diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9b31025e8cd7598445892a77f27c917736b9f875..a5adace7bce04fec92a1f63969640d55b44ff51f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -77,7 +77,7 @@ compile-and-doc:
- .preferred-stable-version
script:
- !reference [.install-dependencies, script]
- - ./create_makefile.sh --without-classic
+ - ./create_makefile.sh
- make -j ${NJOBS}
- !reference [.make-html, script]
artifacts:
@@ -95,7 +95,7 @@ compile-and-doc-and-validate:
- .preferred-stable-version
script:
- !reference [.install-dependencies, script]
- - ./create_makefile.sh --without-classic
+ - ./create_makefile.sh
- make -j ${NJOBS}
- !reference [.make-html, script]
- make validate 2>&1 | tee validation-results.txt
@@ -116,30 +116,11 @@ compile-and-validate:
- .preferred-stable-version
script:
- !reference [.install-dependencies, script]
- - ./create_makefile.sh --without-classic --without-refinements
+ - ./create_makefile.sh --without-refinements
- make -j ${NJOBS}
- make validate 2>&1 | tee validation-results.txt
- scripts/check-validation-output.sh validation-results.txt
-classic-compile-and-doc-and-validate:
- stage: build
- extends:
- - .preferred-stable-version
- - .not_in_wip_branches
- script:
- - !reference [.install-dependencies, script]
- - ./create_makefile.sh --only-classic
- - make -j ${NJOBS}
- - !reference [.make-html, script]
- - make validate
- artifacts:
- name: "prosa-classic-spec-$CI_COMMIT_REF_NAME"
- paths:
- - "with-proofs/"
- - "without-proofs/"
- - "pretty/"
- expire_in: 1 week
-
proof-length:
stage: build
image: python:3-alpine
@@ -152,7 +133,7 @@ spell-check:
stage: build
image: bbbrandenburg/aspell-ci
script:
- - scripts/flag-typos-in-comments.sh `find . -iname '*.v' ! -path './classic/*'`
+ - scripts/flag-typos-in-comments.sh `find . -iname '*.v'`
# mathcomp-dev with stable Coq
#coq-8.15:
@@ -178,7 +159,7 @@ proof-state:
script:
- eval $(opam env "--switch=${COMPILER_EDGE}" --set-switch)
- !reference [.install-dependencies, script]
- - ./create_makefile.sh --without-classic
+ - ./create_makefile.sh
- make -j ${NJOBS} alectryon
artifacts:
name: "prosa-proof-state-$CI_COMMIT_REF_NAME"
diff --git a/README.md b/README.md
index 577b8997aaa380b27e4708b031ebddbf6a94059c..0eb6e9ac17bb0e0e015334a73e9a927538dbed7c 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,13 @@
# Prosa: Formally Proven Schedulability Analysis
-This repository contains the main Coq specification & proof development of the [Prosa open-source project](https://prosa.mpi-sws.org), which was launched in 2016. As of 2018, Prosa is primarily being developed in the context of the [RT-Proofs research project](https://rt-proofs.inria.fr/) (kindly funded jointly by ANR and DFG, projects ANR-17-CE25-0016 and DFG-391919384, respectively).
+This repository contains the main Coq specification & proof development of the [Prosa open-source project](https://prosa.mpi-sws.org), which was launched in 2016.
+
+From 2018–201, Prosa was furter developed in the context of the [RT-Proofs research project](https://rt-proofs.inria.fr/) (funded jointly by ANR and DFG, projects ANR-17-CE25-0016 and DFG-391919384, respectively).
<center><img alt="RT-Proofs logo" src="http://prosa.mpi-sws.org/figures/rt-proofs-logo.png" width="300px"></center>
+Prosa continues to be maintained and developed by the MPI-SWS Real-Time Systems group and contributors. Patches and merge requests are very welcome!
+
## Documentation
Up-to-date documentation for all branches of the main Prosa repository is available on the Prosa homepage:
@@ -14,23 +18,26 @@ Up-to-date documentation for all branches of the main Prosa repository is availa
Please see the [list of publications](https://prosa.mpi-sws.org/publications.html) on the Prosa project's homepage.
-## Directory and Module Structure
+### Classic Prosa
+
+All results published prior to 2020 used the "classic" version of Prosa as first presented at ECRTS'16. Classic Prosa has been superseded by this development and is no longer being maintained. Refer to [the `classic-prosa` branch](https://gitlab.mpi-sws.org/RT-PROOFS/rt-proofs/-/tree/classic-prosa) to find this original version of Prosa.
+
-The directory and module structure is organized as follows. First, the main parts, of which there are currently four.
+## Directory and Module Structure
-- [behavior/](behavior/): The `behavior` namespace collects basic definitions and properties of system behavior (i.e., it defines Prosa's **trace-based semantics**). There are *no* proofs here. This module is mandatory: *all* results in Prosa rely on the basic trace-based semantics defined in this module.
-- [model/](model/): The `model` namespace collects all definitions and basic properties of various **system models** (e.g., sporadic tasks, arrival curves, various scheduling policies, etc.). There are only few proofs here. This module contains multiple, mutually exclusive alternatives (e.g., periodic vs. sporadic tasks, uni- vs. multiprocessor models, constrained vs. arbitrary deadlines, etc.), and higher-level results are expected "pick and choose" whatever definitions and assumptions are appropriate.
-- [analysis/](analysis/): The `analysis` namespace collects all definitions and proof libraries needed to establish **system properties** (e.g., schedulability, response time, etc.). This includes a substantial library of *basic facts* that follow directly from the trace-based semantics or specific modelling assumptions. Virtually all intermediate steps and low-level proofs will be found here.
-- [results/](results/): The `results` namespace contains all **high-level analysis results**.
+The directory and module structure is organized as follows. First, the main parts, of which there are currently six.
+- [behavior](behavior/): The `behavior` namespace collects basic definitions and properties of system behavior (i.e., it defines Prosa's **trace-based semantics**). There are *no* proofs here. This module is mandatory: *all* results in Prosa rely on the basic trace-based semantics defined in this module.
+- [model](model/): The `model` namespace collects all definitions and basic properties of various **system models** (e.g., sporadic tasks, arrival curves, various scheduling policies, etc.). There are only few proofs here. This module contains multiple, mutually exclusive alternatives (e.g., periodic vs. sporadic tasks, uni- vs. multiprocessor models, constrained vs. arbitrary deadlines, etc.), and higher-level results are expected "pick and choose" whatever definitions and assumptions are appropriate. These models are *axiomatic* in the sense that they are collections of hypotheses and not necessarily backed by concrete implementations (but see below).
+- [analysis](analysis/): The `analysis` namespace collects all definitions and proof libraries needed to establish **system properties** (e.g., schedulability, response time, etc.). This includes a substantial library of *basic facts* that follow directly from the trace-based semantics or specific modelling assumptions. Virtually all intermediate steps and low-level proofs will be found here.
+- [results](results/): The `results` namespace contains all **high-level analysis results**.
+- [implementation](implementation/): This module collects concrete implementations of some of the axiomatic models and scheduling policies to which the results apply. These are used to instantiate (i.e., apply) high-level results in an assumption-free environment for concrete job and task types, which establishes the absence of contradictions in the axiomatic models refined by the implementations.
+- [implementation.refinements](implementation/refinements/): The refinements needed by [POET](https://drops.dagstuhl.de/opus/volltexte/2022/16336/) to compute with large numbers, based on [CoqEAL](https://github.com/coq-community/CoqEAL).
-In future work, there will also (again) be an `implementation` or `examples` namespace in which important high-level results are instantiated (i.e., applied) in an assumption-free environment for concrete job and task types to establish the absence of any contradiction in assumptions.
Furthermore, there are a couple of additional folders and namespaces.
-- [classic/](classic/): This module contains the "classic" version of Prosa as first presented at ECRTS'16.
-All results published prior to 2020 build on this "classic" version of Prosa.
-- [util/](util/): A collection of miscellaneous "helper" lemmas and tactics. Used throughout the rest of Prosa.
+- [util](util/): A collection of miscellaneous "helper" lemmas and tactics. Used throughout the rest of Prosa.
- [scripts/](scripts/): Scripts and supporting resources required for continuous integration and documentation generation.
## Installation
@@ -111,16 +118,10 @@ First, create an appropriate `Makefile`.
./create_makefile.sh
```
-Alternatively, to avoid compiling the older "classic" Prosa, specify the `--without-classic` option. This can speed up compilation considerably and is a good idea during development. (It's also possible to *only* compile the "classic" Prosa by specifying the `--only-classic` option, but this is rarely needed.)
-
-```bash
-./create_makefile.sh --without-classic
-```
-
-To avoid compiling the POET-related refinements (which require CoqEAL to be installed and inject a dependency on the *proof irrelevance* axiom), specify the switch `--without-refinements`. For example, to skip both "classic" Prosa and the refinements library, use the following command:
+To avoid compiling the POET-related refinements (which require CoqEAL to be installed and inject a dependency on the *proof irrelevance* axiom), specify the switch `--without-refinements`. For example:
```bash
-./create_makefile.sh --without-classic --without-refinements
+./create_makefile.sh --without-refinements
```
Second, compile the library.
diff --git a/classic/README.md b/classic/README.md
deleted file mode 100644
index d5b522f6ada69ee4a70cef44351d1e2c51d5e23a..0000000000000000000000000000000000000000
--- a/classic/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Classic Prosa
-
-This module contains the Coq specification & proof development of the Prosa project as presented in the ECRTS'16 paper by Cerqueira et al.
-
-- Felipe Cerqueira, Felix Stutz, and Björn Brandenburg, “[Prosa: A Case for Readable Mechanized Schedulability Analysis](https://www.mpi-sws.org/~bbb/papers/pdf/ecrts16f.pdf)â€, *Proceedings of the 28th Euromicro Conference on Real-Time Systems (ECRTS 2016)*, pp. 273–284, July 2016.
-
-This "classic" version of Prosa has since been superseded by a restructuring and refactoring effort that took place throughout most of 2019 in the context of the [RT-Proofs project](https://rt-proofs.inria.fr/) (kindly funded jointly by ANR and DFG, projects ANR-17-CE25-0016 and DFG-391919384, respectively).
-
-For the sake of historical completeness, and since not all "classic" proofs have (yet) been ported to the new Prosa base, "classic" Prosa is still included in the master branch of Prosa of the time being.
-
-## Directory Structure
-
-The Classic Prosa directory was intended to be organized in a hierarchy: while generic, reusable foundations stay in the upper levels, definitions for specific analyses may be found deeper in the directory tree. However, this organizational principle is not consistently followed due to historical developments.
-
-### Base Directories
-
-Classic Prosa contains the following base directories:
-
-- **classic/model/:** Specification of task and scheduler models, as well as generic lemmas related to scheduling.
-
-- **classic/analysis/:** Definition, proofs and implementation of schedulability analyses.
-
-- **classic/implementation/:** Instantiation of each schedulability analysis with concrete task and scheduler implementations.
-Instantiating the main theorems in an assumption free environment shows the absence of contradictory assumptions in the proofs.
-
-- **classic/util/:** additional helper lemmas, notations, and tactics that are no longer used in the "new Prosa".
-
-### Internal Directories
-
-The major concepts in classic Prosa are specified in the *classic/model/* folder.
-
-- **classic/model/arrival:** Arrival sequences and arrival bounds
-- **classic/model/schedule:** Definitions and properties of schedules
-
-Inside *classic/model/schedule*, one can find the different classes of schedulers.
-
-- **classic/model/schedule/uni:** Uniprocessor scheduling.
-- **classic/model/schedule/global:** Global scheduling.
-- **classic/model/schedule/partitioned:** Partitioned scheduling.
-- **classic/model/schedule/apa:** APA scheduling.
-
-For example, the schedulability analysis for global scheduling with release jitter is organized as follows.
-
-- **classic/model/schedule/global/jitter:** Definitions and lemmas for global scheduling with release jitter.
-- **classic/analysis/global/jitter:** Analysis for global scheduling with release jitter.
-- **classic/implementation/global/jitter:** Implementation of the concrete scheduler with release jitter.
-
-## Extending Prosa
-
-Please do not extend this classic version of Prosa in ongoing or future work. As of 2019, all efforts should now be focused on the new, restructured base.
diff --git a/classic/analysis/apa/bertogna_edf_comp.v b/classic/analysis/apa/bertogna_edf_comp.v
deleted file mode 100755
index 50234b06a462f005140d72e1c28b7160a72b3bfe..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/bertogna_edf_comp.v
+++ /dev/null
@@ -1,1002 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.apa.bertogna_edf_theory.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationEDF.
-
- Import ResponseTimeAnalysisEDF.
-
- (* In this section, we define the algorithm corresponding to the APA-reduction
- of Bertogna and Cirinei's RTA for EDF scheduling. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* As input for each iteration of the algorithm, we consider pairs
- of tasks and response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Consider a platform with num_cpus processors. *)
- Variable num_cpus: nat.
-
- (* Assume that every task has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* For the reduction to subproblems, consider a subaffinity alpha' for each task. *)
- Variable alpha': task_affinity sporadic_task num_cpus.
-
- (* First, recall the interference bound under EDF. Note that we use
- subaffinity (alpha' tsk) when computing the set of interfering tasks. *)
- Let I (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline alpha tsk
- (alpha' tsk) (* Subproblem alpha' *)
- rt_bounds delta.
-
- (* Then, we define the response-time recurrence. Note that we divide the
- interference by the cardinality of (alpha' tsk). *)
- Definition edf_response_time_bound (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- task_cost tsk + div_floor (I rt_bounds tsk delta)
- #|alpha' tsk|.
-
- (* Also note that a response-time is only valid if it is no larger
- than the deadline. *)
- Definition R_le_deadline (pair: task_with_response_time) :=
- let (tsk, R) := pair in
- R <= task_deadline tsk.
-
- (* Next, we define the fixed-point iteration for computing the
- response-time bound of each task. *)
-
- (* Given a sequence 'rt_bounds' of task and response-time bounds
- from the previous iteration, we compute the response-time
- bound of a single task using the RTA for EDF. *)
- Definition update_bound (rt_bounds: seq task_with_response_time) pair :=
- let '(tsk, R) := pair in
- (tsk, edf_response_time_bound rt_bounds tsk R).
-
- (* To compute the response-time bounds of the entire task set,
- we start the iteration with a sequence of tasks and costs:
- <(task1, cost1), (task2, cost2), ...>. *)
- Let initial_state (ts: seq sporadic_task) :=
- map (fun tsk => (tsk, task_cost tsk)) ts.
-
- (* Then, we successively update the the response-time bounds based
- on the slack computed in the previous iteration. *)
- Definition edf_rta_iteration (rt_bounds: seq task_with_response_time) :=
- map (update_bound rt_bounds) rt_bounds.
-
- (* To ensure that the procedure converges, we stop the iteration
- after a "sufficient" number of times, which corresponds to
- the time complexity of the procedure. *)
- Let max_steps (ts: seq sporadic_task) :=
- \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1.
-
- (* This yields the following definition for the RTA. At the end
- we check if all computed response-time bounds are less than
- or equal to the deadline, in which case they are valid. *)
- Definition edf_claimed_bounds (ts: seq sporadic_task) :=
- let R_values := iter (max_steps ts) edf_rta_iteration (initial_state ts) in
- if (all R_le_deadline R_values) then
- Some R_values
- else None.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition edf_schedulable (ts: seq sporadic_task) :=
- edf_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of tasks/response-time bounds. *)
- Section SimpleLemmas.
-
- (* Updating a single response-time bound does not modify the task. *)
- Lemma edf_claimed_bounds_unzip1_update_bound :
- forall l rt_bounds,
- unzip1 (map (update_bound rt_bounds) l) = unzip1 l.
- Proof.
- induction l; first by done.
- intros rt_bounds.
- simpl; f_equal; last by done.
- by unfold update_bound; desf.
- Qed.
-
- (* At any point of the iteration, the tasks are the same. *)
- Lemma edf_claimed_bounds_unzip1_iteration :
- forall l k,
- unzip1 (iter k edf_rta_iteration (initial_state l)) = l.
- Proof.
- intros l k; clear -k.
- induction k; simpl.
- {
- unfold initial_state.
- induction l; first by done.
- by simpl; rewrite IHl.
- }
- {
- unfold edf_rta_iteration.
- by rewrite edf_claimed_bounds_unzip1_update_bound.
- }
- Qed.
-
- (* The iteration preserves the size of the list. *)
- Lemma edf_claimed_bounds_size :
- forall l k,
- size (iter k edf_rta_iteration (initial_state l)) = size l.
- Proof.
- intros l k; clear -k.
- induction k; simpl; first by rewrite size_map.
- by rewrite size_map.
- Qed.
-
- (* If the analysis succeeds, the computed response-time bounds are no smaller
- than the task cost. *)
- Lemma edf_claimed_bounds_ge_cost :
- forall l k tsk R,
- (tsk, R) \in (iter k edf_rta_iteration (initial_state l)) ->
- R >= task_cost tsk.
- Proof.
- intros l k tsk R IN.
- destruct k.
- {
- move: IN => /mapP IN; destruct IN as [x IN EQ]; inversion EQ.
- by apply leqnn.
- }
- {
- rewrite iterS in IN.
- move: IN => /mapP IN; destruct IN as [x IN EQ].
- unfold update_bound in EQ; destruct x; inversion EQ.
- by unfold edf_response_time_bound; apply leq_addr.
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadline. *)
- Lemma edf_claimed_bounds_le_deadline :
- forall ts rt_bounds tsk R,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R <= task_deadline tsk.
- Proof.
- intros ts rt_bounds tsk R SOME PAIR; unfold edf_claimed_bounds in SOME.
- destruct (all R_le_deadline (iter (max_steps ts)
- edf_rta_iteration (initial_state ts))) eqn:DEADLINE;
- last by done.
- move: DEADLINE => /allP DEADLINE.
- inversion SOME as [EQ]; rewrite -EQ in PAIR.
- by specialize (DEADLINE (tsk, R) PAIR).
- Qed.
-
- (* The list contains a response-time bound for every task in the task set. *)
- Lemma edf_claimed_bounds_has_R_for_every_task :
- forall ts rt_bounds tsk,
- edf_claimed_bounds ts = Some rt_bounds ->
- tsk \in ts ->
- exists R,
- (tsk, R) \in rt_bounds.
- Proof.
- intros ts rt_bounds tsk SOME IN.
- unfold edf_claimed_bounds in SOME.
- destruct (all R_le_deadline (iter (max_steps ts) edf_rta_iteration (initial_state ts)));
- last by done.
- inversion SOME as [EQ]; clear SOME EQ.
- generalize dependent tsk.
- induction (max_steps ts) as [| step]; simpl in *.
- {
- intros tsk IN; unfold initial_state.
- exists (task_cost tsk).
- by apply/mapP; exists tsk.
- }
- {
- intros tsk IN.
- set prev_state := iter step edf_rta_iteration (initial_state ts).
- fold prev_state in IN, IHstep.
- specialize (IHstep tsk IN); des.
- exists (edf_response_time_bound prev_state tsk R).
- by apply/mapP; exists (tsk, R); [by done | by f_equal].
- }
- Qed.
-
- End SimpleLemmas.
-
- (* In this section, we prove the convergence of the RTA procedure.
- Since we define the RTA procedure as the application of a function
- a fixed number of times, this translates into proving that the value
- of the iteration at (max_steps ts) is equal to the value at (max_steps ts) + 1. *)
- Section Convergence.
-
- (* Consider any sequence of tasks with valid parameters. *)
- Variable ts: seq sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* To simplify, let f denote the RTA procedure. *)
- Let f (k: nat) := iter k edf_rta_iteration (initial_state ts).
-
- (* Since the iteration is applied directly to a list of tasks and response-times,
- we define a corresponding relation "<=" over those lists. *)
-
- (* Let 'all_le' be a binary relation over lists of tasks/response-time bounds.
- It states that every element of list l1 has a response-time bound R that is less
- than or equal to the corresponding response-time bound R' in list l2 (point-wise).
- In addition, the relation states that the tasks of both lists are unchanged. *)
- Let all_le := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- all (fun p => (snd (fst p)) <= (snd (snd p))) (zip l1 l2).
-
- (* Similarly, we define a strict version of 'all_le' called 'one_lt', which states that
- there exists at least one element whose response-time bound increases. *)
- Let one_lt := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- has (fun p => (snd (fst p)) < (snd (snd p))) (zip l1 l2).
-
- (* Next, we prove some basic properties about the relation all_le. *)
- Section RelationProperties.
-
- (* The relation is reflexive, ... *)
- Lemma all_le_reflexive : reflexive all_le.
- Proof.
- intros l; unfold all_le; rewrite eq_refl andTb.
- destruct l; first by done.
- by apply/(zipP t (fun x y => snd x <= snd y)).
- Qed.
-
- (* ... and transitive. *)
- Lemma all_le_transitive: transitive all_le.
- Proof.
- unfold transitive, all_le.
- move => y x z /andP [/eqP ZIPxy LExy] /andP [/eqP ZIPyz LEyz].
- apply/andP; split; first by rewrite ZIPxy -ZIPyz.
- move: LExy => /(zipP _ (fun x y => snd x <= snd y)) LExy.
- move: LEyz => /(zipP _ (fun x y => snd x <= snd y)) LEyz.
- assert (SIZExy: size (unzip1 x) = size (unzip1 y)).
- by rewrite ZIPxy.
- assert (SIZEyz: size (unzip1 y) = size (unzip1 z)).
- by rewrite ZIPyz.
- rewrite 2!size_map in SIZExy; rewrite 2!size_map in SIZEyz.
- destruct y.
- {
- apply size0nil in SIZExy; symmetry in SIZEyz.
- by apply size0nil in SIZEyz; subst.
- }
- apply/(zipP t (fun x y => snd x <= snd y)); first by rewrite SIZExy -SIZEyz.
- intros i LTi.
- exploit LExy; first by rewrite SIZExy.
- {
- rewrite size_zip -SIZEyz -SIZExy minnn in LTi.
- by rewrite size_zip -SIZExy minnn; apply LTi.
- }
- instantiate (1 := t); intro LE.
- exploit LEyz; first by apply SIZEyz.
- {
- rewrite size_zip SIZExy SIZEyz minnn in LTi.
- by rewrite size_zip SIZEyz minnn; apply LTi.
- }
- by instantiate (1 := t); intro LE'; apply (leq_trans LE).
- Qed.
-
- (* At any step of the iteration, the corresponding list
- is larger than or equal to the initial state. *)
- Lemma bertogna_edf_comp_iteration_preserves_minimum :
- forall step, all_le (initial_state ts) (f step).
- Proof.
- unfold f.
- intros step; destruct step; first by apply all_le_reflexive.
- apply/andP; split.
- {
- assert (UNZIP0 := edf_claimed_bounds_unzip1_iteration ts 0).
- by simpl in UNZIP0; rewrite UNZIP0 edf_claimed_bounds_unzip1_iteration.
- }
- destruct ts as [| tsk0 ts'].
- {
- clear -step; induction step; first by done.
- by rewrite iterSr IHstep.
- }
-
- apply/(zipP (tsk0,0) (fun x y => snd x <= snd y));
- first by rewrite edf_claimed_bounds_size size_map.
-
- intros i LTi; rewrite iterS; unfold edf_rta_iteration at 1.
- have MAP := @nth_map _ (tsk0,0) _ (tsk0,0).
- rewrite size_zip edf_claimed_bounds_size size_map minnn in LTi.
- rewrite MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- destruct (nth (tsk0, 0) (initial_state (tsk0 :: ts')) i) as [tsk_i R_i] eqn:SUBST.
- rewrite SUBST; unfold update_bound.
- unfold initial_state in SUBST.
- have MAP := @nth_map _ tsk0 _ (tsk0, 0).
- rewrite ?MAP // in SUBST; inversion SUBST; clear MAP.
- assert (EQtsk: tsk_i = fst (nth (tsk0, 0) (iter step edf_rta_iteration
- (initial_state (tsk0 :: ts'))) i)).
- {
- have MAP := @nth_map _ (tsk0,0) _ tsk0 (fun x => fst x).
- rewrite -MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- have UNZIP := edf_claimed_bounds_unzip1_iteration; unfold unzip1 in UNZIP.
- by rewrite UNZIP; symmetry.
- }
- destruct (nth (tsk0, 0) (iter step edf_rta_iteration (initial_state (tsk0 :: ts')))) as [tsk_i' R_i'].
- by simpl in EQtsk; rewrite -EQtsk; subst; apply leq_addr.
- Qed.
-
- (* The application of the function is inductive. *)
- Lemma bertogna_edf_comp_iteration_inductive (P : seq task_with_response_time -> Type) :
- P (initial_state ts) ->
- (forall k, P (f k) -> P (f (k.+1))) ->
- P (f (max_steps ts)).
- Proof.
- by intros P0 Pn; induction (max_steps ts); last by apply Pn.
- Qed.
-
- (* As a last step, we show that edf_rta_iteration preserves order, i.e., for any
- list l1 no smaller than the initial state, and list l2 such that
- l1 <= l2, we have (edf_rta_iteration l1) <= (edf_rta_iteration l2). *)
- Lemma bertogna_edf_comp_iteration_preserves_order :
- forall l1 l2,
- all_le (initial_state ts) l1 ->
- all_le l1 l2 ->
- all_le (edf_rta_iteration l1) (edf_rta_iteration l2).
- Proof.
- rename H_valid_task_parameters into VALID.
- intros x1 x2 LEinit LE.
- move: LE => /andP [/eqP ZIP LE]; unfold all_le.
-
- assert (UNZIP': unzip1 (edf_rta_iteration x1) = unzip1 (edf_rta_iteration x2)).
- {
- by rewrite 2!edf_claimed_bounds_unzip1_update_bound.
- }
-
- apply/andP; split; first by rewrite UNZIP'.
- apply f_equal with (B := nat) (f := fun x => size x) in UNZIP'.
- rename UNZIP' into SIZE.
- rewrite size_map [size (unzip1 _)]size_map in SIZE.
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- destruct x1 as [| p0 x1'], x2 as [| p0' x2']; try (by ins).
- apply/(zipP p0 (fun x y => snd x <= snd y)); first by done.
-
- intros i LTi.
- exploit LE; first by rewrite 2!size_map in SIZE.
- {
- by rewrite size_zip 2!size_map -size_zip in LTi; apply LTi.
- }
- rewrite 2!size_map in SIZE.
- instantiate (1 := p0); intro LEi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map -SIZE minnn in LTi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map SIZE minnn in LTi.
- unfold update_bound, edf_response_time_bound; desf; simpl.
- rename s into tsk_i, s0 into tsk_i', t into R_i, t0 into R_i', Heq into EQ, Heq0 into EQ'.
- assert (EQtsk: tsk_i = tsk_i').
- {
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0']; simpl in H2; subst.
- have MAP := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0) :: x1').
- have MAP' := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0') :: x2').
- assert (FSTeq: fst (nth (tsk0', R0)((tsk0', R0) :: x1') i) =
- fst (nth (tsk0',R0) ((tsk0', R0') :: x2') i)).
- {
- rewrite -MAP;
- last by simpl; rewrite size_zip 2!size_map /= -H0 minnn in LTi.
- rewrite -MAP';
- last by simpl; rewrite size_zip 2!size_map /= H0 minnn in LTi.
- by f_equal; simpl; f_equal.
- }
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ.
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ'.
- by rewrite FSTeq EQ' /= in EQ; rewrite EQ.
- }
- subst tsk_i'; rewrite leq_add2l.
- unfold I, total_interference_bound_edf; apply leq_div2r.
- rewrite 2!big_cons.
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0'].
- simpl in H2; subst tsk0'.
- rename R_i into delta, R_i' into delta'.
- rewrite EQ EQ' in LEi; simpl in LEi.
- rename H0 into SIZE, H1 into UNZIP; clear EQ EQ'.
-
- assert (SUBST: forall l delta,
- \sum_(j <- l | let '(tsk_other, _) := j in
- different_task_in alpha tsk_i (alpha' tsk_i) tsk_other)
- (let '(tsk_other, R_other) := j in
- interference_bound_edf task_cost task_period task_deadline tsk_i delta
- (tsk_other, R_other)) =
- \sum_(j <- l | different_task_in alpha tsk_i (alpha' tsk_i) (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta j).
- {
- intros l x; clear -l.
- induction l; first by rewrite 2!big_nil.
- by rewrite 2!big_cons; rewrite IHl; desf; rewrite /= Heq in Heq0.
- } rewrite 2!SUBST; clear SUBST.
-
- assert (VALID': valid_sporadic_taskset task_cost task_period task_deadline
- (unzip1 ((tsk0, R0) :: x1'))).
- {
- move: LEinit => /andP [/eqP EQinit _].
- rewrite -EQinit; unfold valid_sporadic_taskset.
- move => tsk /mapP IN. destruct IN as [p INinit EQ]; subst.
- by move: INinit => /mapP INinit; destruct INinit as [tsk INtsk]; subst; apply VALID.
- }
-
- assert (GE_COST: all (fun p => task_cost (fst p) <= snd p) ((tsk0, R0) :: x1')).
- {
- clear LE; move: LEinit => /andP [/eqP UNZIP' LE].
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- specialize (LE (tsk0, R0)).
- apply/(all_nthP (tsk0,R0)).
- intros j LTj; generalize UNZIP'; simpl; intro SIZE'.
- have F := @f_equal _ _ size (unzip1 (initial_state ts)).
- apply F in SIZE'; clear F; rewrite /= 3!size_map in SIZE'.
- exploit LE; [by rewrite size_map /= | |].
- {
- rewrite size_zip size_map /= SIZE' minnn.
- by simpl in LTj; apply LTj.
- }
- clear LE; intro LE.
- unfold initial_state in LE.
- have MAP := @nth_map _ tsk0 _ (tsk0,R0).
- rewrite MAP /= in LE;
- [clear MAP | by rewrite SIZE'; simpl in LTj].
- apply leq_trans with (n := task_cost (nth tsk0 ts j));
- [apply eq_leq; f_equal | by done].
- have MAP := @nth_map _ (tsk0, R0) _ tsk0 (fun x => fst x).
- rewrite -MAP; [clear MAP | by done].
- unfold unzip1 in UNZIP'; rewrite -UNZIP'; f_equal.
- clear -ts; induction ts; [by done | by simpl; f_equal].
- }
- move: GE_COST => /allP GE_COST.
-
- assert (LESUM: \sum_(j <- x1' | different_task_in alpha tsk_i (alpha' tsk_i) (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta j <= \sum_(j <- x2' | different_task_in alpha tsk_i (alpha' tsk_i) (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta' j).
- {
- set elem := (tsk0, R0); rewrite 2!(big_nth elem).
- rewrite -SIZE.
- rewrite big_mkcond [\sum_(_ <- _ | different_task_in _ _ _ _)_]big_mkcond.
- rewrite big_seq_cond [\sum_(_ <- _ | true) _]big_seq_cond.
- apply leq_sum; intros j; rewrite andbT; intros INj.
- rewrite mem_iota add0n subn0 in INj; move: INj => /andP [_ INj].
- assert (FSTeq: fst (nth elem x1' j) = fst (nth elem x2' j)).
- {
- have MAP := @nth_map _ elem _ tsk0 (fun x => fst x).
- by rewrite -2?MAP -?SIZE //; f_equal.
- } rewrite -FSTeq.
- destruct (different_task_in alpha tsk_i (alpha' tsk_i) (fst (nth elem x1' j))) eqn:INTERF;
- last by done.
- {
- exploit (LE elem); [by rewrite /= SIZE | | intro LEj].
- {
- rewrite size_zip 2!size_map /= -SIZE minnn in LTi.
- by rewrite size_zip /= -SIZE minnn; apply (leq_ltn_trans INj).
- }
- simpl in LEj.
- exploit (VALID' (fst (nth elem x1' j))); last intro VALIDj.
- {
- apply/mapP; exists (nth elem x1' j); last by done.
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- exploit (GE_COST (nth elem x1' j)); last intro GE_COSTj.
- {
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- unfold is_valid_sporadic_task in *.
- destruct (nth elem x1' j) as [tsk_j R_j] eqn:SUBST1,
- (nth elem x2' j) as [tsk_j' R_j'] eqn:SUBST2.
- rewrite SUBST1 SUBST2 in LEj; clear SUBST1 SUBST2.
- simpl in FSTeq; rewrite -FSTeq; simpl in LEj; simpl in VALIDj; des.
- by apply interference_bound_edf_monotonic.
- }
- }
- destruct (different_task_in alpha tsk_i (alpha' tsk_i) tsk0) eqn:INTERFtsk0; last by done.
- apply leq_add; last by done.
- {
- exploit (LE (tsk0, R0)); [by rewrite /= SIZE | | intro LEj];
- first by instantiate (1 := 0); rewrite size_zip /= -SIZE minnn.
- exploit (VALID' tsk0); first by rewrite in_cons; apply/orP; left.
- exploit (GE_COST (tsk0, R0)); first by rewrite in_cons eq_refl orTb.
- unfold is_valid_sporadic_task; intros GE_COST0 VALID0; des; simpl in LEj.
- by apply interference_bound_edf_monotonic.
- }
- Qed.
-
- (* It follows from the properties above that the iteration is monotonically increasing. *)
- Lemma bertogna_edf_comp_iteration_monotonic: forall k, all_le (f k) (f k.+1).
- Proof.
- unfold f; intros k.
- apply fun_mon_iter_mon_generic with (x1 := k) (x2 := k.+1);
- try (by done);
- [ by apply all_le_reflexive
- | by apply all_le_transitive
- | by apply bertogna_edf_comp_iteration_preserves_order
- | by apply bertogna_edf_comp_iteration_preserves_minimum].
- Qed.
-
- End RelationProperties.
