ofe.v 66.1 KB
Newer Older
1
From iris.algebra Require Export base.
2
Set Default Proof Using "Type".
3
Set Primitive Projections.
Robbert Krebbers's avatar
Robbert Krebbers committed
4

5
(** This files defines (a shallow embedding of) the category of OFEs:
6
7
8
9
    Complete ordered families of equivalences. This is a cartesian closed
    category, and mathematically speaking, the entire development lives
    in this category. However, we will generally prefer to work with raw
    Coq functions plus some registered Proper instances for non-expansiveness.
Jacques-Henri Jourdan's avatar
Jacques-Henri Jourdan committed
10
    This makes writing such functions much easier. It turns out that it many
11
12
13
    cases, we do not even need non-expansiveness.
*)

Paolo G. Giarrusso's avatar
Paolo G. Giarrusso committed
14
(** Unbundled version *)
Robbert Krebbers's avatar
Robbert Krebbers committed
15
Class Dist A := dist : nat  relation A.
16
Instance: Params (@dist) 3 := {}.
17
18
Notation "x ≡{ n }≡ y" := (dist n x y)
  (at level 70, n at next level, format "x  ≡{ n }≡  y").
19
20
21
Notation "x ≡{ n }@{ A }≡ y" := (dist (A:=A) n x y)
  (at level 70, n at next level, only parsing).

Tej Chajed's avatar
Tej Chajed committed
22
23
Hint Extern 0 (_ {_} _) => reflexivity : core.
Hint Extern 0 (_ {_} _) => symmetry; assumption : core.
24
25
Notation NonExpansive f := ( n, Proper (dist n ==> dist n) f).
Notation NonExpansive2 f := ( n, Proper (dist n ==> dist n ==> dist n) f).
26

27
Tactic Notation "ofe_subst" ident(x) :=
28
  repeat match goal with
29
  | _ => progress simplify_eq/=
30
31
32
  | H:@dist ?A ?d ?n x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
  end.
33
Tactic Notation "ofe_subst" :=
34
  repeat match goal with
35
  | _ => progress simplify_eq/=
36
37
  | H:@dist ?A ?d ?n ?x _ |- _ => setoid_subst_aux (@dist A d n) x
  | H:@dist ?A ?d ?n _ ?x |- _ => symmetry in H;setoid_subst_aux (@dist A d n) x
38
  end.
Robbert Krebbers's avatar
Robbert Krebbers committed
39

40
41
42
43
44
Record OfeMixin A `{Equiv A, Dist A} := {
  mixin_equiv_dist x y : x  y   n, x {n} y;
  mixin_dist_equivalence n : Equivalence (dist n);
  mixin_dist_S n x y : x {S n} y  x {n} y
}.
Robbert Krebbers's avatar
Robbert Krebbers committed
45

Paolo G. Giarrusso's avatar
Paolo G. Giarrusso committed
46
(** Bundled version *)
47
Structure ofeT := OfeT {
48
49
50
  ofe_car :> Type;
  ofe_equiv : Equiv ofe_car;
  ofe_dist : Dist ofe_car;
51
  ofe_mixin : OfeMixin ofe_car
Robbert Krebbers's avatar
Robbert Krebbers committed
52
}.
53
Arguments OfeT _ {_ _} _.
54
55
56
57
58
59
60
Add Printing Constructor ofeT.
Hint Extern 0 (Equiv _) => eapply (@ofe_equiv _) : typeclass_instances.
Hint Extern 0 (Dist _) => eapply (@ofe_dist _) : typeclass_instances.
Arguments ofe_car : simpl never.
Arguments ofe_equiv : simpl never.
Arguments ofe_dist : simpl never.
Arguments ofe_mixin : simpl never.
61

62
63
64
(** When declaring instances of subclasses of OFE (like CMRAs and unital CMRAs)
we need Coq to *infer* the canonical OFE instance of a given type and take the
mixin out of it. This makes sure we do not use two different OFE instances in
65
different places (see for example the constructors [CmraT] and [UcmraT] in the
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
file [cmra.v].)

In order to infer the OFE instance, we use the definition [ofe_mixin_of'] which
is inspired by the [clone] trick in ssreflect. It works as follows, when type
checking [@ofe_mixin_of' A ?Ac id] Coq faces a unification problem:

  ofe_car ?Ac  ~  A

which will resolve [?Ac] to the canonical OFE instance corresponding to [A]. The
definition [@ofe_mixin_of' A ?Ac id] will then provide the corresponding mixin.
Note that type checking of [ofe_mixin_of' A id] will fail when [A] does not have
a canonical OFE instance.

The notation [ofe_mixin_of A] that we define on top of [ofe_mixin_of' A id]
hides the [id] and normalizes the mixin to head normal form. The latter is to
ensure that we do not end up with redundant canonical projections to the mixin,
i.e. them all being of the shape [ofe_mixin_of' A id]. *)
Definition ofe_mixin_of' A {Ac : ofeT} (f : Ac  A) : OfeMixin Ac := ofe_mixin Ac.
Notation ofe_mixin_of A :=
  ltac:(let H := eval hnf in (ofe_mixin_of' A id) in exact H) (only parsing).

