Library prosa.analysis.facts.transform.wc_correctness

Correctness of the work-conservation transformation

This file contains the main argument of the work-conservation proof, starting with an analysis of the individual functions that drive the work-conservation transformation of a given reference schedule and ending with the proofs of individual properties of the obtained work-conserving schedule.
Throughout this file, we assume ideal uniprocessor schedules and the basic (i.e., Liu & Layland) readiness model under which any pending job is ready.
In order to discuss the correctness of the work-conservation transformation at a high level, we first need a set of lemmas about the inner parts of the procedure.
Consider any type of jobs with arrival times, costs, and deadlines...
  Context {Job : JobType}.
  Context `{JobArrival Job}.
  Context `{JobCost Job}.
  Context `{JobDeadline Job}.

...and an arbitrary arrival sequence.
We introduce the notion of work-conservation at a given time t. The definition is based on the concept of readiness of a job, and states that the presence of a ready job implies that the processor is not idle.
First, we prove some useful properties about the most fundamental operation of the work-conservation transformation: swapping two processor states t1 and fsc, with fsc being a valid swap candidate of t1.
Consider an ideal uniprocessor schedule...
    Variable sched: schedule (ideal.processor_state Job).

...in which jobs must be ready to execute.
Consider an arbitrary time instant t1.
    Variable t1: instant.

Let us define fsc as the result of the search for a swap candidate starting from t1...
...and sched' as the schedule resulting from the swap.
    Let sched' := swapped sched t1 fsc.

First, we show that, in any case, the result of the search will yield an instant that is in the future (or, in case of failure, equal to t1).
    Lemma swap_candidate_is_in_future:
      t1 fsc.

Also, we show that the search will not yield jobs that arrive later than the given reference time.
    Lemma fsc_respects_has_arrived:
       j t,
        sched (find_swap_candidate arr_seq sched t) == Some j
        has_arrived j t.
Next, we extend the previous lemma by stating that no job in the transformed schedule is scheduled before its arrival.
Finally we show that, in the transformed schedule, jobs are scheduled only if they are ready.
In the following section, we put our attention on the point-wise transformation performed at each point in time prior to the horizon.
  Section MakeWCAtFacts.

Consider an ideal uniprocessor schedule...
    Variable sched: schedule (ideal.processor_state Job).

...and take an arbitrary point in time...
    Variable t: instant.

...we define sched' as the resulting schedule after one point-wise transformation.
    Let sched' := make_wc_at arr_seq sched t.

We start by proving that the point-wise transformation can only lead to higher service for a job at a given time. This is true because we swap only idle processor states with ones in which a job is scheduled.
    Lemma mwa_service_bound:
       j t, service sched j t service sched' j t.

Next, we show that any ready job in the transformed schedule must be ready also in the original one, since the transformation can only lead to higher service.
Since the search for a swap candidate is performed until the latest deadline among all the jobs arrived before the reference time, we need to show that the computed deadline is indeed the latest.
    Lemma max_dl_is_greatest_dl:
       j t,
        arrives_in arr_seq j
        job_arrival j t
        job_deadline j max_deadline_for_jobs_arrived_before arr_seq t.

Next, we want to show that, if a job arriving from the arrival sequence is ready at some instant, then the point-wise transformation is guaranteed to find a job to swap with. We will proceed by doing a case analysis, and show that it is impossible that a swap candidate is not found.
    Section MakeWCAtFindsReadyJobs.

We need to assume that, in the original schedule, all the deadlines of the jobs coming from the arrival sequence are met, in order to be sure that a ready job will be eventually scheduled.
We define max_dl as the maximum deadline for all jobs arrived before t.
Next, we define search_result as the result of the search for a swap candidate. In order to take the first result, it is sufficient to define the ordering function as a constant false.
      Definition order (_ _ : nat) := false.
      Definition search_result := search_arg sched (relevant_pstate t) order t max_dl.

First, we consider the case in which the procedure finds a job to swap with.
Assuming that the processor is idle at time t...
        Hypothesis H_sched_t_idle: is_idle sched t.

...let t_swap be a time instant found by the search procedure.
        Variable t_swap: instant.
        Hypothesis search_result_found: search_result = Some t_swap.

We show that, since the search only yields relevant processor states, a job is found.
        Lemma make_wc_at_case_result_found:
           j: Job,
            swapped sched t t_swap t = Some j.

      End MakeWCAtFindsReadyJobs_CaseResultFound.

Conversely, we prove that assuming that the search yields no result brings to a contradiction.
Consider a job that arrives in the arrival sequence, and assume that it is ready at time t in the transformed schedule.
        Variable j: Job.
        Hypothesis H_arrives_in: arrives_in arr_seq j.
        Hypothesis H_job_ready_sched': job_ready sched' j t.