-
- (* Knowing that the iteration is monotonically increasing (with respect to all_le),
- we show that the RTA procedure converges to a fixed point. *)
-
- (* First, note that when there are no tasks, the iteration trivially converges. *)
- Lemma bertogna_edf_comp_f_converges_with_no_tasks :
- size ts = 0 ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- intro SIZE; destruct ts; last by inversion SIZE.
- unfold max_steps; rewrite big_nil /=.
- by unfold edf_rta_iteration.
- Qed.
-
- (* Otherwise, if the iteration reached a fixed point before (max_steps ts), then
- the value at (max_steps ts) is still at a fixed point. *)
- Lemma bertogna_edf_comp_f_converges_early :
- (exists k, k <= max_steps ts /\ f k = f k.+1) ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- by intros EX; des; apply (@fixedpoint.iter_fix _ _ _ k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume that there are tasks. *)
- Hypothesis H_at_least_one_task: size ts > 0.
-
- (* Assume that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps ts -> f k != f k.+1.
-
- (* Since the iteration is monotonically increasing, it must be
- strictly increasing. *)
- Lemma bertogna_edf_comp_f_increases :
- forall k,
- k <= max_steps ts -> one_lt (f k) (f k.+1).
- Proof.
- rename H_at_least_one_task into NONEMPTY.
- intros step LEstep; unfold one_lt; apply/andP; split;
- first by rewrite 2!edf_claimed_bounds_unzip1_iteration.
- rewrite -[has _ _]negbK; apply/negP; unfold not; intro ALL.
- rewrite -all_predC in ALL.
- move: ALL => /allP ALL.
- exploit (H_keeps_diverging step); [by done | intro DIFF].
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- }
- des; clear DUMMY.
- move: DIFF => /eqP DIFF; apply DIFF.
- apply eq_from_nth with (x0 := (tsk, 0));
- first by simpl; rewrite size_map.
- {
- intros i LTi.
- remember (nth (tsk, 0)(f step) i) as p_i;rewrite -Heqp_i.
- remember (nth (tsk, 0)(f step.+1) i) as p_i';rewrite -Heqp_i'.
- rename Heqp_i into EQ, Heqp_i' into EQ'.
- exploit (ALL (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- unfold predC; simpl; rewrite -ltnNge; intro LTp.
-
- have GROWS := bertogna_edf_comp_iteration_monotonic step.
- move: GROWS => /andP [_ /allP GROWS].
- exploit (GROWS (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- simpl; intros LE.
- destruct p_i as [tsk_i R_i], p_i' as [tsk_i' R_i'].
- simpl in *.
- assert (EQtsk: tsk_i = tsk_i').
- {
- unfold edf_rta_iteration in EQ'.
- rewrite (nth_map (tsk, 0)) in EQ'; last by done.
- by unfold update_bound in EQ'; desf.
- }
- rewrite EQtsk; f_equal.
- by apply/eqP; rewrite eqn_leq; apply/andP; split.
- }
- Qed.
-
- (* In the end, each response-time bound is so high that the sum
- of all response-time bounds exceeds the sum of all deadlines.
- Contradiction! *)
- Lemma bertogna_edf_comp_rt_grows_too_much :
- forall k,
- k <= max_steps ts ->
- \sum_((tsk, R) <- f k) (R - task_cost tsk) + 1 > k.
- Proof.
- have LT := bertogna_edf_comp_f_increases.
- have MONO := bertogna_edf_comp_iteration_monotonic.
- rename H_at_least_one_task into NONEMPTY.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_valid_task_parameters into VALID.
- intros step LE.
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- } destruct DUMMY as [elem _].
-
- induction step.
- {
- by rewrite addn1.
- }
- {
- rewrite -addn1 ltn_add2r.
- apply leq_ltn_trans with (n := \sum_(i <- f step) (let '(tsk, R) := i in R - task_cost tsk)).
- {
- rewrite -ltnS; rewrite addn1 in IHstep.
- by apply IHstep, ltnW.
- }
- rewrite (eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- rewrite [\sum_(_ <- f step.+1)_](eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- unfold f at 2; rewrite iterS.
- rewrite big_map; fold (f step).
- rewrite -(ltn_add2r (\sum_(i <- f step) task_cost (fst i))).
- rewrite -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun i => snd i)); last first.
- {
- intro i; rewrite andbT; intro IN;
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts step.
- by destruct i; apply GE_COST.
- }
- rewrite [\sum_(_ <- _ | _)(_ - _ + _)](eq_bigr (fun i => snd (update_bound (f step) i))); last first.
- {
- intro i; rewrite andbT; intro IN.
- unfold update_bound; destruct i; simpl.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- apply (edf_claimed_bounds_ge_cost ts step.+1).
- by rewrite iterS; apply/mapP; exists (s, t).
- }
- rewrite -2!big_seq_cond.
-
- specialize (LT step (ltnW LE)).
- specialize (MONO step).
- move: LT => /andP [_ LT]; move: LT => /hasP LT.
- destruct LT as [[x1 x2] INzip LT]; simpl in *.
- move: MONO => /andP [_ /(zipP _ (fun x y => snd x <= snd y)) MONO].
- rewrite 2!(big_nth (elem, 0)).
- apply mem_zip_exists with (elem := (elem, 0)) (elem' := (elem, 0)) in INzip; des;
- last by rewrite size_map.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite -addn1 -addnA; apply leq_add.
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0)); [by rewrite size_map | | intro LEi].
- {
- rewrite size_zip; apply (ltn_trans LT2).
- by apply leq_trans with (n := size (f step));
- [by done | by rewrite size_map minnn].
- }
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi;
- last by apply (ltn_trans LT2).
- }
- rewrite -addnA [_ + 1]addnC addnA; apply leq_add.
- {
- unfold edf_rta_iteration in INzip2; rewrite addn1.
- rewrite -> nth_map with (x1 := (elem, 0)) in INzip2; last by done.
- by rewrite -INzip2 -INzip1.
- }
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0));
- [ by rewrite size_map
- | by rewrite size_zip; apply (leq_trans LT2); rewrite size_map minnn | intro LEi ].
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi; last by done.
- }
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove that edf_rta_iteration reaches
- a fixed point after (max_steps ts) step, ... *)
- Lemma edf_claimed_bounds_finds_fixed_point_of_list :
- forall rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- valid_sporadic_taskset task_cost task_period task_deadline ts ->
- f (max_steps ts) = edf_rta_iteration (f (max_steps ts)).
- Proof.
- intros rt_bounds SOME VALID.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- unfold edf_claimed_bounds in SOME; desf.
- rename Heq into LE.
- fold (f (max_steps ts)) in *; fold (f (max_steps ts).+1).
-
- (* Either the task set is empty or not. *)
- destruct (size ts == 0) eqn:EMPTY;
- first by apply bertogna_edf_comp_f_converges_with_no_tasks; apply/eqP.
- apply negbT in EMPTY; rewrite -lt0n in EMPTY.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_((max_steps ts).+1), f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- destruct k as [k LTk]; simpl in ITERk.
- apply bertogna_edf_comp_f_converges_early.
- exists k; split; [by apply LTk | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
-
- assert (SAMESUM: \sum_(tsk <- ts) task_cost tsk = \sum_(p <- f (max_steps ts)) task_cost (fst p)).
- {
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_cost x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- by rewrite UNZIP in MAP; rewrite MAP.
- }
-
- (* Show that the sum is less than the sum of all deadlines. *)
- assert (SUM: \sum_(p <- f (max_steps ts)) (snd p - task_cost (fst p)) + 1 <= max_steps ts).
- {
- unfold max_steps at 2; rewrite leq_add2r.
- rewrite -(leq_add2r (\sum_(tsk <- ts) task_cost tsk)).
- rewrite {1}SAMESUM -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun x => snd x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts (max_steps ts).
- fold (f (max_steps ts)) in GE_COST.
- by destruct i; apply GE_COST.
- }
- rewrite (eq_bigr (fun x => task_deadline x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- by specialize (VALID i IN); des.
- }
- rewrite -2!big_seq_cond.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_deadline x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- rewrite UNZIP in MAP; rewrite MAP.
- rewrite big_seq_cond [\sum_(_ <- _|true)_]big_seq_cond.
- apply leq_sum; intro i; rewrite andbT; intro IN.
- move: LE => /allP LE; unfold R_le_deadline in LE.
- by specialize (LE i IN); destruct i.
- }
-
- have TOOMUCH :=
- bertogna_edf_comp_rt_grows_too_much EMPTY _ (max_steps ts) (leqnn (max_steps ts)).
- exploit TOOMUCH; [| intro BUG].
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | by ins].
- }
- rewrite (eq_bigr (fun i => snd i - task_cost (fst i))) in BUG;
- last by ins; destruct i.
- by apply (leq_ltn_trans SUM) in BUG; rewrite ltnn in BUG.
- Qed.
-
- (* ...and since there cannot be a vector of response-time bounds with values less than
- the task costs, this solution is also the least fixed point. *)
- Lemma edf_claimed_bounds_finds_least_fixed_point :
- forall v,
- all_le (initial_state ts) v ->
- v = edf_rta_iteration v ->
- all_le (f (max_steps ts)) v.
- Proof.
- intros v GE0 EQ.
- apply bertogna_edf_comp_iteration_inductive; first by done.
- intros k GEk.
- rewrite EQ.
- apply bertogna_edf_comp_iteration_preserves_order; last by done.
- by apply bertogna_edf_comp_iteration_preserves_minimum.
- Qed.
-
-
- (* Therefore, with regard to the response-time bound recurrence,
- the individual response-time bounds (elements of the list) are
- also fixed points. *)
- Theorem edf_claimed_bounds_finds_fixed_point_for_each_bound :
- forall tsk R rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R = edf_response_time_bound rt_bounds tsk R.
- Proof.
- intros tsk R rt_bounds SOME IN.
- have CONV := edf_claimed_bounds_finds_fixed_point_of_list rt_bounds.
- rewrite -iterS in CONV; fold (f (max_steps ts).+1) in CONV.
- unfold edf_claimed_bounds in *; desf.
- exploit (CONV); [by done | by done | intro ITER; clear CONV].
- unfold f in ITER.
-
- cut (update_bound (iter (max_steps ts)
- edf_rta_iteration (initial_state ts)) (tsk,R) = (tsk, R)).
- {
- intros EQ.
- have F := @f_equal _ _ (fun x => snd x) _ (tsk, R).
- by apply F in EQ; simpl in EQ.
- }
- set s := iter (max_steps ts) edf_rta_iteration (initial_state ts).
- fold s in ITER, IN.
- move: IN => /(nthP (tsk,0)) IN; destruct IN as [i LT EQ].
- generalize EQ; rewrite ITER iterS in EQ; intro EQ'.
- fold s in EQ.
- unfold edf_rta_iteration in EQ.
- have MAP := @nth_map _ (tsk,0) _ _ (update_bound s).
- by rewrite MAP // EQ' in EQ; rewrite EQ.
- Qed.
-
- End Convergence.
-
- (* Now we prove the correctness of the response-time bounds. *)
- Section MainProof.
-
- (* Consider a task set ts where... *)
- Variable ts: taskset_of sporadic_task.
-
- (* ... all tasks have valid parameters ... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ... and constrained deadlines. *)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Assume that alpha' is a non-empty subaffinity of alpha. *)
- Hypothesis H_non_empty_affinity:
- forall tsk, tsk \in ts -> #|alpha' tsk| > 0.
- Hypothesis H_subaffinity:
- forall tsk, tsk \in ts -> is_subaffinity (alpha' tsk) (alpha tsk).
-
- (* Next, consider any arrival sequence such that...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...they have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any schedule with at least one CPU such that...*)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after they arrived and no longer
- than their execution costs,... *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* ...and jobs are sequential. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assume a work-conserving APA scheduler that respects EDF policy. *)
- Hypothesis H_respects_affinity: respects_affinity job_task sched alpha.
- Hypothesis H_work_conserving: apa_work_conserving job_arrival job_cost job_task arr_seq
- sched alpha.
- Hypothesis H_edf_policy:
- respects_JLFP_policy_under_weak_APA job_arrival job_cost job_task
- arr_seq sched alpha (EDF job_arrival job_deadline).
-
- (* To avoid a long list of parameters, we provide some local definitions. *)
- Definition no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Definition no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in edf_claimed_bounds is safe. The proof follows by direct application of
- the main Theorem from bertogna_edf_theory.v. *)
- Theorem edf_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In edf_claimed_bounds ts ->
- response_time_bounded_by tsk R.
- Proof.
- have BOUND := bertogna_cirinei_response_time_bound_edf.
- intros tsk R IN j ARRj JOBj.
- destruct (edf_claimed_bounds ts) as [rt_bounds |] eqn:SOME; last by done.
- unfold edf_rta_iteration in *.
- unfold is_response_time_bound_of_task in *.
- apply BOUND with (task_cost := task_cost) (task_period := task_period)
- (arr_seq := arr_seq) (task_deadline := task_deadline) (job_deadline := job_deadline)
- (job_task := job_task) (ts := ts) (tsk := tsk) (rt_bounds := rt_bounds) (alpha := alpha) (alpha' := alpha'); try (by ins).
- by unfold edf_claimed_bounds in SOME; desf; rewrite edf_claimed_bounds_unzip1_iteration.
- by ins; apply edf_claimed_bounds_finds_fixed_point_for_each_bound with (ts := ts).
- by ins; rewrite (edf_claimed_bounds_le_deadline ts rt_bounds).
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: edf_schedulable ts.
-
- (*... no task misses its deadline. *)
- Theorem taskset_schedulable_by_edf_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (edf_analysis_yields_response_time_bounds).
- have DL := (edf_claimed_bounds_le_deadline ts).
- have HAS := (edf_claimed_bounds_has_R_for_every_task ts).
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- edf_schedulable,
- valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS.
- intros tsk INtsk j ARRj JOBtsk.
- destruct (edf_claimed_bounds ts) as [rt_bounds |] eqn:SOME; last by ins.
- exploit (HAS rt_bounds tsk); [by ins | by ins | clear HAS; intro HAS; des].
- have COMPLETED := RLIST tsk R HAS j ARRj JOBtsk.
- exploit (DL rt_bounds tsk R);
- [by ins | by ins | clear DL; intro DL].
- apply leq_trans with (n := service sched j (job_arrival j + R)); last first.
- {
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- apply extend_sum; rewrite // leq_add2l.
- specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS1.
- by rewrite JOBtsk.
- }
- by done.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we conclude that no job misses
- its deadline. *)
- Theorem jobs_schedulable_by_edf_rta :
- forall j, arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_edf_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationEDF.
diff --git a/classic/analysis/apa/bertogna_edf_theory.v b/classic/analysis/apa/bertogna_edf_theory.v
deleted file mode 100644
index 47da1d50962402f0ca7eec2f8b084136179ba63a..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/bertogna_edf_theory.v
+++ /dev/null
@@ -1,1035 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.response_time
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.platform prosa.classic.model.schedule.apa.interference
- prosa.classic.model.schedule.apa.affinity prosa.classic.model.schedule.apa.constrained_deadlines.
-Require Import prosa.classic.analysis.apa.workload_bound prosa.classic.analysis.apa.interference_bound_edf.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisEDF.
-
- Export Job SporadicTaskset ScheduleOfSporadicTask Workload Schedulability ResponseTime
- Priority TaskArrival WorkloadBound InterferenceBoundEDF
- Interference Platform Affinity ConstrainedDeadlines.
-
- (* In this section, we prove that any fixed point in the APA-reduction of
- Bertogna and Cirinei's RTA for EDF scheduling is a safe response-time bound.
- This result corresponds to Lemma 10 in the revised version of the APA paper:
- http://www.mpi-sws.org/~bbb/papers/pdf/ecrts13a-rev1.pdf *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider a task set ts where all tasks have valid parameters
- and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and assume that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Also assume that every task has a non-empty processor affinity alpha. *)
- Context {num_cpus: nat}.
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Next, consider any schedule such that...*)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs are sequential and do not execute before their
- arrival times nor longer than their execution costs. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule is an work-conserving APA schedule that
- respects EDF priorities. *)
- Hypothesis H_respects_affinity: respects_affinity job_task sched alpha.
- Hypothesis H_work_conserving: apa_work_conserving job_arrival job_cost job_task arr_seq
- sched alpha.
- Hypothesis H_edf_policy:
- respects_JLFP_policy_under_weak_APA job_arrival job_cost job_task arr_seq
- sched alpha (EDF job_arrival job_deadline).
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Now we consider the response-time recurrence. In the computation of
- the response-time bound, we assume that each task under analysis has
- a non-empty subaffinity alpha'.
- Note that the notation #|...| expresses the cardinality of the set. *)
- Variable alpha': task_affinity sporadic_task num_cpus.
- Hypothesis H_affinity_subset: forall tsk, tsk \in ts -> is_subaffinity (alpha' tsk) (alpha tsk).
- Hypothesis H_at_least_one_cpu : forall tsk, tsk \in ts -> #|alpha' tsk| > 0.
-
- (* Assume that a response-time bound R is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable rt_bounds: seq task_with_response_time.
-
- (* ...for any task in the task set, ... *)
- Hypothesis H_rt_bounds_contains_all_tasks: unzip1 rt_bounds = ts.
-
- (* ... where R is a fixed-point of the response-time recurrence (with
- alpha' as the reduced affinity mask), ... *)
- Let I (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline alpha
- tsk (alpha' tsk) rt_bounds delta.
- Hypothesis H_response_time_is_fixed_point :
- forall tsk R,
- (tsk, R) \in rt_bounds ->
- R = task_cost tsk + div_floor (I tsk R) #|alpha' tsk|.
-
- (* ..., and R is no larger than the deadline. *)
- Hypothesis H_tasks_miss_no_deadlines:
- forall tsk R,
- (tsk, R) \in rt_bounds -> R <= task_deadline tsk.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Consider any job j of tsk ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* ... that did not complete on time, ... *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (job_arrival j + R).
-
- (* ... and that is the first job not to satisfy its response-time bound. *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_other tsk_other R_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- (tsk_other, R_other) \in rt_bounds ->
- job_arrival j_other + R_other < job_arrival j + R ->
- completed job_cost sched j_other (job_arrival j_other + R_other).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task sched alpha j
- tsk_other (job_arrival j) (job_arrival j + R).
-
- (* and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost sched j (job_arrival j) (job_arrival j + R).
-
- (* Recall Bertogna and Cirinei's workload bound ... *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W task_cost task_period tsk_other R_other R.
-
- (*... and the EDF-specific bound, ... *)
- Let edf_specific_bound (tsk_other: sporadic_task) (R_other: time) :=
- edf_specific_interference_bound task_cost task_period task_deadline tsk tsk_other R_other.
-
- (* ... which combined form the interference bound. *)
- Let interference_bound (tsk_other: sporadic_task) (R_other: time) :=
- interference_bound_edf task_cost task_period task_deadline tsk R (tsk_other, R_other).
-
- (* Based on the definition of a different task in subaffinity alpha', ... *)
- Let other_task_in alpha' := different_task_in alpha tsk alpha'.
-
- (* ...let (other_tasks_in alpha') denote the set of tasks that are different from tsk
- and that can be scheduled on subaffinity alpha'. *)
- Let other_tasks_in alpha' :=
- [seq tsk_other <- ts | other_task_in (alpha' tsk) tsk_other].
-
- (* Now we establish results the interfering tasks. *)
- Section LemmasAboutInterferingTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task and
- response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_response_time_of_tsk_other: (tsk_other, R_other) \in rt_bounds.
-
- (* Note that tsk_other is in the task set, ...*)
- Lemma bertogna_edf_tsk_other_in_ts: tsk_other \in ts.
- Proof.
- by rewrite set_mem -H_rt_bounds_contains_all_tasks; apply/mapP; exists (tsk_other, R_other).
- Qed.
-
- (* ... and R_other is larger than the cost of tsk_other. *)
- Lemma bertogna_edf_R_other_ge_cost :
- R_other >= task_cost tsk_other.
- Proof.
- by rewrite [R_other](H_response_time_is_fixed_point tsk_other);
- first by apply leq_addr.
- Qed.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_edf_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_all_previous_jobs_completed_on_time into BEFOREok,
- H_valid_job_parameters into PARAMS,
- H_valid_task_parameters into TASK_PARAMS,
- H_constrained_deadlines into RESTR,
- H_tasks_miss_no_deadlines into NOMISS.
- unfold x, task_interference.
- have INts := bertogna_edf_tsk_other_in_ts.
- apply leq_trans with (n := workload job_task sched tsk_other
- (job_arrival j) (job_arrival j + R));
- first by apply task_interference_le_workload.
- by ((try ( apply workload_bounded_by_W with (task_deadline0 := task_deadline)
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq)
- (job_cost0 := job_cost) (job_deadline0 := job_deadline)) ||
- apply workload_bounded_by_W with (task_deadline := task_deadline)
- (job_arrival := job_arrival) (arr_seq := arr_seq)
- (job_cost := job_cost) (job_deadline := job_deadline)); try (by ins); last 2 first;
- [ by apply bertogna_edf_R_other_ge_cost
- | by ins; apply NOMISS
- | by ins; apply TASK_PARAMS
- | by ins; apply RESTR
- | by ins; apply BEFOREok with (tsk_other := tsk_other)]).
- Qed.
-
- (* Recall that the edf-specific interference bound also holds for tsk_other. *)
- Lemma bertogna_edf_specific_bound_holds :
- x tsk_other <= edf_specific_bound tsk_other R_other.
- Proof.
- (try ( apply interference_bound_edf_bounds_interference with
- (job_deadline0 := job_deadline)
- (arr_seq0 := arr_seq) (ts0 := ts) ) ||
- apply interference_bound_edf_bounds_interference with
- (job_deadline := job_deadline)
- (arr_seq := arr_seq) (ts := ts)); try (by done);
- [ by apply bertogna_edf_tsk_other_in_ts |
- by apply H_tasks_miss_no_deadlines | ].
- by ins; apply H_all_previous_jobs_completed_on_time with (tsk_other := tsk_other).
- Qed.
-
- End LemmasAboutInterferingTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X exceeds R - e_k + 1. *)
- Lemma bertogna_edf_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS, H_response_time_is_fixed_point into REC,
- H_job_of_tsk into JOBtsk, H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite [R](REC tsk) // leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
- apply leq_ltn_trans with (n := (\sum_(job_arrival j <= t < job_arrival j + R)
- backlogged job_arrival job_cost sched j t) +
- service sched j (job_arrival j + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_j_arrives); des; rewrite -JOBtsk.
- }
- unfold service; rewrite service_before_arrival_eq_service_during //.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(job_arrival j <= i < job_arrival j + R) 1);
- first by rewrite big_const_nat iter_addn mul1n addn0 addKn.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [GEi LTi] _].
- destruct (backlogged job_arrival job_cost sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* 1) Next, we prove that during the scheduling window of j, any job that is
- scheduled while j is backlogged comes from a different task.
- This follows from the fact that j is the first job not to complete
- by its response-time bound, so previous jobs of j's task must have
- completed by their periods and cannot be pending. *)
- Lemma bertogna_edf_interference_by_different_tasks :
- forall t j_other,
- job_arrival j <= t < job_arrival j + R ->
- arrives_in arr_seq j_other ->
- backlogged job_arrival job_cost sched j t ->
- scheduled sched j_other t ->
- job_task j_other != tsk.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_constrained_deadlines into RESTR.
- move => t j_other /andP [LEt GEt] ARRother BACK SCHED.
- apply/eqP; red; intro SAMEtsk.
- move: SCHED => /existsP [cpu SCHED].
- assert (SCHED': scheduled sched j_other t).
- by apply/existsP; exists cpu.
- clear SCHED; rename SCHED' into SCHED.
- move: (SCHED) => PENDING.
- (try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival) (job_cost0 := job_cost)
- in PENDING ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival) (job_cost := job_cost)
- in PENDING); try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- move: (BEFOREother) => LT; rewrite -(ltn_add2r R) in LT.
- specialize (BEFOREok j_other tsk R ARRother SAMEtsk INbounds LT).
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- (try ( apply completion_monotonic with (t0 := job_arrival j_other + R)) ||
- apply completion_monotonic with (t := job_arrival j_other + R)); try (by done).
- apply leq_trans with (n := job_arrival j); last by done.
- apply leq_trans with (n := job_arrival j_other + task_deadline tsk);
- first by rewrite leq_add2l; apply NOMISS.
- apply leq_trans with (n := job_arrival j_other + task_period tsk);
- first by rewrite leq_add2l; apply RESTR; rewrite -JOBtsk FROMTS.
- rewrite -SAMEtsk; apply SPO; try (by done); [ | by rewrite JOBtsk | by apply ltnW].
- by red; intro EQ; subst; rewrite ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge.
- apply leq_ltn_trans with (n := t); first by done.
- apply leq_trans with (n := job_arrival j + R); first by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by rewrite JOBtsk RESTR // -JOBtsk FROMTS].
- }
- by red; intros EQtsk; subst; rewrite /backlogged SCHED andbF in BACK.
- }
- Qed.
-
- (* 2) In order to use the lemmas in constrained_deadlines.v, we show that
- all jobs released before the end of the interval complete by their
- periods. This follows trivially from the hypothesis that all jobs
- before (job_arrival j + R) complete by their response-time bounds.
- With this lemma, we can conclude that during job j's scheduling
- window there cannot be multiple pending jobs of each task.*)
- Lemma bertogna_edf_all_previous_jobs_complete_by_their_period:
- forall t j0,
- arrives_in arr_seq j0 ->
- t < job_arrival j + R ->
- job_arrival j0 + task_period (job_task j0) <= t ->
- completed job_cost sched j0
- (job_arrival j0 + task_period (job_task j0)).
- Proof.
- rename H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into CONSTR,
- H_tasks_miss_no_deadlines into NOMISS,
- H_all_jobs_from_taskset into FROMTS,
- H_all_previous_jobs_completed_on_time into BEFOREok.
- intros t j0 ARR0 LEt LE.
- cut ((job_task j0) \in unzip1 rt_bounds = true); last by rewrite UNZIP FROMTS.
- move => /mapP [p IN EQ]; destruct p as [tsk' R0]; simpl in *; subst tsk'.
- try ( apply completion_monotonic with (t0 := job_arrival j0 + R0) ) ||
- apply completion_monotonic with (t := job_arrival j0 + R0).
- {
- rewrite leq_add2l; apply leq_trans with (n := task_deadline (job_task j0));
- [by apply NOMISS | by apply CONSTR; rewrite FROMTS].
- }
- apply BEFOREok with (tsk_other := (job_task j0)); try by done.
- apply leq_ltn_trans with (n := t); last by done.
- apply leq_trans with (n := job_arrival j0 + task_period (job_task j0)); last by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline (job_task j0));
- [by apply NOMISS | apply CONSTR; rewrite FROMTS].
- Qed.
-
- (* 3) Next, we prove that the sum of the interference of each task is equal to the
- total interference multiplied by the number of processors in tsk's *actual*
- affinity. This holds because interference only occurs when all processors in
- the affinity are busy.
- With this lemma we can relate per-task interference with the total interference
- incurred by j (backlogged time). *)
- Lemma bertogna_edf_all_cpus_in_affinity_busy :
- \sum_(tsk_k <- other_tasks_in alpha) x tsk_k = X * #|alpha tsk|.
- Proof.
- have DIFFTASK := bertogna_edf_interference_by_different_tasks.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into RESTR,
- H_respects_affinity into APA.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last first.
- {
- rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- by intros i _; rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- }
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus | cpu \in alpha tsk) 1);
- last by rewrite sum1_card.
- rewrite [\sum_(_ < _ | _) 1]big_mkcond /=.
- apply eq_bigr; intros cpu _.
- unfold can_execute_on in *.
- destruct (cpu \in alpha (job_task j)) eqn:ALPHA; rewrite -?JOBtsk ALPHA;
- last by rewrite big_filter (eq_bigr (fun x => 0));
- [by simpl_sum_const | by ins].
- move: (WORK j t H_j_arrives BACK cpu ALPHA) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- have ARRother: arrives_in arr_seq j_other.
- by apply (FROMSEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- rewrite big_const_seq iter_addn mul0n 2!addn0; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- unfold different_task_in, affinity_intersects.
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu; rewrite -JOBtsk ALPHA andTb.
- by apply APA with (t := t); apply/eqP.
- }
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu; apply/eqP.
- Qed.
-
- (* 4) Recall that the reduction-based analysis considers only the interfering tasks
- within subaffinity (alpha' tsk), as opposed to (alpha tsk). Therefore, we must
- reason about the task interference wihin (alpha' tsk).
- We begin by showing that the cumulative interference within (alpha' tsk) is at
- least the total interference multiplied by the number of processors in (alpha' tsk). *)
- Lemma bertogna_edf_all_cpus_in_subaffinity_busy :
- \sum_(tsk_k <- other_tasks_in alpha') x tsk_k >= X * #|alpha' tsk|.
- Proof.
- have DIFFTASK := bertogna_edf_interference_by_different_tasks.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into RESTR,
- H_respects_affinity into APA, H_affinity_subset into SUB.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond /=.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last first.
- {
- rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- by intros i _; rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- }
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply leq_trans with (n := \sum_(cpu < num_cpus | cpu \in alpha' tsk) 1);
- first by rewrite sum1_card.
- rewrite [\sum_(_ < _ | _) 1]big_mkcond /=.
- apply leq_sum; intros cpu _.
- unfold can_execute_on in *.
- destruct (cpu \in alpha' (job_task j)) eqn:ALPHA'; rewrite -?JOBtsk ALPHA';
- last by done.
- feed (SUB (job_task j)); first by apply FROMTS.
- specialize (SUB cpu ALPHA').
- move: (WORK j t H_j_arrives BACK cpu SUB) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- have ARRother: arrives_in arr_seq j_other.
- by apply (H_jobs_come_from_arrival_sequence j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite (bigD1_seq (job_task j_other)) /=; last by apply filter_uniq; destruct ts.
- {
- by rewrite {1}/task_scheduled_on SUB SCHED eq_refl andTb.
- }
- {
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu; apply/andP; split; first by rewrite -JOBtsk.
- by apply APA with (t := t); apply/eqP.
- }
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu; apply/eqP.
- }
- Qed.
-
- (* Let's define a predicate for whether a task is scheduled on (alpha tsk). *)
- Let scheduled_on_alpha_tsk := fun t tsk_k =>
- task_scheduled_on_affinity job_task sched (alpha tsk) tsk_k t.
-
- (* 5) Now we prove that, at all times that j is backlogged, the number
- of tasks whose affinity intersects (alpha' tsk) that are in fact
- scheduled on (alpha' tsk) is at least the size of (alpha' tsk).
- This is required to prove lemma (6). *)
- Lemma bertogna_edf_alpha'_is_full:
- forall t,
- job_arrival j <= t < job_arrival j + R ->
- backlogged job_arrival job_cost sched j t ->
- count (scheduled_on_alpha_tsk t) (other_tasks_in alpha') >= #|alpha' tsk|.
- Proof.
- have COMP := bertogna_edf_all_previous_jobs_complete_by_their_period.
- rename H_work_conserving into WORK, H_respects_affinity into APA,
- H_affinity_subset into SUB, H_job_of_tsk into JOBtsk,
- H_all_jobs_from_taskset into FROMTS, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_valid_task_parameters into PARAMS,
- H_sequential_jobs into SEQ.
- move => t /andP [GEt LTt] BACK.
- move: WORK => WORK.
- specialize (WORK j t H_j_arrives BACK).
- rewrite -size_filter.
- apply leq_trans with (n := size (alpha' tsk));
- first by apply card_size.
- apply leq_trans with (n := size (pmap (fun cpu => sched cpu t) (enum (alpha' tsk)))).
- {
- rewrite size_pmap -size_filter.
- apply uniq_leq_size; first by destruct (alpha' tsk).
- intros cpu IN.
- rewrite mem_filter; apply/andP; split; last by rewrite mem_enum.
- feed (WORK cpu); first by apply SUB; rewrite ?FROMTS ?JOBtsk.
- by move: WORK => [j_other /eqP SCHED]; rewrite SCHED.
- }
- {
- apply leq_trans with (n := size (map (fun j => job_task j) (pmap (fun cpu => sched cpu t) (enum (alpha' tsk)))));
- first by rewrite size_map.
- apply uniq_leq_size.
- {
- rewrite map_inj_in_uniq.
- {
- apply pmap_inj_in_uniq; last by apply enum_uniq.
- intros cpu1 cpu2 IN1 IN2 SCHED2.
- destruct (sched cpu1 t) as [j0|] eqn:SCHED1; symmetry in SCHED2;
- first by apply SEQ with (j := j0) (t := t).
- rewrite 2!mem_enum in IN1 IN2.
- exploit (WORK cpu1); first by apply SUB; rewrite ?FROMTS ?JOBtsk.
- by move => [j_other SCHED]; rewrite /scheduled_on SCHED1 in SCHED.
- }
- {
- intros j1 j2 SCHED1 SCHED2 SAMEtsk.
- rewrite 2!mem_pmap in SCHED1 SCHED2.
- move: SCHED1 SCHED2 => /mapP [cpu1 IN1 SCHED1] /mapP [cpu2 IN2 SCHED2].
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu1; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu2; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu1; rewrite /scheduled_on -SCHED1.
- }
- assert (SCHED2': pending job_arrival job_cost sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu2; rewrite /scheduled_on -SCHED2.
- }
- ( try ( apply platform_at_most_one_pending_job_of_each_task with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (tsk0 := tsk)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) (j0 := j) (t0 := t)
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq) ) ||
- apply platform_at_most_one_pending_job_of_each_task with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (tsk := tsk)
- (job_cost := job_cost) (job_task := job_task) (sched := sched) (j := j) (t := t)
- (job_arrival := job_arrival) (arr_seq := arr_seq) );
- rewrite ?JOBtsk ?SAMEtsk //; first by apply PARAMS; rewrite -JOBtsk FROMTS.
- intros j0 tsk0 ARR0 TSK0 LE.
- by apply (COMP t); rewrite ?TSK0.
