169
  Proof. induction 2; eauto using dist_S. Qed.
170 171
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
172 173
  Instance ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f | 100.
Robbert Krebbers's avatar
Robbert Krebbers committed
174
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
175
  Instance ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
Robbert Krebbers's avatar
Robbert Krebbers committed
176 177 178
    Proper (() ==> () ==> ()) f | 100.
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
179
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
180
  Qed.
181

182
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
183 184 185 186
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
    apply chain_cauchy. omega.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
187

188
  Lemma discrete_iff n (x : A) `{!Discrete x} y : x  y  x {n} y.
189
  Proof.
190
    split; intros; auto. apply (discrete _), dist_le with n; auto with lia.
191
  Qed.
192
  Lemma discrete_iff_0 n (x : A) `{!Discrete x} y : x {0} y  x {n} y.
193
  Proof. by rewrite -!discrete_iff. Qed.
194
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
195

196
(** Contractive functions *)
197
Definition dist_later `{Dist A} (n : nat) (x y : A) : Prop :=
198
  match n with 0 => True | S n => x {n} y end.
199
Arguments dist_later _ _ !_ _ _ /.
200

201
Global Instance dist_later_equivalence (A : ofeT) n : Equivalence (@dist_later A _ n).
202 203
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

204 205 206
Lemma dist_dist_later {A : ofeT} n (x y : A) : dist n x y  dist_later n x y.
Proof. intros Heq. destruct n; first done. exact: dist_S. Qed.

207 208 209 210 211 212 213 214 215 216 217
Lemma dist_later_dist {A : ofeT} n (x y : A) : dist_later (S n) x y  dist n x y.
Proof. done. Qed.

(* We don't actually need this lemma (as our tactics deal with this through
   other means), but technically speaking, this is the reason why
   pre-composing a non-expansive function to a contractive function
   preserves contractivity. *)
Lemma ne_dist_later {A B : ofeT} (f : A  B) :
  NonExpansive f   n, Proper (dist_later n ==> dist_later n) f.
Proof. intros Hf [|n]; last exact: Hf. hnf. by intros. Qed.

218
Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
219

220
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
221 222
Proof. by intros n y1 y2. Qed.

223
Section contractive.
224
  Local Set Default Proof Using "Type*".
225 226 227 228
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
229
  Proof. by apply (_ : Contractive f). Qed.
230
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
231
  Proof. intros. by apply (_ : Contractive f). Qed.
232

233 234
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
235 236 237 238
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

239 240
Ltac f_contractive :=
  match goal with
Robbert Krebbers's avatar
Robbert Krebbers committed
241 242 243
  | |- ?f _ {_} ?f _ => simple apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (_ ==> dist_later _ ==> _) f)
244 245
  end;
  try match goal with
246
  | |- @dist_later ?A _ ?n ?x ?y =>
247
         destruct n as [|n]; [exact I|change (@dist A _ n x y)]
248
  end;
Robbert Krebbers's avatar
Robbert Krebbers committed
249
  try simple apply reflexivity.
250

Robbert Krebbers's avatar
Robbert Krebbers committed
251 252
Ltac solve_contractive :=
  solve_proper_core ltac:(fun _ => first [f_contractive | f_equiv]).
Robbert Krebbers's avatar
Robbert Krebbers committed
253

Robbert Krebbers's avatar
Robbert Krebbers committed
254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270
(** Limit preserving predicates *)
Class LimitPreserving `{!Cofe A} (P : A  Prop) : Prop :=
  limit_preserving (c : chain A) : ( n, P (c n))  P (compl c).
Hint Mode LimitPreserving + + ! : typeclass_instances.

Section limit_preserving.
  Context `{Cofe A}.
  (* These are not instances as they will never fire automatically...
     but they can still be helpful in proving things to be limit preserving. *)

  Lemma limit_preserving_ext (P Q : A  Prop) :
    ( x, P x  Q x)  LimitPreserving P  LimitPreserving Q.
  Proof. intros HP Hlimit c ?. apply HP, Hlimit=> n; by apply HP. Qed.

  Global Instance limit_preserving_const (P : Prop) : LimitPreserving (λ _, P).
  Proof. intros c HP. apply (HP 0). Qed.