87
(** Lifting properties from the mixin *)
88
89
Section ofe_mixin.
  Context {A : ofeT}.
90
  Implicit Types x y : A.
91
  Lemma equiv_dist x y : x  y   n, x {n} y.
92
  Proof. apply (mixin_equiv_dist _ (ofe_mixin A)). Qed.
93
  Global Instance dist_equivalence n : Equivalence (@dist A _ n).
94
  Proof. apply (mixin_dist_equivalence _ (ofe_mixin A)). Qed.
95
  Lemma dist_S n x y : x {S n} y  x {n} y.
96
97
  Proof. apply (mixin_dist_S _ (ofe_mixin A)). Qed.
End ofe_mixin.
98

Tej Chajed's avatar
Tej Chajed committed
99
Hint Extern 1 (_ {_} _) => apply equiv_dist; assumption : core.
Robbert Krebbers's avatar
Robbert Krebbers committed
100

101
102
103
104
(** Discrete OFEs and discrete OFE elements *)
Class Discrete {A : ofeT} (x : A) := discrete y : x {0} y  x  y.
Arguments discrete {_} _ {_} _ _.
Hint Mode Discrete + ! : typeclass_instances.
105
Instance: Params (@Discrete) 1 := {}.
106

107
Class OfeDiscrete (A : ofeT) := ofe_discrete_discrete (x : A) :> Discrete x.
108
109
110
111
112
113
114
115
116

(** OFEs with a completion *)
Record chain (A : ofeT) := {
  chain_car :> nat  A;
  chain_cauchy n i : n  i  chain_car i {n} chain_car n
}.
Arguments chain_car {_} _ _.
Arguments chain_cauchy {_} _ _ _ _.

117
Program Definition chain_map {A B : ofeT} (f : A  B)
118
    `{!NonExpansive f} (c : chain A) : chain B :=
119
120
121
  {| chain_car n := f (c n) |}.
Next Obligation. by intros A B f Hf c n i ?; apply Hf, chain_cauchy. Qed.

122
123
124
125
126
127
Notation Compl A := (chain A%type  A).
Class Cofe (A : ofeT) := {
  compl : Compl A;
  conv_compl n c : compl c {n} c n;
}.
Arguments compl : simpl never.
Robbert Krebbers's avatar
Robbert Krebbers committed
128
Hint Mode Cofe ! : typeclass_instances.
129

130
Lemma compl_chain_map `{Cofe A, Cofe B} (f : A  B) c `(NonExpansive f) :
131
132
133
  compl (chain_map f c)  f (compl c).
Proof. apply equiv_dist=>n. by rewrite !conv_compl. Qed.

134
135
136
137
138
139
140
141
Program Definition chain_const {A : ofeT} (a : A) : chain A :=
  {| chain_car n := a |}.
Next Obligation. by intros A a n i _. Qed.

Lemma compl_chain_const {A : ofeT} `{!Cofe A} (a : A) :
  compl (chain_const a)  a.
Proof. apply equiv_dist=>n. by rewrite conv_compl. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
142
(** General properties *)
143
Section ofe.
144
  Context {A : ofeT}.
145
  Implicit Types x y : A.
146
  Global Instance ofe_equivalence : Equivalence (() : relation A).
Robbert Krebbers's avatar
Robbert Krebbers committed
147
148
  Proof.
    split.
149
150
    - by intros x; rewrite equiv_dist.
    - by intros x y; rewrite !equiv_dist.
151
    - by intros x y z; rewrite !equiv_dist; intros; trans y.
Robbert Krebbers's avatar
Robbert Krebbers committed
152
  Qed.
153
  Global Instance dist_ne n : Proper (dist n ==> dist n ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
154
155
  Proof.
    intros x1 x2 ? y1 y2 ?; split; intros.
156
157
    - by trans x1; [|trans y1].
    - by trans x2; [|trans y2].
Robbert Krebbers's avatar
Robbert Krebbers committed
158
  Qed.
159
  Global Instance dist_proper n : Proper (() ==> () ==> iff) (@dist A _ n).
Robbert Krebbers's avatar
Robbert Krebbers committed
160
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
161
    by move => x1 x2 /equiv_dist Hx y1 y2 /equiv_dist Hy; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
162
163
164
  Qed.
  Global Instance dist_proper_2 n x : Proper (() ==> iff) (dist n x).
  Proof. by apply dist_proper. Qed.
165
166
  Global Instance Discrete_proper : Proper (() ==> iff) (@Discrete A).
  Proof. intros x y Hxy. rewrite /Discrete. by setoid_rewrite Hxy. Qed.
167

Robbert Krebbers's avatar
Robbert Krebbers committed
168
  Lemma dist_le n n' x y : x {n} y  n'  n  x {n'} y.
Robbert Krebbers's avatar
Robbert Krebbers committed
169
  Proof. induction 2; eauto using dist_S. Qed.
170
171
  Lemma dist_le' n n' x y : n'  n  x {n} y  x {n'} y.
  Proof. intros; eauto using dist_le. Qed.
172
173
174
175
176
177
  (** [ne_proper] and [ne_proper_2] are not instances to improve efficiency of
  type class search during setoid rewriting.
  Instances of [NonExpansive{,2}] are hence accompanied by instances of
  [Proper] built using these lemmas. *)
  Lemma ne_proper {B : ofeT} (f : A  B) `{!NonExpansive f} :
    Proper (() ==> ()) f.
Robbert Krebbers's avatar
Robbert Krebbers committed
178
  Proof. by intros x1 x2; rewrite !equiv_dist; intros Hx n; rewrite (Hx n). Qed.
179
180
  Lemma ne_proper_2 {B C : ofeT} (f : A  B  C) `{!NonExpansive2 f} :
    Proper (() ==> () ==> ()) f.
Robbert Krebbers's avatar
Robbert Krebbers committed
181
182
  Proof.
     unfold Proper, respectful; setoid_rewrite equiv_dist.
Robbert Krebbers's avatar
Robbert Krebbers committed
183
     by intros x1 x2 Hx y1 y2 Hy n; rewrite (Hx n) (Hy n).
Robbert Krebbers's avatar
Robbert Krebbers committed
184
  Qed.
185