- }
- }
- {
- move => tsk' /mapP [j' IN EQtsk'].
- rewrite mem_pmap in IN.
- move: IN => /mapP [cpu INcpu SCHED'].
- rewrite mem_enum in INcpu.
- rewrite mem_filter; apply/andP; split.
- {
- apply/existsP; exists cpu; apply/andP; split;
- first by apply SUB; rewrite -?JOBtsk ?FROMTS ?JOBtsk.
- by rewrite /task_scheduled_on -SCHED' EQtsk'.
- }
- have ARR': arrives_in arr_seq j'.
- by apply (FROMSEQ j' t); apply/existsP; exists cpu; apply/eqP.
- rewrite EQtsk' mem_filter; apply/andP; split; last by apply FROMTS.
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu; apply/andP; split; first by done.
- by apply APA with (t := t); rewrite /scheduled_on SCHED'.
- }
- {
- apply/eqP; intro SAMEtsk.
- move: BACK => /andP [PENDING NOTSCHED].
- assert (SCHEDULED': scheduled sched j' t).
- {
- by apply/existsP; exists cpu; rewrite /scheduled_on -SCHED'.
- }
- move: (SCHEDULED') => PENDING'.
- ( try ( apply scheduled_implies_pending with (job_cost0 := job_cost) (job_arrival0:=job_arrival)
- in PENDING' ) ||
- apply scheduled_implies_pending with (job_cost := job_cost) (job_arrival:=job_arrival)
- in PENDING' ); try by done.
- assert (BUG: j = j').
- {
- (try ( apply platform_at_most_one_pending_job_of_each_task with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (tsk0 := tsk)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) (j0 := j) (t0 := t)
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq) ) ||
- apply platform_at_most_one_pending_job_of_each_task with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (tsk := tsk)
- (job_cost := job_cost) (job_task := job_task) (sched := sched) (j := j) (t := t)
- (job_arrival := job_arrival) (arr_seq := arr_seq));
- rewrite ?JOBtsk ?SAMEtsk //; first by apply PARAMS; rewrite -JOBtsk FROMTS.
- intros j0 tsk0 ARR0 TSK0 LE.
- by apply (COMP t); rewrite ?TSK0.
- }
- by rewrite BUG SCHEDULED' in NOTSCHED.
- }
- }
- }
- Qed.
-
- (* Before stating the next lemma, let (num_tasks_exceeding delta) be the
- number of interfering tasks that can execute on (alpha' tsk) whose
- interference x is larger than delta. *)
- Let num_tasks_exceeding delta := count (fun i => x i >= delta) (other_tasks_in alpha').
-
- (* 6) Now we prove that, for any delta, if (num_task_exceeding delta > 0), then the
- cumulative interference caused by the complementary set of interfering tasks fills
- the remaining, not-completely-full (#|alpha' tsk| - num_tasks_exceeding delta)
- processors. *)
- Lemma bertogna_edf_interference_in_non_full_processors :
- forall delta,
- 0 < num_tasks_exceeding delta < #|alpha' tsk| ->
- \sum_(i <- other_tasks_in alpha' | x i < delta) x i >= delta * (#|alpha' tsk| - num_tasks_exceeding delta).
- Proof.
- have COMP := bertogna_edf_all_previous_jobs_complete_by_their_period.
- have ATMOST := platform_at_most_one_pending_job_of_each_task.
- have INV := bertogna_edf_alpha'_is_full.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_sporadic_tasks into SPO,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_constrained_deadlines into RESTR,
- H_sequential_jobs into SEQ.
- unfold sporadic_task_model in *.
- move => delta /andP [HAS LT].
- rewrite -has_count in HAS.
-
- set some_interference_A := fun t =>
- has (fun tsk_k => backlogged job_arrival job_cost sched j t &&
- (x tsk_k >= delta) &&
- scheduled_on_alpha_tsk t tsk_k)
- (other_tasks_in alpha').
- set total_interference_B := fun t =>
- backlogged job_arrival job_cost sched j t *
- count (fun tsk_k => (x tsk_k < delta) &&
- scheduled_on_alpha_tsk t tsk_k) (other_tasks_in alpha').
-
- apply leq_trans with ((\sum_(job_arrival j <= t < job_arrival j + R)
- some_interference_A t) * (#|alpha' tsk| - num_tasks_exceeding delta)).
- {
- rewrite leq_mul2r; apply/orP; right.
- move: HAS => /hasP HAS; destruct HAS as [tsk_a INa LEa].
- apply leq_trans with (n := x tsk_a); first by apply LEa.
- unfold x, task_interference, some_interference_A.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- last by rewrite (eq_bigr (fun x => 0)); [by simpl_sum_const | by ins].
- destruct ([exists cpu, can_execute_on alpha (job_task j) cpu &&
- task_scheduled_on job_task sched tsk_a cpu t]) eqn:SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED; move: SCHED => /forallP ALL.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (ALL cpu); apply negbTE in ALL; rewrite ALL.
- }
- move: SCHED => /existsP [cpu /andP [CAN SCHED]].
- apply leq_trans with (n := 1); last first.
- {
- rewrite lt0b; apply/hasP; exists tsk_a; first by done.
- rewrite LEa 2!andTb; apply/existsP; exists cpu.
- by apply/andP; split; first by rewrite -JOBtsk.
- }
- rewrite (bigD1 cpu) /= // SCHED.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const; rewrite leq_b1.
- intros cpu' DIFF.
- apply/eqP; rewrite eqb0; apply/negP.
- move => /andP [ALPHA' SCHED'].
- move: DIFF => /negP DIFF; apply DIFF; apply/eqP.
- unfold task_scheduled_on in *.
- destruct (sched cpu t) as [j1|] eqn:SCHED1; last by done.
- destruct (sched cpu' t) as [j2|] eqn:SCHED2; last by done.
- move: SCHED SCHED' => /eqP JOB /eqP JOB'.
- subst tsk_a; symmetry in JOB'.
- assert (BUG: j1 = j2).
- {
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu'; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu; rewrite /scheduled_on -SCHED1.
- }
- assert (SCHED2': pending job_arrival job_cost sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu'; rewrite /scheduled_on -SCHED2.
- }
- ( try ( apply platform_at_most_one_pending_job_of_each_task with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (tsk0 := tsk)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) (j0 := j) (t0 := t)
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq);
- rewrite ?JOBtsk ?SAMEtsk // ) ||
- apply platform_at_most_one_pending_job_of_each_task with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (tsk := tsk)
- (job_cost := job_cost) (job_task := job_task) (sched := sched) (j := j) (t := t)
- (job_arrival := job_arrival) (arr_seq := arr_seq);
- rewrite ?JOBtsk ?SAMEtsk //); first by apply PARAMS; rewrite -JOBtsk FROMTS.
- intros j0 tsk0 ARR0 TSK0 LE.
- by apply (COMP t); rewrite ?TSK0.
- }
- by subst j2; apply SEQ with (j := j1) (t := t).
- }
-
- apply leq_trans with (\sum_(job_arrival j <= t < job_arrival j + R)
- total_interference_B t).
- {
- rewrite big_distrl /=.
- apply leq_sum_nat; move => t LEt _.
- unfold some_interference_A, total_interference_B.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- [rewrite mul1n /= | by rewrite has_pred0 //].
-
- destruct (has (fun tsk_k : sporadic_task => (delta <= x tsk_k) &&
- scheduled_on_alpha_tsk t tsk_k) (other_tasks_in alpha')) eqn:HAS';
- last by done.
- rewrite mul1n; move: HAS => /hasP [tsk_k INk LEk].
- unfold num_tasks_exceeding.
- apply leq_trans with (n := #|alpha' tsk| -
- count (fun i => (x i >= delta) &&
- scheduled_on_alpha_tsk t i) (other_tasks_in alpha')).
- {
- apply leq_sub2l.
- rewrite -2!sum1_count big_mkcond /=.
- rewrite [\sum_(_ <- _ | _ <= _)_]big_mkcond /=.
- apply leq_sum; intros i _.
- by destruct (scheduled_on_alpha_tsk t i);
- [by rewrite andbT | by rewrite andbF].
- }
- rewrite -count_filter -[count _ (other_tasks_in _)]count_filter.
- eapply leq_trans with (n := count (predC (fun tsk => delta <= x tsk)) _);
- last by apply eq_leq, eq_in_count; red; ins; rewrite ltnNge.
- rewrite leq_subLR count_predC size_filter.
- move: INV => INV. by apply (INV t).
- }
- {
- unfold x at 2, total_interference_B.
- rewrite exchange_big /=; apply leq_sum; intros t _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last by ins.
- rewrite mul1n -sum1_count.
- rewrite big_mkcond [\sum_(i <- other_tasks_in alpha' | _ < _) _]big_mkcond /=.
- apply leq_sum_seq; move => tsk_k IN _.
- destruct (x tsk_k < delta); [rewrite andTb | by rewrite andFb].
- destruct (scheduled_on_alpha_tsk t tsk_k) eqn:SCHED; last by done.
- move: SCHED => /existsP [cpu /andP [ALPHA SCHED]].
- rewrite (bigD1 cpu) /= // JOBtsk SCHED andbT.
- by rewrite /can_execute_on ALPHA.
- }
- Qed.
-
- (* 7) Based on lemma (6), we prove that, for any interval delta, if the sum of per-task
- interference exceeds (delta * |alpha' tsk|), the same applies for the
- sum of the minimum of the interference and delta. *)
- Lemma bertogna_edf_minimum_exceeds_interference :
- forall delta,
- \sum_(tsk_k <- other_tasks_in alpha') x tsk_k >= delta * #|alpha' tsk| ->
- \sum_(tsk_k <- other_tasks_in alpha') minn (x tsk_k) delta >=
- delta * #|alpha' tsk|.
- Proof.
- intros delta SUMLESS.
- set more_interf := fun tsk_k => x tsk_k >= delta.
- rewrite [\sum_(_ <- _) minn _ _](bigID more_interf) /=.
- unfold more_interf, minn.
- rewrite [\sum_(_ <- _ | delta <= _)_](eq_bigr (fun i => delta));
- last by intros i COND; rewrite leqNgt in COND; destruct (delta > x i).
- rewrite [\sum_(_ <- _ | ~~_)_](eq_big (fun i => x i < delta)
- (fun i => x i));
- [| by red; ins; rewrite ltnNge
- | by intros i COND; rewrite -ltnNge in COND; rewrite COND].
-
- (* Case 1: num_tasks_exceeding = 0 *)
- destruct (~~ has (fun i => delta <= x i) (other_tasks_in alpha')) eqn:HASa.
- {
- rewrite [\sum_(_ <- _ | _ <= _) _]big_hasC; last by apply HASa.
- rewrite big_seq_cond; move: HASa => /hasPn HASa.
- rewrite add0n (eq_bigl (fun i => (i \in other_tasks_in alpha') && true));
- last by red; intros tsk_k; destruct (tsk_k \in other_tasks_in alpha') eqn:INk;
- [by rewrite andTb ltnNge; apply HASa | by rewrite andFb].
- by rewrite -big_seq_cond.
- } apply negbFE in HASa.
-
- (* Case 2: num_tasks_exceeding >= #|alpha' tsk| *)
- destruct (num_tasks_exceeding delta >= #|alpha' tsk|) eqn:CARD.
- {
- apply leq_trans with (delta * num_tasks_exceeding delta);
- first by rewrite leq_mul2l; apply/orP; right.
- unfold num_tasks_exceeding; rewrite -sum1_count big_distrr /=.
- rewrite -[\sum_(_ <- _ | _) _]addn0.
- by apply leq_add; [by apply leq_sum; ins; rewrite muln1|by ins].
- } apply negbT in CARD; rewrite -ltnNge in CARD.
-
- (* Case 3: num_tasks_exceeding < #|alpha' tsk| *)
- rewrite big_const_seq iter_addn addn0; fold num_tasks_exceeding.
- apply leq_trans with (n := delta * num_tasks_exceeding delta +
- delta * (#|alpha' tsk| - num_tasks_exceeding delta));
- first by rewrite -mulnDr subnKC //; apply ltnW.
- rewrite leq_add2l bertogna_edf_interference_in_non_full_processors //.
- by apply/andP; split; [by rewrite -has_count | by done].
- Qed.
-
- (* 8) Note that lemma (7) only refers to interference within subaffinity (alpha' tsk).
- To reason about the interference incurred by job j in its complete affinity,
- we prove that an exceeding interference on affinity (alpha tsk) also
- implies an exceeding interference on the subaffinity (alpha' tsk). *)
- Lemma bertogna_edf_interference_on_subaffinity :
- forall delta,
- \sum_(tsk_k <- other_tasks_in alpha) x tsk_k >= delta * #|alpha tsk| ->
- \sum_(tsk_k <- other_tasks_in alpha') x tsk_k >= delta * #|alpha' tsk|.
- Proof.
- have ALL := bertogna_edf_all_cpus_in_affinity_busy.
- have SUB := bertogna_edf_all_cpus_in_subaffinity_busy.
- rename H_at_least_one_cpu into NONEMPTY',
- H_job_of_tsk into JOBtsk, H_affinity_subset into SUBSET,
- H_all_jobs_from_taskset into FROMTS.
- intros delta LE.
- rewrite ALL in LE.
- apply leq_trans with (n := X * #|alpha' tsk|); last by apply SUB.
- rewrite leq_mul2r in LE; move: LE => /orP [/eqP EMPTY | LEx];
- last by rewrite leq_mul2r; apply/orP; right.
- assert (NONEMPTY: #|alpha tsk| > 0).
- {
- apply leq_trans with (n := #|alpha' tsk|);
- last by apply leq_subaffinity, SUBSET; rewrite -JOBtsk FROMTS.
- by apply NONEMPTY'; rewrite -JOBtsk FROMTS.
- }
- by rewrite EMPTY ltnn in NONEMPTY.
- Qed.
-
- (* 9) Next, using lemmas (0), (3), (7) and (8), we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_edf_sum_exceeds_total_interference:
- \sum_((tsk_other, R_other) <- rt_bounds | other_task_in (alpha' tsk) tsk_other)
- minn (x tsk_other) (R - task_cost tsk + 1) > I tsk R.
- Proof.
- have GE_COST := bertogna_edf_R_other_ge_cost.
- have EXCEEDS := bertogna_edf_minimum_exceeds_interference.
- have SUB := bertogna_edf_interference_on_subaffinity.
- have ALLBUSY := bertogna_edf_all_cpus_in_affinity_busy.
- have TOOMUCH := bertogna_edf_too_much_interference.
- rename H_rt_bounds_contains_all_tasks into UNZIP,
- H_job_of_tsk into JOBtsk,
- H_all_jobs_from_taskset into FROMTS,
- H_response_time_is_fixed_point into REC.
- apply leq_trans with (n := \sum_(tsk_other <- other_tasks_in alpha')
- minn (x tsk_other) (R - task_cost tsk + 1));
- last first.
- {
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- assert (FILTER: filter (other_task_in (alpha' tsk)) (unzip1 rt_bounds) =
- filter (other_task_in (alpha' tsk)) ts).
- by f_equal.
- unfold other_tasks_in; rewrite -FILTER; clear FILTER.
- rewrite -[\sum_(_ <- rt_bounds | _)_]big_filter.
- assert (SUBST: [seq i <- rt_bounds
- | let '(tsk_other, _) := i in
- other_task_in (alpha' tsk) tsk_other] =
- [seq i <- rt_bounds
- | other_task_in (alpha' tsk) (fst i)]).
- {
- by apply eq_filter; red; intro i; destruct i.
- } rewrite SUBST; clear SUBST.
- have MAP := big_map (fun x => fst x) (fun i => true)
- (fun i => minn (x i) (R - task_cost tsk + 1)).
- by rewrite -MAP; apply eq_leq; f_equal; rewrite filter_map.
- }
-
- apply ltn_div_trunc with (d := #|alpha' tsk|);
- first by apply H_at_least_one_cpu; rewrite -JOBtsk FROMTS.
- rewrite -(ltn_add2l (task_cost tsk)) -REC; last first. by done.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by apply GE_COST.
- rewrite leq_divRL;
- last by apply H_at_least_one_cpu; rewrite -JOBtsk FROMTS.
- apply EXCEEDS, SUB.
- apply leq_trans with (n := X * #|alpha tsk|); last by rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 10) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k, I_edf, R - e_i + 1).
- This implies that either x_k > W_k or x_k > I_edf, which is a contradiction,
- since both W_k and I_edf are valid task interference bounds. *)
- Lemma bertogna_edf_exists_task_that_exceeds_bound :
- exists tsk_other R_other,
- (tsk_other, R_other) \in rt_bounds /\
- (minn (x tsk_other) (R - task_cost tsk + 1) > interference_bound tsk_other R_other).
- Proof.
- have SUM := bertogna_edf_sum_exceeds_total_interference.
- have BOUND := bertogna_edf_workload_bounds_interference.
- have EDFBOUND := bertogna_edf_specific_bound_holds.
- rename H_rt_bounds_contains_all_tasks into UNZIP.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_other, R_other) := tup in
- (tsk_other \in ts) && other_task_in (alpha' tsk) tsk_other &&
- (minn (x tsk_other) (R - task_cost tsk + 1) > interference_bound tsk_other R_other))
- rt_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- unfold I, total_interference_bound_edf.
- rewrite big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => tsk_k /andP [INBOUNDSk INTERFk]; destruct tsk_k as [tsk_k R_k].
- specialize (ALL (tsk_k, R_k) INBOUNDSk).
- unfold interference_bound_edf; simpl in *.
- rewrite leq_min; apply/andP; split.
- {
- unfold interference_bound; rewrite leq_min; apply/andP; split;
- last by rewrite geq_minr.
- by apply leq_trans with (n := x tsk_k);
- [by rewrite geq_minl | by apply BOUND].
- }
- {
- apply leq_trans with (n := x tsk_k);
- [by rewrite geq_minl | by apply EDFBOUND].
- }
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MIN].
- move: MIN => /andP [/andP [INts INTERFk] MINk].
- by exists tsk_k, R_k; repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- (* Using the lemmas above, we now prove that any response-time bound
- obtained from the analysis is safe. *)
- Section MainProof.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Then, R bounds the response-time of tsk. *)
- Theorem bertogna_cirinei_response_time_bound_edf :
- response_time_bounded_by tsk R.
- Proof.
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + R) as ctime.
-
- revert H_tsk_R_in_rt_bounds.
- generalize dependent R; generalize dependent tsk; generalize dependent j.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj tsk' JOBtsk R' EQc INbounds; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0 tsk R0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- (tsk, R0) \in rt_bounds ->
- job_arrival j0 + R0 < job_arrival j + R' ->
- service sched j0 (job_arrival j0 + R0) >= job_cost j0).
- {
- by ins; apply IH with (tsk := tsk0) (R := R0).
- }
- clear IH.
-
- (* The proof follows by contradiction. Assume that job j does not complete by its
- response-time bound. By the induction hypothesis, all jobs with absolute
- response-time bound t < (job_arrival j + R) have correct response-time bounds. *)
- destruct (completed job_cost sched j (job_arrival j + R')) eqn:NOTCOMP;
- first by done.
- apply negbT in NOTCOMP; exfalso.
-
- (* Next, we derive a contradiction using the previous lemmas. *)
- exploit (bertogna_edf_exists_task_that_exceeds_bound tsk' R' INbounds j ARRj JOBtsk NOTCOMP).
- {
- by ins; apply IH with (tsk := tsk_other) (R := R_other).
- }
- intro EX; destruct EX as [tsk_other [R_other [HP LTmin]]].
- unfold interference_bound_edf, interference_bound_generic in LTmin.
- rewrite minnAC in LTmin; apply min_lt_same in LTmin.
- have BASICBOUND := bertogna_edf_workload_bounds_interference R' j BEFOREok tsk_other R_other HP.
- have EDFBOUND := (bertogna_edf_specific_bound_holds tsk' R' j ARRj JOBtsk BEFOREok tsk_other R_other HP).
- unfold minn in LTmin; clear -LTmin HP BASICBOUND EDFBOUND tsk; desf.
- {
- by apply (leq_ltn_trans BASICBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- {
- by apply (leq_ltn_trans EDFBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- Qed.
-
- End MainProof.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisEDF.
diff --git a/classic/analysis/apa/bertogna_fp_comp.v b/classic/analysis/apa/bertogna_fp_comp.v
deleted file mode 100644
index 39e694dd803be0f8c14a9857a9710d5b242fb4d0..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/bertogna_fp_comp.v
+++ /dev/null
@@ -1,732 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.apa.bertogna_fp_theory.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationFP.
-
- Import ResponseTimeAnalysisFP.
-
- (* In this section, we define the algorithm corresponding to the APA-reduction
- of Bertogna and Cirinei's RTA for FP scheduling. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* As input for each iteration of the algorithm, we consider pairs
- of tasks and computed response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Consider a platform with num_cpus processors, ... *)
- Variable num_cpus: nat.
-
- (* ..., and priorities based on an FP policy. *)
- Variable higher_priority: FP_policy sporadic_task.
-
- (* Assume that every task has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* For the reduction to subproblems, consider a subaffinity alpha' for each task. *)
- Variable alpha': task_affinity sporadic_task num_cpus.
-
- (* Next we define the fixed-point iteration for the APA-reduction of
- Bertogna and Cirineis's response-time analysis. *)
-
- (* First, given a sequence of pairs R_prev = <..., (tsk_hp, R_hp)> of
- response-time bounds for the higher-priority tasks, we define an
- iteration that computes the response-time bound of the current task:
-
- R_tsk (0) = task_cost tsk
- R_tsk (step + 1) = f (R step),
-
- where f is the response-time recurrence, step is the number of iterations,
- and R_tsk (0) is the initial state. *)
- Definition per_task_rta (tsk: sporadic_task)
- (R_prev: seq task_with_response_time) (step: nat) :=
- iter step
- (fun t => task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period alpha tsk
- (alpha' tsk) R_prev t higher_priority)
- #|alpha' tsk|)
- (task_cost tsk).
-
- (* To ensure that the iteration converges, we will apply per_task_rta
- a "sufficient" number of times: task_deadline tsk - task_cost tsk + 1.
- This corresponds to the time complexity of the iteration. *)
- Definition max_steps (tsk: sporadic_task) := task_deadline tsk - task_cost tsk + 1.
-
- (* Next we compute the response-time bounds for the entire task set.
- Since high-priority tasks may not be schedulable, we allow the
- computation to fail.
- Thus, given the response-time bound of previous tasks, we either
- (a) append the computed response-time bound (tsk, R) of the current task
- to the list of pairs, or,
- (b) return None if the response-time analysis failed. *)
- Definition fp_bound_of_task hp_pairs tsk :=
- if hp_pairs is Some rt_bounds then
- let R := per_task_rta tsk rt_bounds (max_steps tsk) in
- if R <= task_deadline tsk then
- Some (rcons rt_bounds (tsk, R))
- else None
- else None.
-
- (* The response-time analysis for a given task set is defined
- as a left-fold (reduce) based on the function above.
- This either returns a list of task and response-time bounds, or None. *)
- Definition fp_claimed_bounds (ts: seq sporadic_task) :=
- foldl fp_bound_of_task (Some [::]) ts.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition fp_schedulable (ts: seq sporadic_task) :=
- fp_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of response-time bounds. The results seem trivial, but must be proven
- nonetheless since the list of response-time bounds is computed with
- a specific algorithm and there are no lemmas in the library for that. *)
- Section SimpleLemmas.
-
- (* First, we show that the first component of the computed list is the set of tasks. *)
- Lemma fp_claimed_bounds_unzip :
- forall ts hp_bounds,
- fp_claimed_bounds ts = Some hp_bounds ->
- unzip1 hp_bounds = ts.
- Proof.
- unfold fp_claimed_bounds in *; intros ts.
- induction ts using last_ind; first by destruct hp_bounds.
- {
- intros hp_bounds SOME.
- destruct (lastP hp_bounds) as [| hp_bounds'].
- {
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- by destruct l.
- }
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- move: H0 => /eqP EQSEQ.
- rewrite eqseq_rcons in EQSEQ.
- move: EQSEQ => /andP [/eqP SUBST /eqP EQSEQ]; subst.
- unfold unzip1; rewrite map_rcons; f_equal.
- by apply IHts.
- }
- Qed.
-
- (* Next, we show that some properties of the analysis are preserved for the
- prefixes of the list: (a) the tasks do not change, (b) R <= deadline,
- (c) R is computed using the response-time equation, ... *)
- Lemma fp_claimed_bounds_rcons :
- forall ts' hp_bounds tsk1 tsk2 R,
- (fp_claimed_bounds (rcons ts' tsk1) = Some (rcons hp_bounds (tsk2, R)) ->
- (fp_claimed_bounds ts' = Some hp_bounds /\
- tsk1 = tsk2 /\
- R = per_task_rta tsk1 hp_bounds (max_steps tsk1) /\
- R <= task_deadline tsk1)).
- Proof.
- intros ts hp_bounds tsk tsk' R.
- rewrite -cats1.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /=.
- unfold fp_bound_of_task at 1; simpl; desf.
- intros EQ; inversion EQ; move: EQ H0 => _ /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [/eqP EQ /eqP RESP].
- by inversion RESP; repeat split; subst.
- Qed.
-
- (* ..., which implies that any prefix of the computation is the computation
- of the prefix. *)
- Lemma fp_claimed_bounds_take :
- forall ts hp_bounds i,
- fp_claimed_bounds ts = Some hp_bounds ->
- i <= size hp_bounds ->
- fp_claimed_bounds (take i ts) = Some (take i hp_bounds).
- Proof.
- intros ts hp_bounds i SOME LTi.
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
- rewrite <- UNZIP in *.
- rewrite -[hp_bounds]take_size /unzip1 map_take in SOME.
- fold (unzip1 hp_bounds) in *; clear UNZIP.
- rewrite leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LTi]; first by subst.
- remember (size hp_bounds) as len; apply eq_leq in Heqlen.
- induction len; first by rewrite ltn0 in LTi.
- {
- assert (TAKElen: fp_claimed_bounds (take len (unzip1 (hp_bounds))) =
- Some (take len (hp_bounds))).
- {
- assert (exists p, p \in hp_bounds).
- {
- destruct hp_bounds; first by rewrite ltn0 in Heqlen.
- by exists t; rewrite in_cons eq_refl orTb.
- } destruct H as [[tsk R] _].
- rewrite (take_nth tsk) in SOME; last by rewrite size_map.
- rewrite (take_nth (tsk,R)) in SOME; last by done.
- destruct (nth (tsk, R) hp_bounds len) as [tsk_len R_len].
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- rewrite ltnS leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LESS]; first by subst.
- apply ltnW in Heqlen.
- by specialize (IHlen Heqlen TAKElen LESS).
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadlines ... *)
- Lemma fp_claimed_bounds_le_deadline :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R <= task_deadline tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by apply Heq0.
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* ... and no smaller than the task costs. *)
- Lemma fp_claimed_bounds_ge_cost :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R >= task_cost tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by destruct (max_steps tsk_lst');
- [by apply leqnn | by apply leq_addr].
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* Short lemma about unfolding the iteration one step. *)
- Lemma per_task_rta_fold :
- forall tsk rt_bounds,
- task_cost tsk +
- div_floor (total_interference_bound_fp task_cost task_period alpha tsk (alpha' tsk) rt_bounds
- (per_task_rta tsk rt_bounds (max_steps tsk)) higher_priority) #|alpha' tsk|
- = per_task_rta tsk rt_bounds (max_steps tsk).+1.
- Proof.
- by done.
- Qed.
-
- End SimpleLemmas.
-
- (* In this section, we prove that if the task set is sorted by priority,
- the tasks in fp_claimed_bounds are interfering tasks. *)
- Section HighPriorityTasks.
-
- (* Consider a list of previous tasks and a task tsk to be analyzed. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that the task set is sorted by unique priorities, ... *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
-
- (* ...the priority order is transitive, ...*)
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* ... and that the response-time analysis succeeds. *)
- Variable hp_bounds: seq task_with_response_time.
- Variable R: time.
- Hypothesis H_analysis_succeeds: fp_claimed_bounds ts = Some hp_bounds.
-
- (* Let's refer to tasks by index. *)
- Variable elem: sporadic_task.
- Let TASK := nth elem ts.
-
- (* We prove that higher-priority tasks have smaller index. *)
- Lemma fp_claimed_bounds_hp_tasks_have_smaller_index :
- forall hp_idx idx,
- hp_idx < size ts ->
- idx < size ts ->
- hp_idx != idx ->
- higher_priority (TASK hp_idx) (TASK idx) ->
- hp_idx < idx.
- Proof.
- unfold TASK; clear TASK.
- rename ts into ts'; destruct ts' as [ts UNIQ]; simpl in *.
- intros hp_idx idx LThp LT NEQ HP.
- rewrite ltn_neqAle; apply/andP; split; first by done.
- by apply sorted_rel_implies_le_idx with (leT := higher_priority) (xs := ts) (default := elem).
- Qed.
-
- End HighPriorityTasks.
-
- (* In this section, we show that the fixed-point iteration converges. *)
- Section Convergence.
-
- (* Consider any sequence with higher-priority tasks. *)
- Variable ts_hp: seq sporadic_task.
-
- (* Assume that the response-time analysis succeeds for the higher-priority tasks. *)
- Variable rt_bounds: seq task_with_response_time.
- Hypothesis H_test_succeeds: fp_claimed_bounds ts_hp = Some rt_bounds.
-
- (* Consider any task tsk to be analyzed, ... *)
- Variable tsk: sporadic_task.
-
- (* ... and assume all tasks have valid parameters. *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline (rcons ts_hp tsk).
-
- (* To simplify, let f denote the fixed-point iteration. *)
- Let f := per_task_rta tsk rt_bounds.
-
- (* Assume that f (max_steps tsk) is no larger than the deadline. *)
- Hypothesis H_no_larger_than_deadline: f (max_steps tsk) <= task_deadline tsk.
-
- (* First, we show that f is monotonically increasing. *)
- Lemma bertogna_fp_comp_f_monotonic :
- forall x1 x2, x1 <= x2 -> f x1 <= f x2.
- Proof.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_test_succeeds into SOME,
- H_valid_task_parameters into VALID.
- intros x1 x2 LEx; unfold f, per_task_rta.
- apply fun_mon_iter_mon; [by ins | by ins; apply leq_addr |].
- clear LEx x1 x2; intros x1 x2 LEx.
- unfold div_floor, total_interference_bound_fp.
- rewrite big_seq_cond [\sum_(i <- _ | let '(tsk_other, _) := i in
- higher_priority_task_in _ _ _ _ _)_]big_seq_cond.
- rewrite leq_add2l leq_div2r //.
- apply leq_sum; move => i /andP [IN _].
- destruct i as [i R].
- have GE_COST := fp_claimed_bounds_ge_cost ts_hp rt_bounds i R SOME IN.
- have UNZIP := fp_claimed_bounds_unzip ts_hp rt_bounds SOME.
- unfold interference_bound_generic; simpl.
- assert (IN': i \in ts_hp).
- {
- by rewrite -UNZIP; apply/mapP; exists (i,R).
- }
- unfold interference_bound_generic; simpl.
- rewrite leq_min; apply/andP; split.
- {
- apply leq_trans with (n := W task_cost task_period i R x1); first by apply geq_minl.
- exploit (VALID i); [by rewrite mem_rcons in_cons IN' orbT | ins; des].
- by apply W_monotonic; try (by done); apply GE_COST.
- }
- {
- apply leq_trans with (n := x1 - task_cost tsk + 1); first by apply geq_minr.
- by rewrite leq_add2r leq_sub2r //.
- }
- Qed.
-
- (* If the iteration converged at an earlier step, it remains as a fixed point. *)
- Lemma bertogna_fp_comp_f_converges_early :
- (exists k, k <= max_steps tsk /\ f k = f k.+1) ->
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- by intros EX; des; apply fixedpoint.iter_fix with (k := k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume instead that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps tsk -> f k != f k.+1.
-
- (* By monotonicity, it follows that the value always increases. *)
- Lemma bertogna_fp_comp_f_increases :
- forall k,
- k <= max_steps tsk ->
- f k < f k.+1.
- Proof.
- intros k LT.
- rewrite ltn_neqAle; apply/andP; split.
- by apply H_keeps_diverging.
- by apply bertogna_fp_comp_f_monotonic, leqnSn.
- Qed.
-
- (* In the end, the response-time bound must exceed the deadline. Contradiction! *)
- Lemma bertogna_fp_comp_rt_grows_too_much :
- forall k,
- k <= max_steps tsk ->
- f k > k + task_cost tsk - 1.
- Proof.
- have INC := bertogna_fp_comp_f_increases.
- rename H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- induction k.
- {
- intros _; rewrite add0n -addn1 addnBAC;
- first by rewrite -addnBA // subnn addn0 /= leqnn.
- by apply PARAMS.
- }
- {
- intros LT.
- specialize (IHk (ltnW LT)).
- apply leq_ltn_trans with (n := f k);last by apply INC, ltnW.
- rewrite -addn1 -addnA [1 + _]addnC addnA -addnBA // subnn addn0.
- rewrite -(ltn_add2r 1) in IHk.
- rewrite addnBAC in IHk;
- last by apply leq_trans with (n := task_cost tsk);
- [by apply PARAMS | by apply leq_addl].
- by rewrite -addnBA // subnn addn0 addn1 ltnS in IHk.
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove the convergence of the iteration after max_steps. *)
- Lemma per_task_rta_converges:
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- have TOOMUCH := bertogna_fp_comp_rt_grows_too_much.
- have INC := bertogna_fp_comp_f_increases.
- rename H_no_larger_than_deadline into LE,
- H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_(max_steps tsk).+1, f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- apply bertogna_fp_comp_f_converges_early.
- by exists k; split; [by rewrite -ltnS; apply ltn_ord | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
- rewrite leqNgt in LE; move: LE => /negP LE.
- exfalso; apply LE.