271
  Lemma limit_preserving_discrete (P : A  Prop) :
Robbert Krebbers's avatar
Robbert Krebbers committed
272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293
    Proper (dist 0 ==> impl) P  LimitPreserving P.
  Proof. intros PH c Hc. by rewrite (conv_compl 0). Qed.

  Lemma limit_preserving_and (P1 P2 : A  Prop) :
    LimitPreserving P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof. intros Hlim1 Hlim2 c Hc. split. apply Hlim1, Hc. apply Hlim2, Hc. Qed.

  Lemma limit_preserving_impl (P1 P2 : A  Prop) :
    Proper (dist 0 ==> impl) P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof.
    intros Hlim1 Hlim2 c Hc HP1. apply Hlim2=> n; apply Hc.
    eapply Hlim1, HP1. apply dist_le with n; last lia. apply (conv_compl n).
  Qed.

  Lemma limit_preserving_forall {B} (P : B  A  Prop) :
    ( y, LimitPreserving (P y)) 
    LimitPreserving (λ x,  y, P y x).
  Proof. intros Hlim c Hc y. by apply Hlim. Qed.
End limit_preserving.

Robbert Krebbers's avatar
Robbert Krebbers committed
294
(** Fixpoint *)
295
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
296
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
297
Next Obligation.
298
  intros A ? f ? n.
299
  induction n as [|n IH]=> -[|i] //= ?; try omega.
300 301
  - apply (contractive_0 f).
  - apply (contractive_S f), IH; auto with omega.
Robbert Krebbers's avatar
Robbert Krebbers committed
302
Qed.
303

304
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
305
  `{!Contractive f} : A := compl (fixpoint_chain f).
306 307 308
Definition fixpoint_aux : seal (@fixpoint_def). by eexists. Qed.
Definition fixpoint {A AC AiH} f {Hf} := unseal fixpoint_aux A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := seal_eq fixpoint_aux.
Robbert Krebbers's avatar
Robbert Krebbers committed
309 310

Section fixpoint.
311
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
312

313
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
314
  Proof.
315 316
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
317
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
318
  Qed.
319 320 321

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
322 323 324
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
325 326
  Qed.

327
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
328
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
329
  Proof.
330
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
331
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
332 333
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
334
  Qed.
335 336
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
337
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
338 339

  Lemma fixpoint_ind (P : A  Prop) :
340
    Proper (() ==> impl) P 
341
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
342
    LimitPreserving P 
343 344 345 346
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
Robbert Krebbers's avatar
Robbert Krebbers committed
347 348
    { intros n. rewrite /chcar. induction n as [|n IH]=> -[|i] //=;
        eauto using contractive_0, contractive_S with omega. }
349
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
Robbert Krebbers's avatar
Robbert Krebbers committed
350 351 352 353
    assert (f fp2  fp2).
    { apply equiv_dist=>n. rewrite /fp2 (conv_compl n) /= /chcar.
      induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S. }
    rewrite -(fixpoint_unique fp2) //.
Robbert Krebbers's avatar
Robbert Krebbers committed
354
    apply Hlim=> n /=. by apply Nat_iter_ind.
355
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
356 357
End fixpoint.

Robbert Krebbers's avatar
Robbert Krebbers committed
358

359 360 361
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
362

363
Section fixpointK.
364
  Local Set Default Proof Using "Type*".
365
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388
  Context {f_contractive : Contractive (Nat.iter k f)} {f_ne : NonExpansive f}.
  (* Note than f_ne is crucial here:  there are functions f such that f^2 is contractive,
     but f is not non-expansive.
     Consider for example f: SPred → SPred (where SPred is "downclosed sets of natural numbers").
     Define f (using informative excluded middle) as follows:
     f(N) = N  (where N is the set of all natural numbers)
     f({0, ..., n}) = {0, ... n-1}  if n is even (so n-1 is at least -1, in which case we return the empty set)
     f({0, ..., n}) = {0, ..., n+2} if n is odd
     In other words, if we consider elements of SPred as ordinals, then we decreaste odd finite
     ordinals by 1 and increase even finite ordinals by 2.
     f is not non-expansive:  Consider f({0}) = ∅ and f({0,1}) = f({0,1,2,3}).
     The arguments are clearly 0-equal, but the results are not.