186
  Lemma conv_compl' `{Cofe A} n (c : chain A) : compl c {n} c (S n).
187
188
  Proof.
    transitivity (c n); first by apply conv_compl. symmetry.
Ralf Jung's avatar
Ralf Jung committed
189
    apply chain_cauchy. lia.
190
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
191

192
  Lemma discrete_iff n (x : A) `{!Discrete x} y : x  y  x {n} y.
193
  Proof.
194
    split; intros; auto. apply (discrete _), dist_le with n; auto with lia.
195
  Qed.
196
  Lemma discrete_iff_0 n (x : A) `{!Discrete x} y : x {0} y  x {n} y.
197
  Proof. by rewrite -!discrete_iff. Qed.
198
End ofe.
Robbert Krebbers's avatar
Robbert Krebbers committed
199

200
(** Contractive functions *)
201
Definition dist_later `{Dist A} (n : nat) (x y : A) : Prop :=
202
  match n with 0 => True | S n => x {n} y end.
203
Arguments dist_later _ _ !_ _ _ /.
204

205
Global Instance dist_later_equivalence (A : ofeT) n : Equivalence (@dist_later A _ n).
206
207
Proof. destruct n as [|n]. by split. apply dist_equivalence. Qed.

208
209
210
Lemma dist_dist_later {A : ofeT} n (x y : A) : dist n x y  dist_later n x y.
Proof. intros Heq. destruct n; first done. exact: dist_S. Qed.

211
212
213
214
215
216
217
218
219
220
221
Lemma dist_later_dist {A : ofeT} n (x y : A) : dist_later (S n) x y  dist n x y.
Proof. done. Qed.

(* We don't actually need this lemma (as our tactics deal with this through
   other means), but technically speaking, this is the reason why
   pre-composing a non-expansive function to a contractive function
   preserves contractivity. *)
Lemma ne_dist_later {A B : ofeT} (f : A  B) :
  NonExpansive f   n, Proper (dist_later n ==> dist_later n) f.
Proof. intros Hf [|n]; last exact: Hf. hnf. by intros. Qed.

222
Notation Contractive f := ( n, Proper (dist_later n ==> dist n) f).
223

224
Instance const_contractive {A B : ofeT} (x : A) : Contractive (@const A B x).
225
226
Proof. by intros n y1 y2. Qed.

227
Section contractive.
228
  Local Set Default Proof Using "Type*".
229
230
231
232
  Context {A B : ofeT} (f : A  B) `{!Contractive f}.
  Implicit Types x y : A.

  Lemma contractive_0 x y : f x {0} f y.
233
  Proof. by apply (_ : Contractive f). Qed.
234
  Lemma contractive_S n x y : x {n} y  f x {S n} f y.
235
  Proof. intros. by apply (_ : Contractive f). Qed.
236

237
238
  Global Instance contractive_ne : NonExpansive f | 100.
  Proof. by intros n x y ?; apply dist_S, contractive_S. Qed.
239
240
241
242
  Global Instance contractive_proper : Proper (() ==> ()) f | 100.
  Proof. apply (ne_proper _). Qed.
End contractive.

243
244
Ltac f_contractive :=
  match goal with
Robbert Krebbers's avatar
Robbert Krebbers committed
245
246
247
  | |- ?f _ {_} ?f _ => simple apply (_ : Proper (dist_later _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (dist_later _ ==> _ ==> _) f)
  | |- ?f _ _ {_} ?f _ _ => simple apply (_ : Proper (_ ==> dist_later _ ==> _) f)
248
249
  end;
  try match goal with
250
  | |- @dist_later ?A _ ?n ?x ?y =>
251
         destruct n as [|n]; [exact I|change (@dist A _ n x y)]
252
  end;
Robbert Krebbers's avatar
Robbert Krebbers committed
253
  try simple apply reflexivity.
254

Robbert Krebbers's avatar
Robbert Krebbers committed
255
256
Ltac solve_contractive :=
  solve_proper_core ltac:(fun _ => first [f_contractive | f_equiv]).
Robbert Krebbers's avatar
Robbert Krebbers committed
257

Robbert Krebbers's avatar
Robbert Krebbers committed
258
259
260
261
262
263
264
265
266
267
268
269
270
271
(** Limit preserving predicates *)
Class LimitPreserving `{!Cofe A} (P : A  Prop) : Prop :=
  limit_preserving (c : chain A) : ( n, P (c n))  P (compl c).
Hint Mode LimitPreserving + + ! : typeclass_instances.

Section limit_preserving.
  Context `{Cofe A}.
  (* These are not instances as they will never fire automatically...
     but they can still be helpful in proving things to be limit preserving. *)

  Lemma limit_preserving_ext (P Q : A  Prop) :
    ( x, P x  Q x)  LimitPreserving P  LimitPreserving Q.
  Proof. intros HP Hlimit c ?. apply HP, Hlimit=> n; by apply HP. Qed.

Robbert Krebbers's avatar
Robbert Krebbers committed
272
  Global Instance limit_preserving_const (P : Prop) : LimitPreserving (λ _ : A, P).
Robbert Krebbers's avatar
Robbert Krebbers committed
273
274
  Proof. intros c HP. apply (HP 0). Qed.

275
  Lemma limit_preserving_discrete (P : A  Prop) :
Robbert Krebbers's avatar
Robbert Krebbers committed
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
    Proper (dist 0 ==> impl) P  LimitPreserving P.
  Proof. intros PH c Hc. by rewrite (conv_compl 0). Qed.

  Lemma limit_preserving_and (P1 P2 : A  Prop) :
    LimitPreserving P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof. intros Hlim1 Hlim2 c Hc. split. apply Hlim1, Hc. apply Hlim2, Hc. Qed.