-
- assert (DIFF: forall k : nat, k <= max_steps tsk -> f k != f k.+1).
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | intro DIFF; apply DIFF].
- }
- exploit TOOMUCH; [by apply DIFF | by apply leq_addr |].
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- rewrite addnBAC; last by apply PARAMS2.
- rewrite -addnBA // subnn addn0 subn1 prednK //.
- intros LT; apply (leq_ltn_trans LT).
- by rewrite /max_steps [_ - _ + 1]addn1; apply INC, leq_addr.
- Qed.
-
- End Convergence.
-
- (* Now we prove the correctness of the response-time bounds. *)
- Section MainProof.
-
- (* Consider a task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all tasks have valid parameters ... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ...and constrained deadlines. *)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Assume that alpha' is a non-empty subaffinity of alpha. *)
- Hypothesis H_non_empty_affinity:
- forall tsk, tsk \in ts -> #|alpha' tsk| > 0.
- Hypothesis H_subaffinity:
- forall tsk, tsk \in ts -> is_subaffinity (alpha' tsk) (alpha tsk).
-
- (* Assume that the task set is totally ordered by unique decreasing
- priorities and that the priority order is transitive. *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
- Hypothesis H_priority_is_total:
- FP_is_total_over_task_set higher_priority ts.
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* Next, consider any arrival sequence such that...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...jobs have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any schedule such that...*)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after they arrived and no longer
- than their execution costs,... *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* ...and jobs are sequential. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assume a work-conserving APA scheduler that respects the FP policy. *)
- Hypothesis H_respects_affinity: respects_affinity job_task sched alpha.
- Hypothesis H_work_conserving: apa_work_conserving job_arrival job_cost job_task arr_seq
- sched alpha.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy_under_weak_APA job_arrival job_cost job_task arr_seq sched
- alpha higher_priority.
-
- (* To avoid a long list of parameters, we provide some local definitions. *)
- Let no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in fp_claimed_bounds is safe. The proof follows by induction on the task set:
-
- Induction hypothesis: assume all higher-priority tasks have safe response-time bounds.
- Inductive step: we prove that the response-time bound of the current task is safe.
-
- Note that the inductive step is a direct application of the main Theorem from
- bertogna_fp_theory.v. *)
- Theorem fp_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In fp_claimed_bounds ts ->
- response_time_bounded_by tsk R.
- Proof.
- rename H_valid_job_parameters into JOBPARAMS, H_valid_task_parameters into TASKPARAMS.
- unfold valid_sporadic_taskset in *.
- intros tsk R MATCH.
- assert (SOME: exists hp_bounds, fp_claimed_bounds ts = Some hp_bounds /\
- (tsk, R) \in hp_bounds).
- {
- destruct (fp_claimed_bounds ts); last by done.
- by exists l; split.
- } clear MATCH; des; rename SOME0 into IN.
-
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
-
- set elem := (tsk,R).
- move: IN => /(nthP elem) [idx LTidx EQ].
- set NTH := fun k => nth elem hp_bounds k.
- set TASK := fun k => (NTH k).1.
- set RESP := fun k => (NTH k).2.
- cut (response_time_bounded_by (TASK idx) (RESP idx));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- clear EQ.
-
- assert (PAIR: forall idx, (TASK idx, RESP idx) = NTH idx).
- by intros i; unfold TASK, RESP; destruct (NTH i).
-
- assert (SUBST: forall i, i < size hp_bounds -> TASK i = nth tsk ts i).
- by intros i LTi; rewrite /TASK /NTH -UNZIP (nth_map elem) //.
-
- assert (SIZE: size hp_bounds = size ts).
- by rewrite -UNZIP size_map.
-
- induction idx as [idx IH'] using strong_ind.
-
- assert (IH: forall tsk_hp R_hp, (tsk_hp, R_hp) \in take idx hp_bounds -> response_time_bounded_by tsk_hp R_hp).
- {
- intros tsk_hp R_hp INhp.
- move: INhp => /(nthP elem) [k LTk EQ].
- rewrite size_take LTidx in LTk.
- rewrite nth_take in EQ; last by done.
- cut (response_time_bounded_by (TASK k) (RESP k));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- by apply IH'; try (by done); apply (ltn_trans LTk).
- } clear IH'.
-
- unfold response_time_bounded_by in *.
-
- exploit (fp_claimed_bounds_rcons (take idx ts) (take idx hp_bounds) (TASK idx) (TASK idx) (RESP idx)).
- {
- by rewrite PAIR SUBST // -2?take_nth -?SIZE // (fp_claimed_bounds_take _ hp_bounds).
- }
- intros [_ [_ [REC DL]]].
-
- (try ( apply bertogna_cirinei_response_time_bound_fp with
- (alpha0 := alpha) (alpha'0 := alpha')
- (task_cost0 := task_cost) (task_period0 := task_period)
- (task_deadline0 := task_deadline) (job_deadline0 := job_deadline) (tsk0 := (TASK idx))
- (job_task0 := job_task) (ts0 := ts) (hp_bounds0 := take idx hp_bounds)
- (higher_eq_priority := higher_priority) ) ||
- apply bertogna_cirinei_response_time_bound_fp with
- (alpha := alpha) (alpha' := alpha')
- (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (job_deadline := job_deadline) (tsk := (TASK idx))
- (job_task := job_task) (ts := ts) (hp_bounds := take idx hp_bounds)
- (higher_eq_priority := higher_priority)); try (by ins).
- {
- cut (NTH idx \in hp_bounds = true); [intros IN | by apply mem_nth].
- by rewrite set_mem -UNZIP; apply/mapP; exists (TASK idx, RESP idx); rewrite PAIR.
- }
- {
- intros hp_tsk IN INTERF.
- exists (RESP (index hp_tsk ts)).
- move: (IN) => INDEX; apply nth_index with (x0 := tsk) in INDEX.
- rewrite -{1}[hp_tsk]INDEX -SUBST; last by rewrite SIZE index_mem.
- assert (UNIQ: uniq hp_bounds).
- {
- apply map_uniq with (f := fst); unfold unzip1 in *; rewrite UNZIP.
- by destruct ts.
- }
- rewrite -filter_idx_lt_take //.
- {
- rewrite PAIR mem_filter; apply/andP; split;
- last by apply mem_nth; rewrite SIZE index_mem.
- {
- rewrite /NTH index_uniq; [| by rewrite SIZE index_mem | by done ].
- {
- move: INTERF => /andP [/andP [HP NEQ] _].
- apply fp_claimed_bounds_hp_tasks_have_smaller_index with
- (ts := ts) (elem := tsk) (hp_bounds := hp_bounds);
- try (by done);
- [by rewrite index_mem | by rewrite -SIZE | | by rewrite INDEX -SUBST].
- apply/eqP; intro BUG; subst idx.
- rewrite SUBST -{1}INDEX in NEQ;
- first by rewrite eq_refl in NEQ.
- by rewrite SIZE index_mem INDEX.
- }
- }
- }
- }
- {
- intros hp_tsk R_hp IN; apply mem_take in IN.
- by apply fp_claimed_bounds_ge_cost with (ts' := ts) (rt_bounds := hp_bounds).
- }
- {
- intros hp_tsk R_hp IN; apply mem_take in IN.
- by apply fp_claimed_bounds_le_deadline with (ts' := ts) (rt_bounds := hp_bounds).
- }
- {
- rewrite REC.
- rewrite per_task_rta_fold.
- apply per_task_rta_converges with (ts_hp := take idx ts);
- [by apply fp_claimed_bounds_take; try (by apply ltnW) | | by rewrite -REC ].
- rewrite SUBST // -take_nth -?SIZE //.
- by intros i IN; eapply TASKPARAMS, mem_take, IN.
- }
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: fp_schedulable ts.
-
- (*..., no task misses its deadline. *)
- Theorem taskset_schedulable_by_fp_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (fp_analysis_yields_response_time_bounds).
- have UNZIP := (fp_claimed_bounds_unzip ts).
- have DL := (fp_claimed_bounds_le_deadline ts).
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- fp_schedulable, valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS.
- move => tsk INtsk j ARRj JOBtsk.
-
- destruct (fp_claimed_bounds ts) as [rt_bounds |]; last by ins.
- feed (UNZIP rt_bounds); first by done.
- assert (EX: exists R, (tsk, R) \in rt_bounds).
- {
- rewrite set_mem -UNZIP in INtsk; move: INtsk => /mapP EX.
- by destruct EX as [p]; destruct p as [tsk' R]; simpl in *; subst tsk'; exists R.
- } des.
- exploit (RLIST tsk R EX j ARRj); [by apply JOBtsk | intro COMPLETED].
- exploit (DL rt_bounds tsk R); [by ins | by ins | clear DL; intro DL].
- apply leq_trans with (n := service sched j (job_arrival j + R)); last first.
- {
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- apply extend_sum; rewrite // leq_add2l.
- specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS1.
- by rewrite JOBtsk.
- }
- by done.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we also conclude that no job in
- the schedule misses its deadline. *)
- Theorem jobs_schedulable_by_fp_rta :
- forall j, arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_fp_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationFP.
diff --git a/classic/analysis/apa/bertogna_fp_theory.v b/classic/analysis/apa/bertogna_fp_theory.v
deleted file mode 100644
index 63b395a8f533543856fb85ac7723f90eebd9180f..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/bertogna_fp_theory.v
+++ /dev/null
@@ -1,1070 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.response_time prosa.classic.model.schedule.global.schedulability
- prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.platform prosa.classic.model.schedule.apa.constrained_deadlines
- prosa.classic.model.schedule.apa.interference prosa.classic.model.schedule.apa.affinity.
-Require Import prosa.classic.analysis.apa.workload_bound
- prosa.classic.analysis.apa.interference_bound_fp.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisFP.
-
- Export Job SporadicTaskset ScheduleOfSporadicTask Workload Interference InterferenceBoundFP
- Platform Schedulability ResponseTime Priority
- TaskArrival WorkloadBound Affinity ConstrainedDeadlines.
-
- (* In this section, we prove that any fixed point in the APA-reduction of Bertogna
- and Cirinei's RTA for FP scheduling with slack updates is a safe response-time
- bound. This result corresponds to Lemma 9 in the revised version of the APA paper:
- http://www.mpi-sws.org/~bbb/papers/pdf/ecrts13a-rev1.pdf *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j -> job_task j \in ts.
-
- (* Also assume that every task has a non-empty processor affinity alpha. *)
- Context {num_cpus: nat}.
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Next, consider any schedule such that...*)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs are sequential and do not execute before their
- arrival times nor longer than their execution costs. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Consider a given FP policy, ... *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ... and assume that the schedule is an APA work-conserving
- schedule that respects this policy. *)
- Hypothesis H_respects_affinity: respects_affinity job_task sched alpha.
- Hypothesis H_work_conserving: apa_work_conserving job_arrival job_cost job_task
- arr_seq sched alpha.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy_under_weak_APA job_arrival job_cost job_task arr_seq
- sched alpha higher_eq_priority.
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Next, we consider the response-time recurrence.
- Let tsk be a task in ts that is to be analyzed. *)
- Variable tsk: sporadic_task.
- Hypothesis task_in_ts: tsk \in ts.
-
- (* When computing the response-time bounds, we assume that each task under
- analysis has a non-empty subaffinity alpha'. *)
- Variable alpha': task_affinity sporadic_task num_cpus.
- Hypothesis H_affinity_subset: forall tsk, tsk \in ts -> is_subaffinity (alpha' tsk) (alpha tsk).
- Hypothesis H_at_least_one_cpu : forall tsk, tsk \in ts -> #|alpha' tsk| > 0.
-
- (* Let (hp_task_in alpha') denote whether a task is a higher-priority task
- (with respect to tsk) that can execute on processors in (alpha' tsk). *)
- Let hp_task_in alpha' := higher_priority_task_in alpha higher_eq_priority tsk alpha'.
-
- (* Assume a response-time bound is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable hp_bounds: seq task_with_response_time.
- Hypothesis H_response_time_of_interfering_tasks_is_known:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds ->
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched hp_tsk R.
-
- (* ... for every higher-priority task in (alpha tsk). *)
- Hypothesis H_hp_bounds_has_interfering_tasks:
- forall hp_tsk,
- hp_tsk \in ts ->
- hp_task_in (alpha tsk) hp_tsk ->
- exists R,
- (hp_tsk, R) \in hp_bounds.
-
- (* Assume that the response-time bounds are larger than task costs. *)
- Hypothesis H_response_time_bounds_ge_cost:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds -> R >= task_cost hp_tsk.
-
- (* Assume that no deadline is missed by any higher-priority task. *)
- Hypothesis H_interfering_tasks_miss_no_deadlines:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds -> R <= task_deadline hp_tsk.
-
- (* Let R be the fixed point of the APA-reduction of Bertogna and
- Cirinei's response-time recurrence (using subaffinity alpha'), ...*)
- Variable R: time.
- Hypothesis H_response_time_recurrence_holds :
- R = task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period alpha tsk
- (alpha' tsk) hp_bounds R higher_eq_priority)
- #|alpha' tsk|.
-
- (* ... and assume that R is no larger than the deadline of tsk.*)
- Hypothesis H_response_time_no_larger_than_deadline:
- R <= task_deadline tsk.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Assume that job j is the first job of tsk not to complete by the response time bound. *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (job_arrival j + R).
- Hypothesis H_previous_jobs_of_tsk_completed :
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + R).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task sched alpha j tsk_other
- (job_arrival j) (job_arrival j + R).
-
- (* and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost sched j (job_arrival j) (job_arrival j + R).
-
- (* Recall Bertogna and Cirinei's workload bound. *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W task_cost task_period tsk_other R_other R.
-
- (* Let (hp_tasks_in alpha') denote the set of higher-priority tasks
- that can be scheduled on subaffinity alpha'. *)
- Let hp_tasks_in alpha' :=
- [seq tsk_other <- ts | hp_task_in (alpha' tsk) tsk_other].
-
- (* Now we establish results the higher-priority tasks. *)
- Section LemmasAboutHPTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task
- and response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_tsk_other_already_processed: (tsk_other, R_other) \in hp_bounds.
- Hypothesis H_tsk_other_has_higher_priority: hp_task_in (alpha tsk) tsk_other.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_fp_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold completed, completed_jobs_dont_execute, valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS,
- H_valid_task_parameters into TASK_PARAMS,
- H_constrained_deadlines into RESTR,
- H_all_jobs_from_taskset into FROMTS,
- H_response_time_of_interfering_tasks_is_known into RESP,
- H_interfering_tasks_miss_no_deadlines into NOMISS,
- H_response_time_bounds_ge_cost into GE_COST.
- unfold x, workload_bound.
- destruct ([exists t: 'I_(job_arrival j + R),
- task_is_scheduled job_task sched tsk_other t]) eqn: SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED.
- move: SCHED => /forallP SCHED.
- apply leq_trans with (n := 0); last by done.
- apply leq_trans with (n := \sum_(job_arrival j <= t < job_arrival j + R) 0);
- last by rewrite big1.
- apply leq_sum_nat; move => i /andP [_ LTi] _.
- specialize (SCHED (Ordinal LTi)).
- rewrite negb_exists in SCHED; move: SCHED => /forallP SCHED.
- rewrite big1 //; intros cpu _.
- specialize (SCHED cpu); apply negbTE in SCHED.
- by rewrite SCHED andbF.
- }
- move: SCHED => /existsP [t /existsP [cpu SCHED]].
- unfold task_scheduled_on in SCHED.
- destruct (sched cpu t) as [j0 |] eqn:SCHED'; last by done.
- assert (INts: tsk_other \in ts).
- {
- move: SCHED => /eqP <-. apply FROMTS, (H_jobs_come_from_arrival_sequence j0 t).
- by apply/existsP; exists cpu; apply/eqP.
- }
- apply leq_trans with (n := workload job_task sched tsk_other
- (job_arrival j) (job_arrival j + R));
- first by apply task_interference_le_workload.
- by ( try ( apply workload_bounded_by_W with (task_deadline0 := task_deadline) (arr_seq0 := arr_seq)
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (job_deadline0 := job_deadline) ) ||
- apply workload_bounded_by_W with (task_deadline := task_deadline) (arr_seq := arr_seq)
- (job_arrival := job_arrival) (job_cost := job_cost) (job_deadline := job_deadline));
- try (by ins); last 2 first;
- [ by ins; apply GE_COST
- | by ins; apply NOMISS
- | by ins; apply TASK_PARAMS
- | by ins; apply RESTR
- | by ins; apply RESP with (hp_tsk := tsk_other)].
- Qed.
-
- End LemmasAboutHPTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X >= R - e_k + 1. *)
- Lemma bertogna_fp_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS,
- H_response_time_recurrence_holds into REC,
- H_job_of_tsk into JOBtsk, H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite [R]REC // leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
- apply leq_ltn_trans with (n := (\sum_(job_arrival j <= t < job_arrival j + R)
- backlogged job_arrival job_cost sched j t) +
- service sched j (job_arrival j + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_j_arrives); des; rewrite -JOBtsk.
- }
- unfold service; rewrite service_before_arrival_eq_service_during //.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(job_arrival j <= i < job_arrival j + R) 1);
- first by rewrite big_const_nat iter_addn mul1n addn0 addKn.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [GEi LTi] _].
- destruct (backlogged job_arrival job_cost sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* 1) Next, we prove that during the scheduling window of j, any job that is
- scheduled while j is backlogged comes from a different task.
- This follows from the fact that j is the first job not to complete
- by its response-time bound, so previous jobs of j's task must have
- completed by their periods and cannot be pending. *)
- Lemma bertogna_fp_interference_by_different_tasks :
- forall t j_other,
- job_arrival j <= t < job_arrival j + R ->
- arrives_in arr_seq j_other ->
- backlogged job_arrival job_cost sched j t ->
- scheduled sched j_other t ->
- job_task j_other != tsk.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_previous_jobs_of_tsk_completed into BEFOREok,
- H_response_time_no_larger_than_deadline into NOMISS,
- H_constrained_deadlines into RESTR.
- move => t j_other /andP [LEt GEt] ARRother BACK SCHED.
- apply/eqP; red; intro SAMEtsk.
- move: SCHED => /existsP [cpu SCHED].
- assert (SCHED': scheduled sched j_other t).
- by apply/existsP; exists cpu.
- clear SCHED; rename SCHED' into SCHED.
- move: (SCHED) => PENDING.
- ( try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) in PENDING ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := job_cost) in PENDING); try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- move: (BEFOREother) => LT; rewrite -(ltn_add2r R) in LT.
- specialize (BEFOREok j_other ARRother SAMEtsk BEFOREother).
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- ( try ( apply completion_monotonic with (t0 := job_arrival j_other + R) ) ||
- apply completion_monotonic with (t := job_arrival j_other + R)); try (by done).
- apply leq_trans with (n := job_arrival j); last by done.
- apply leq_trans with (n := job_arrival j_other + task_deadline tsk);
- first by rewrite leq_add2l; apply NOMISS.
- apply leq_trans with (n := job_arrival j_other + task_period tsk);
- first by rewrite leq_add2l; apply RESTR; rewrite -JOBtsk FROMTS.
- rewrite -SAMEtsk; apply SPO; try (by done); [ | by rewrite JOBtsk | by apply ltnW].
- by red; intro EQ; subst j_other; rewrite ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge.
- apply leq_ltn_trans with (n := t); first by done.
- apply leq_trans with (n := job_arrival j + R); first by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by rewrite JOBtsk RESTR // -JOBtsk FROMTS].
- }
- by red; intros EQtsk; subst j_other; rewrite /backlogged SCHED andbF in BACK.
- }
- Qed.
-
- (* 2) In order to use the lemmas in constrained_deadlines.v, we show that
- all jobs of higher-priority tasks released before the end of the
- interval complete by their periods. This follows trivially from
- the fact that all these tasks are known to be schedulable.
- With this lemma, we can conclude that during job j's scheduling
- window there cannot be multiple pending jobs of higher-priority tasks.*)
- Lemma bertogna_fp_previous_interfering_jobs_complete_by_their_period:
- forall j0,
- arrives_in arr_seq j0 ->
- hp_task_in (alpha tsk) (job_task j0) ->
- completed job_cost sched j0
- (job_arrival j0 + task_period (job_task j0)).
- Proof.
- rename H_hp_bounds_has_interfering_tasks into HAS,
- H_constrained_deadlines into CONSTR,
- H_response_time_no_larger_than_deadline into NOMISS,
- H_all_jobs_from_taskset into FROMTS,
- H_interfering_tasks_miss_no_deadlines into NOMISS',
- H_previous_jobs_of_tsk_completed into BEFOREok,
- H_response_time_of_interfering_tasks_is_known into RESP.
- intros j0 ARR0 INTERF.
- exploit (HAS (job_task j0));
- [by rewrite FROMTS | by done | move => [R0 INbounds]].
- apply completion_monotonic with (t := job_arrival j0 + R0).
- - rewrite leq_add2l; apply leq_trans with (n := task_deadline (job_task j0));
- [by apply NOMISS' | by apply CONSTR; rewrite FROMTS].
- - by apply (RESP (job_task j0)).
- Qed.
-
- (* 3) Next, we prove that the sum of the interference of each task is equal to the
- total interference multiplied by the number of processors in tsk's *actual*
- affinity. This holds because interference only occurs when all processors in
- the affinity are busy.
- With this lemma we can relate per-task interference with the total interference
- incurred by j (backlogged time). *)
- Lemma bertogna_fp_all_cpus_in_affinity_busy :
- \sum_(tsk_k <- hp_tasks_in alpha) x tsk_k = X * #|alpha tsk|.
- Proof.
- have DIFFTASK := bertogna_fp_interference_by_different_tasks.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK, H_jobs_come_from_arrival_sequence into SEQ,
- H_previous_jobs_of_tsk_completed into BEFOREok,
- H_response_time_no_larger_than_deadline into NOMISS,
- H_constrained_deadlines into RESTR,
- H_respects_affinity into APA, H_respects_FP_policy into FP.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last first.
- {
- rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- by intros i _; rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- }
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus | cpu \in alpha tsk) 1);
- last by rewrite sum1_card.
- rewrite [\sum_(_ < _ | _) 1]big_mkcond /=.
- apply eq_bigr; intros cpu _.
- unfold can_execute_on in *.
- destruct (cpu \in alpha (job_task j)) eqn:ALPHA; rewrite -?JOBtsk ALPHA;
- last by rewrite big_filter (eq_bigr (fun x => 0));
- [by simpl_sum_const | by ins].
- move: (WORK j t H_j_arrives BACK cpu ALPHA) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- rewrite big_const_seq iter_addn mul0n 2!addn0; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- have ARRother: arrives_in arr_seq j_other.
- by apply (SEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- unfold higher_priority_task_in, affinity_intersects.
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu; rewrite -JOBtsk ALPHA andTb.
- by apply APA with (t := t); apply/eqP.
- }
- apply/andP; split; last first.
- {
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu; apply/eqP.
- }
- by rewrite -JOBtsk; apply FP with (cpu := cpu) (t := t); try (by apply/eqP).
- Qed.
-
- (* 4) Recall that the reduction-based analysis considers only the interfering tasks
- within subaffinity (alpha' tsk), as opposed to (alpha tsk). Therefore, we must
- reason about the task interference wihin (alpha' tsk).
- We begin by showing that the cumulative interference within (alpha' tsk) is at
- least the total interference multiplied by the number of processors in (alpha' tsk). *)
- Lemma bertogna_fp_all_cpus_in_subaffinity_busy :
- \sum_(tsk_k <- hp_tasks_in alpha') x tsk_k >= X * #|alpha' tsk|.
- Proof.
- have DIFFTASK := bertogna_fp_interference_by_different_tasks.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS, H_jobs_come_from_arrival_sequence into SEQ,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_response_time_no_larger_than_deadline into NOMISS,
- H_constrained_deadlines into RESTR,
- H_respects_FP_policy into FP,
- H_respects_affinity into APA, H_affinity_subset into SUB.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond /=.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last first.
- {
- rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- by intros i _; rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- }
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply leq_trans with (n := \sum_(cpu < num_cpus | cpu \in alpha' tsk) 1);
- first by rewrite sum1_card.
- rewrite [\sum_(_ < _ | _) 1]big_mkcond /=.
- apply leq_sum; intros cpu _.
- unfold can_execute_on in *.
- destruct (cpu \in alpha' (job_task j)) eqn:ALPHA'; rewrite -?JOBtsk ALPHA';
- last by done.
- feed (SUB (job_task j)); first by apply FROMTS.
- specialize (SUB cpu ALPHA').
- move: (WORK j t H_j_arrives BACK cpu SUB) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- have ARRother: arrives_in arr_seq j_other.
- by apply (SEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite (bigD1_seq (job_task j_other)) /=; last by apply filter_uniq; destruct ts.
- {
- by rewrite {1}/task_scheduled_on SUB SCHED eq_refl andTb.
- }
- {
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu; apply/andP; split; first by rewrite -JOBtsk.
- by apply APA with (t := t); apply/eqP.
- }
- apply/andP; split; last first.
- {
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu; apply/eqP.
- }
- by rewrite -JOBtsk; apply FP with (cpu := cpu) (t := t); try (by apply/eqP).
- }
- Qed.
-
- (* Let's define a predicate for whether a task is scheduled on (alpha tsk). *)
- Let scheduled_on_alpha_tsk := fun t tsk_k =>
- task_scheduled_on_affinity job_task sched (alpha tsk) tsk_k t.
-
-
- (* 5) Now we prove that, at all times that j is backlogged, the number
- of tasks whose affinity intersects (alpha' tsk) that are in fact
- scheduled on (alpha' tsk) is at least the size of (alpha' tsk).
- This is required to prove lemma (6). *)
- Lemma bertogna_fp_alpha'_is_full:
- forall t,
- job_arrival j <= t < job_arrival j + R ->
- backlogged job_arrival job_cost sched j t ->
- count (scheduled_on_alpha_tsk t) (hp_tasks_in alpha') >= #|alpha' tsk|.
- Proof.
- have DIFFTASK := bertogna_fp_interference_by_different_tasks.
- have COMP := bertogna_fp_previous_interfering_jobs_complete_by_their_period.
- rename H_work_conserving into WORK, H_respects_affinity into APA,
- H_affinity_subset into SUB, H_job_of_tsk into JOBtsk,
- H_all_jobs_from_taskset into FROMTS, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_valid_task_parameters into PARAMS,
- H_previous_jobs_of_tsk_completed into BEFOREok,
- H_sequential_jobs into SEQ, H_constrained_deadlines into CONSTR,
- H_respects_FP_policy into FP.
- move => t /andP [GEt LTt] BACK.
- move: WORK => WORK.
- specialize (WORK j t H_j_arrives BACK).
- rewrite -size_filter.
- apply leq_trans with (n := size (alpha' tsk));
- first by apply card_size.
- apply leq_trans with (n := size (pmap (fun cpu => sched cpu t) (enum (alpha' tsk)))).
- {
- rewrite size_pmap -size_filter.
- apply uniq_leq_size; first by destruct (alpha' tsk).
- intros cpu IN.
- rewrite mem_filter; apply/andP; split; last by rewrite mem_enum.
- feed (WORK cpu); first by apply SUB; rewrite JOBtsk.
- by move: WORK => [j_other /eqP SCHED]; rewrite SCHED.
- }
- {
- apply leq_trans with (n := size (map (fun j => job_task j) (pmap (fun cpu => sched cpu t) (enum (alpha' tsk)))));
- first by rewrite size_map.
- apply uniq_leq_size.
- {
- rewrite map_inj_in_uniq.
- {
- apply pmap_inj_in_uniq; last by apply enum_uniq.
- intros cpu1 cpu2 IN1 IN2 SCHED2.
- destruct (sched cpu1 t) as [j0 |] eqn:SCHED1; symmetry in SCHED2;
- first by apply SEQ with (j := j0) (t := t).
- rewrite 2!mem_enum in IN1 IN2.
- exploit (WORK cpu1); first by apply SUB; rewrite JOBtsk.
- by move => [j_other SCHED]; rewrite /scheduled_on SCHED1 in SCHED.
- }
- {
- intros j1 j2 SCHED1 SCHED2 SAMEtsk.
- rewrite 2!mem_pmap in SCHED1 SCHED2.
- move: SCHED1 SCHED2 => /mapP [cpu1 IN1 SCHED1] /mapP [cpu2 IN2 SCHED2].
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu1; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu2; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu1; rewrite /scheduled_on -SCHED1.
- }
- assert (SCHED2': pending job_arrival job_cost sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu2; rewrite /scheduled_on -SCHED2.
- }
-
- ( try ( apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (arr_seq0 := arr_seq) (task_period0 := task_period) (tsk0 := tsk) (alpha0 := alpha)
- (job_arrival0 := job_arrival) (higher_eq_priority0 := higher_eq_priority) (t0 := t)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) ) ||
- apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (arr_seq := arr_seq) (task_period := task_period) (tsk := tsk) (alpha := alpha)
- (job_arrival := job_arrival) (higher_eq_priority := higher_eq_priority) (t := t)
- (job_cost := job_cost) (job_task := job_task) (sched := sched));
- rewrite ?JOBtsk ?SAMEtsk //.
- {
- by intros j0 tsk0 TSK0 LE; subst tsk0; apply COMP.
- }
- {
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu2; apply/andP; split.
- by apply SUB; [rewrite -JOBtsk FROMTS | rewrite -mem_enum].
- by apply APA with (t := t); apply/eqP; rewrite SCHED2.
- }
- apply/andP; split.
- {
- rewrite -JOBtsk; apply FP with (cpu := cpu2) (t := t); try (by done);
- first by apply/eqP; rewrite SCHED2.
- by apply SUB; rewrite ?FROMTS // -mem_enum JOBtsk.
- }
- {
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu2; apply/eqP; rewrite SCHED2.
- }
- }
- }
- }
- {
- move => tsk' /mapP [j' IN EQtsk'].
- rewrite mem_pmap in IN.
- move: IN => /mapP [cpu INcpu SCHED'].
- rewrite mem_enum in INcpu.
- rewrite mem_filter; apply/andP; split.
- {
- apply/existsP; exists cpu; apply/andP; split; first by apply SUB.
- by rewrite /task_scheduled_on -SCHED' EQtsk'.
- }
- have ARR': arrives_in arr_seq j'.
- by apply (FROMSEQ j' t); apply/existsP; exists cpu; apply/eqP.
- rewrite EQtsk' mem_filter; apply/andP; split; last by apply FROMTS.
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu; apply/andP; split; first by done.
- by apply APA with (t := t); rewrite /scheduled_on SCHED'.
- }
- apply/andP; split.
- {
- by rewrite -JOBtsk; apply FP with (cpu := cpu) (t := t);
- try (by done); [by apply/eqP; rewrite SCHED' | apply SUB; rewrite JOBtsk].
- }
- {
- apply/eqP; intro SAMEtsk.
- move: BACK => /andP [PENDING NOTSCHED].
- assert (SCHEDULED': scheduled sched j' t).
- {
- by apply/existsP; exists cpu; rewrite /scheduled_on -SCHED'.
- }
- move: (SCHEDULED') => PENDING'.
- ( try ( apply scheduled_implies_pending with (job_cost0 := job_cost)
- (job_arrival0 := job_arrival) in PENDING' ) ||
- apply scheduled_implies_pending with (job_cost := job_cost)
- (job_arrival := job_arrival) in PENDING'); try by done.
- assert (BUG: j' = j).
- {
- ( try ( apply platform_fp_no_multiple_jobs_of_tsk with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline)
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (job_task0 := job_task)
- (arr_seq0 := arr_seq) (sched0 := sched) (tsk0 := tsk) (t0 := t) ) ||
- apply platform_fp_no_multiple_jobs_of_tsk with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (job_arrival := job_arrival) (job_cost := job_cost) (job_task := job_task)
- (arr_seq := arr_seq) (sched := sched) (tsk := tsk) (t := t) );
- try (by done);
- [by apply PARAMS | by apply/andP; split | |].
- {
- apply leq_trans with (n := job_arrival j + R); first by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- last by apply CONSTR; rewrite -JOBtsk FROMTS.
- }
- {
- intros j0 JOB0 ARR0 LT0.
- ( try ( apply completion_monotonic with (t0 := job_arrival j0 + R) ) ||
- apply completion_monotonic with (t := job_arrival j0 + R)); [| by apply BEFOREok].
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- last by apply CONSTR; rewrite -JOBtsk FROMTS.
- }
- }
- by rewrite -BUG SCHEDULED' in NOTSCHED.
- }
- }
- }
- Qed.
-
- (* Before stating the next lemma, let (num_tasks_exceeding delta) be the
- number of interfering tasks that can execute on (alpha' tsk) whose
- interference x is larger than delta. *)
- Let num_tasks_exceeding delta := count (fun i => x i >= delta) (hp_tasks_in alpha').
-
- (* 6) Now we prove that, for any delta, if (num_task_exceeding delta > 0), then the
- cumulative interference caused by the complementary set of interfering tasks fills
- the remaining, not-completely-full (#|alpha' tsk| - num_tasks_exceeding delta)
- processors. *)
- Lemma bertogna_fp_interference_in_non_full_processors :
- forall delta,
- 0 < num_tasks_exceeding delta < #|alpha' tsk| ->
- \sum_(i <- hp_tasks_in alpha' | x i < delta) x i >= delta * (#|alpha' tsk| - num_tasks_exceeding delta).
- Proof.
- have ATMOST := platform_at_most_one_pending_job_of_each_task.
- have INV := bertogna_fp_alpha'_is_full.
- have DIFFTASK := bertogna_fp_interference_by_different_tasks.
- have COMP := bertogna_fp_previous_interfering_jobs_complete_by_their_period.
- rename H_all_jobs_from_taskset into FROMTS, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_affinity_subset into SUB,
- H_sporadic_tasks into SPO, H_respects_affinity into APA,
- H_constrained_deadlines into RESTR,
- H_sequential_jobs into SEQ, H_respects_FP_policy into FP.