     Now consider g := f^2. We have
     g(N) = N
     g({0, ..., n}) = {0, ... n+1}  if n is even
     g({0, ..., n}) = {0, ..., n+4} if n is odd
     g is contractive.  All outputs contain 0, so they are all 0-equal.
     Now consider two n-equal inputs. We have to show that the outputs are n+1-equal.
     Either they both do not contain n in which case they have to be fully equal and
     hence so are the results.  Or else they both contain n, so the results will
     both contain n+1, so the results are n+1-equal.
   *)
389 390

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
391
  Local Existing Instance f_proper.
392

393
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
394
  Proof.
395 396
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
397 398
  Qed.

399
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
400
  Proof.
401 402
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
403 404
  Qed.

405
  Section fixpointK_ne.
406
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
407
    Context {g_ne : NonExpansive g}.
408

409
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
410
    Proof.
411 412 413
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
414 415
    Qed.

416 417 418
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
419 420 421 422

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
423
    LimitPreserving P 
Ralf Jung's avatar
Ralf Jung committed
424 425
    P (fixpointK k f).
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
426
    intros. rewrite /fixpointK. apply fixpoint_ind; eauto.
Robbert Krebbers's avatar
Robbert Krebbers committed
427
    intros; apply Nat_iter_ind; auto.
Ralf Jung's avatar
Ralf Jung committed
428
  Qed.
429
End fixpointK.
430

Robbert Krebbers's avatar
Robbert Krebbers committed
431
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
432
Section fixpointAB.
433 434
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
476
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
477

Ralf Jung's avatar
Ralf Jung committed
478
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
510
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
511

512
(** Non-expansive function space *)
513 514
Record ofe_mor (A B : ofeT) : Type := CofeMor {
  ofe_mor_car :> A  B;
515
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
516 517
}.
Arguments CofeMor {_ _} _ {_}.
518 519
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
520

521 522 523 524
Notation "'λne' x .. y , t" :=
  (@CofeMor _ _ (λ x, .. (@CofeMor _ _ (λ y, t) _) ..) _)
  (at level 200, x binder, y binder, right associativity).

525 526 527 528 529 530 531
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
532 533
  Proof.
    split.
534
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
535
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
536
    - intros n; split.
537 538
      + by intros f x.
      + by intros f g ? x.
539
      + by intros f g h ?? x; trans (g x).
540
    - by intros n f g ? x; apply dist_S.
541
  Qed.
542 543 544 545 546 547 548 549 550 551 552
  Canonical Structure ofe_morC := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.

  Program Definition ofe_mor_chain (c : chain ofe_morC)
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morC := λ c,
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
Jacques-Henri Jourdan's avatar
Typo  
Jacques-Henri Jourdan committed
553
  Global Program Instance ofe_mor_cofe `{Cofe B} : Cofe ofe_morC :=
554 555 556 557 558
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
559

560 561 562
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
563 564 565
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
566
  Proof. done. Qed.
567
End ofe_mor.
568

569
Arguments ofe_morC : clear implicits.
570
Notation "A -n> B" :=
571 572
  (ofe_morC A B) (at level 99, B at level 200, right associativity).
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
573
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
574

575
(** Identity and composition and constant function *)
Robbert Krebbers's avatar
Robbert Krebbers committed
576 577
Definition cid {A} : A -n> A := CofeMor id.
Instance: Params (@cid) 1.
578
Definition cconst {A B : ofeT} (x : B) : A -n> B := CofeMor (const x).
579
Instance: Params (@cconst) 2.
580

Robbert Krebbers's avatar
Robbert Krebbers committed
581 582 583 584
Definition ccompose {A B C}
  (f : B -n> C) (g : A -n> B) : A -n> C := CofeMor (f  g).
Instance: Params (@ccompose) 3.
Infix "◎" := ccompose (at level 40, left associativity).
585 586 587
Global Instance ccompose_ne {A B C} :
  NonExpansive2 (@ccompose A B C).
Proof. intros n ?? Hf g1 g2 Hg x. rewrite /= (Hg x) (Hf (g2 x)) //. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
588