  Lemma limit_preserving_impl (P1 P2 : A  Prop) :
    Proper (dist 0 ==> impl) P1  LimitPreserving P2 
    LimitPreserving (λ x, P1 x  P2 x).
  Proof.
    intros Hlim1 Hlim2 c Hc HP1. apply Hlim2=> n; apply Hc.
    eapply Hlim1, HP1. apply dist_le with n; last lia. apply (conv_compl n).
  Qed.

  Lemma limit_preserving_forall {B} (P : B  A  Prop) :
    ( y, LimitPreserving (P y)) 
    LimitPreserving (λ x,  y, P y x).
  Proof. intros Hlim c Hc y. by apply Hlim. Qed.
296
297
298
299
300
301
302

  Lemma limit_preserving_equiv `{!Cofe B} (f g : A  B) :
    NonExpansive f  NonExpansive g  LimitPreserving (λ x, f x  g x).
  Proof.
    intros Hf Hg c Hc. apply equiv_dist=> n.
    by rewrite -!compl_chain_map !conv_compl /= Hc.
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
303
304
End limit_preserving.

Robbert Krebbers's avatar
Robbert Krebbers committed
305
(** Fixpoint *)
306
Program Definition fixpoint_chain {A : ofeT} `{Inhabited A} (f : A  A)
307
  `{!Contractive f} : chain A := {| chain_car i := Nat.iter (S i) f inhabitant |}.
Robbert Krebbers's avatar
Robbert Krebbers committed
308
Next Obligation.
309
  intros A ? f ? n.
Ralf Jung's avatar
Ralf Jung committed
310
  induction n as [|n IH]=> -[|i] //= ?; try lia.
311
  - apply (contractive_0 f).
Ralf Jung's avatar
Ralf Jung committed
312
  - apply (contractive_S f), IH; auto with lia.
Robbert Krebbers's avatar
Robbert Krebbers committed
313
Qed.
314

315
Program Definition fixpoint_def `{Cofe A, Inhabited A} (f : A  A)
316
  `{!Contractive f} : A := compl (fixpoint_chain f).
317
Definition fixpoint_aux : seal (@fixpoint_def). Proof. by eexists. Qed.
318
319
Definition fixpoint {A AC AiH} f {Hf} := fixpoint_aux.(unseal) A AC AiH f Hf.
Definition fixpoint_eq : @fixpoint = @fixpoint_def := fixpoint_aux.(seal_eq).
Robbert Krebbers's avatar
Robbert Krebbers committed
320
321

Section fixpoint.
322
  Context `{Cofe A, Inhabited A} (f : A  A) `{!Contractive f}.
323

324
  Lemma fixpoint_unfold : fixpoint f  f (fixpoint f).
Robbert Krebbers's avatar
Robbert Krebbers committed
325
  Proof.
326
327
    apply equiv_dist=>n.
    rewrite fixpoint_eq /fixpoint_def (conv_compl n (fixpoint_chain f)) //.
328
    induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
329
  Qed.
330
331
332

  Lemma fixpoint_unique (x : A) : x  f x  x  fixpoint f.
  Proof.
333
334
335
    rewrite !equiv_dist=> Hx n. induction n as [|n IH]; simpl in *.
    - rewrite Hx fixpoint_unfold; eauto using contractive_0.
    - rewrite Hx fixpoint_unfold. apply (contractive_S _), IH.
336
337
  Qed.

338
  Lemma fixpoint_ne (g : A  A) `{!Contractive g} n :
339
    ( z, f z {n} g z)  fixpoint f {n} fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
340
  Proof.
341
    intros Hfg. rewrite fixpoint_eq /fixpoint_def
Robbert Krebbers's avatar
Robbert Krebbers committed
342
      (conv_compl n (fixpoint_chain f)) (conv_compl n (fixpoint_chain g)) /=.
343
344
    induction n as [|n IH]; simpl in *; [by rewrite !Hfg|].
    rewrite Hfg; apply contractive_S, IH; auto using dist_S.
Robbert Krebbers's avatar
Robbert Krebbers committed
345
  Qed.
346
347
  Lemma fixpoint_proper (g : A  A) `{!Contractive g} :
    ( x, f x  g x)  fixpoint f  fixpoint g.
Robbert Krebbers's avatar
Robbert Krebbers committed
348
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_ne. Qed.
349
350

  Lemma fixpoint_ind (P : A  Prop) :
351
    Proper (() ==> impl) P 
352
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
353
    LimitPreserving P 
354
355
356
357
    P (fixpoint f).
  Proof.
    intros ? [x Hx] Hincr Hlim. set (chcar i := Nat.iter (S i) f x).
    assert (Hcauch :  n i : nat, n  i  chcar i {n} chcar n).
Robbert Krebbers's avatar
Robbert Krebbers committed
358
    { intros n. rewrite /chcar. induction n as [|n IH]=> -[|i] //=;
Ralf Jung's avatar
Ralf Jung committed
359
        eauto using contractive_0, contractive_S with lia. }
360
    set (fp2 := compl {| chain_cauchy := Hcauch |}).
Robbert Krebbers's avatar
Robbert Krebbers committed
361
362
363
364
    assert (f fp2  fp2).
    { apply equiv_dist=>n. rewrite /fp2 (conv_compl n) /= /chcar.
      induction n as [|n IH]; simpl; eauto using contractive_0, contractive_S. }
    rewrite -(fixpoint_unique fp2) //.
Robbert Krebbers's avatar
Robbert Krebbers committed
365
    apply Hlim=> n /=. by apply Nat_iter_ind.
366
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
367
368
End fixpoint.