- unfold sporadic_task_model in *.
- move => delta /andP [HAS LT].
- rewrite -has_count in HAS.
-
- set some_interference_A := fun t =>
- has (fun tsk_k => backlogged job_arrival job_cost sched j t &&
- (x tsk_k >= delta) &&
- scheduled_on_alpha_tsk t tsk_k)
- (hp_tasks_in alpha').
- set total_interference_B := fun t =>
- backlogged job_arrival job_cost sched j t *
- count (fun tsk_k => (x tsk_k < delta) &&
- scheduled_on_alpha_tsk t tsk_k) (hp_tasks_in alpha').
-
- apply leq_trans with ((\sum_(job_arrival j <= t < job_arrival j + R)
- some_interference_A t) * (#|alpha' tsk| - num_tasks_exceeding delta)).
- {
- rewrite leq_mul2r; apply/orP; right.
- move: HAS => /hasP HAS; destruct HAS as [tsk_a INa LEa].
- apply leq_trans with (n := x tsk_a); first by apply LEa.
- unfold x, task_interference, some_interference_A.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- last by rewrite (eq_bigr (fun x => 0)); [by simpl_sum_const | by ins].
- destruct ([exists cpu, can_execute_on alpha (job_task j) cpu &&
- task_scheduled_on job_task sched tsk_a cpu t]) eqn:SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED; move: SCHED => /forallP ALL.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (ALL cpu); apply negbTE in ALL; rewrite ALL.
- }
- move: SCHED => /existsP [cpu /andP [CAN SCHED]].
- apply leq_trans with (n := 1); last first.
- {
- rewrite lt0b; apply/hasP; exists tsk_a; first by done.
- rewrite LEa 2!andTb; apply/existsP; exists cpu.
- by apply/andP; split; first by rewrite -JOBtsk.
- }
- rewrite (bigD1 cpu) /= // SCHED.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const; rewrite leq_b1.
- intros cpu' DIFF.
- apply/eqP; rewrite eqb0; apply/negP.
- move => /andP [ALPHA' SCHED'].
- move: DIFF => /negP DIFF; apply DIFF; apply/eqP.
- unfold task_scheduled_on in *.
- destruct (sched cpu t) as [j1|] eqn:SCHED1; last by done.
- destruct (sched cpu' t) as [j2|] eqn:SCHED2; last by done.
- move: SCHED SCHED' => /eqP JOB /eqP JOB'.
- subst tsk_a; symmetry in JOB'.
- assert (BUG: j1 = j2).
- {
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu'; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu; rewrite /scheduled_on -SCHED1.
- }
- assert (SCHED2': pending job_arrival job_cost sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu'; rewrite /scheduled_on -SCHED2.
- }
- ( try ( apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (arr_seq0 := arr_seq) (task_period0 := task_period) (tsk0 := tsk) (alpha0 := alpha)
- (job_arrival0 := job_arrival) (higher_eq_priority0 := higher_eq_priority) (t0 := t)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) ) ||
- apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (arr_seq := arr_seq) (task_period := task_period) (tsk := tsk) (alpha := alpha)
- (job_arrival := job_arrival) (higher_eq_priority := higher_eq_priority) (t := t)
- (job_cost := job_cost) (job_task := job_task) (sched := sched)); try (by done);
- rewrite ?JOBtsk ?SAMEtsk //.
- {
- by intros j0 tsk0 TSK0 LE; subst tsk0; apply COMP.
- }
- {
- apply/andP; split; last first.
- {
- apply/existsP; exists cpu; apply/andP; split;
- first by rewrite -JOBtsk.
- by apply APA with (t := t); apply/eqP.
- }
- apply/andP; split.
- {
- by rewrite -JOBtsk; apply FP with (cpu := cpu) (t := t);
- try (by done); apply/eqP.
- }
- {
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu; apply/eqP.
- }
- }
- }
- by subst j2; apply SEQ with (j := j1) (t := t).
- }
-
- apply leq_trans with (\sum_(job_arrival j <= t < job_arrival j + R)
- total_interference_B t).
- {
- rewrite big_distrl /=.
- apply leq_sum_nat; move => t LEt _.
- unfold some_interference_A, total_interference_B.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- [rewrite mul1n /= | by rewrite has_pred0 //].
-
- destruct (has (fun tsk_k : sporadic_task => (delta <= x tsk_k) &&
- scheduled_on_alpha_tsk t tsk_k) (hp_tasks_in alpha')) eqn:HAS';
- last by done.
- rewrite mul1n; move: HAS => /hasP [tsk_k INk LEk].
- unfold num_tasks_exceeding.
- apply leq_trans with (n := #|alpha' tsk| -
- count (fun i => (x i >= delta) &&
- scheduled_on_alpha_tsk t i) (hp_tasks_in alpha')).
- {
- apply leq_sub2l.
- rewrite -2!sum1_count big_mkcond /=.
- rewrite [\sum_(_ <- _ | _ <= _)_]big_mkcond /=.
- apply leq_sum; intros i _.
- by destruct (scheduled_on_alpha_tsk t i);
- [by rewrite andbT | by rewrite andbF].
- }
- rewrite -count_filter -[count _ (hp_tasks_in _)]count_filter.
- eapply leq_trans with (n := count (predC (fun tsk => delta <= x tsk)) _);
- last by apply eq_leq, eq_in_count; red; ins; rewrite ltnNge.
- rewrite leq_subLR count_predC size_filter.
- move: INV => INV. by apply (INV t).
- }
- {
- unfold x at 2, total_interference_B.
- rewrite exchange_big /=; apply leq_sum; intros t _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last by ins.
- rewrite mul1n -sum1_count.
- rewrite big_mkcond [\sum_(i <- hp_tasks_in alpha' | _ < _) _]big_mkcond /=.
- apply leq_sum_seq; move => tsk_k IN _.
- destruct (x tsk_k < delta); [rewrite andTb | by rewrite andFb].
- destruct (scheduled_on_alpha_tsk t tsk_k) eqn:SCHED; last by done.
- move: SCHED => /existsP [cpu /andP [ALPHA SCHED]].
- rewrite (bigD1 cpu) /= // JOBtsk SCHED andbT.
- by rewrite /can_execute_on ALPHA.
- }
- Qed.
-
- (* 7) Based on lemma (6), we prove that, for any interval delta, if the sum of per-task
- interference exceeds (delta * |alpha' tsk|), the same applies for the
- sum of the minimum of the interference and delta. *)
- Lemma bertogna_fp_minimum_exceeds_interference :
- forall delta,
- \sum_(tsk_k <- hp_tasks_in alpha') x tsk_k >= delta * #|alpha' tsk| ->
- \sum_(tsk_k <- hp_tasks_in alpha') minn (x tsk_k) delta >=
- delta * #|alpha' tsk|.
- Proof.
- intros delta SUMLESS.
- set more_interf := fun tsk_k => x tsk_k >= delta.
- rewrite [\sum_(_ <- _) minn _ _](bigID more_interf) /=.
- unfold more_interf, minn.
- rewrite [\sum_(_ <- _ | delta <= _)_](eq_bigr (fun i => delta));
- last by intros i COND; rewrite leqNgt in COND; destruct (delta > x i).
- rewrite [\sum_(_ <- _ | ~~_)_](eq_big (fun i => x i < delta)
- (fun i => x i));
- [| by red; ins; rewrite ltnNge
- | by intros i COND; rewrite -ltnNge in COND; rewrite COND].
-
- (* Case 1: num_tasks_exceeding = 0 *)
- destruct (~~ has (fun i => delta <= x i) (hp_tasks_in alpha')) eqn:HASa.
- {
- rewrite [\sum_(_ <- _ | _ <= _) _]big_hasC; last by apply HASa.
- rewrite big_seq_cond; move: HASa => /hasPn HASa.
- rewrite add0n (eq_bigl (fun i => (i \in hp_tasks_in alpha') && true));
- last by red; intros tsk_k; destruct (tsk_k \in hp_tasks_in alpha') eqn:INk;
- [by rewrite andTb ltnNge; apply HASa | by rewrite andFb].
- by rewrite -big_seq_cond.
- } apply negbFE in HASa.
-
- (* Case 2: num_tasks_exceeding >= |alpha' tsk| *)
- destruct (num_tasks_exceeding delta >= #|alpha' tsk|) eqn:CARD.
- {
- apply leq_trans with (delta * num_tasks_exceeding delta);
- first by rewrite leq_mul2l; apply/orP; right.
- unfold num_tasks_exceeding; rewrite -sum1_count big_distrr /=.
- rewrite -[\sum_(_ <- _ | _) _]addn0.
- by apply leq_add; [by apply leq_sum; ins; rewrite muln1|by ins].
- } apply negbT in CARD; rewrite -ltnNge in CARD.
-
- (* Case 3: num_tasks_exceeding < |alpha' tsk| *)
- rewrite big_const_seq iter_addn addn0; fold num_tasks_exceeding.
- apply leq_trans with (n := delta * num_tasks_exceeding delta +
- delta * (#|alpha' tsk| - num_tasks_exceeding delta));
- first by rewrite -mulnDr subnKC //; apply ltnW.
- rewrite leq_add2l bertogna_fp_interference_in_non_full_processors //.
- by apply/andP; split; [by rewrite -has_count | by done].
- Qed.
-
- (* 8) Note that lemma (7) only refers to interference within subaffinity (alpha' tsk).
- To reason about the interference incurred by job j in its complete affinity,
- we prove that an exceeding interference on affinity (alpha tsk) also
- implies an exceeding interference on the subaffinity (alpha' tsk). *)
- Lemma bertogna_fp_interference_on_subaffinity :
- forall delta,
- \sum_(tsk_k <- hp_tasks_in alpha) x tsk_k >= delta * #|alpha tsk| ->
- \sum_(tsk_k <- hp_tasks_in alpha') x tsk_k >= delta * #|alpha' tsk|.
- Proof.
- have ALL := bertogna_fp_all_cpus_in_affinity_busy.
- have SUB := bertogna_fp_all_cpus_in_subaffinity_busy.
- rename H_at_least_one_cpu into NONEMPTY',
- H_job_of_tsk into JOBtsk, H_affinity_subset into SUBSET,
- H_all_jobs_from_taskset into FROMTS.
- intros delta LE.
- rewrite ALL in LE.
- apply leq_trans with (n := X * #|alpha' tsk|); last by apply SUB.
- rewrite leq_mul2r in LE; move: LE => /orP [/eqP EMPTY | LEx];
- last by rewrite leq_mul2r; apply/orP; right.
- assert (NONEMPTY: #|alpha tsk| > 0).
- {
- apply leq_trans with (n := #|alpha' tsk|);
- last by apply leq_subaffinity, SUBSET; rewrite -JOBtsk FROMTS.
- by apply NONEMPTY'; rewrite -JOBtsk FROMTS.
- }
- by rewrite EMPTY ltnn in NONEMPTY.
- Qed.
-
- (* 9) Next, using lemmas (0), (3), (7) and (8), we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_fp_sum_exceeds_total_interference:
- \sum_((tsk_other, R_other) <- hp_bounds | hp_task_in (alpha' tsk) tsk_other)
- minn (x tsk_other) (R - task_cost tsk + 1) >
- total_interference_bound_fp task_cost task_period alpha tsk
- (alpha' tsk) hp_bounds R higher_eq_priority.
- Proof.
- have EXCEEDS := bertogna_fp_minimum_exceeds_interference.
- have SUB := bertogna_fp_interference_on_subaffinity.
- have ALLBUSY := bertogna_fp_all_cpus_in_affinity_busy.
- have TOOMUCH := bertogna_fp_too_much_interference.
-
- rename H_hp_bounds_has_interfering_tasks into HAS,
- H_response_time_recurrence_holds into REC,
- H_at_least_one_cpu into NONEMPTY,
- H_affinity_subset into SUBSET.
- unfold total_interference_bound_fp.
- apply leq_trans with (n := \sum_(tsk_other <- hp_tasks_in alpha') minn (x tsk_other) (R - task_cost tsk + 1));
- last first.
- {
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- rewrite (eq_bigl (fun i => hp_task_in (alpha' tsk) (fst i)));
- last by intro p; destruct p.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) hp_bounds _ (fun y => minn (x y) (R - task_cost tsk + 1)).
- rewrite -MAP.
- rewrite -[\sum_(_ <- [seq fst _ | _ <- _] | _)_]big_filter.
- apply leq_sum_sub_uniq; first by apply filter_uniq; destruct ts.
- red; move => tsk0 IN0.
- rewrite mem_filter in IN0; move: IN0 => /andP [INTERF0 IN0].
- rewrite mem_filter; apply/andP; split; first by done.
- apply/mapP.
- exploit (HAS tsk0); [by done | | move => [R0 INbounds0]].
- {
- move: INTERF0 => /andP [HP INTER].
- apply/andP; split; first by done.
- move: INTER => /existsP [cpu /andP [IN1 IN2]].
- by apply/existsP; exists cpu; rewrite IN2 andbT; apply SUBSET.
- }
- by exists (tsk0, R0).
- }
- apply ltn_div_trunc with (d := #|alpha' tsk|); first by apply NONEMPTY.
- rewrite -(ltn_add2l (task_cost tsk)) -REC.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by rewrite REC; apply leq_addr.
- rewrite leq_divRL; last by apply NONEMPTY.
- apply EXCEEDS, SUB.
- apply leq_trans with (n := X * #|alpha tsk|); last by rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 10) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k, R - e_i + 1).
- This implies that x_k > W_k, which is of course a contradiction,
- since W_k is a valid task interference bound. *)
- Lemma bertogna_fp_exists_task_that_exceeds_bound :
- exists tsk_k R_k,
- (tsk_k, R_k) \in hp_bounds /\
- (minn (x tsk_k) (R - task_cost tsk + 1) >
- minn (workload_bound tsk_k R_k) (R - task_cost tsk + 1)).
- Proof.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_k, R_k) := tup in
- (minn (x tsk_k) (R - task_cost tsk + 1) >
- minn (workload_bound tsk_k R_k)(R - task_cost tsk + 1)))
- hp_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- have SUM := bertogna_fp_sum_exceeds_total_interference.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- unfold total_interference_bound_fp.
- rewrite big_seq_cond.
- rewrite [\sum_(i <- _| let '(tsk_other,_) := i in _)_]big_seq_cond.
- apply leq_sum; move => [tsk_k R_k /andP [IN INTERk]].
- specialize (ALL (tsk_k, R_k)); simpl in ALL.
- by rewrite leqNgt; apply ALL, IN.
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MIN].
- by exists tsk_k, R_k; repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- (* Using the lemmas above, we prove that R bounds the response time of tsk. *)
- Theorem bertogna_cirinei_response_time_bound_fp :
- response_time_bounded_by tsk R.
- Proof.
- have EX := bertogna_fp_exists_task_that_exceeds_bound.
- have WORKLOAD := bertogna_fp_workload_bounds_interference.
- rename H_response_time_bounds_ge_cost into GE_COST,
- H_interfering_tasks_miss_no_deadlines into NOMISS,
- H_response_time_recurrence_holds into REC,
- H_response_time_of_interfering_tasks_is_known into RESP,
- H_response_time_no_larger_than_deadline into LEdl.
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + R) as ctime.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- generalize dependent j.
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj JOBtsk EQc; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- service sched j0 (job_arrival j0 + R) >= job_cost j0).
- {
- by ins; apply IH; try (by done); rewrite ltn_add2r.
- } clear IH.
-
- unfold response_time_bounded_by, is_response_time_bound_of_task,
- completed, completed_jobs_dont_execute, valid_sporadic_job in *.
-
- (* Now we start the proof. Assume by contradiction that job j
- is not complete at time (job_arrival j + R). *)
- destruct (completed job_cost sched j (job_arrival j + R)) eqn:NOTCOMP;
- first by done.
- apply negbT in NOTCOMP; exfalso.
-
- (* We derive a contradiction using the previous lemmas. *)
- specialize (EX j ARRj JOBtsk NOTCOMP BEFOREok).
- destruct EX as [tsk_k [R_k [HPk LTmin]]].
- unfold minn at 1 in LTmin.
- specialize (WORKLOAD j tsk_k R_k HPk).
- destruct (W task_cost task_period tsk_k R_k R < R - task_cost tsk + 1); rewrite leq_min in LTmin;
- last by move: LTmin => /andP [_ BUG]; rewrite ltnn in BUG.
- move: LTmin => /andP [BUG _]; des.
- apply leq_trans with (p := W task_cost task_period tsk_k R_k R) in BUG; last by done.
- by rewrite ltnn in BUG.
- Qed.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisFP.
-
diff --git a/classic/analysis/apa/interference_bound.v b/classic/analysis/apa/interference_bound.v
deleted file mode 100644
index 4e740724e6491a00ec881dfaa425dcf10399d1b1..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/interference_bound.v
+++ /dev/null
@@ -1,45 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.analysis.apa.workload_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundGeneric.
-
- Section Definitions.
-
- Import Schedule WorkloadBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Variable num_cpus: nat.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- Section PerTask.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* Based on the workload bound, Bertogna and Cirinei define the
- following interference bound for a task. *)
- Definition interference_bound_generic :=
- minn (W task_cost task_period tsk_other R_other delta) (delta - (task_cost tsk) + 1).
-
- End PerTask.
-
- End Definitions.
-
-End InterferenceBoundGeneric.
\ No newline at end of file
diff --git a/classic/analysis/apa/interference_bound_edf.v b/classic/analysis/apa/interference_bound_edf.v
deleted file mode 100644
index 4a9a8b57f25c7ea14e217cfd0a7b88ee0057be7e..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/interference_bound_edf.v
+++ /dev/null
@@ -1,1229 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.response_time
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.platform prosa.classic.model.schedule.apa.interference
- prosa.classic.model.schedule.apa.interference_edf prosa.classic.model.schedule.apa.affinity.
-Require Import prosa.classic.analysis.apa.workload_bound prosa.classic.analysis.apa.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-(* In this file, we define the reduction-based interference bound for APA
- scheduling with EDF, based on Bertogna and Cirinei's interference bound. *)
-Module InterferenceBoundEDF.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask Schedulability
- WorkloadBound ResponseTime Priority Affinity
- TaskArrival Interference InterferenceEDF.
- Export InterferenceBoundGeneric.
-
- (* First we define Bertogna and Cirinei's EDF-specific interference bound. *)
- Section SpecificBoundDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- (* Consider the interference incurred by tsk in a window of length delta... *)
- Variable delta: time.
-
- (* ... due to a different task tsk_other, with response-time bound R_other. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
-
- (* Bertogna and Cirinei define the following bound for task interference
- under EDF scheduling. *)
- Definition edf_specific_interference_bound :=
- let d_tsk := task_deadline tsk in
- let e_other := task_cost tsk_other in
- let p_other := task_period tsk_other in
- let d_other := task_deadline tsk_other in
- (div_floor d_tsk p_other) * e_other +
- minn e_other ((d_tsk %% p_other) - (d_other - R_other)).
-
- End SpecificBoundDef.
-
- (* Next, we define the total interference bound for EDF, which combines the generic
- and the EDF-specific bounds. *)
- Section TotalInterferenceBoundEDF.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {num_cpus: nat}.
-
- (* Assume that each task has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Let tsk be the task to be analyzed, ... *)
- Variable tsk: sporadic_task.
-
- (* ... and let alpha' be any subaffinity of tsk. *)
- Variable alpha': affinity num_cpus.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- (* First we recall the interference bounds. *)
- Section RecallInterferenceBounds.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* By combining Bertogna's interference bound for a work-conserving
- scheduler ... *)
- Let basic_interference_bound := interference_bound_generic task_cost task_period tsk delta tsk_R.
-
- (* ... with and EDF-specific interference bound, ... *)
- Let edf_specific_bound := edf_specific_interference_bound task_cost task_period task_deadline tsk tsk_other R_other.
-
- (* ... Bertogna and Cirinei define the following interference bound
- under EDF scheduling. *)
- Definition interference_bound_edf :=
- minn basic_interference_bound edf_specific_bound.
-
- End RecallInterferenceBounds.
-
- (* Next we define the computation of the total interference for APA scheduling. *)
- Section TotalInterference.
-
- (* Let (other_task_in alpha') denote the other tasks that can execute on alpha'. *)
- Let other_task_in alpha' := different_task_in alpha tsk alpha'.
-
- (* The total interference incurred by tsk is bounded by the sum of individual
- interferences of the other tasks that can be scheduled on alpha'. *)
- Definition total_interference_bound_edf :=
- \sum_((tsk_other, R_other) <- R_prev | other_task_in alpha' tsk_other)
- interference_bound_edf (tsk_other, R_other).
-
- End TotalInterference.
-
- End TotalInterferenceBoundEDF.
-
- (* In this section, we show that the EDF-specific interference bound is safe. *)
- Section ProofSpecificBound.
-
- Import Schedule Interference Platform SporadicTaskset Affinity.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs do not execute before their arrival times nor longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that jobs are sequential and that
- there exists at least one processor. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Assume that every job at any time has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Consider a task set ts where all jobs come from the task set
- and tasks have valid parameters and constrained deadlines. *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Assume that the scheduler is a work-conserving EDF scheduler. *)
- Hypothesis H_work_conserving: apa_work_conserving job_arrival job_cost job_task arr_seq
- sched alpha.
- Hypothesis H_edf_weak_APA_scheduler:
- respects_JLFP_policy_under_weak_APA job_arrival job_cost job_task arr_seq
- sched alpha (EDF job_arrival job_deadline).
-
- (* Let tsk_i be the task to be analyzed, ...*)
- Variable tsk_i: sporadic_task.
- Hypothesis H_tsk_i_in_task_set: tsk_i \in ts.
-
- (* ... and j_i one of its jobs. *)
- Variable j_i: Job.
- Hypothesis H_j_i_arrives: arrives_in arr_seq j_i.
- Hypothesis H_job_of_tsk_i: job_task j_i = tsk_i.
-
- (* Let tsk_k denote any interfering task, ... *)
- Variable tsk_k: sporadic_task.
- Hypothesis H_tsk_k_in_task_set: tsk_k \in ts.
-
- (* ...and R_k its response-time bound. *)
- Variable R_k: time.
- Hypothesis H_R_k_le_deadline: R_k <= task_deadline tsk_k.
-
- (* Consider a time window of length delta <= D_i, starting with j_i's arrival time. *)
- Variable delta: time.
- Hypothesis H_delta_le_deadline: delta <= task_deadline tsk_i.
-
- (* Assume that the jobs of tsk_k satisfy the response-time bound before the end of the interval *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_k,
- arrives_in arr_seq j_k ->
- job_task j_k = tsk_k ->
- job_arrival j_k + R_k < job_arrival j_i + delta ->
- completed job_cost sched j_k (job_arrival j_k + R_k).
-
- (* In this section, we prove that Bertogna and Cirinei's EDF interference bound
- indeed bounds the interference caused by task tsk_k in the interval [t1, t1 + delta). *)
- Section MainProof.
-
- (* Let's call x the task interference incurred by job j due to tsk_k. *)
- Let x :=
- task_interference job_arrival job_cost job_task sched alpha j_i
- tsk_k (job_arrival j_i) (job_arrival j_i + delta).
-
- (* Also, recall the EDF-specific interference bound for EDF. *)
- Let interference_bound :=
- edf_specific_interference_bound task_cost task_period task_deadline tsk_i tsk_k R_k.
-
- (* Let's simplify the names a bit. *)
- Let t1 := job_arrival j_i.
- Let t2 := job_arrival j_i + delta.
- Let D_i := task_deadline tsk_i.
- Let D_k := task_deadline tsk_k.
- Let p_k := task_period tsk_k.
-
- Let n_k := div_floor D_i p_k.
-
- (* Let's give a simpler name to job interference. *)
- Let interference_caused_by := job_interference job_arrival job_cost job_task sched alpha j_i.
-
- (* Identify the subset of jobs that actually cause interference *)
- Let interfering_jobs :=
- filter (fun j' => (job_task j' == tsk_k) && (interference_caused_by j' t1 t2 != 0))
- (jobs_scheduled_between sched t1 t2).
-
- (* Now, consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := sort earlier_arrival interfering_jobs.
-
- (* Now we proceed with the proof. The first step consists in simplifying the sum corresponding to the workload. *)
- Section SimplifyJobSequence.
-
- (* Use the alternative definition of task interference, based on
- individual job interference. *)
- Lemma interference_bound_edf_use_another_definition :
- x <= \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2.
- Proof.
- by apply interference_le_interference_joblist.
- Qed.
-
- (* Remove the elements that we don't care about from the sum *)
- Lemma interference_bound_edf_simpl_by_filtering_interfering_jobs :
- \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2 =
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2.
- Proof.
- unfold interfering_jobs; rewrite big_filter.
- rewrite big_mkcond; rewrite [\sum_(_ <- _ | _) _]big_mkcond /=.
- apply eq_bigr; intros i _; clear -i.
- destruct (job_task i == tsk_k); rewrite ?andTb ?andFb; last by done.
- destruct (interference_caused_by i t1 t2 != 0) eqn:DIFF; first by done.
- by apply negbT in DIFF; rewrite negbK in DIFF; apply/eqP.
- Qed.
-
- (* Then, we consider the sum over the sorted sequence of jobs. *)
- Lemma interference_bound_edf_simpl_by_sorting_interfering_jobs :
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2 =
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2.
- Proof.
- by rewrite (perm_big sorted_jobs) /=; last by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Note that both sequences have the same set of elements. *)
- Lemma interference_bound_edf_job_in_same_sequence :
- forall j,
- (j \in interfering_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Also recall that all jobs in the sorted sequence is an interfering job of tsk_k, ... *)
- Lemma interference_bound_edf_all_jobs_from_tsk_k :
- forall j,
- j \in sorted_jobs ->
- arrives_in arr_seq j /\
- job_task j = tsk_k /\
- interference_caused_by j t1 t2 != 0 /\
- j \in jobs_scheduled_between sched t1 t2.
- Proof.
- intros j LT.
- rewrite -interference_bound_edf_job_in_same_sequence mem_filter in LT.
- move: LT => /andP [/andP [/eqP JOBi SERVi] INi]; repeat split; try (by done).
- unfold jobs_scheduled_between in *; rewrite mem_undup in INi.
- apply mem_bigcat_nat_exists in INi; des.
- rewrite mem_scheduled_jobs_eq_scheduled in INi.
- by apply (H_jobs_come_from_arrival_sequence j i).
- Qed.
-
- (* ...and consecutive jobs are ordered by arrival. *)
- Lemma interference_bound_edf_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- (* Finally, for any job of task tsk_k, the interference is bounded by the task cost. *)
- Lemma interference_bound_edf_interference_le_task_cost :
- forall j,
- j \in interfering_jobs ->
- interference_caused_by j t1 t2 <= task_cost tsk_k.
- Proof.
- rename H_valid_job_parameters into PARAMS.
- intros j IN.
- feed (interference_bound_edf_all_jobs_from_tsk_k j);
- first by rewrite -interference_bound_edf_job_in_same_sequence.
- move => [ARRj [TSKj [_ SCHEDj]]].
- specialize (PARAMS j ARRj); des.
- apply leq_trans with (n := service_during sched j t1 t2);
- first by apply job_interference_le_service.
- try ( by apply cumulative_service_le_task_cost with (job_task0 := job_task)
- (task_deadline0 := task_deadline) (job_cost0 := job_cost)
- (job_deadline0 := job_deadline) ) ||
- by apply cumulative_service_le_task_cost with (job_task := job_task)
- (task_deadline := task_deadline) (job_cost := job_cost)
- (job_deadline := job_deadline).
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section InterferenceFewJobs.
-
- Hypothesis H_few_jobs: size sorted_jobs <= n_k.
-
- Lemma interference_bound_edf_holds_for_at_most_n_k_jobs :
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2 <=
- interference_bound.
- Proof.
- rewrite -[\sum_(_ <- _ | _) _]addn0 leq_add //.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk_k);
- last by rewrite big_const_seq iter_addn addn0 mulnC leq_mul2r; apply/orP; right.
- {
- rewrite [\sum_(_ <- _) interference_caused_by _ _ _]big_seq_cond.
- rewrite [\sum_(_ <- _) task_cost _]big_seq_cond.
- apply leq_sum; intros i; move/andP => [INi _].
- rewrite -interference_bound_edf_job_in_same_sequence in INi.
- by apply interference_bound_edf_interference_le_task_cost.
- }
- Qed.
-
- End InterferenceFewJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0. *)
- Section InterferenceManyJobs.
-
- Hypothesis H_many_jobs: n_k < size sorted_jobs.
-
- (* This trivially implies that there's at least one job. *)
- Lemma interference_bound_edf_at_least_one_job: size sorted_jobs > 0.
- Proof.
- by apply leq_ltn_trans with (n := n_k).
- Qed.
-
- (* Let j_fst be the first job, and a_fst its arrival time. *)
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let a_fst := job_arrival j_fst.
-
- (* In this section, we prove some basic lemmas about j_fst. *)
- Section FactsAboutFirstJob.
-
- (* The first job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_fst_is_job_of_tsk_k :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk_k /\
- interference_caused_by j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth,
- interference_bound_edf_at_least_one_job.
- Qed.
-
- (* The deadline of j_fst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_fst_deadline :
- job_deadline j_fst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- by specialize (PARAMS j_fst FSTarr); des; rewrite PARAMS1 FSTtask.
- Qed.
-
- (* The deadline of j_i is the deadline of tsk_i. *)
- Lemma interference_bound_edf_j_i_deadline :
- job_deadline j_i = task_deadline tsk_i.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS,
- H_job_of_tsk_i into JOBtsk.
- by specialize (PARAMS j_i H_j_i_arrives); des; rewrite PARAMS1 JOBtsk.
- Qed.
-
- (* If j_fst completes by its response-time bound, then t1 <= a_fst + R_k,
- where t1 is the beginning of the time window (arrival of j_i). *)
- Lemma interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval :
- completed job_cost sched j_fst (a_fst + R_k) ->
- t1 <= a_fst + R_k.
- Proof.
- intros RBOUND.
- rewrite leqNgt; apply/negP; unfold not; intro BUG.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [_ [ FSTserv _]]].
- move: FSTserv => /negP FSTserv; apply FSTserv.
- rewrite -leqn0; apply leq_trans with (n := service_during sched j_fst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_after_job_rt_zero with (job_cost0 := job_cost) (R := R_k)
- (job_arrival0 := job_arrival); try (by done); apply ltnW ) ||
- by apply cumulative_service_after_job_rt_zero with (job_cost := job_cost) (R := R_k)
- (job_arrival := job_arrival); try (by done); apply ltnW.
- Qed.
-
- End FactsAboutFirstJob.
-
- (* Now, let's prove the interference bound for the particular case of a single job.
- This case must be solved separately because the single job can simultaneously
- be carry-in and carry-out job, so its response time is not necessarily
- bounded by R_k (from the hypothesis H_all_previous_jobs_completed_on_time). *)
- Section InterferenceSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_only_one_job: size sorted_jobs = 1.
-
- (* Since there's only one job, we simplify the terms in the interference bound. *)
- Lemma interference_bound_edf_simpl_when_there's_one_job :
- D_i %% p_k - (D_k - R_k) = D_i - (D_k - R_k).
- Proof.
- rename H_many_jobs into NUM,
- H_valid_task_parameters into TASK_PARAMS,
- H_tsk_k_in_task_set into INk.
- unfold valid_sporadic_taskset, is_valid_sporadic_task,
- interference_bound, edf_specific_interference_bound in *.
- rewrite H_only_one_job in NUM.
- rewrite ltnS leqn0 in NUM; move: NUM => /eqP EQnk.
- move: EQnk => /eqP EQnk; unfold n_k, div_floor in EQnk.
- rewrite -leqn0 leqNgt divn_gt0 in EQnk;
- last by specialize (TASK_PARAMS tsk_k INk); des.
- by rewrite -ltnNge in EQnk; rewrite modn_small //.
- Qed.
-
- (* Next, we show that if j_fst completes by its response-time bound R_k,
- then then interference bound holds. *)
- Section ResponseTimeOfSingleJobBounded.
-
- Hypothesis H_j_fst_completed_by_rt_bound :
- completed job_cost sched j_fst (a_fst + R_k).
-
- Lemma interference_bound_edf_holds_for_single_job_that_completes_on_time :
- job_interference job_arrival job_cost job_task sched alpha j_i j_fst t1 t2
- <= D_i - (D_k - R_k).
- Proof.
- rename H_j_fst_completed_by_rt_bound into RBOUND.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval RBOUND.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [_ [ LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- destruct (D_k - R_k <= D_i) eqn:LEdk; last first.
- {
- apply negbT in LEdk; rewrite -ltnNge in LEdk.
- apply leq_trans with (n := 0); last by done.
- apply leq_trans with (n := job_interference job_arrival job_cost job_task sched
- alpha j_i j_fst (a_fst + R_k) t2).
- {
- apply extend_sum; last by apply leqnn.
- rewrite -(leq_add2r D_i).
- rewrite interference_bound_edf_j_fst_deadline
- interference_bound_edf_j_i_deadline in LEdl.
- apply leq_trans with (n := a_fst + D_k); last by done.
- rewrite -addnA leq_add2l.
- by apply ltnW; rewrite -ltn_subRL.
- }
- apply leq_trans with (n := service_during sched j_fst (a_fst + R_k) t2);
- first by apply job_interference_le_service.
- unfold service_during; rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_after_job_rt_zero with (job_cost0 := job_cost) (R := R_k)
- (job_arrival0 := job_arrival); try (by done); apply leqnn ) ||
- by apply cumulative_service_after_job_rt_zero with (job_cost := job_cost) (R := R_k)
- (job_arrival := job_arrival); try (by done); apply leqnn.
- }
- {
- rewrite -(leq_add2r (D_k - R_k)) addnBAC // -addnBA // subnn addn0.
- assert (SUBST: D_k - R_k = \sum_(a_fst + R_k <= i < a_fst + D_k) 1).