Ralf Jung's avatar
Ralf Jung committed
589
(* Function space maps *)
590
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
591
  (h : A -n> B) : A' -n> B' := g  h  f.
592 593
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
594
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
595

596 597
Definition ofe_morC_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := CofeMor (ofe_mor_map f g).
598 599
Instance ofe_morC_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morC_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
600
Proof.
601
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
602
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
603 604
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
605
(** unit *)
606 607
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
608
  Definition unit_ofe_mixin : OfeMixin unit.
609
  Proof. by repeat split; try exists 0. Qed.
610
  Canonical Structure unitC : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
611

612 613
  Global Program Instance unit_cofe : Cofe unitC := { compl x := () }.
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
614

615
  Global Instance unit_ofe_discrete : OfeDiscrete unitC.
Robbert Krebbers's avatar
Robbert Krebbers committed
616
  Proof. done. Qed.
617
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
618 619

(** Product *)
620
Section product.
621
  Context {A B : ofeT}.
622 623 624

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
625 626 627
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
628
  Definition prod_ofe_mixin : OfeMixin (A * B).
629 630
  Proof.
    split.
631
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
632
      rewrite !equiv_dist; naive_solver.
633 634
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
635
  Qed.
636 637 638 639 640 641 642 643 644
  Canonical Structure prodC : ofeT := OfeT (A * B) prod_ofe_mixin.

  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodC :=
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

645 646 647
  Global Instance prod_discrete (x : A * B) :
    Discrete (x.1)  Discrete (x.2)  Discrete x.
  Proof. by intros ???[??]; split; apply (discrete _). Qed.
648 649
  Global Instance prod_ofe_discrete :
    OfeDiscrete A  OfeDiscrete B  OfeDiscrete prodC.
650
  Proof. intros ?? [??]; apply _. Qed.
651 652 653 654 655
End product.

Arguments prodC : clear implicits.
Typeclasses Opaque prod_dist.

656
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
657 658 659 660 661
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
Definition prodC_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodC A B -n> prodC A' B' := CofeMor (prod_map f g).
662 663 664
Instance prodC_map_ne {A A' B B'} :
  NonExpansive2 (@prodC_map A A' B B').
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
665

666 667
(** Functors *)
Structure cFunctor := CFunctor {
668
  cFunctor_car : ofeT  ofeT  ofeT;
669 670
  cFunctor_map {A1 A2 B1 B2} :
    ((A2 -n> A1) * (B1 -n> B2))  cFunctor_car A1 B1 -n> cFunctor_car A2 B2;
671 672
  cFunctor_ne {A1 A2 B1 B2} :
    NonExpansive (@cFunctor_map A1 A2 B1 B2);
673
  cFunctor_id {A B : ofeT} (x : cFunctor_car A B) :
674 675 676 677 678
    cFunctor_map (cid,cid) x  x;
  cFunctor_compose {A1 A2 A3 B1 B2 B3}
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
    cFunctor_map (fg, g'f') x  cFunctor_map (g,g') (cFunctor_map (f,f') x)
}.
679
Existing Instance cFunctor_ne.
680 681
Instance: Params (@cFunctor_map) 5.

682 683 684
Delimit Scope cFunctor_scope with CF.
Bind Scope cFunctor_scope with cFunctor.

685 686 687
Class cFunctorContractive (F : cFunctor) :=
  cFunctor_contractive A1 A2 B1 B2 :> Contractive (@cFunctor_map F A1 A2 B1 B2).

688
Definition cFunctor_diag (F: cFunctor) (A: ofeT) : ofeT := cFunctor_car F A A.
689 690
Coercion cFunctor_diag : cFunctor >-> Funclass.