Robbert Krebbers's avatar
Robbert Krebbers committed
369

370
371
372
(** Fixpoint of f when f^k is contractive. **)
Definition fixpointK `{Cofe A, Inhabited A} k (f : A  A)
  `{!Contractive (Nat.iter k f)} := fixpoint (Nat.iter k f).
373

374
Section fixpointK.
375
  Local Set Default Proof Using "Type*".
376
  Context `{Cofe A, Inhabited A} (f : A  A) (k : nat).
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
  Context {f_contractive : Contractive (Nat.iter k f)} {f_ne : NonExpansive f}.
  (* Note than f_ne is crucial here:  there are functions f such that f^2 is contractive,
     but f is not non-expansive.
     Consider for example f: SPred → SPred (where SPred is "downclosed sets of natural numbers").
     Define f (using informative excluded middle) as follows:
     f(N) = N  (where N is the set of all natural numbers)
     f({0, ..., n}) = {0, ... n-1}  if n is even (so n-1 is at least -1, in which case we return the empty set)
     f({0, ..., n}) = {0, ..., n+2} if n is odd
     In other words, if we consider elements of SPred as ordinals, then we decreaste odd finite
     ordinals by 1 and increase even finite ordinals by 2.
     f is not non-expansive:  Consider f({0}) = ∅ and f({0,1}) = f({0,1,2,3}).
     The arguments are clearly 0-equal, but the results are not.

     Now consider g := f^2. We have
     g(N) = N
     g({0, ..., n}) = {0, ... n+1}  if n is even
     g({0, ..., n}) = {0, ..., n+4} if n is odd
     g is contractive.  All outputs contain 0, so they are all 0-equal.
     Now consider two n-equal inputs. We have to show that the outputs are n+1-equal.
     Either they both do not contain n in which case they have to be fully equal and
     hence so are the results.  Or else they both contain n, so the results will
     both contain n+1, so the results are n+1-equal.
   *)
400
401

  Let f_proper : Proper (() ==> ()) f := ne_proper f.
402
  Local Existing Instance f_proper.
403

404
  Lemma fixpointK_unfold : fixpointK k f  f (fixpointK k f).
405
  Proof.
406
407
    symmetry. rewrite /fixpointK. apply fixpoint_unique.
    by rewrite -Nat_iter_S_r Nat_iter_S -fixpoint_unfold.
408
409
  Qed.

410
  Lemma fixpointK_unique (x : A) : x  f x  x  fixpointK k f.
411
  Proof.
412
413
    intros Hf. apply fixpoint_unique. clear f_contractive.
    induction k as [|k' IH]=> //=. by rewrite -IH.
414
415
  Qed.

416
  Section fixpointK_ne.
417
    Context (g : A  A) `{g_contractive : !Contractive (Nat.iter k g)}.
418
    Context {g_ne : NonExpansive g}.
419

420
    Lemma fixpointK_ne n : ( z, f z {n} g z)  fixpointK k f {n} fixpointK k g.
421
    Proof.
422
423
424
      rewrite /fixpointK=> Hfg /=. apply fixpoint_ne=> z.
      clear f_contractive g_contractive.
      induction k as [|k' IH]=> //=. by rewrite IH Hfg.
425
426
    Qed.

427
428
429
    Lemma fixpointK_proper : ( z, f z  g z)  fixpointK k f  fixpointK k g.
    Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpointK_ne. Qed.
  End fixpointK_ne.
Ralf Jung's avatar
Ralf Jung committed
430
431
432
433

  Lemma fixpointK_ind (P : A  Prop) :
    Proper (() ==> impl) P 
    ( x, P x)  ( x, P x  P (f x)) 
Robbert Krebbers's avatar
Robbert Krebbers committed
434
    LimitPreserving P 
Ralf Jung's avatar
Ralf Jung committed
435
436
    P (fixpointK k f).
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
437
    intros. rewrite /fixpointK. apply fixpoint_ind; eauto.
Robbert Krebbers's avatar
Robbert Krebbers committed
438
    intros; apply Nat_iter_ind; auto.
Ralf Jung's avatar
Ralf Jung committed
439
  Qed.
440
End fixpointK.
441

Robbert Krebbers's avatar
Robbert Krebbers committed
442
(** Mutual fixpoints *)
Ralf Jung's avatar
Ralf Jung committed
443
Section fixpointAB.
444
445
  Local Unset Default Proof Using.

Robbert Krebbers's avatar
Robbert Krebbers committed
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA : A  B  A).
  Context (fB : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.

  Local Definition fixpoint_AB (x : A) : B := fixpoint (fB x).
  Local Instance fixpoint_AB_contractive : Contractive fixpoint_AB.
  Proof.
    intros n x x' Hx; rewrite /fixpoint_AB.
    apply fixpoint_ne=> y. by f_contractive.
  Qed.

  Local Definition fixpoint_AA (x : A) : A := fA x (fixpoint_AB x).
  Local Instance fixpoint_AA_contractive : Contractive fixpoint_AA.
  Proof. solve_contractive. Qed.

  Definition fixpoint_A : A := fixpoint fixpoint_AA.
  Definition fixpoint_B : B := fixpoint_AB fixpoint_A.

  Lemma fixpoint_A_unfold : fA fixpoint_A fixpoint_B  fixpoint_A.
  Proof. by rewrite {2}/fixpoint_A (fixpoint_unfold _). Qed.
  Lemma fixpoint_B_unfold : fB fixpoint_A fixpoint_B  fixpoint_B.
  Proof. by rewrite {2}/fixpoint_B /fixpoint_AB (fixpoint_unfold _). Qed.

  Instance: Proper (() ==> () ==> ()) fA.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.
  Instance: Proper (() ==> () ==> ()) fB.
  Proof.
    apply ne_proper_2=> n x x' ? y y' ?. f_contractive; auto using dist_S.
  Qed.