- {
- rewrite big_const_nat iter_addn mul1n addn0.
- rewrite addnC -subnBA; last by apply leq_addr.
- by rewrite addnC -addnBA // subnn addn0.
- }
- apply leq_trans with (n := job_interference job_arrival job_cost job_task sched alpha j_i j_fst t1
- (a_fst + D_k) + (D_k - R_k)).
- {
- rewrite leq_add2r.
- destruct (t2 <= a_fst + R_k) eqn:LEt2.
- {
- apply extend_sum; first by apply leqnn.
- apply leq_trans with (n := a_fst + R_k); first by done.
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- {
- unfold job_interference.
- apply negbT in LEt2; rewrite -ltnNge in LEt2.
- rewrite -> big_cat_nat with (n := a_fst + R_k);
- [simpl | by apply AFTERt1 | by apply ltnW].
- apply leq_trans with (n := job_interference job_arrival job_cost job_task sched alpha j_i j_fst t1
- (a_fst + R_k) + service_during sched j_fst (a_fst + R_k) t2).
- {
- rewrite leq_add2l.
- by apply job_interference_le_service.
- }
- unfold service_during.
- rewrite (cumulative_service_after_job_rt_zero job_arrival job_cost _ _ _ R_k) //.
- rewrite addn0; apply extend_sum; first by apply leqnn.
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- }
-
- unfold job_interference.
- rewrite -> big_cat_nat with (n := a_fst + R_k);
- [simpl| by apply AFTERt1 | by rewrite leq_add2l; apply H_R_k_le_deadline].
- apply leq_trans with (n := job_interference job_arrival job_cost job_task sched alpha j_i j_fst t1
- (a_fst+R_k) + service_during sched j_fst (a_fst+R_k) (a_fst+D_k) + (D_k-R_k));
- first by rewrite leq_add2r leq_add2l job_interference_le_service.
- unfold service_during.
- rewrite (cumulative_service_after_job_rt_zero job_arrival job_cost _ _ _ R_k) // addn0.
- apply leq_trans with (n := (\sum_(t1 <= t < a_fst + R_k) 1) +
- \sum_(a_fst + R_k <= t < a_fst + D_k) 1).
- {
- apply leq_add; last by rewrite SUBST.
- rewrite big_const_nat iter_addn mul1n addn0.
- rewrite -{1}[a_fst + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- rewrite -big_cat_nat;
- [simpl | by apply AFTERt1 | by rewrite leq_add2l; apply H_R_k_le_deadline ].
- rewrite big_const_nat iter_addn mul1n addn0 leq_subLR.
- by unfold D_i, D_k, t1, a_fst; rewrite -interference_bound_edf_j_fst_deadline
- -interference_bound_edf_j_i_deadline.
- }
- Qed.
-
- End ResponseTimeOfSingleJobBounded.
-
- (* Else, if j_fst did not complete by its response-time bound, then
- we need a separate proof. *)
- Section ResponseTimeOfSingleJobNotBounded.
-
- Hypothesis H_j_fst_not_complete_by_rt_bound :
- ~~ completed job_cost sched j_fst (a_fst + R_k).
-
- (* This trivially implies that a_fst + R_k lies after the end of the interval,
- otherwise j_fst would have completed by its response-time bound. *)
- Lemma interference_bound_edf_response_time_bound_of_j_fst_after_interval :
- job_arrival j_fst + R_k >= job_arrival j_i + delta.
- Proof.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- rewrite leqNgt; apply/negP; intro LT.
- move: H_j_fst_not_complete_by_rt_bound => /negP BUG; apply BUG.
- by apply H_all_previous_jobs_completed_on_time.
- Qed.
-
- (* If the slack is too big (D_i < D_k - R_k), j_fst causes no interference. *)
- Lemma interference_bound_edf_holds_for_single_job_with_big_slack :
- D_i < D_k - R_k ->
- interference_caused_by j_fst t1 t2 = 0.
- Proof.
- intro LTdk.
- rewrite ltn_subRL in LTdk.
- rewrite -(ltn_add2l a_fst) addnA in LTdk.
- apply leq_ltn_trans with (m := t1 + D_i) in LTdk; last first.
- {
- rewrite leq_add2r.
- apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- by apply interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- }
- apply/eqP; rewrite -[_ _ _ _ == 0]negbK; apply/negP; red; intro BUG.
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in BUG; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in BUG; try (by done).
- rewrite interference_bound_edf_j_fst_deadline
- interference_bound_edf_j_i_deadline in BUG.
- by apply (leq_trans LTdk) in BUG; rewrite ltnn in BUG.
- Qed.
-
- (* Else, if the slack is small, j_fst causes interference for no longer than
- D_i - (D_k - R_k). *)
- Lemma interference_bound_edf_holds_for_single_job_with_small_slack :
- D_i >= D_k - R_k ->
- interference_caused_by j_fst t1 t2 <= D_i - (D_k - R_k).
- Proof.
- intro LEdk.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask [LEdl _]]].
- have LTr := interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- apply leq_subRL_impl; rewrite addnC.
- apply leq_trans with (n := job_interference job_arrival job_cost job_task sched alpha j_i j_fst t1
- (job_arrival j_fst + R_k) + (D_k - R_k));
- first by rewrite leq_add2r; apply extend_sum; [by apply leqnn|].
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 +
- \sum_(a_fst + R_k <= t < a_fst + D_k)1).
- {
- apply leq_add.
- {
- rewrite big_const_nat iter_addn mul1n addn0.
- rewrite -{1}[job_arrival j_fst + R_k](addKn t1) -addnBA;
- first by apply job_interference_le_delta.
- by apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- }
- rewrite big_const_nat iter_addn mul1n addn0 addnC.
- rewrite -subnBA; last by apply leq_addr.
- by rewrite addnC -addnBA // subnn addn0.
- }
- rewrite -big_cat_nat; simpl; last 2 first.
- {
- apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- by apply interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- }
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- rewrite big_const_nat iter_addn mul1n addn0 leq_subLR.
- unfold D_i, D_k, t1, a_fst; rewrite -interference_bound_edf_j_fst_deadline
- -interference_bound_edf_j_i_deadline.
- try ( by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl ) ||
- by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl.
- Qed.
-
- End ResponseTimeOfSingleJobNotBounded.
-
- (* By combining the results above, we prove that the interference caused by the single job
- is bounded by D_i - (D_k - R_k), ... *)
- Lemma interference_bound_edf_interference_of_j_fst_limited_by_slack :
- interference_caused_by j_fst t1 t2 <= D_i - (D_k - R_k).
- Proof.
- destruct (completed job_cost sched j_fst (a_fst + R_k)) eqn:COMP;
- first by apply interference_bound_edf_holds_for_single_job_that_completes_on_time.
- apply negbT in COMP.
- destruct (ltnP D_i (D_k - R_k)) as [LEdk | LTdk].
- by rewrite interference_bound_edf_holds_for_single_job_with_big_slack.
- by apply interference_bound_edf_holds_for_single_job_with_small_slack.
- Qed.
-
- (* ... and thus the interference bound holds. *)
- Lemma interference_bound_edf_holds_for_a_single_job :
- interference_caused_by j_fst t1 t2 <= interference_bound.
- Proof.
- have ONE := interference_bound_edf_simpl_when_there's_one_job.
- have SLACK := interference_bound_edf_interference_of_j_fst_limited_by_slack.
- rename H_many_jobs into NUM, H_only_one_job into SIZE.
- unfold interference_caused_by, interference_bound, edf_specific_interference_bound.
- fold D_i D_k p_k n_k.
- rewrite SIZE ltnS leqn0 in NUM; move: NUM => /eqP EQnk.
- rewrite EQnk mul0n add0n.
- rewrite leq_min; apply/andP; split.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite SIZE.
- }
- by rewrite ONE; apply SLACK.
- Qed.
-
- End InterferenceSingleJob.
-
- (* Next, consider the other case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section InterferenceTwoOrMoreJobs.
-
- (* Assume there are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- (* Let j_lst be the last job of the sequence and a_lst its arrival time. *)
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
- Let a_lst := job_arrival j_lst.
-
- (* In this section, we prove some basic lemmas about the first and last jobs. *)
- Section FactsAboutFirstAndLastJobs.
-
- (* The last job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_lst_is_job_of_tsk_k:
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk_k /\
- interference_caused_by j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The deadline of j_lst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_lst_deadline :
- job_deadline j_lst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [LSTtask _]].
- by specialize (PARAMS j_lst LSTarr); des; rewrite PARAMS1 LSTtask.
- Qed.
-
- (* The first job arrives before the last job. *)
- Lemma interference_bound_edf_j_fst_before_j_lst :
- job_arrival j_fst <= job_arrival j_lst.
- Proof.
- rename H_at_least_two_jobs into SIZE.
- unfold j_fst, j_lst; rewrite -[num_mid_jobs.+1]add0n.
- apply prev_le_next; last by rewrite SIZE leqnn.
- by intros i LT; apply interference_bound_edf_jobs_ordered_by_arrival.
- Qed.
-
- (* The last job arrives before the end of the interval. *)
- Lemma interference_bound_edf_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- exploit interference_bound_edf_all_jobs_from_tsk_k.
- {
- apply mem_nth; instantiate (1 := num_mid_jobs.+1).
- by rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- }
- instantiate (1 := elem); move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- apply LSTserv; apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := service_during sched j_lst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP; unfold service_during.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- Qed.
-
- (* Since there are multiple jobs, j_fst is far enough from the end of
- the interval that its response-time bound is valid
- (by the assumption H_all_previous_jobs_completed_on_time). *)
- Lemma interference_bound_edf_j_fst_completed_on_time :
- completed job_cost sched j_fst (a_fst + R_k).
- Proof.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k; des.
- set j_snd := nth elem sorted_jobs 1.
- exploit interference_bound_edf_all_jobs_from_tsk_k.
- {
- by apply mem_nth; instantiate (1 := 1); rewrite H_at_least_two_jobs.
- }
- instantiate (1 := elem); move => [SNDarr [SNDtsk [/eqP SNDserv _]]].
- apply H_all_previous_jobs_completed_on_time; try (by done).
- apply leq_ltn_trans with (n := job_arrival j_snd); last first.
- {
- rewrite ltnNge; apply/negP; red; intro BUG; apply SNDserv.
- apply/eqP; rewrite -leqn0; apply leq_trans with (n := service_during
- sched j_snd t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- }
- apply leq_trans with (n := a_fst + p_k).
- {
- by rewrite leq_add2l; apply leq_trans with (n := D_k);
- [by apply H_R_k_le_deadline | by apply H_constrained_deadlines].
- }
-
- (* Since jobs are sporadic, we know that the first job arrives
- at least p_k units before the second. *)
- unfold p_k; rewrite -FST0.
- apply H_sporadic_tasks; try (by done); [| by rewrite SNDtsk | ]; last first.
- {
- apply interference_bound_edf_jobs_ordered_by_arrival.
- by rewrite H_at_least_two_jobs.
- }
- red; move => /eqP BUG.
- by rewrite nth_uniq in BUG; rewrite ?SIZE //;
- [ by apply interference_bound_edf_at_least_one_job
- | by rewrite H_at_least_two_jobs
- | by rewrite sort_uniq; apply filter_uniq, undup_uniq].
- Qed.
-
- End FactsAboutFirstAndLastJobs.
-
- (* Next, we prove that the distance between the first and last jobs is at least
- num_mid_jobs + 1 periods. *)
- Lemma interference_bound_edf_many_periods_in_between :
- a_lst - a_fst >= num_mid_jobs.+1 * p_k.
- Proof.
- clear H_at_least_one_cpu H_tsk_i_in_task_set H_delta_le_deadline.
- unfold a_fst, a_lst, j_fst, j_lst.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- rewrite EQnk telescoping_sum;
- last by ins; apply interference_bound_edf_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk_k]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply interference_bound_edf_jobs_ordered_by_arrival.
-
- feed (interference_bound_edf_all_jobs_from_tsk_k cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (interference_bound_edf_all_jobs_from_tsk_k next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first by move: EQ => /eqP EQ; try lia.
- by apply ltn_trans with (n := (size sorted_jobs).-1); destruct sorted_jobs; ins.
- by destruct sorted_jobs; ins.
- by rewrite sort_uniq -/interfering_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk.
- }
- by rewrite leq_subRL_impl // /p_k -CURtsk.
- Qed.
-
- (* Using the lemma above, we prove that the ratio n_k is at least the number of
- middle jobs + 1, ... *)
- Lemma interference_bound_edf_n_k_covers_middle_jobs_plus_one :
- n_k >= num_mid_jobs.+1.
- Proof.
- have DIST := interference_bound_edf_many_periods_in_between.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- rename H_valid_task_parameters into TASK_PARAMS,
- H_tsk_k_in_task_set into INk.
- unfold valid_sporadic_taskset, is_valid_sporadic_task,
- interference_bound, edf_specific_interference_bound in *.
- rewrite leqNgt; apply/negP; unfold not; intro LTnk; unfold n_k in LTnk.
- rewrite ltn_divLR in LTnk; last by specialize (TASK_PARAMS tsk_k INk); des.
- apply (leq_trans LTnk) in DIST; rewrite ltn_subRL in DIST.
- rewrite -(ltn_add2r D_k) -addnA [D_i + _]addnC addnA in DIST.
- apply leq_ltn_trans with (m := job_arrival j_i + D_i) in DIST; last first.
- {
- rewrite leq_add2r; apply (leq_trans AFTERt1).
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [ LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- unfold D_i, D_k in DIST; rewrite interference_bound_edf_j_lst_deadline
- interference_bound_edf_j_i_deadline in LEdl.
- by rewrite ltnNge LEdl in DIST.
- Qed.
-
- (* ... which allows bounding the interference of the middle and last jobs
- using n_k multiplied by the cost. *)
- Lemma interference_bound_edf_holds_for_middle_and_last_jobs :
- interference_caused_by j_lst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- interference_caused_by (nth elem sorted_jobs i.+1) t1 t2
- <= n_k * task_cost tsk_k.
- Proof.
- apply leq_trans with (n := num_mid_jobs.+1 * task_cost tsk_k); last first.
- {
- rewrite leq_mul2r; apply/orP; right.
- by apply interference_bound_edf_n_k_covers_middle_jobs_plus_one.
- }
- rewrite mulSn; apply leq_add.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- {
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs) task_cost tsk_k);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < num_mid_jobs) task_cost _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- apply mem_nth; rewrite H_at_least_two_jobs.
- by rewrite ltnS; apply leq_trans with (n := num_mid_jobs).
- }
- Qed.
-
- (* Now, since n_k < sorted_jobs = num_mid_jobs + 2, it follows that
- n_k = num_mid_jobs + 1. *)
- Lemma interference_bound_edf_n_k_equals_num_mid_jobs_plus_one :
- n_k = num_mid_jobs.+1.
- Proof.
- have NK := interference_bound_edf_n_k_covers_middle_jobs_plus_one.
- rename H_many_jobs into NUM, H_at_least_two_jobs into SIZE.
- by move: NK; rewrite leq_eqVlt orbC; move => /orP NK; des;
- [by rewrite SIZE ltnS leqNgt NK in NUM | by rewrite NK].
- Qed.
-
- (* After proving the bounds of the middle and last jobs, we do the same for
- the first job. This requires a different proof in order to exploit the slack. *)
- Section InterferenceOfFirstJob.
-
- (* As required by the next lemma, in order to move (D_i %% p_k) to the left of
- the inequality (<=), we must show that it is no smaller than the slack. *)
- Lemma interference_bound_edf_remainder_ge_slack :
- D_k - R_k <= D_i %% p_k.
- Proof.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- have NK := interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
- have DIST := interference_bound_edf_many_periods_in_between.
- rewrite -NK in DIST.
- rewrite -subndiv_eq_mod leq_subLR.
- fold (div_floor D_i p_k) n_k.
- rewrite addnBA; last by apply leq_trunc_div.
- apply leq_trans with (n := R_k + D_i - (a_lst - a_fst)); last by apply leq_sub2l.
- rewrite subnBA; last by apply interference_bound_edf_j_fst_before_j_lst.
- rewrite -(leq_add2r a_lst) addnBAC; last first.
- {
- apply leq_trans with (n := t2);
- [by apply ltnW, interference_bound_edf_last_job_arrives_before_end_of_interval|].
- rewrite addnC addnA.
- apply leq_trans with (n := t1 + D_i).
- unfold t2; rewrite leq_add2l; apply H_delta_le_deadline.
- by rewrite leq_add2r; apply AFTERt1.
- }
- rewrite -addnBA // subnn addn0 [D_k + _]addnC.
- apply leq_trans with (n := t1 + D_i);
- last by rewrite -addnA [D_i + _]addnC addnA leq_add2r addnC AFTERt1.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [ LSTserv _]]].
- unfold D_i, D_k, a_lst, t1; rewrite -interference_bound_edf_j_lst_deadline
- -interference_bound_edf_j_i_deadline.
- try ( by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LSTserv ) ||
- by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LSTserv.
- Qed.
-
- (* To conclude that the interference bound holds, it suffices to show that
- this reordered inequality holds. *)
- Lemma interference_bound_edf_simpl_by_moving_to_left_side :
- interference_caused_by j_fst t1 t2 + (D_k - R_k) + D_i %/ p_k * p_k <= D_i ->
- interference_caused_by j_fst t1 t2 <= D_i %% p_k - (D_k - R_k).
- Proof.
- intro LE.
- apply leq_subRL_impl.
- by rewrite addnC -subndiv_eq_mod; apply leq_subRL_impl; rewrite addnC.
- Qed.
-
- (* Next, we prove that interference caused by j_fst is bounded by the length
- of the interval [t1, a_fst + R_k), ... *)
- Lemma interference_bound_edf_interference_of_j_fst_bounded_by_response_time :
- interference_caused_by j_fst t1 t2 <= \sum_(t1 <= t < a_fst + R_k) 1.
- Proof.
- assert (AFTERt1: t1 <= a_fst + R_k).
- {
- apply interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval.
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- destruct (leqP t2 (a_fst + R_k)) as [LEt2 | GTt2].
- {
- apply leq_trans with (n := job_interference job_arrival job_cost job_task sched alpha j_i j_fst t1
- (a_fst + R_k));
- first by apply extend_sum; rewrite ?leqnn.
- simpl_sum_const; rewrite -{1}[_ + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- {
- unfold interference_caused_by, job_interference.
- rewrite -> big_cat_nat with (n := a_fst + R_k);
- [simpl | by apply AFTERt1 | by apply ltnW].
- rewrite -[\sum_(_ <= _ < _) 1]addn0; apply leq_add.
- {
- simpl_sum_const; rewrite -{1}[_ + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- apply leq_trans with (n := service_during sched j_fst (a_fst + R_k) t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- (try ( apply cumulative_service_after_job_rt_zero with (job_cost0 := job_cost) (R := R_k)
- (job_arrival0 := job_arrival) ) ||
- apply cumulative_service_after_job_rt_zero with (job_cost := job_cost) (R := R_k)
- (job_arrival := job_arrival)); [ by done | | by apply leqnn].
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- Qed.
-
- (* ..., which leads to the following bounds based on interval lengths. *)
- Lemma interference_bound_edf_bounding_interference_with_interval_lengths :
- interference_caused_by j_fst t1 t2 + (D_k - R_k) + D_i %/ p_k * p_k <=
- \sum_(t1 <= t < a_fst + R_k) 1
- + \sum_(a_fst + R_k <= t < a_fst + D_k) 1
- + \sum_(a_fst + D_k <= t < a_lst + D_k) 1.
- Proof.
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 + (D_k - R_k) +
- D_i %/ p_k * p_k).
- {
- rewrite 2!leq_add2r.
- apply interference_bound_edf_interference_of_j_fst_bounded_by_response_time.
- }
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 + (D_k - R_k) +
- (a_lst - a_fst)).
- {
- rewrite leq_add2l; fold (div_floor D_i p_k) n_k.
- rewrite interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
- by apply interference_bound_edf_many_periods_in_between.
- }
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 +
- \sum_(a_fst + R_k <= t < a_fst + D_k) 1 + \sum_(a_fst + D_k <= t < a_lst + D_k) 1).
- {
- by rewrite -2!addnA leq_add2l; apply leq_add;
- rewrite big_const_nat iter_addn mul1n addn0;
- rewrite ?subnDl ?subnDr leqnn.
- }
- by apply leqnn.
- Qed.
-
- (* To conclude, we show that the concatenation of these interval lengths equals
- (a_lst + D_k) - 1, ... *)
- Lemma interference_bound_edf_simpl_by_concatenation_of_intervals :
- \sum_(t1 <= t < a_fst + R_k) 1
- + \sum_(a_fst + R_k <= t < a_fst + D_k) 1
- + \sum_(a_fst + D_k <= t < a_lst + D_k) 1 = (a_lst + D_k) - t1.
- Proof.
- assert (AFTERt1: t1 <= a_fst + R_k).
- {
- apply interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval.
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- rewrite -big_cat_nat;
- [simpl | by apply AFTERt1 | by rewrite leq_add2l; apply H_R_k_le_deadline].
- rewrite -big_cat_nat; simpl; last 2 first.
- {
- apply leq_trans with (n := a_fst + R_k); first by apply AFTERt1.
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- {
- rewrite leq_add2r; unfold a_fst, a_lst, j_fst, j_lst.
- rewrite -[num_mid_jobs.+1]add0n; apply prev_le_next;
- last by rewrite add0n H_at_least_two_jobs ltnSn.
- by ins; apply interference_bound_edf_jobs_ordered_by_arrival.
- }
- by rewrite big_const_nat iter_addn mul1n addn0.
- Qed.
-
- (* ... which results in proving that (a_lst + D_k) - t1 <= D_i.
- This holds because high-priority jobs have earlier deadlines. Therefore,
- the interference caused by the first job is bounded by D_i %% p_k - (D_k - R_k). *)
- Lemma interference_bound_edf_interference_of_j_fst_limited_by_remainder_and_slack :
- interference_caused_by j_fst t1 t2 <= D_i %% p_k - (D_k - R_k).
- Proof.
- apply interference_bound_edf_simpl_by_moving_to_left_side.
- apply (leq_trans interference_bound_edf_bounding_interference_with_interval_lengths).
- rewrite interference_bound_edf_simpl_by_concatenation_of_intervals leq_subLR.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [ LSTserv _]]].
- unfold D_i, D_k, a_lst, t1; rewrite -interference_bound_edf_j_lst_deadline
- -interference_bound_edf_j_i_deadline.
- try ( by apply interference_under_edf_implies_shorter_deadlines
- with (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LSTserv ) ||
- by apply interference_under_edf_implies_shorter_deadlines
- with (arr_seq := arr_seq) (job_deadline := job_deadline) in LSTserv.
- Qed.
-
- End InterferenceOfFirstJob.
-
- (* Using the lemmas above we show that the interference bound works in the
- case of two or more jobs. *)
- Lemma interference_bound_edf_holds_for_multiple_jobs :
- \sum_(0 <= i < num_mid_jobs.+2)
- interference_caused_by (nth elem sorted_jobs i) t1 t2 <= interference_bound.
- Proof.
- (* Knowing that we have at least two elements, we take first and last out of the sum *)
- rewrite [nth]lock big_nat_recl // big_nat_recr // /= -lock.
- rewrite addnA addnC addnA.
-
- have NK := interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
-
- (* We use the lemmas we proved to show that the interference bound holds. *)
- unfold interference_bound, edf_specific_interference_bound.
- fold D_i D_k p_k n_k.
- rewrite addnC addnA; apply leq_add;
- first by rewrite addnC interference_bound_edf_holds_for_middle_and_last_jobs.
- rewrite leq_min; apply/andP; split.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- by apply interference_bound_edf_interference_of_j_fst_limited_by_remainder_and_slack.
- Qed.
-
- End InterferenceTwoOrMoreJobs.
-
- End InterferenceManyJobs.
-
- Theorem interference_bound_edf_bounds_interference :
- x <= interference_bound.
- Proof.
- (* Use the definition of workload based on list of jobs. *)
- apply (leq_trans interference_bound_edf_use_another_definition).
-
- (* We only care about the jobs that cause interference. *)
- rewrite interference_bound_edf_simpl_by_filtering_interfering_jobs.
-
- (* Now we order the list by job arrival time. *)
- rewrite interference_bound_edf_simpl_by_sorting_interfering_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply interference_bound_edf_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs as [| j]; [by rewrite ltn0 in NUM | by exists j].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a single job, or for multiple jobs. *)
- destruct n as [| num_mid_jobs].
- {
- rewrite big_nat_recr // big_geq //.
- rewrite [nth]lock /= -lock add0n.
- by apply interference_bound_edf_holds_for_a_single_job; rewrite SIZE.
- }
- {
- by apply interference_bound_edf_holds_for_multiple_jobs; first by rewrite SIZE.
- }
- Qed.
-
- End MainProof.
-
- End ProofSpecificBound.
-
- (* As required by the proof of convergence of EDF RTA, we show that the
- EDF-specific bound is monotonically increasing with both the size
- of the interval and the value of the previous response-time bounds. *)
- Section MonotonicitySpecificBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Variable tsk tsk_other: sporadic_task.
- Hypothesis H_period_positive: task_period tsk_other > 0.
-
- Variable delta delta' R R': time.
- Hypothesis H_delta_monotonic: delta <= delta'.
- Hypothesis H_response_time_monotonic: R <= R'.
- Hypothesis H_cost_le_rt_bound: task_cost tsk_other <= R.
-
- Lemma interference_bound_edf_monotonic :
- interference_bound_edf task_cost task_period task_deadline tsk delta (tsk_other, R) <=
- interference_bound_edf task_cost task_period task_deadline tsk delta' (tsk_other, R').
- Proof.
- rename H_response_time_monotonic into LEr, H_delta_monotonic into LEx,
- H_cost_le_rt_bound into LEcost, H_period_positive into GEperiod.
- unfold interference_bound_edf, interference_bound_generic.
- rewrite leq_min; apply/andP; split.
- {
- rewrite leq_min; apply/andP; split.
- apply leq_trans with (n := (minn (W task_cost task_period (fst (tsk_other, R))
- (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1)));
- first by apply geq_minl.
- apply leq_trans with (n := W task_cost task_period (fst (tsk_other, R))
- (snd (tsk_other, R)) delta);
- [by apply geq_minl | by apply W_monotonic].
- apply leq_trans with (n := minn (W task_cost task_period (fst (tsk_other, R)) (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1));
- first by apply geq_minl.
- apply leq_trans with (n := delta - task_cost tsk + 1);
- first by apply geq_minr.
- by rewrite leq_add2r leq_sub2r.
- }
- {
- apply leq_trans with (n := edf_specific_interference_bound task_cost task_period
- task_deadline tsk tsk_other R);
- first by apply geq_minr.
- unfold edf_specific_interference_bound; simpl.
- rewrite leq_add2l leq_min; apply/andP; split; first by apply geq_minl.
- apply leq_trans with (n := task_deadline tsk %% task_period tsk_other -
- (task_deadline tsk_other - R));
- [by apply geq_minr | by rewrite 2?leq_sub2l 2?leq_sub2r // leq_sub2l].
- }
- Qed.
-
- End MonotonicitySpecificBound.
-
-End InterferenceBoundEDF.
diff --git a/classic/analysis/apa/interference_bound_fp.v b/classic/analysis/apa/interference_bound_fp.v
deleted file mode 100644
index bfb8fdd3b612e6eba74d08a92717e21e501052aa..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/interference_bound_fp.v
+++ /dev/null
@@ -1,56 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.interference prosa.classic.model.schedule.apa.affinity.
-Require Import prosa.classic.analysis.apa.workload_bound prosa.classic.analysis.apa.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundFP.
-
- Import Schedule WorkloadBound Priority Interference Affinity.
- Export InterferenceBoundGeneric.
-
- Section Definitions.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Assume that each task has a processor affinity alpha. *)
- Context {num_cpus: nat}.
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Let tsk be the task to be analyzed ... *)
- Variable tsk: sporadic_task.
-
- (* ... under subaffinity alpha'. *)
- Variable alpha': affinity num_cpus.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- (* Assume an FP policy. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* Recall the generic interference bound. *)
- Let total_interference_bound := interference_bound_generic task_cost task_period tsk delta.
-
- (* Let (hp_task_in alpha') denote the higher-priority tasks that can execute on alpha'. *)
- Let hp_task_in alpha' := higher_priority_task_in alpha higher_eq_priority tsk alpha'.
-
- (* The total interference incurred by tsk is bounded by the sum
- of individual task interferences of tasks in (hp_task_in alpha'). *)
- Definition total_interference_bound_fp :=
- \sum_((tsk_other, R_other) <- R_prev | hp_task_in alpha' tsk_other)
- total_interference_bound (tsk_other, R_other).
-
- End Definitions.
-
-End InterferenceBoundFP.
\ No newline at end of file
diff --git a/classic/analysis/apa/workload_bound.v b/classic/analysis/apa/workload_bound.v
deleted file mode 100644
index a527ab35c190d1c84de7ed43c3de6186bad4f337..0000000000000000000000000000000000000000
--- a/classic/analysis/apa/workload_bound.v
+++ /dev/null
@@ -1,746 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.response_time prosa.classic.model.schedule.global.schedulability
- prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq div fintype bigop path.
-
-Module WorkloadBound.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask TaskArrival ResponseTime Schedulability Workload.
-
- Section WorkloadBoundDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
-
- (* Consider any task tsk with response-time bound R_tsk,
- that is scheduled in an interval of length delta. *)
- Variable tsk: sporadic_task.
- Variable R_tsk: time.
- Variable delta: time.
-
- (* Based on the number of jobs that execute completely in the interval, ... *)
- Definition max_jobs :=
- div_floor (delta + R_tsk - task_cost tsk) (task_period tsk).
-
- (* ... Bertogna and Cirinei's workload bound is defined as follows. *)
- Definition W :=
- let e_k := (task_cost tsk) in
- let p_k := (task_period tsk) in
- minn e_k (delta + R_tsk - e_k - max_jobs * p_k) + max_jobs * e_k.
-
- End WorkloadBoundDef.
-
- Section BasicLemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
-
- (* Let tsk be any task...*)
- Variable tsk: sporadic_task.
-
- (* ... with period > 0. *)
- Hypothesis H_period_positive: task_period tsk > 0.
-
- (* Let R1 <= R2 be two response-time bounds that
- are larger than the cost of the tsk. *)
- Variable R1 R2: time.
- Hypothesis H_R_lower_bound: R1 >= task_cost tsk.
- Hypothesis H_R1_le_R2: R1 <= R2.
-
- Let workload_bound := W task_cost task_period tsk.
-
- (* Then, Bertogna and Cirinei's workload bound is monotonically increasing. *)
- Lemma W_monotonic :
- forall t1 t2,
- t1 <= t2 ->
- workload_bound R1 t1 <= workload_bound R2 t2.
- Proof.
- intros t1 t2 LEt.
- unfold workload_bound, W, max_jobs, div_floor; rewrite 2!subndiv_eq_mod.
- set e := task_cost tsk; set p := task_period tsk.
- set x1 := t1 + R1.
- set x2 := t2 + R2.
- set delta := x2 - x1.
- rewrite -[x2](addKn x1) -addnBA; fold delta;
- last by apply leq_add.
-
- induction delta; first by rewrite addn0 leqnn.
- {
- apply (leq_trans IHdelta).
-
- (* Prove special case for p <= 1. *)
- destruct (leqP p 1) as [LTp | GTp].
- {
- rewrite leq_eqVlt in LTp; move: LTp => /orP LTp; des;
- last by rewrite ltnS in LTp; apply (leq_trans H_period_positive) in LTp.
- {
- rewrite LTp 2!modn1 2!divn1.
- rewrite leq_add2l leq_mul2r; apply/orP; right.
- by rewrite leq_sub2r // leq_add2l.
- }
- }
- (* Harder case: p > 1. *)
- {
- assert (EQ: (x1 + delta.+1 - e) = (x1 + delta - e).+1).
- {
- rewrite -[(x1 + delta - e).+1]addn1.
- rewrite [_+1]addnC addnBA; last first.
- {
- apply (leq_trans H_R_lower_bound).
- by rewrite -addnA addnC -addnA leq_addr.
- }
- by rewrite [1 + _]addnC -addnA addn1.
- } rewrite -> EQ in *; clear EQ.
-
- have DIV := divSn_cases (x1 + delta - e) p GTp; des.
- {
- rewrite DIV leq_add2r leq_min; apply/andP; split;
- first by rewrite geq_minl.
- by apply leq_trans with (n := (x1 + delta - e) %% p);
- [by rewrite geq_minr | by rewrite -DIV0 addn1 leqnSn].
- }
- {
- rewrite -[minn e _]add0n -addnA; apply leq_add; first by ins.
- rewrite -DIV mulnDl mul1n [_ + e]addnC.
- by apply leq_add; [by rewrite geq_minl | by ins].
- }
- }
- }
- Qed.
-
- End BasicLemmas.
-
- Section ProofWorkloadBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_deadline: Job -> time.
-
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume that all jobs have valid parameters *)
- Hypothesis H_jobs_have_valid_parameters :
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider any schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Assumption: jobs only execute if they arrived.
- This is used to eliminate jobs that arrive after end of the interval t1 + delta. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
-
- (* Assumption: jobs do not execute after they completed.
- This is used to eliminate jobs that complete before the start of the interval t1. *)
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assumption: Jobs are sequential.
- This is required to use interval lengths as a measure of service. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assumption: sporadic task model.
- This is necessary to conclude that consecutive jobs ordered by arrival times
- are separated by at least 'period' times units. *)
- Hypothesis H_sporadic_tasks: sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Before starting the proof, let's give simpler names to the definitions. *)
- Let job_has_completed_by := completed job_cost sched.
-
- Let workload_of (tsk: sporadic_task) (t1 t2: time) := workload job_task sched tsk t1 t2.