Moreover, assume the search for a swap candidate yields nothing.
        Hypothesis H_search_result_none: search_result = None.

First, note that, since nothing was found, it means there is no relevant processor state between t and max_dl.
        Lemma no_relevant_state_in_range:
           t',
            t t' < max_dl
            ~~ (relevant_pstate t) (sched t').

Since j is ready at time t, then it must be incomplete.
And since j is incomplete and meets its deadline, the deadline of j is in the future.
        Lemma t_is_less_than_deadline_of_j: t job_deadline j.

On the other hand, since we know that there is no relevant state between t and max_dl, then it must be the case that j is never scheduled in this period, and hence gets no service.
Combining the previous lemmas, we can deduce that j misses its deadline.
        Lemma j_misses_deadline: service sched j (job_deadline j) < job_cost j.

The fact that j misses its deadline contradicts the fact that all deadlines of jobs coming from the arrival sequence are met. We have a contradiction.
Next, we show that make_wc_at always manages to establish the work-conservation property at the given time. Using the above case analysis, we can conclude that the presence of a ready job always leads to a valid swap.
Next we prove that, given a schedule that respects the work-conservation property until t-1, applying the point-wise transformation at time t will extend the property until t.
We now show that the point-wise transformation does not introduce any new job that does not come from the arrival sequence.
We also show that the point-wise transformation does not schedule jobs in instants in which they are not ready.
Finally, we show that the point-wise transformation does not introduce deadline misses.
In the following section, we proceed by proving some useful properties respected by the partial schedule obtained by applying the work-conservation transformation up to an arbitrary horizon.
  Section PrefixFacts.

Consider an ideal uniprocessor schedule.
    Variable sched: schedule (ideal.processor_state Job).

We start by proving that the transformation performed with two different horizons will yield two schedules that are identical until the earlier horizon.
    Section PrefixInclusion.

Consider two horizons...
      Variable h1 h2: instant.

...and assume w.l.o.g. that they are ordered...
      Hypothesis H_horizon_order: h1 h2.

...we define two schedules, resulting from the transformation performed, respectively, until the first and the second horizon.
Then, we show that the two schedules are guaranteed to be equal until the earlier horizon.
      Lemma wc_transform_prefix_inclusion:
         t, t < h1 sched1 t = sched2 t.

    End PrefixInclusion.

Next, we show that repeating the point-wise transformation up to a given horizon does not introduce any deadline miss.
    Section JobsMeetDeadlinePrefix.

Assuming that all deadlines of jobs coming from the arrival sequence are met...
...let us define sched' as the schedule resulting from the full work-conservation transformation. Note that, if the schedule is sampled at time t, the transformation is performed until t+1.
      Let sched' := wc_transform arr_seq sched.

Consider a job from the arrival sequence.
      Variable j: Job.
      Hypothesis H_arrives_in: arrives_in arr_seq j.

We show that, in the transformed schedule, the service of the job is always greater or equal than in the original one, at any given time.
      Lemma wc_prefix_service_bound:
         t, service sched j t service sched' j t.

Finally, it follows directly that the transformed schedule cannot introduce a deadline miss for any job from the arrival sequence.
      Lemma wc_prefix_job_meets_deadline:
        job_meets_deadline sched' j.

    End JobsMeetDeadlinePrefix.

Next, consider a given time, used as horizon for the transformation...
    Variable h: instant.

...and let us call sched' the schedule resulting from the transformation performed until h.
We prove that sched' will never introduce jobs not coming from the arrival sequence.
Similarly, we can show that sched' will only schedule jobs if they are ready.
Finally, we can leverage all the previous results to prove statements about the full work-conservation transformation.
Consider any type of jobs with arrival times, costs, and deadlines...
  Context {Job : JobType}.
  Context `{JobArrival Job}.
  Context `{JobCost Job}.
  Context `{JobDeadline Job}.

...an arbitrary valid arrival sequence...
...and an ideal uniprocessor schedule...
...in which jobs come from the arrival sequence, and must be ready to execute...
...and in which no job misses a deadline.
Let us call sched_wc the schedule obtained after applying the work-conservation transformation.
First, we show that any scheduled job still comes from the arrival sequence.
Similarly, jobs are only scheduled if they are ready.
Also, no deadline misses are introduced.
Finally, we can show that the transformation leads to a schedule in which the processor is not idle if a job is ready.
  Lemma wc_is_work_conserving_at:
     j t,
      job_ready sched_wc j t
      arrives_in arr_seq j
       j', sched_wc t = Some j'.
We can easily extend the previous lemma to obtain the definition of a work-conserving schedule.
Ultimately, we can show that the work-conservation transformation maintains all the properties of validity, does not introduce new deadline misses, and establishes the work-conservation property.