  Lemma fixpoint_A_unique p q : fA p q  p  fB p q  q  p  fixpoint_A.
  Proof.
    intros HfA HfB. rewrite -HfA. apply fixpoint_unique. rewrite /fixpoint_AA.
    f_equiv=> //. apply fixpoint_unique. by rewrite HfA HfB.
  Qed.
  Lemma fixpoint_B_unique p q : fA p q  p  fB p q  q  q  fixpoint_B.
  Proof. intros. apply fixpoint_unique. by rewrite -fixpoint_A_unique. Qed.
Ralf Jung's avatar
Ralf Jung committed
487
End fixpointAB.
Robbert Krebbers's avatar
Robbert Krebbers committed
488

Ralf Jung's avatar
Ralf Jung committed
489
Section fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
  Context `{Cofe A, Cofe B, !Inhabited A, !Inhabited B}.
  Context (fA fA' : A  B  A).
  Context (fB fB' : A  B  B).
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA}.
  Context `{ n, Proper (dist_later n ==> dist n ==> dist n) fA'}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB}.
  Context `{ n, Proper (dist_later n ==> dist_later n ==> dist n) fB'}.

  Lemma fixpoint_A_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_A fA fB {n} fixpoint_A fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z.
    rewrite /fixpoint_AA /fixpoint_AB HfA. f_equiv. by apply fixpoint_ne.
  Qed.
  Lemma fixpoint_B_ne n :
    ( x y, fA x y {n} fA' x y)  ( x y, fB x y {n} fB' x y) 
    fixpoint_B fA fB {n} fixpoint_B fA' fB'.
  Proof.
    intros HfA HfB. apply fixpoint_ne=> z. rewrite HfB. f_contractive.
    apply fixpoint_A_ne; auto using dist_S.
  Qed.

  Lemma fixpoint_A_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_A fA fB  fixpoint_A fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_A_ne. Qed.
  Lemma fixpoint_B_proper :
    ( x y, fA x y  fA' x y)  ( x y, fB x y  fB' x y) 
    fixpoint_B fA fB  fixpoint_B fA' fB'.
  Proof. setoid_rewrite equiv_dist; naive_solver eauto using fixpoint_B_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
521
End fixpointAB_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
522

523
(** Non-expansive function space *)
524
Record ofe_mor (A B : ofeT) : Type := OfeMor {
525
  ofe_mor_car :> A  B;
526
  ofe_mor_ne : NonExpansive ofe_mor_car
Robbert Krebbers's avatar
Robbert Krebbers committed
527
}.
528
Arguments OfeMor {_ _} _ {_}.
529
530
Add Printing Constructor ofe_mor.
Existing Instance ofe_mor_ne.
Robbert Krebbers's avatar
Robbert Krebbers committed
531

532
Notation "'λne' x .. y , t" :=
533
  (@OfeMor _ _ (λ x, .. (@OfeMor _ _ (λ y, t) _) ..) _)
534
535
  (at level 200, x binder, y binder, right associativity).

536
537
538
539
540
541
542
Section ofe_mor.
  Context {A B : ofeT}.
  Global Instance ofe_mor_proper (f : ofe_mor A B) : Proper (() ==> ()) f.
  Proof. apply ne_proper, ofe_mor_ne. Qed.
  Instance ofe_mor_equiv : Equiv (ofe_mor A B) := λ f g,  x, f x  g x.
  Instance ofe_mor_dist : Dist (ofe_mor A B) := λ n f g,  x, f x {n} g x.
  Definition ofe_mor_ofe_mixin : OfeMixin (ofe_mor A B).
543
544
  Proof.
    split.
545
    - intros f g; split; [intros Hfg n k; apply equiv_dist, Hfg|].
Robbert Krebbers's avatar
Robbert Krebbers committed
546
      intros Hfg k; apply equiv_dist=> n; apply Hfg.
547
    - intros n; split.
548
549
      + by intros f x.
      + by intros f g ? x.
550
      + by intros f g h ?? x; trans (g x).
551
    - by intros n f g ? x; apply dist_S.
552
  Qed.
553
  Canonical Structure ofe_morO := OfeT (ofe_mor A B) ofe_mor_ofe_mixin.
554

555
  Program Definition ofe_mor_chain (c : chain ofe_morO)
556
557
    (x : A) : chain B := {| chain_car n := c n x |}.
  Next Obligation. intros c x n i ?. by apply (chain_cauchy c). Qed.
558
  Program Definition ofe_mor_compl `{Cofe B} : Compl ofe_morO := λ c,
559
560
561
562
563
    {| ofe_mor_car x := compl (ofe_mor_chain c x) |}.
  Next Obligation.
    intros ? c n x y Hx. by rewrite (conv_compl n (ofe_mor_chain c x))
      (conv_compl n (ofe_mor_chain c y)) /= Hx.
  Qed.
564
  Global Program Instance ofe_mor_cofe `{Cofe B} : Cofe ofe_morO :=
565
566
567
568
569
    {| compl := ofe_mor_compl |}.
  Next Obligation.
    intros ? n c x; simpl.
    by rewrite (conv_compl n (ofe_mor_chain c x)) /=.
  Qed.
570

571
572
573
  Global Instance ofe_mor_car_ne :
    NonExpansive2 (@ofe_mor_car A B).
  Proof. intros n f g Hfg x y Hx; rewrite Hx; apply Hfg. Qed.
574
575
576
  Global Instance ofe_mor_car_proper :
    Proper (() ==> () ==> ()) (@ofe_mor_car A B) := ne_proper_2 _.
  Lemma ofe_mor_ext (f g : ofe_mor A B) : f  g   x, f x  g x.
577
  Proof. done. Qed.
578
End ofe_mor.
579