691
Program Definition constCF (B : ofeT) : cFunctor :=
692 693
  {| cFunctor_car A1 A2 := B; cFunctor_map A1 A2 B1 B2 f := cid |}.
Solve Obligations with done.
694
Coercion constCF : ofeT >-> cFunctor.
695

696
Instance constCF_contractive B : cFunctorContractive (constCF B).
697
Proof. rewrite /cFunctorContractive; apply _. Qed.
698 699 700 701

Program Definition idCF : cFunctor :=
  {| cFunctor_car A1 A2 := A2; cFunctor_map A1 A2 B1 B2 f := f.2 |}.
Solve Obligations with done.
702
Notation "∙" := idCF : cFunctor_scope.
703

704 705 706 707 708
Program Definition prodCF (F1 F2 : cFunctor) : cFunctor := {|
  cFunctor_car A B := prodC (cFunctor_car F1 A B) (cFunctor_car F2 A B);
  cFunctor_map A1 A2 B1 B2 fg :=
    prodC_map (cFunctor_map F1 fg) (cFunctor_map F2 fg)
|}.
709 710 711
Next Obligation.
  intros ?? A1 A2 B1 B2 n ???; by apply prodC_map_ne; apply cFunctor_ne.
Qed.
712 713 714 715 716
Next Obligation. by intros F1 F2 A B [??]; rewrite /= !cFunctor_id. Qed.
Next Obligation.
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [??]; simpl.
  by rewrite !cFunctor_compose.
Qed.
717
Notation "F1 * F2" := (prodCF F1%CF F2%CF) : cFunctor_scope.
718

719 720 721 722 723 724 725 726
Instance prodCF_contractive F1 F2 :
  cFunctorContractive F1  cFunctorContractive F2 
  cFunctorContractive (prodCF F1 F2).
Proof.
  intros ?? A1 A2 B1 B2 n ???;
    by apply prodC_map_ne; apply cFunctor_contractive.
Qed.

727
Program Definition ofe_morCF (F1 F2 : cFunctor) : cFunctor := {|
728
  cFunctor_car A B := cFunctor_car F1 B A -n> cFunctor_car F2 A B;
Ralf Jung's avatar
Ralf Jung committed
729
  cFunctor_map A1 A2 B1 B2 fg :=
730
    ofe_morC_map (cFunctor_map F1 (fg.2, fg.1)) (cFunctor_map F2 fg)
Ralf Jung's avatar
Ralf Jung committed
731
|}.
732 733
Next Obligation.
  intros F1 F2 A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
734
  apply ofe_morC_map_ne; apply cFunctor_ne; split; by apply Hfg.
735
Qed.
Ralf Jung's avatar
Ralf Jung committed
736
Next Obligation.
737 738
  intros F1 F2 A B [f ?] ?; simpl. rewrite /= !cFunctor_id.
  apply (ne_proper f). apply cFunctor_id.
Ralf Jung's avatar
Ralf Jung committed
739 740
Qed.
Next Obligation.
741 742
  intros F1 F2 A1 A2 A3 B1 B2 B3 f g f' g' [h ?] ?; simpl in *.
  rewrite -!cFunctor_compose. do 2 apply (ne_proper _). apply cFunctor_compose.
Ralf Jung's avatar
Ralf Jung committed
743
Qed.
744
Notation "F1 -n> F2" := (ofe_morCF F1%CF F2%CF) : cFunctor_scope.
Ralf Jung's avatar
Ralf Jung committed
745

746
Instance ofe_morCF_contractive F1 F2 :
747
  cFunctorContractive F1  cFunctorContractive F2 
748
  cFunctorContractive (ofe_morCF F1 F2).
749 750
Proof.
  intros ?? A1 A2 B1 B2 n [f g] [f' g'] Hfg; simpl in *.
751
  apply ofe_morC_map_ne; apply cFunctor_contractive; destruct n, Hfg; by split.
752 753
Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
754 755
(** Sum *)
Section sum.
756
  Context {A B : ofeT}.
Robbert Krebbers's avatar
Robbert Krebbers committed
757 758

  Instance sum_dist : Dist (A + B) := λ n, sum_relation (dist n) (dist n).
759 760
  Global Instance inl_ne : NonExpansive (@inl A B) := _.
  Global Instance inr_ne : NonExpansive (@inr A B) := _.
Robbert Krebbers's avatar
Robbert Krebbers committed
761 762 763
  Global Instance inl_ne_inj : Inj (dist n) (dist n) (@inl A B) := _.
  Global Instance inr_ne_inj : Inj (dist n) (dist n) (@inr A B) := _.

764 765 766 767 768 769 770 771 772 773 774 775
  Definition sum_ofe_mixin : OfeMixin (A + B).
  Proof