-
- (* Now we define the theorem. Let tsk be any task in the taskset. *)
- Variable tsk: sporadic_task.
-
- (* Assumption: the task must have valid parameters:
- a) period > 0 (used in divisions)
- b) deadline of the jobs = deadline of the task
- c) cost <= period
- (used to prove that the distance between the first and last
- jobs is at least (cost + n*period), where n is the number
- of middle jobs. If cost >> period, the claim does not hold
- for every task set. *)
- Hypothesis H_valid_task_parameters:
- is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (* Assumption: the task must have a constrained deadline.
- This is required to prove that n_k (max_jobs) from Bertogna
- and Cirinei's formula accounts for at least the number of
- middle jobs (i.e., number of jobs - 2 in the worst case). *)
- Hypothesis H_constrained_deadline: task_deadline tsk <= task_period tsk.
-
- (* Consider an interval [t1, t1 + delta). *)
- Variable t1 delta: time.
-
- (* Assume that a response-time bound R_tsk for that task in any
- schedule of this processor platform is also given, ... *)
- Variable R_tsk: time.
-
- Hypothesis H_response_time_bound :
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_arrival j + R_tsk < t1 + delta ->
- job_has_completed_by j (job_arrival j + R_tsk).
-
- (* ... such that R_tsk >= task_cost tsk and R_tsk <= task_deadline tsk. *)
- Hypothesis H_response_time_ge_cost: R_tsk >= task_cost tsk.
- Hypothesis H_no_deadline_miss: R_tsk <= task_deadline tsk.
-
- Section MainProof.
-
- (* In this section, we prove that the workload of a task in the
- interval [t1, t1 + delta) is bounded by W. *)
-
- (* Let's simplify the names a bit. *)
- Let t2 := t1 + delta.
- Let n_k := max_jobs task_cost task_period tsk R_tsk delta.
- Let workload_bound := W task_cost task_period tsk R_tsk delta.
-
- (* Since we only care about the workload of tsk, we restrict
- our view to the set of jobs of tsk scheduled in [t1, t2). *)
- Let scheduled_jobs :=
- jobs_of_task_scheduled_between job_task sched tsk t1 t2.
-
- (* Now, let's consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := sort earlier_arrival scheduled_jobs.
-
- (* The first step consists in simplifying the sum corresponding
- to the workload. *)
- Section SimplifyJobSequence.
-
- (* After switching to the definition of workload based on a list
- of jobs, we show that sorting the list preserves the sum. *)
- Lemma workload_bound_simpl_by_sorting_scheduled_jobs :
- workload_joblist job_task sched tsk t1 t2 =
- \sum_(i <- sorted_jobs) service_during sched i t1 t2.
- Proof.
- unfold workload_joblist; fold scheduled_jobs.
- rewrite (perm_big sorted_jobs) /= //.
- by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that both sequences have the same set of elements *)
- Lemma workload_bound_job_in_same_sequence :
- forall j,
- (j \in scheduled_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that all jobs in the sorted sequence is an
- interfering job of task tsk. *)
- Lemma workload_bound_all_jobs_from_tsk :
- forall j_i,
- j_i \in sorted_jobs ->
- arrives_in arr_seq j_i /\
- job_task j_i = tsk /\
- service_during sched j_i t1 t2 != 0 /\
- j_i \in jobs_scheduled_between sched t1 t2.
- Proof.
- rename H_jobs_come_from_arrival_sequence into FROMarr.
- intros j_i LTi.
- rewrite -workload_bound_job_in_same_sequence mem_filter in LTi; des.
- have IN := LTi0.
- unfold jobs_scheduled_between in *; rewrite mem_undup in IN.
- apply mem_bigcat_nat_exists in IN; des.
- rewrite mem_scheduled_jobs_eq_scheduled in IN.
- repeat split; try (by done); first by apply (FROMarr j_i i).
- unfold jobs_scheduled_between in *; rewrite mem_undup in LTi0.
- apply mem_bigcat_nat_exists in LTi0; des.
- rewrite mem_scheduled_jobs_eq_scheduled in LTi0.
- apply service_implies_cumulative_service with (t := i);
- first by apply/andP; split.
- by rewrite -not_scheduled_no_service negbK.
- Qed.
-
- (* Remember that consecutive jobs are ordered by arrival. *)
- Lemma workload_bound_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section WorkloadNotManyJobs.
-
- Lemma workload_bound_holds_for_at_most_n_k_jobs :
- size sorted_jobs <= n_k ->
- \sum_(i <- sorted_jobs) service_during sched i t1 t2 <=
- workload_bound.
- Proof.
- intros LEnk.
- rewrite -[\sum_(_ <- _ | _) _]add0n leq_add //.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk);
- last by rewrite big_const_seq iter_addn addn0 mulnC leq_mul2r; apply/orP; right.
- {
- rewrite [\sum_(_ <- _) service_during _ _ _ _]big_seq_cond.
- rewrite [\sum_(_ <- _) task_cost _]big_seq_cond.
- apply leq_sum; intros j_i; move/andP => [INi _].
- apply workload_bound_all_jobs_from_tsk in INi; des.
- eapply cumulative_service_le_task_cost;
- [by apply H_completed_jobs_dont_execute | by apply INi0 |].
- by apply H_jobs_have_valid_parameters.
- }
- Qed.
-
- End WorkloadNotManyJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0.
- First, consider the simple case with only one job. *)
- Section WorkloadSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_at_least_one_job: size sorted_jobs > 0.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
-
- (* The first job is an interfering job of task tsk. *)
- Lemma workload_bound_j_fst_is_job_of_tsk :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk /\
- service_during sched j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply workload_bound_all_jobs_from_tsk, mem_nth.
- Qed.
-
- (* The workload bound holds for the single job. *)
- Lemma workload_bound_holds_for_a_single_job :
- \sum_(0 <= i < 1) service_during sched (nth elem sorted_jobs i) t1 t2 <=
- workload_bound.
- Proof.
- unfold workload_bound, W; fold n_k.
- have INfst := workload_bound_j_fst_is_job_of_tsk; des.
- rewrite big_nat_recr // big_geq // [nth]lock /= -lock add0n.
- destruct n_k; last first.
- {
- rewrite -[service_during _ _ _ _]add0n; rewrite leq_add //.
- rewrite -[service_during _ _ _ _]add0n [_* task_cost tsk]mulSnr.
- apply leq_add; first by done.
- by eapply cumulative_service_le_task_cost;
- [| by apply INfst0
- | by apply H_jobs_have_valid_parameters].
- }
- {
- rewrite 2!mul0n addn0 subn0 leq_min; apply/andP; split.
- {
- by eapply cumulative_service_le_task_cost;
- [| by apply INfst0
- | by apply H_jobs_have_valid_parameters].
- }
- {
- rewrite -addnBA // -[service_during _ _ _ _]addn0.
- apply leq_add; last by done.
- by apply cumulative_service_le_delta.
- }
- }
- Qed.
-
- End WorkloadSingleJob.
-
- (* Next, consider the last case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section WorkloadTwoOrMoreJobs.
-
- (* There are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
-
- (* The last job is an interfering job of task tsk. *)
- Lemma workload_bound_j_lst_is_job_of_tsk :
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk /\
- service_during sched j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply workload_bound_all_jobs_from_tsk, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The response time of the first job must fall inside the interval. *)
- Lemma workload_bound_response_time_of_first_job_inside_interval :
- t1 <= job_arrival j_fst + R_tsk.
- Proof.
- rewrite leqNgt; apply /negP; unfold not; intro LTt1.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := 0).
- apply ltn_trans with (n := 1); [by done | by rewrite H_at_least_two_jobs].
- }
- instantiate (1 := elem); move => [FSTarr [FSTtsk [/eqP FSTserv FSTin]]].
- apply FSTserv.
- apply (cumulative_service_after_job_rt_zero job_arrival job_cost) with (R := R_tsk);
- try (by done); last by apply ltnW.
- apply H_response_time_bound; try (by done).
- by apply leq_trans with (n := t1); last by apply leq_addr.
- Qed.
-
- (* The arrival of the last job must also fall inside the interval. *)
- Lemma workload_bound_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := num_mid_jobs.+1).
- by rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- }
- instantiate (1 := elem); move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- unfold service_during; apply LSTserv.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- Qed.
-
- (* Next, we upper-bound the service of the first and last jobs using their arrival times. *)
- Lemma workload_bound_service_of_first_and_last_jobs :
- service_during sched j_fst t1 t2 +
- service_during sched j_lst t1 t2 <=
- (job_arrival j_fst + R_tsk - t1) + (t2 - job_arrival j_lst).
- Proof.
- apply leq_add; unfold service_during.
- {
- rewrite -[_ + _ - _]mul1n -[1*_]addn0 -iter_addn -big_const_nat.
- apply leq_trans with (n := \sum_(t1 <= t < job_arrival j_fst + R_tsk)
- service_at sched j_fst t);
- last by apply leq_sum; ins; apply service_at_most_one.
- destruct (job_arrival j_fst + R_tsk < t2) eqn:LEt2; last first.
- {
- unfold t2; apply negbT in LEt2; rewrite -ltnNge in LEt2.
- rewrite -> big_cat_nat with (n := t1 + delta) (p := job_arrival j_fst + R_tsk);
- [by apply leq_addr | by apply leq_addr | by done].
- }
- {
- rewrite -> big_cat_nat with (n := job_arrival j_fst + R_tsk);
- [| by apply workload_bound_response_time_of_first_job_inside_interval
- | by apply ltnW].
- rewrite -{2}[\sum_(_ <= _ < _) _]addn0 /= leq_add2l leqn0; apply/eqP.
- apply (cumulative_service_after_job_rt_zero job_arrival job_cost) with (R := R_tsk); try (by done).
- exploit workload_bound_all_jobs_from_tsk.
- by apply mem_nth; instantiate (1 := 0); rewrite H_at_least_two_jobs.
- instantiate (1 := elem); move => [FSTarr [FSTtsk _]].
- by apply H_response_time_bound.
- }
- }
- {
- rewrite -[_ - _]mul1n -[1 * _]addn0 -iter_addn -big_const_nat.
- destruct (job_arrival j_lst <= t1) eqn:LT.
- {
- apply leq_trans with (n := \sum_(job_arrival j_lst <= t < t2)
- service_at sched j_lst t);
- first by rewrite -> big_cat_nat with (m := job_arrival j_lst) (n := t1);
- [by apply leq_addl | by ins | by apply leq_addr].
- by apply leq_sum; ins; apply service_at_most_one.
- }
- {
- apply negbT in LT; rewrite -ltnNge in LT.
- rewrite -> big_cat_nat with (n := job_arrival j_lst);
- [| by apply ltnW
- | by apply ltnW, workload_bound_last_job_arrives_before_end_of_interval].
- rewrite /= -[\sum_(_ <= _ < _) 1]add0n; apply leq_add.
- rewrite (cumulative_service_before_job_arrival_zero job_arrival);
- [by apply leqnn | by ins | by apply leqnn].
- by apply leq_sum; ins; apply service_at_most_one.
- }
- }
- Qed.
-
- (* Simplify the expression from the previous lemma. *)
- Lemma workload_bound_simpl_expression_with_first_and_last :
- job_arrival j_fst + R_tsk - t1 + (t2 - job_arrival j_lst) =
- delta + R_tsk - (job_arrival j_lst - job_arrival j_fst).
- Proof.
- have lemma1 := workload_bound_last_job_arrives_before_end_of_interval.
- have lemma2 := workload_bound_response_time_of_first_job_inside_interval.
- rewrite addnBA; last by apply ltnW.
- rewrite addnBAC // -addnBA; last by apply leq_addr.
- rewrite addnC [job_arrival _ + _]addnC.
- unfold t2; rewrite [t1 + _]addnC -[delta + t1 - _]subnBA // subnn subn0.
- rewrite addnA -subnBA; first by ins.
- unfold j_fst, j_lst. rewrite -[_.+1]add0n.
- apply prev_le_next; last by rewrite H_at_least_two_jobs add0n leqnn.
- by ins; apply workload_bound_jobs_ordered_by_arrival.
- Qed.
-
- (* Bound the service of the middle jobs. *)
- Lemma workload_bound_service_of_middle_jobs :
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2 <=
- num_mid_jobs * task_cost tsk.
- Proof.
- apply leq_trans with (n := num_mid_jobs * task_cost tsk);
- last by rewrite leq_mul2l; apply/orP; right.
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs) task_cost tsk);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < num_mid_jobs) task_cost _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- exploit workload_bound_all_jobs_from_tsk.
- {
- instantiate (1 := nth elem sorted_jobs i.+1).
- apply mem_nth; rewrite H_at_least_two_jobs.
- by rewrite ltnS; apply leq_trans with (n := num_mid_jobs).
- }
- move => [ARR [TSK _]].
- by eapply cumulative_service_le_task_cost; eauto 2.
- Qed.
-
- (* Conclude that the distance between first and last is at least num_mid_jobs + 1 periods. *)
- Lemma workload_bound_many_periods_in_between :
- job_arrival j_lst - job_arrival j_fst >= num_mid_jobs.+1 * (task_period tsk).
- Proof.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- unfold j_fst, j_lst; rewrite EQnk telescoping_sum;
- last by ins; apply workload_bound_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply workload_bound_jobs_ordered_by_arrival.
-
- feed (workload_bound_all_jobs_from_tsk cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (workload_bound_all_jobs_from_tsk next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first move: EQ => /eqP EQ; try lia.
- by rewrite sort_uniq -/scheduled_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk.
- }
- by rewrite leq_subRL_impl // -CURtsk.
- Qed.
-
- (* Prove that n_k is at least the number of the middle jobs *)
- Lemma workload_bound_n_k_covers_middle_jobs :
- n_k >= num_mid_jobs.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *; des.
- rewrite leqNgt; apply/negP; unfold not; intro LTnk.
- assert (DISTmax: job_arrival j_lst - job_arrival j_fst >= delta + task_period tsk).
- {
- apply leq_trans with (n := n_k.+2 * task_period tsk).
- {
- rewrite -addn1 mulnDl mul1n leq_add2r.
- apply leq_trans with (n := delta + R_tsk - task_cost tsk);
- first by rewrite -addnBA //; apply leq_addr.
- by apply ltnW, ltn_ceil, PARAMS0.
- }
- apply leq_trans with (num_mid_jobs.+1 * task_period tsk);
- first by rewrite leq_mul2r; apply/orP; right.
- by apply workload_bound_many_periods_in_between.
- }
- rewrite <- leq_add2r with (p := job_arrival j_fst) in DISTmax.
- rewrite addnC addnBAC in DISTmax; last first.
- {
- unfold j_fst, j_lst; rewrite -[_.+1]add0n.
- apply prev_le_next; last by rewrite H_at_least_two_jobs add0n leqnn.
- by ins; apply workload_bound_jobs_ordered_by_arrival.
- }
- rewrite -subnBA // subnn subn0 in DISTmax.
- rewrite [delta + task_period tsk]addnC addnA in DISTmax.
- have BEFOREt2 := workload_bound_last_job_arrives_before_end_of_interval.
- generalize BEFOREt2; move: BEFOREt2; rewrite {1}ltnNge; move => /negP BEFOREt2'.
- intros BEFOREt2; apply BEFOREt2'; clear BEFOREt2'.
- apply leq_trans with (n := job_arrival j_fst + task_deadline tsk + delta);
- last by apply leq_trans with (n := job_arrival j_fst + task_period tsk + delta);
- [rewrite leq_add2r leq_add2l; apply H_constrained_deadline | apply DISTmax].
- unfold t2; rewrite leq_add2r.
- apply leq_trans with (n := job_arrival j_fst + R_tsk);
- last by rewrite leq_add2l.
- by apply workload_bound_response_time_of_first_job_inside_interval.
- Qed.
-
- (* If n_k = num_mid_jobs, then the workload bound holds. *)
- Lemma workload_bound_n_k_equals_num_mid_jobs :
- num_mid_jobs = n_k ->
- service_during sched j_lst t1 t2 +
- service_during sched j_fst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2
- <= workload_bound.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *; des.
- unfold workload_bound, W; fold n_k.
- move => NK; rewrite -NK.
- apply leq_add;
- last by apply workload_bound_service_of_middle_jobs.
- apply leq_trans with (delta + R_tsk - (job_arrival j_lst - job_arrival j_fst)).
- {
- rewrite addnC -workload_bound_simpl_expression_with_first_and_last.
- by apply workload_bound_service_of_first_and_last_jobs.
- }
- rewrite leq_min; apply/andP; split.
- {
- rewrite leq_subLR [_ + task_cost _]addnC -leq_subLR.
- apply leq_trans with (num_mid_jobs.+1 * task_period tsk);
- last by apply workload_bound_many_periods_in_between.
- rewrite NK ltnW // -ltn_divLR;
- last by apply PARAMS0.
- by unfold n_k, max_jobs, div_floor.
- }
- {
- rewrite -subnDA; apply leq_sub2l.
- apply leq_trans with (n := num_mid_jobs.+1 * task_period tsk);
- last by apply workload_bound_many_periods_in_between.
- rewrite -addn1 addnC mulnDl mul1n.
- by rewrite leq_add2l; last by apply PARAMS3.
- }
- Qed.
-
- (* If n_k = num_mid_jobs + 1, then the workload bound holds. *)
- Lemma workload_bound_n_k_equals_num_mid_jobs_plus_1 :
- num_mid_jobs.+1 = n_k ->
- service_during sched j_lst t1 t2 +
- service_during sched j_fst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2
- <= workload_bound.
- Proof.
- have MID := workload_bound_service_of_middle_jobs.
- rename H_jobs_have_valid_parameters into JOBPARAMS.
- unfold workload_bound, W; fold n_k.
- move => NK; rewrite -NK.
- rewrite -{2}addn1 mulnDl mul1n [_* _ + _]addnC addnA addn_minl.
- apply leq_add; last by apply MID.
- rewrite leq_min; apply/andP; split.
- {
- assert (SIZE: 0 < size sorted_jobs).
- by rewrite H_at_least_two_jobs.
- have INfst := workload_bound_j_fst_is_job_of_tsk SIZE elem;
- have INlst := workload_bound_j_lst_is_job_of_tsk; des.
- have PARAMSfst := JOBPARAMS j_fst INfst; des.
- have PARAMSlst := JOBPARAMS j_lst INlst; des.
- try ( by apply leq_add; apply cumulative_service_le_task_cost with
- (task_deadline0 := task_deadline)
- (job_cost0 := job_cost) (job_deadline0 := job_deadline) (job_task0 := job_task) ) ||
- by apply leq_add; apply cumulative_service_le_task_cost with
- (task_deadline := task_deadline)
- (job_cost := job_cost) (job_deadline := job_deadline) (job_task := job_task).
- }
- {
- rewrite subnAC subnK; last first.
- {
- assert (TMP: delta + R_tsk = task_cost tsk + (delta + R_tsk - task_cost tsk));
- first by rewrite subnKC; [by ins | by rewrite -[task_cost _]add0n; apply leq_add].
- rewrite TMP; clear TMP.
- rewrite -{1}[task_cost _]addn0 -addnBA NK; [by apply leq_add | by apply leq_trunc_div].
- }
- apply leq_trans with (delta + R_tsk - (job_arrival j_lst - job_arrival j_fst)).
- {
- rewrite addnC -workload_bound_simpl_expression_with_first_and_last.
- by apply workload_bound_service_of_first_and_last_jobs.
- }
- {
- by apply leq_sub2l, workload_bound_many_periods_in_between.
- }
- }
- Qed.
-
- End WorkloadTwoOrMoreJobs.
-
- (* Using the lemmas above, we prove the main theorem about the workload bound. *)
- Theorem workload_bounded_by_W :
- workload_of tsk t1 (t1 + delta) <= workload_bound.
- Proof.
- unfold workload_of, workload_bound, W in *; ins; des.
- fold n_k.
-
- (* Use the definition of workload based on list of jobs. *)
- rewrite workload_eq_workload_joblist.
-
- (* Now we order the list by job arrival time. *)
- rewrite workload_bound_simpl_by_sorting_scheduled_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply workload_bound_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs; [ by rewrite ltn0 in NUM | by exists s].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a singleton set of jobs. *)
- destruct n as [| num_mid_jobs];
- first by apply workload_bound_holds_for_a_single_job; rewrite SIZE.
-
- (* Knowing that we have at least two elements, we take first and last out of the sum *)
- rewrite [nth]lock big_nat_recl // big_nat_recr // /= -lock.
- rewrite addnA addnC addnA.
-
- (* There are two cases to be analyze since n <= n_k < n + 2,
- where n is the number of middle jobs. *)
- have NK := workload_bound_n_k_covers_middle_jobs num_mid_jobs SIZE elem.
- move: NK; rewrite leq_eqVlt orbC leq_eqVlt; move => /orP [NK | /eqP NK].
- move: NK => /orP [/eqP NK | NK]; last by rewrite ltnS leqNgt NK in NUM.
- {
- (* Case 1: n_k = n + 1, where n is the number of middle jobs. *)
- by apply (workload_bound_n_k_equals_num_mid_jobs_plus_1 num_mid_jobs).
- }
- {
- (* Case 2: n_k = n, where n is the number of middle jobs. *)
- by apply (workload_bound_n_k_equals_num_mid_jobs num_mid_jobs).
- }
- Qed.
-
- End MainProof.
-
- End ProofWorkloadBound.
-
-End WorkloadBound.
diff --git a/classic/analysis/global/basic/bertogna_edf_comp.v b/classic/analysis/global/basic/bertogna_edf_comp.v
deleted file mode 100755
index d8e82c98da4c14650ef544d4e8146f9e207d4568..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/bertogna_edf_comp.v
+++ /dev/null
@@ -1,990 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.global.basic.bertogna_edf_theory.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationEDF.
-
- Import ResponseTimeAnalysisEDF.
-
- (* In this section, we define the algorithm for Bertogna and Cirinei's
- response-time analysis for EDF scheduling. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* As input for each iteration of the algorithm, we consider pairs
- of tasks and computed response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider a platform with num_cpus processors. *)
- Variable num_cpus: nat.
-
- (* First, recall the interference bound under EDF, ... *)
- Let I (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline tsk rt_bounds delta.
-
- (* ..., which yields the following response-time bound. *)
- Definition edf_response_time_bound (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- task_cost tsk + div_floor (I rt_bounds tsk delta) num_cpus.
-
- (* Also note that a response-time is only valid if it is no larger
- than the deadline. *)
- Definition R_le_deadline (pair: task_with_response_time) :=
- let (tsk, R) := pair in
- R <= task_deadline tsk.
-
- (* Next we define the fixed-point iteration for computing
- Bertogna's response-time bound of a task set. *)
-
- (* Given a sequence 'rt_bounds' of task and response-time bounds
- from the previous iteration, we compute the response-time
- bound of a single task using the RTA for EDF. *)
- Definition update_bound (rt_bounds: seq task_with_response_time)
- (pair : task_with_response_time) :=
- let (tsk, R) := pair in
- (tsk, edf_response_time_bound rt_bounds tsk R).
-
- (* To compute the response-time bounds of the entire task set,
- We start the iteration with a sequence of tasks and costs:
- <(task1, cost1), (task2, cost2), ...>. *)
- Let initial_state (ts: seq sporadic_task) :=
- map (fun t => (t, task_cost t)) ts.
-
- (* Then, we successively update the the response-time bounds based
- on the slack computed in the previous iteration. *)
- Definition edf_rta_iteration (rt_bounds: seq task_with_response_time) :=
- map (update_bound rt_bounds) rt_bounds.
-
- (* To ensure that the procedure converges, we stop the iteration
- after a "sufficient" number of times, which corresponds to
- the time complexity of the procedure. *)
- Let max_steps (ts: seq sporadic_task) :=
- \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1.
-
- (* This yields the following definition for the RTA. At the end
- we check if all computed response-time bounds are less than
- or equal to the deadline, in which case they are valid. *)
- Definition edf_claimed_bounds (ts: seq sporadic_task) :=
- let R_values := iter (max_steps ts) edf_rta_iteration (initial_state ts) in
- if (all R_le_deadline R_values) then
- Some R_values
- else None.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition edf_schedulable (ts: seq sporadic_task) :=
- edf_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of tasks/response-time bounds. *)
- Section SimpleLemmas.
-
- (* Updating a single response-time bound does not modify the task. *)
- Lemma edf_claimed_bounds_unzip1_update_bound :
- forall l rt_bounds,
- unzip1 (map (update_bound rt_bounds) l) = unzip1 l.
- Proof.
- induction l; first by done.
- intros rt_bounds.
- simpl; f_equal; last by done.
- by unfold update_bound; desf.
- Qed.
-
- (* At any point of the iteration, the tasks are the same. *)
- Lemma edf_claimed_bounds_unzip1_iteration :
- forall l k,
- unzip1 (iter k edf_rta_iteration (initial_state l)) = l.
- Proof.
- intros l k; clear -k.
- induction k; simpl.
- {
- unfold initial_state.
- induction l; first by done.
- by simpl; rewrite IHl.
- }
- {
- unfold edf_rta_iteration.
- by rewrite edf_claimed_bounds_unzip1_update_bound.
- }
- Qed.
-
- (* The iteration preserves the size of the list. *)
- Lemma edf_claimed_bounds_size :
- forall l k,
- size (iter k edf_rta_iteration (initial_state l)) = size l.
- Proof.
- intros l k; clear -k.
- induction k; simpl; first by rewrite size_map.
- by rewrite size_map.
- Qed.
-
- (* If the analysis succeeds, the computed response-time bounds are no smaller
- than the task cost. *)
- Lemma edf_claimed_bounds_ge_cost :
- forall l k tsk R,
- (tsk, R) \in (iter k edf_rta_iteration (initial_state l)) ->
- R >= task_cost tsk.
- Proof.
- intros l k tsk R IN.
- destruct k.
- {
- move: IN => /mapP IN; destruct IN as [x IN EQ]; inversion EQ.
- by apply leqnn.
- }
- {
- rewrite iterS in IN.
- move: IN => /mapP IN; destruct IN as [x IN EQ].
- unfold update_bound in EQ; destruct x; inversion EQ.
- by unfold edf_response_time_bound; apply leq_addr.
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadline. *)
- Lemma edf_claimed_bounds_le_deadline :
- forall ts rt_bounds tsk R,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R <= task_deadline tsk.
- Proof.
- intros ts rt_bounds tsk R SOME PAIR; unfold edf_claimed_bounds in SOME.
- destruct (all R_le_deadline (iter (max_steps ts)
- edf_rta_iteration (initial_state ts))) eqn:DEADLINE;
- last by done.
- move: DEADLINE => /allP DEADLINE.
- inversion SOME as [EQ]; rewrite -EQ in PAIR.
- by specialize (DEADLINE (tsk, R) PAIR).
- Qed.
-
- (* The list contains a response-time bound for every task in the task set. *)
- Lemma edf_claimed_bounds_has_R_for_every_task :
- forall ts rt_bounds tsk,
- edf_claimed_bounds ts = Some rt_bounds ->
- tsk \in ts ->
- exists R,
- (tsk, R) \in rt_bounds.
- Proof.
- intros ts rt_bounds tsk SOME IN.
- unfold edf_claimed_bounds in SOME.
- destruct (all R_le_deadline (iter (max_steps ts) edf_rta_iteration (initial_state ts)));
- last by done.
- inversion SOME as [EQ]; clear SOME EQ.
- generalize dependent tsk.
- induction (max_steps ts) as [| step]; simpl in *.
- {
- intros tsk IN; unfold initial_state.
- exists (task_cost tsk).
- by apply/mapP; exists tsk.
- }
- {
- intros tsk IN.
- set prev_state := iter step edf_rta_iteration (initial_state ts).
- fold prev_state in IN, IHstep.
- specialize (IHstep tsk IN); des.
- exists (edf_response_time_bound prev_state tsk R).
- by apply/mapP; exists (tsk, R); [by done | by f_equal].
- }
- Qed.
-
- End SimpleLemmas.
-
- (* In this section, we prove the convergence of the RTA procedure.
- Since we define the RTA procedure as the application of a function
- a fixed number of times, this translates into proving that the value
- of the iteration at (max_steps ts) is equal to the value at (max_steps ts) + 1. *)
- Section Convergence.
-
- (* Consider any valid task set. *)
- Variable ts: seq sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* To simplify, let f denote the RTA procedure. *)
- Let f (k: nat) := iter k edf_rta_iteration (initial_state ts).
-
- (* Since the iteration is applied directly to a list of tasks and response-times,
- we define a corresponding relation "<=" over those lists. *)
-
- (* Let 'all_le' be a binary relation over lists of tasks/response-time bounds.
- It states that every element of list l1 has a response-time bound R that is less
- than or equal to the corresponding response-time bound R' in list l2 (point-wise).
- In addition, the relation states that the tasks of both lists are unchanged. *)
- Let all_le := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- all (fun p => (snd (fst p)) <= (snd (snd p))) (zip l1 l2).
-
- (* Similarly, we define a strict version of 'all_le' called 'one_lt', which states that
- there exists at least one element whose response-time bound increases. *)
- Let one_lt := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- has (fun p => (snd (fst p)) < (snd (snd p))) (zip l1 l2).
-
- (* Next, we prove some basic properties about the relation all_le. *)
- Section RelationProperties.
-
- (* The relation is reflexive, ... *)
- Lemma all_le_reflexive : reflexive all_le.
- Proof.
- intros l; unfold all_le; rewrite eq_refl andTb.
- destruct l; first by done.
- by apply/(zipP t (fun x y => snd x <= snd y)).
- Qed.
-
- (* ... and transitive. *)
- Lemma all_le_transitive: transitive all_le.
- Proof.
- unfold transitive, all_le.
- move => y x z /andP [/eqP ZIPxy LExy] /andP [/eqP ZIPyz LEyz].
- apply/andP; split; first by rewrite ZIPxy -ZIPyz.
- move: LExy => /(zipP _ (fun x y => snd x <= snd y)) LExy.
- move: LEyz => /(zipP _ (fun x y => snd x <= snd y)) LEyz.
- assert (SIZExy: size (unzip1 x) = size (unzip1 y)).
- by rewrite ZIPxy.
- assert (SIZEyz: size (unzip1 y) = size (unzip1 z)).
- by rewrite ZIPyz.
- rewrite 2!size_map in SIZExy; rewrite 2!size_map in SIZEyz.
- destruct y.
- {
- apply size0nil in SIZExy; symmetry in SIZEyz.
- by apply size0nil in SIZEyz; subst.
- }
- rewrite -SIZExy in SIZEyz.
- have ZIP := zipP t (fun x y => snd x <= snd y) _ _ SIZEyz.
- apply/ZIP.
- intros i LTi.
- specialize (LExy t); specialize (LEyz t).
- exploit LExy; first by rewrite SIZExy.
- {
- rewrite size_zip -SIZExy minnn.
- rewrite size_zip -SIZEyz minnn in LTi; apply LTi.
- }
- intro LE.
- exploit LEyz; first by rewrite -SIZExy.
- {
- by rewrite size_zip -SIZExy -size_zip; apply LTi.
- }
- by intro LE'; apply (leq_trans LE).
- Qed.
-
- (* At any step of the iteration, the corresponding list
- is larger than or equal to the initial state. *)
- Lemma bertogna_edf_comp_iteration_preserves_minimum :
- forall step, all_le (initial_state ts) (f step).
- Proof.
- unfold f.
- intros step; destruct step; first by apply all_le_reflexive.
- apply/andP; split.
- {
- assert (UNZIP0 := edf_claimed_bounds_unzip1_iteration ts 0).
- by simpl in UNZIP0; rewrite UNZIP0 edf_claimed_bounds_unzip1_iteration.
- }
- destruct ts as [| tsk0 ts'].
- {
- clear -step; induction step; first by done.
- by rewrite iterSr IHstep.
- }
-
- apply/(zipP (tsk0,0) (fun x y => snd x <= snd y));
- first by rewrite edf_claimed_bounds_size size_map.
-
- intros i LTi; rewrite iterS; unfold edf_rta_iteration at 1.
- have MAP := @nth_map _ (tsk0,0) _ (tsk0,0).
- rewrite size_zip edf_claimed_bounds_size size_map minnn in LTi.
- rewrite MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- destruct (nth (tsk0, 0) (initial_state (tsk0 :: ts')) i) as [tsk_i R_i] eqn:SUBST.
- rewrite SUBST; unfold update_bound.
- unfold initial_state in SUBST.
- have MAP := @nth_map _ tsk0 _ (tsk0, 0).
- rewrite ?MAP // in SUBST; inversion SUBST; clear MAP.
- assert (EQtsk: tsk_i = fst (nth (tsk0, 0) (iter step edf_rta_iteration
- (initial_state (tsk0 :: ts'))) i)).
- {
- have MAP := @nth_map _ (tsk0,0) _ tsk0 (fun x => fst x).
- rewrite -MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- have UNZIP := edf_claimed_bounds_unzip1_iteration; unfold unzip1 in UNZIP.
- by rewrite UNZIP; symmetry.
- }
- destruct (nth (tsk0, 0) (iter step edf_rta_iteration (initial_state (tsk0 :: ts')))) as [tsk_i' R_i'].
- by simpl in EQtsk; rewrite -EQtsk; subst; apply leq_addr.
- Qed.
-
- (* The application of the function is inductive. *)
- Lemma bertogna_edf_comp_iteration_inductive (P : seq task_with_response_time -> Type) :
- P (initial_state ts) ->
- (forall k, P (f k) -> P (f (k.+1))) ->
- P (f (max_steps ts)).
- Proof.
- by intros P0 Pn; induction (max_steps ts); last by apply Pn.
- Qed.