580
Arguments ofe_morO : clear implicits.
581
Notation "A -n> B" :=
582
  (ofe_morO A B) (at level 99, B at level 200, right associativity).
583
Instance ofe_mor_inhabited {A B : ofeT} `{Inhabited B} :
584
  Inhabited (A -n> B) := populate (λne _, inhabitant).
Robbert Krebbers's avatar
Robbert Krebbers committed
585

586
(** Identity and composition and constant function *)
587
Definition cid {A} : A -n> A := OfeMor id.
588
Instance: Params (@cid) 1 := {}.
589
Definition cconst {A B : ofeT} (x : B) : A -n> B := OfeMor (const x).
590
Instance: Params (@cconst) 2 := {}.
591

Robbert Krebbers's avatar
Robbert Krebbers committed
592
Definition ccompose {A B C}
593
  (f : B -n> C) (g : A -n> B) : A -n> C := OfeMor (f  g).
594
Instance: Params (@ccompose) 3 := {}.
Robbert Krebbers's avatar
Robbert Krebbers committed
595
Infix "◎" := ccompose (at level 40, left associativity).
596
597
598
Global Instance ccompose_ne {A B C} :
  NonExpansive2 (@ccompose A B C).
Proof. intros n ?? Hf g1 g2 Hg x. rewrite /= (Hg x) (Hf (g2 x)) //. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
599

Ralf Jung's avatar
Ralf Jung committed
600
(* Function space maps *)
601
Definition ofe_mor_map {A A' B B'} (f : A' -n> A) (g : B -n> B')
Ralf Jung's avatar
Ralf Jung committed
602
  (h : A -n> B) : A' -n> B' := g  h  f.
603
604
Instance ofe_mor_map_ne {A A' B B'} n :
  Proper (dist n ==> dist n ==> dist n ==> dist n) (@ofe_mor_map A A' B B').
605
Proof. intros ??? ??? ???. by repeat apply ccompose_ne. Qed.
Ralf Jung's avatar
Ralf Jung committed
606

607
608
609
610
Definition ofe_morO_map {A A' B B'} (f : A' -n> A) (g : B -n> B') :
  (A -n> B) -n> (A' -n>  B') := OfeMor (ofe_mor_map f g).
Instance ofe_morO_map_ne {A A' B B'} :
  NonExpansive2 (@ofe_morO_map A A' B B').
Ralf Jung's avatar
Ralf Jung committed
611
Proof.
612
  intros n f f' Hf g g' Hg ?. rewrite /= /ofe_mor_map.
613
  by repeat apply ccompose_ne.
Ralf Jung's avatar
Ralf Jung committed
614
615
Qed.

616
(** * Unit type *)
617
618
Section unit.
  Instance unit_dist : Dist unit := λ _ _ _, True.
619
  Definition unit_ofe_mixin : OfeMixin unit.
620
  Proof. by repeat split; try exists 0. Qed.
621
  Canonical Structure unitO : ofeT := OfeT unit unit_ofe_mixin.
Robbert Krebbers's avatar
Robbert Krebbers committed
622

623
  Global Program Instance unit_cofe : Cofe unitO := { compl x := () }.
624
  Next Obligation. by repeat split; try exists 0. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
625

626
  Global Instance unit_ofe_discrete : OfeDiscrete unitO.
Robbert Krebbers's avatar
Robbert Krebbers committed
627
  Proof. done. Qed.
628
End unit.
Robbert Krebbers's avatar
Robbert Krebbers committed
629

630
(** * Empty type *)
631
632
633
634
635
636
637
638
639
640
641
642
643
Section empty.
  Instance Empty_set_dist : Dist Empty_set := λ _ _ _, True.
  Definition Empty_set_ofe_mixin : OfeMixin Empty_set.
  Proof. by repeat split; try exists 0. Qed.
  Canonical Structure Empty_setO : ofeT := OfeT Empty_set Empty_set_ofe_mixin.

  Global Program Instance Empty_set_cofe : Cofe Empty_setO := { compl x := x 0 }.
  Next Obligation. by repeat split; try exists 0. Qed.

  Global Instance Empty_set_ofe_discrete : OfeDiscrete Empty_setO.
  Proof. done. Qed.
End empty.

644
(** * Product type *)
645
Section product.
646
  Context {A B : ofeT}.
647
648
649

  Instance prod_dist : Dist (A * B) := λ n, prod_relation (dist n) (dist n).
  Global Instance pair_ne :
650
651
652
    NonExpansive2 (@pair A B) := _.
  Global Instance fst_ne : NonExpansive (@fst A B) := _.
  Global Instance snd_ne : NonExpansive (@snd A B) := _.
653
  Definition prod_ofe_mixin : OfeMixin (A * B).
654
655
  Proof.
    split.
656
    - intros x y; unfold dist, prod_dist, equiv, prod_equiv, prod_relation.
657
      rewrite !equiv_dist; naive_solver.
658
659
    - apply _.
    - by intros n [x1 y1] [x2 y2] [??]; split; apply dist_S.
660
  Qed.
661
  Canonical Structure prodO : ofeT := OfeT (A * B) prod_ofe_mixin.
662

663
  Global Program Instance prod_cofe `{Cofe A, Cofe B} : Cofe prodO :=
664
665
666
667
668
669
    { compl c := (compl (chain_map fst c), compl (chain_map snd c)) }.
  Next Obligation.
    intros ?? n c; split. apply (conv_compl n (chain_map fst c)).
    apply (conv_compl n (chain_map snd c)).
  Qed.

670
671
672
  Global Instance prod_discrete (x : A * B) :
    Discrete (x.1)  Discrete (x.2)  Discrete x.
  Proof. by intros ???[??]; split; apply (discrete _). Qed.
673
  Global Instance prod_ofe_discrete :
674
    OfeDiscrete A  OfeDiscrete B  OfeDiscrete prodO.
675
  Proof. intros ?? [??]; apply _. Qed.
676
677
End product.

678
Arguments prodO : clear implicits.
679
680
Typeclasses Opaque prod_dist.

681
Instance prod_map_ne {A A' B B' : ofeT} n :
Robbert Krebbers's avatar
Robbert Krebbers committed
682
683
684
  Proper ((dist n ==> dist n) ==> (dist n ==> dist n) ==>
           dist n ==> dist n) (@prod_map A A' B B').
Proof. by intros f f' Hf g g' Hg ?? [??]; split; [apply Hf|apply Hg]. Qed.
685
686
687
688
Definition prodO_map {A A' B B'} (f : A -n> A') (g : B -n> B') :
  prodO A B -n> prodO A' B' := OfeMor (prod_map f g).
Instance prodO_map_ne {A A' B B'} :
  NonExpansive2 (@prodO_map A A' B B').
689
Proof. intros n f f' Hf g g' Hg [??]; split; [apply Hf|apply Hg]. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
690

691
(** * COFE → OFE Functors *)
692
693
694
695
Record oFunctor := OFunctor {
  oFunctor_car :  A `{!Cofe A} B `{!Cofe B}, ofeT;
  oFunctor_map `{!Cofe A1, !Cofe A2, !Cofe B1, !Cofe B2} :
    ((A2 -n> A1) * (B1 -n> B2))  oFunctor_car A1 B1 -n> oFunctor_car A2 B2;
696
  oFunctor_map_ne `{!Cofe A1, !Cofe A2, !Cofe B1, !Cofe B2} :
697
    NonExpansive (@oFunctor_map A1 _ A2 _ B1 _ B2 _);
698
  oFunctor_map_id `{!Cofe A, !Cofe B} (x : oFunctor_car A B) :
699
    oFunctor_map (cid,cid) x  x;
700
  oFunctor_map_compose `{!Cofe A1, !Cofe A2, !Cofe A3, !Cofe B1, !Cofe B2, !Cofe B3}
701
      (f : A2 -n> A1) (g : A3 -n> A2) (f' : B1 -n> B2) (g' : B2 -n> B3) x :
702
    oFunctor_map (fg, g'f') x  oFunctor_map (g,g') (oFunctor_map (f,f') x)
703
}.
704
Existing Instance oFunctor_map_ne.
705
Instance: Params (@oFunctor_map) 9 := {}.
706

Ralf Jung's avatar
Ralf Jung committed
707
Declare Scope oFunctor_scope.
708
709
Delimit Scope oFunctor_scope with OF.
Bind Scope oFunctor_scope with oFunctor.
710

711
Class oFunctorContractive (F : oFunctor) :=
712
  oFunctor_map_contractive `{!Cofe A1, !Cofe A2, !Cofe B1, !Cofe B2} :>
713
714
    Contractive (@oFunctor_map F A1 _ A2 _ B1 _ B2 _).
Hint Mode oFunctorContractive ! : typeclass_instances.
715

Robbert Krebbers's avatar
Robbert Krebbers committed
716
717
(** Not a coercion due to the [Cofe] type class argument, and to avoid
ambiguous coercion paths, see https://gitlab.mpi-sws.org/iris/iris/issues/240. *)
718
Definition oFunctor_apply (F: oFunctor) (A: ofeT) `{!Cofe A} : ofeT :=
719
  oFunctor_car F A A.
720

721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
Program Definition oFunctor_oFunctor_compose (F1 F2 : oFunctor)
  `{! `{Cofe A, Cofe B}, Cofe (oFunctor_car F2 A B)} : oFunctor := {|
  oFunctor_car A _ B _ := oFunctor_car F1 (oFunctor_car F2 B A) (oFunctor_car F2 A B);
  oFunctor_map A1 _ A2 _ B1 _ B2 _ 'fg :=
    oFunctor_map F1 (oFunctor_map F2 (fg.2,fg.1),oFunctor_map F2 fg)
|}.
Next Obligation.
  intros F1 F2 ? A1 ? A2 ? B1 ? B2 ? n [f1 g1] [f2 g2] [??]; simpl in *.
  apply oFunctor_map_ne; split; apply oFunctor_map_ne; by split.
Qed.
Next Obligation.
  intros F1 F2 ? A ? B ? x; simpl in *. rewrite -{2}(oFunctor_map_id F1 x).
  apply equiv_dist=> n. apply oFunctor_map_ne.
  split=> y /=; by rewrite !oFunctor_map_id.
Qed.
Next Obligation.
  intros F1 F2 ? A1 ? A2 ? A3 ? B1 ? B2 ? B3 ? f g f' g' x; simpl in *.
  rewrite -oFunctor_map_compose. apply equiv_dist=> n. apply oFunctor_map_ne.
  split=> y /=; by rewrite !oFunctor_map_compose.
Qed.
Instance oFunctor_oFunctor_compose_contractive_1 (F1 F2 : oFunctor)
    `{! `{Cofe A, Cofe B}, Cofe (oFunctor_car F2 A B)} :
  oFunctorContractive F1  oFunctorContractive (oFunctor_oFunctor_compose F1 F2).
Proof.
  intros ? A1 ? A2 ? B1 ? B2 ? n [f1 g1] [f2 g2] Hfg; simpl in *.
  f_contractive; destruct Hfg; split; simpl in *; apply oFunctor_map_ne; by split.
Qed.
Instance oFunctor_oFunctor_compose_contractive_2 (F1 F2 : oFunctor)
    `{! `{Cofe A, Cofe B}, Cofe (oFunctor_car F2 A B)} :
  oFunctorContractive F2  oFunc