-
- (* As a last step, we show that edf_rta_iteration preserves order, i.e., for any
- list l1 no smaller than the initial state, and list l2 such that
- l1 <= l2, we have (edf_rta_iteration l1) <= (edf_rta_iteration l2). *)
- Lemma bertogna_edf_comp_iteration_preserves_order :
- forall l1 l2,
- all_le (initial_state ts) l1 ->
- all_le l1 l2 ->
- all_le (edf_rta_iteration l1) (edf_rta_iteration l2).
- Proof.
- rename H_valid_task_parameters into VALID.
- intros x1 x2 LEinit LE.
- move: LE => /andP [/eqP ZIP LE]; unfold all_le.
-
- assert (UNZIP': unzip1 (edf_rta_iteration x1) = unzip1 (edf_rta_iteration x2)).
- {
- by rewrite 2!edf_claimed_bounds_unzip1_update_bound.
- }
-
- apply/andP; split; first by rewrite UNZIP'.
- apply f_equal with (B := nat) (f := fun x => size x) in UNZIP'.
- rename UNZIP' into SIZE.
- rewrite size_map [size (unzip1 _)]size_map in SIZE.
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- destruct x1 as [| p0 x1'], x2 as [| p0' x2']; try (by ins).
- apply/(zipP p0 (fun x y => snd x <= snd y)); first by done.
-
- intros i LTi.
- exploit LE; first by rewrite 2!size_map in SIZE.
- {
- by rewrite size_zip 2!size_map -size_zip in LTi; apply LTi.
- }
- rewrite 2!size_map in SIZE.
- instantiate (1 := p0); intro LEi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map -SIZE minnn in LTi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map SIZE minnn in LTi.
- unfold update_bound, edf_response_time_bound; desf; simpl.
- rename s into tsk_i, s0 into tsk_i', t into R_i, t0 into R_i', Heq into EQ, Heq0 into EQ'.
- assert (EQtsk: tsk_i = tsk_i').
- {
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0']; simpl in H2; subst.
- have MAP := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0) :: x1').
- have MAP' := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0') :: x2').
- assert (FSTeq: fst (nth (tsk0', R0)((tsk0', R0) :: x1') i) =
- fst (nth (tsk0',R0) ((tsk0', R0') :: x2') i)).
- {
- rewrite -MAP;
- last by simpl; rewrite size_zip 2!size_map /= -H0 minnn in LTi.
- rewrite -MAP';
- last by simpl; rewrite size_zip 2!size_map /= H0 minnn in LTi.
- by f_equal; simpl; f_equal.
- }
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ.
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ'.
- by rewrite FSTeq EQ' /= in EQ; rewrite EQ.
- }
- subst tsk_i'; rewrite leq_add2l.
- unfold I, total_interference_bound_edf; apply leq_div2r.
- rewrite 2!big_cons.
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0'].
- simpl in H2; subst tsk0'.
- rename R_i into delta, R_i' into delta'.
- rewrite EQ EQ' in LEi; simpl in LEi.
- rename H0 into SIZE, H1 into UNZIP; clear EQ EQ'.
-
- assert (SUBST: forall l delta,
- \sum_(j <- l | let '(tsk_other, _) := j in
- different_task tsk_i tsk_other)
- (let '(tsk_other, R_other) := j in
- interference_bound_edf task_cost task_period task_deadline tsk_i delta
- (tsk_other, R_other)) =
- \sum_(j <- l | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta j).
- {
- intros l x; clear -l.
- induction l; first by rewrite 2!big_nil.
- by rewrite 2!big_cons; rewrite IHl; desf; rewrite /= Heq in Heq0.
- } rewrite 2!SUBST; clear SUBST.
-
- assert (VALID': valid_sporadic_taskset task_cost task_period task_deadline
- (unzip1 ((tsk0, R0) :: x1'))).
- {
- move: LEinit => /andP [/eqP EQinit _].
- rewrite -EQinit; unfold valid_sporadic_taskset.
- move => tsk /mapP IN. destruct IN as [p INinit EQ]; subst.
- by move: INinit => /mapP INinit; destruct INinit as [tsk INtsk]; subst; apply VALID.
- }
-
- assert (GE_COST: all (fun p => task_cost (fst p) <= snd p) ((tsk0, R0) :: x1')).
- {
- clear LE; move: LEinit => /andP [/eqP UNZIP' LE].
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- specialize (LE (tsk0, R0)).
- apply/(all_nthP (tsk0,R0)).
- intros j LTj; generalize UNZIP'; simpl; intro SIZE'.
- have F := @f_equal _ _ size (unzip1 (initial_state ts)).
- apply F in SIZE'; clear F; rewrite /= 3!size_map in SIZE'.
- exploit LE; [by rewrite size_map /= | |].
- {
- rewrite size_zip size_map /= SIZE' minnn.
- by simpl in LTj; apply LTj.
- }
- clear LE; intro LE.
- unfold initial_state in LE.
- have MAP := @nth_map _ tsk0 _ (tsk0,R0).
- rewrite MAP /= in LE;
- [clear MAP | by rewrite SIZE'; simpl in LTj].
- apply leq_trans with (n := task_cost (nth tsk0 ts j));
- [apply eq_leq; f_equal | by done].
- have MAP := @nth_map _ (tsk0, R0) _ tsk0 (fun x => fst x).
- rewrite -MAP; [clear MAP | by done].
- unfold unzip1 in UNZIP'; rewrite -UNZIP'; f_equal.
- clear -ts; induction ts; [by done | by simpl; f_equal].
- }
- move: GE_COST => /allP GE_COST.
-
- assert (LESUM: \sum_(j <- x1' | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta j <=
- \sum_(j <- x2' | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta' j).
- {
- set elem := (tsk0, R0); rewrite 2!(big_nth elem).
- rewrite -SIZE.
- rewrite big_mkcond [\sum_(_ <- _ | different_task _ _)_]big_mkcond.
- rewrite big_seq_cond [\sum_(_ <- _ | true) _]big_seq_cond.
- apply leq_sum; intros j; rewrite andbT; intros INj.
- rewrite mem_iota add0n subn0 in INj; move: INj => /andP [_ INj].
- assert (FSTeq: fst (nth elem x1' j) = fst (nth elem x2' j)).
- {
- have MAP := @nth_map _ elem _ tsk0 (fun x => fst x).
- by rewrite -2?MAP -?SIZE //; f_equal.
- } rewrite -FSTeq.
- destruct (different_task tsk_i (fst (nth elem x1' j))) eqn:INTERF;
- last by done.
- {
- exploit (LE elem); [by rewrite /= SIZE | | intro LEj].
- {
- rewrite size_zip 2!size_map /= -SIZE minnn in LTi.
- by rewrite size_zip /= -SIZE minnn; apply (leq_ltn_trans INj).
- }
- simpl in LEj.
- exploit (VALID' (fst (nth elem x1' j))); last intro VALIDj.
- {
- apply/mapP; exists (nth elem x1' j); last by done.
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- exploit (GE_COST (nth elem x1' j)); last intro GE_COSTj.
- {
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- unfold is_valid_sporadic_task in *.
- destruct (nth elem x1' j) as [tsk_j R_j] eqn:SUBST1,
- (nth elem x2' j) as [tsk_j' R_j'] eqn:SUBST2.
- rewrite SUBST1 SUBST2 in LEj; clear SUBST1 SUBST2.
- simpl in FSTeq; rewrite -FSTeq; simpl in LEj; simpl in VALIDj; des.
- by apply interference_bound_edf_monotonic.
- }
- }
- destruct (different_task tsk_i tsk0) eqn:INTERFtsk0; last by done.
- apply leq_add; last by done.
- {
- exploit (LE (tsk0, R0)); [by rewrite /= SIZE | | intro LEj];
- first by instantiate (1 := 0); rewrite size_zip /= -SIZE minnn.
- exploit (VALID' tsk0); first by rewrite in_cons; apply/orP; left.
- exploit (GE_COST (tsk0, R0)); first by rewrite in_cons eq_refl orTb.
- unfold is_valid_sporadic_task; intros GE_COST0 VALID0; des; simpl in LEj.
- by apply interference_bound_edf_monotonic.
- }
- Qed.
-
- (* It follows from the properties above that the iteration is monotonically increasing. *)
- Lemma bertogna_edf_comp_iteration_monotonic: forall k, all_le (f k) (f k.+1).
- Proof.
- unfold f; intros k.
- apply fun_mon_iter_mon_generic with (x1 := k) (x2 := k.+1);
- try (by done);
- [ by apply all_le_reflexive
- | by apply all_le_transitive
- | by apply bertogna_edf_comp_iteration_preserves_order
- | by apply bertogna_edf_comp_iteration_preserves_minimum].
- Qed.
-
- End RelationProperties.
-
- (* Knowing that the iteration is monotonically increasing (with respect to all_le),
- we show that the RTA procedure converges to a fixed point. *)
-
- (* First, note that when there are no tasks, the iteration trivially converges. *)
- Lemma bertogna_edf_comp_f_converges_with_no_tasks :
- size ts = 0 ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- intro SIZE; destruct ts; last by inversion SIZE.
- unfold max_steps; rewrite big_nil /=.
- by unfold edf_rta_iteration.
- Qed.
-
- (* Otherwise, if the iteration reached a fixed point before (max_steps ts), then
- the value at (max_steps ts) is still at a fixed point. *)
- Lemma bertogna_edf_comp_f_converges_early :
- (exists k, k <= max_steps ts /\ f k = f k.+1) ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- by intros EX; des; apply fixedpoint.iter_fix with (k := k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume that there are tasks. *)
- Hypothesis H_at_least_one_task: size ts > 0.
-
- (* Assume that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps ts -> f k != f k.+1.
-
- (* Since the iteration is monotonically increasing, it must be
- strictly increasing. *)
- Lemma bertogna_edf_comp_f_increases :
- forall k,
- k <= max_steps ts -> one_lt (f k) (f k.+1).
- Proof.
- rename H_at_least_one_task into NONEMPTY.
- intros step LEstep; unfold one_lt; apply/andP; split;
- first by rewrite 2!edf_claimed_bounds_unzip1_iteration.
- rewrite -[has _ _]negbK; apply/negP; unfold not; intro ALL.
- rewrite -all_predC in ALL.
- move: ALL => /allP ALL.
- exploit (H_keeps_diverging step); [by done | intro DIFF].
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- }
- des; clear DUMMY.
- move: DIFF => /eqP DIFF; apply DIFF.
- apply eq_from_nth with (x0 := (tsk, 0));
- first by simpl; rewrite size_map.
- {
- intros i LTi.
- remember (nth (tsk, 0)(f step) i) as p_i;rewrite -Heqp_i.
- remember (nth (tsk, 0)(f step.+1) i) as p_i';rewrite -Heqp_i'.
- rename Heqp_i into EQ, Heqp_i' into EQ'.
- exploit (ALL (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- unfold predC; simpl; rewrite -ltnNge; intro LTp.
-
- have GROWS := bertogna_edf_comp_iteration_monotonic step.
- move: GROWS => /andP [_ /allP GROWS].
- exploit (GROWS (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- simpl; intros LE.
- destruct p_i as [tsk_i R_i], p_i' as [tsk_i' R_i'].
- simpl in *.
- assert (EQtsk: tsk_i = tsk_i').
- {
- unfold edf_rta_iteration in EQ'.
- rewrite (nth_map (tsk, 0)) in EQ'; last by done.
- by unfold update_bound in EQ'; desf.
- }
- rewrite EQtsk; f_equal.
- by apply/eqP; rewrite eqn_leq; apply/andP; split.
- }
- Qed.
-
- (* In the end, each response-time bound is so high that the sum
- of all response-time bounds exceeds the sum of all deadlines.
- Contradiction! *)
- Lemma bertogna_edf_comp_rt_grows_too_much :
- forall k,
- k <= max_steps ts ->
- \sum_((tsk, R) <- f k) (R - task_cost tsk) + 1 > k.
- Proof.
- have INC := bertogna_edf_comp_f_increases.
- have MONO := bertogna_edf_comp_iteration_monotonic.
- rename H_at_least_one_task into NONEMPTY.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_valid_task_parameters into VALID.
- intros step LE.
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- } destruct DUMMY as [elem _].
-
- induction step.
- {
- by rewrite addn1.
- }
- {
- rewrite -addn1 ltn_add2r.
- apply leq_ltn_trans with (n := \sum_(i <- f step) (let '(tsk, R) := i in R - task_cost tsk)).
- {
- rewrite -ltnS; rewrite addn1 in IHstep.
- by apply IHstep, ltnW.
- }
- rewrite (eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- rewrite [\sum_(_ <- f step.+1)_](eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- unfold f at 2; rewrite iterS.
- rewrite big_map; fold (f step).
- rewrite -(ltn_add2r (\sum_(i <- f step) task_cost (fst i))).
- rewrite -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun i => snd i)); last first.
- {
- intro i; rewrite andbT; intro IN;
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts step.
- by destruct i; apply GE_COST.
- }
- rewrite [\sum_(_ <- _ | _)(_ - _ + _)](eq_bigr (fun i => snd (update_bound (f step) i))); last first.
- {
- intro i; rewrite andbT; intro IN.
- unfold update_bound; destruct i; simpl.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- apply (edf_claimed_bounds_ge_cost ts step.+1).
- by rewrite iterS; apply/mapP; exists (s, t).
- }
- rewrite -2!big_seq_cond.
-
- have LT := INC step (ltnW LE).
- specialize (MONO step).
-
- move: LT => /andP [_ LT]; move: LT => /hasP LT.
- destruct LT as [[x1 x2] INzip LT]; simpl in *.
- move: MONO => /andP [_ /(zipP _ (fun x y => snd x <= snd y)) MONO].
- rewrite 2!(big_nth (elem, 0)).
- apply mem_zip_exists with (elem := (elem, 0)) (elem' := (elem, 0)) in INzip; des;
- last by rewrite size_map.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite -addn1 -addnA; apply leq_add.
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0)); [by rewrite size_map | | intro LEi].
- {
- rewrite size_zip; apply (ltn_trans LT2).
- by apply leq_trans with (n := size (f step));
- [by done | by rewrite size_map minnn].
- }
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi;
- last by apply (ltn_trans LT2).
- }
- rewrite -addnA [_ + 1]addnC addnA; apply leq_add.
- {
- unfold edf_rta_iteration in INzip2; rewrite addn1.
- rewrite -> nth_map with (x1 := (elem, 0)) in INzip2; last by done.
- by rewrite -INzip2 -INzip1.
- }
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0));
- [ by rewrite size_map
- | by rewrite size_zip; apply (leq_trans LT2); rewrite size_map minnn | intro LEi ].
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi; last by done.
- }
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove that edf_rta_iteration reaches
- a fixed point after (max_steps ts) step, ... *)
- Lemma edf_claimed_bounds_finds_fixed_point_of_list :
- forall rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- valid_sporadic_taskset task_cost task_period task_deadline ts ->
- f (max_steps ts) = edf_rta_iteration (f (max_steps ts)).
- Proof.
- intros rt_bounds SOME VALID.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- unfold edf_claimed_bounds in SOME; desf.
- rename Heq into LE.
- fold (f (max_steps ts)) in *; fold (f (max_steps ts).+1).
-
- (* Either the task set is empty or not. *)
- destruct (size ts == 0) eqn:EMPTY;
- first by apply bertogna_edf_comp_f_converges_with_no_tasks; apply/eqP.
- apply negbT in EMPTY; rewrite -lt0n in EMPTY.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_((max_steps ts).+1), f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- destruct k as [k LTk]; simpl in ITERk.
- apply bertogna_edf_comp_f_converges_early.
- exists k; split; [by apply LTk | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
-
- assert (SAMESUM: \sum_(tsk <- ts) task_cost tsk = \sum_(p <- f (max_steps ts)) task_cost (fst p)).
- {
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_cost x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- by rewrite UNZIP in MAP; rewrite MAP.
- }
-
- (* Show that the sum is less than the sum of all deadlines. *)
- assert (SUM: \sum_(p <- f (max_steps ts)) (snd p - task_cost (fst p)) + 1 <= max_steps ts).
- {
- unfold max_steps at 2; rewrite leq_add2r.
- rewrite -(leq_add2r (\sum_(tsk <- ts) task_cost tsk)).
- rewrite {1}SAMESUM -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun x => snd x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts (max_steps ts).
- fold (f (max_steps ts)) in GE_COST.
- by destruct i; apply GE_COST.
- }
- rewrite (eq_bigr (fun x => task_deadline x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- by specialize (VALID i IN); des.
- }
- rewrite -2!big_seq_cond.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_deadline x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- rewrite UNZIP in MAP; rewrite MAP.
- rewrite big_seq_cond [\sum_(_ <- _|true)_]big_seq_cond.
- apply leq_sum; intro i; rewrite andbT; intro IN.
- move: LE => /allP LE; unfold R_le_deadline in LE.
- by specialize (LE i IN); destruct i.
- }
-
- have TOOMUCH :=
- bertogna_edf_comp_rt_grows_too_much EMPTY _ (max_steps ts) (leqnn (max_steps ts)).
- exploit TOOMUCH; [| intro BUG].
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | by ins].
- }
- rewrite (eq_bigr (fun i => snd i - task_cost (fst i))) in BUG;
- last by ins; destruct i.
- by apply (leq_ltn_trans SUM) in BUG; rewrite ltnn in BUG.
- Qed.
-
- (* ...and since there cannot be a vector of response-time bounds with values less than
- the task costs, this solution is also the least fixed point. *)
- Lemma edf_claimed_bounds_finds_least_fixed_point :
- forall v,
- all_le (initial_state ts) v ->
- v = edf_rta_iteration v ->
- all_le (f (max_steps ts)) v.
- Proof.
- intros v GE0 EQ.
- apply bertogna_edf_comp_iteration_inductive; first by done.
- intros k GEk.
- rewrite EQ.
- apply bertogna_edf_comp_iteration_preserves_order; last by done.
- by apply bertogna_edf_comp_iteration_preserves_minimum.
- Qed.
-
- (* Therefore, with regard to the response-time bound recurrence, ...*)
-
- (* ..., the individual response-time bounds (elements of the list) are also fixed points. *)
- Theorem edf_claimed_bounds_finds_fixed_point_for_each_bound :
- forall tsk R rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R = edf_response_time_bound rt_bounds tsk R.
- Proof.
- intros tsk R rt_bounds SOME IN.
- have CONV := edf_claimed_bounds_finds_fixed_point_of_list rt_bounds.
- rewrite -iterS in CONV; fold (f (max_steps ts).+1) in CONV.
- unfold edf_claimed_bounds in *; desf.
- exploit (CONV); [by done | by done | intro ITER; clear CONV].
- unfold f in ITER.
-
- cut (update_bound (iter (max_steps ts)
- edf_rta_iteration (initial_state ts)) (tsk,R) = (tsk, R)).
- {
- intros EQ.
- have F := @f_equal _ _ (fun x => snd x) _ (tsk, R).
- by apply F in EQ; simpl in EQ.
- }
- set s := iter (max_steps ts) edf_rta_iteration (initial_state ts).
- fold s in ITER, IN.
- move: IN => /(nthP (tsk,0)) IN; destruct IN as [i LT EQ].
- generalize EQ; rewrite ITER iterS in EQ; intro EQ'.
- fold s in EQ.
- unfold edf_rta_iteration in EQ.
- have MAP := @nth_map _ (tsk,0) _ _ (update_bound s).
- by rewrite MAP // EQ' in EQ; rewrite EQ.
- Qed.
-
- End Convergence.
-
- Section MainProof.
-
- (* Consider a task set ts where... *)
- Variable ts: taskset_of sporadic_task.
-
- (* ...all tasks have valid parameters ... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ...and constrained deadlines. *)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Next, consider any arrival sequence such that...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...they have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any schedule of this arrival sequence such that... *)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after they arrived and no longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that jobs are sequential. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assume a work-conserving scheduler with EDF policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_edf_policy: respects_JLFP_policy job_arrival job_cost arr_seq sched
- (EDF job_arrival job_deadline).
-
- Definition no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Definition no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in edf_claimed_bounds is safe. The proof follows by direct application of
- the main Theorem from bertogna_edf_theory.v. *)
- Theorem edf_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In edf_claimed_bounds ts ->
- response_time_bounded_by tsk R.
- Proof.
- intros tsk R IN j JOBj.
- destruct (edf_claimed_bounds ts) as [rt_bounds |] eqn:SOME; last by done.
- unfold edf_rta_iteration in *.
- have BOUND := bertogna_cirinei_response_time_bound_edf.
- unfold is_response_time_bound_of_task in *.
- apply BOUND with (task_cost := task_cost) (task_period := task_period)
- (arr_seq := arr_seq) (task_deadline := task_deadline) (job_deadline := job_deadline)
- (job_task := job_task) (ts := ts) (tsk := tsk) (rt_bounds := rt_bounds); try (by ins).
- by unfold edf_claimed_bounds in SOME; desf; rewrite edf_claimed_bounds_unzip1_iteration.
- by ins; apply edf_claimed_bounds_finds_fixed_point_for_each_bound with (ts := ts).
- by ins; rewrite (edf_claimed_bounds_le_deadline ts rt_bounds).
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: edf_schedulable ts.
-
- (*... no task misses its deadline. *)
- Theorem taskset_schedulable_by_edf_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (edf_analysis_yields_response_time_bounds).
- have DL := (edf_claimed_bounds_le_deadline ts).
- have HAS := (edf_claimed_bounds_has_R_for_every_task ts).
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- edf_schedulable,
- valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS,
- H_valid_task_parameters into TASKPARAMS,
- H_constrained_deadlines into RESTR,
- H_completed_jobs_dont_execute into COMP,
- H_jobs_must_arrive_to_execute into MUSTARRIVE,
- H_all_jobs_from_taskset into ALLJOBS,
- H_test_succeeds into TEST.
-
- move => tsk INtsk j ARRj JOBtsk.
- destruct (edf_claimed_bounds ts) as [rt_bounds |] eqn:SOME; last by ins.
- exploit (HAS rt_bounds tsk); [by ins | by ins | clear HAS; intro HAS; des].
- have COMPLETED := RLIST tsk R HAS j ARRj JOBtsk.
- exploit (DL rt_bounds tsk R); try (by done); clear DL; intro DL.
- apply leq_trans with (n := service sched j (job_arrival j + R)); last first.
- {
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- apply extend_sum; rewrite // leq_add2l.
- specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS1.
- by rewrite JOBtsk.
- }
- by done.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we conclude that no job misses
- its deadline. *)
- Theorem jobs_schedulable_by_edf_rta :
- forall j, arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_edf_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationEDF.
diff --git a/classic/analysis/global/basic/bertogna_edf_theory.v b/classic/analysis/global/basic/bertogna_edf_theory.v
deleted file mode 100644
index b3a6b86786b0f88d519ae7962fedf45de3d4f72f..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/bertogna_edf_theory.v
+++ /dev/null
@@ -1,822 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.schedulability
- prosa.classic.model.schedule.global.response_time.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform
- prosa.classic.model.schedule.global.basic.interference prosa.classic.model.schedule.global.basic.platform
- prosa.classic.model.schedule.global.basic.constrained_deadlines.
-Require Import prosa.classic.analysis.global.basic.workload_bound prosa.classic.analysis.global.basic.interference_bound_edf.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisEDF.
-
- Export Job SporadicTaskset Schedule ScheduleOfSporadicTask Workload Schedulability ResponseTime
- Priority TaskArrival WorkloadBound InterferenceBoundEDF
- Interference Platform ConstrainedDeadlines.
-
- (* In this section, we prove that any fixed point in Bertogna and
- Cirinei's RTA for EDF scheduling is a safe response-time bound.
- This analysis can be found in Chapter 17.1.2 of Baruah et al.'s
- book Multiprocessor Scheduling for Real-time Systems. *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider a task set ts where all tasks have valid parameters
- and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and assume that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j -> job_task j \in ts.
-
- (* Next, consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs are sequential and do not execute before their
- arrival times nor longer than their execution costs. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume that there exists at least one processor. *)
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Assume that the schedule is a work-conserving EDF schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_edf_policy: respects_JLFP_policy job_arrival job_cost arr_seq sched
- (EDF job_arrival job_deadline).
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Next we consider the response-time recurrence.
- Assume that a response-time bound R is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable rt_bounds: seq task_with_response_time.
-
- (* ...for any task in the task set, ... *)
- Hypothesis H_rt_bounds_contains_all_tasks: unzip1 rt_bounds = ts.
-
- (* ... where R is a fixed-point of the response-time recurrence, ... *)
- Let I (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline tsk rt_bounds delta.
- Hypothesis H_response_time_is_fixed_point :
- forall tsk R,
- (tsk, R) \in rt_bounds ->
- R = task_cost tsk + div_floor (I tsk R) num_cpus.
-
- (* ..., and R is no larger than the deadline. *)
- Hypothesis H_tasks_miss_no_deadlines:
- forall tsk_other R,
- (tsk_other, R) \in rt_bounds -> R <= task_deadline tsk_other.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Consider any job j of tsk ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* ... that did not complete on time, ... *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (job_arrival j + R).
-
- (* ... and that is the first job not to satisfy its response-time bound. *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_other tsk_other R_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- (tsk_other, R_other) \in rt_bounds ->
- job_arrival j_other + R_other < job_arrival j + R ->
- completed job_cost sched j_other (job_arrival j_other + R_other).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task sched j tsk_other
- (job_arrival j) (job_arrival j + R).
-
- (* ...and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost sched j (job_arrival j) (job_arrival j + R).
-
- (* Recall Bertogna and Cirinei's workload bound ... *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W task_cost task_period tsk_other R_other R.
-
- (*... and the EDF-specific bound, ... *)
- Let edf_specific_bound (tsk_other: sporadic_task) (R_other: time) :=
- edf_specific_interference_bound task_cost task_period task_deadline tsk tsk_other R_other.
-
- (* ... which combined form the interference bound. *)
- Let interference_bound (tsk_other: sporadic_task) (R_other: time) :=
- interference_bound_edf task_cost task_period task_deadline tsk R (tsk_other, R_other).
-
- (* Based on the definition of a different task, ... *)
- Let other_task := different_task tsk.
-
- (* ...let other_tasks denote the set of tasks that are different from tsk. *)
- Let other_tasks :=
- [seq tsk_other <- ts | other_task tsk_other].
-
- (* Now we establish results the interfering tasks. *)
- Section LemmasAboutInterferingTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task and
- response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_response_time_of_tsk_other: (tsk_other, R_other) \in rt_bounds.
-
- (* Note that tsk_other is in the task set, ...*)
- Lemma bertogna_edf_tsk_other_in_ts: tsk_other \in ts.
- Proof.
- rewrite set_mem -H_rt_bounds_contains_all_tasks.
- by apply/mapP; exists (tsk_other, R_other).
- Qed.
-
- (* ... and R_other is larger than the cost of tsk_other. *)
- Lemma bertogna_edf_R_other_ge_cost :
- R_other >= task_cost tsk_other.
- Proof.
- by rewrite [R_other](H_response_time_is_fixed_point tsk_other);
- first by apply leq_addr.
- Qed.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_edf_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_all_previous_jobs_completed_on_time into BEFOREok,
- H_valid_job_parameters into PARAMS,
- H_valid_task_parameters into TASK_PARAMS,
- H_constrained_deadlines into RESTR,
- H_tasks_miss_no_deadlines into NOMISS.
- unfold x, task_interference.
- have INts := bertogna_edf_tsk_other_in_ts.
- apply leq_trans with (n := workload job_task sched tsk_other
- (job_arrival j) (job_arrival j + R));
- first by apply task_interference_le_workload.
- by ( try ( apply workload_bounded_by_W with (task_deadline0 := task_deadline) (arr_seq0 := arr_seq)
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (job_deadline0 := job_deadline) ) ||
- apply workload_bounded_by_W with (task_deadline := task_deadline) (arr_seq := arr_seq)
- (job_arrival := job_arrival) (job_cost := job_cost) (job_deadline := job_deadline));
- try (by ins); last 2 first;
- [ by apply bertogna_edf_R_other_ge_cost
- | by ins; apply NOMISS
- | by ins; apply TASK_PARAMS
- | by ins; apply RESTR
- | by ins; apply BEFOREok with (tsk_other := tsk_other)].
- Qed.
-
- (* Recall that the edf-specific interference bound also holds for tsk_other. *)
- Lemma bertogna_edf_specific_bound_holds :
- x tsk_other <= edf_specific_bound tsk_other R_other.
- Proof.
- ( try ( apply interference_bound_edf_bounds_interference with (job_deadline0 := job_deadline)
- (arr_seq0 := arr_seq) (ts0 := ts); try (by done) ) ||
- apply interference_bound_edf_bounds_interference with (job_deadline := job_deadline)
- (arr_seq := arr_seq) (ts := ts); try (by done));
- [ by apply bertogna_edf_tsk_other_in_ts
- | by apply H_tasks_miss_no_deadlines
- | ].
- by ins; apply H_all_previous_jobs_completed_on_time with (tsk_other := tsk_other).
- Qed.
-
- End LemmasAboutInterferingTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X >= R - e_k + 1. *)
- Lemma bertogna_edf_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS, H_response_time_is_fixed_point into REC,
- H_job_of_tsk into JOBtsk, H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite [R](REC tsk) // leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
- apply leq_ltn_trans with (n := (\sum_(job_arrival j <= t < job_arrival j + R)
- backlogged job_arrival job_cost sched j t) +
- service sched j (job_arrival j + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_j_arrives); des; rewrite -JOBtsk.
- }
- unfold service; rewrite service_before_arrival_eq_service_during //.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(job_arrival j <= i < job_arrival j + R) 1);
- first by rewrite big_const_nat iter_addn mul1n addn0 addKn.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [GEi LTi] _].
- destruct (backlogged job_arrival job_cost sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* 1) Next, we prove that during the scheduling window of j, any job that is
- scheduled while j is backlogged comes from a different task.
- This follows from the fact that j is the first job not to complete
- by its response-time bound, so previous jobs of j's task must have
- completed by their periods and cannot be pending. *)
- Lemma bertogna_edf_interference_by_different_tasks :
- forall t j_other,
- job_arrival j <= t < job_arrival j + R ->
- arrives_in arr_seq j_other ->
- backlogged job_arrival job_cost sched j t ->
- scheduled sched j_other t ->
- job_task j_other != tsk.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_constrained_deadlines into CONSTR.
- move => t j_other /andP [LEt GEt] ARRother BACK SCHED.
- apply/eqP; red; intro SAMEtsk.
- move: SCHED => /existsP [cpu SCHED].
- assert (SCHED': scheduled sched j_other t).
- by apply/existsP; exists cpu.
- clear SCHED; rename SCHED' into SCHED.
- move: (SCHED) => PENDING.
- try ( apply scheduled_implies_pending with (job_cost0 := job_cost) (job_arrival0 := job_arrival)
- in PENDING; try (by done) ) ||
- apply scheduled_implies_pending with (job_cost := job_cost) (job_arrival := job_arrival)
- in PENDING; try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- move: (BEFOREother) => LT; rewrite -(ltn_add2r R) in LT.
- specialize (BEFOREok j_other tsk R ARRother SAMEtsk INbounds LT).
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- try ( apply completion_monotonic with (t0 := job_arrival j_other + R); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j_other + R); try (by done).
- apply leq_trans with (n := job_arrival j); last by done.
- apply leq_trans with (n := job_arrival j_other + task_deadline tsk);
- first by rewrite leq_add2l; apply NOMISS.
- apply leq_trans with (n := job_arrival j_other + task_period tsk);
- first by rewrite leq_add2l; apply CONSTR; rewrite -JOBtsk FROMTS.
- rewrite -SAMEtsk; apply SPO; try (by done); [ | by rewrite JOBtsk | by apply ltnW].
- by red; intro EQ; subst; rewrite ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge.
- apply leq_ltn_trans with (n := t); first by done.
- apply leq_trans with (n := job_arrival j + R); first by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by rewrite JOBtsk CONSTR // -JOBtsk FROMTS].
- }
- by red; intros EQtsk; subst; rewrite /backlogged SCHED andbF in BACK.
- }
- Qed.
-
- (* 2) In order to use the lemmas in constrained_deadlines.v, we show that
- all jobs released before the end of the interval complete by their
- periods. This follows trivially from the hypothesis that all jobs
- before (job_arrival j + R) complete by their response-time bounds.
- With this lemma, we can conclude that during job j's scheduling
- window there cannot be multiple pending jobs of each task.*)
- Lemma bertogna_edf_all_previous_jobs_complete_by_their_period:
- forall t j0,
- arrives_in arr_seq j0 ->
- t < job_arrival j + R ->
- job_arrival j0 + task_period (job_task j0) <= t ->
- completed job_cost sched j0
- (job_arrival j0 + task_period (job_task j0)).
- Proof.
- rename H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into CONSTR,
- H_tasks_miss_no_deadlines into NOMISS,
- H_all_jobs_from_taskset into FROMTS,
- H_all_previous_jobs_completed_on_time into BEFOREok.
- intros t j0 ARR0 LEt LE.
- cut ((job_task j0) \in unzip1 rt_bounds = true); last by rewrite UNZIP FROMTS.
- move => /mapP [p IN EQ]; destruct p as [tsk' R0]; simpl in *; subst tsk'.
- try ( apply completion_monotonic with (t0 := job_arrival j0 + R0) ) ||
- apply completion_monotonic with (t := job_arrival j0 + R0).
- {
- rewrite leq_add2l; apply leq_trans with (n := task_deadline (job_task j0));
- [by apply NOMISS | by apply CONSTR; rewrite FROMTS].
- }
- apply BEFOREok with (tsk_other := (job_task j0)); try by done.
- apply leq_ltn_trans with (n := t); last by done.
- apply leq_trans with (n := job_arrival j0 + task_period (job_task j0)); last by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline (job_task j0));
- [by apply NOMISS | apply CONSTR; rewrite FROMTS].
- Qed.
-
- (* Let's define a predicate to identify the other tasks that are scheduled. *)
- Let other_scheduled_task (t: time) (tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- other_task tsk_other.
-
- (* 3) Now we prove that, at all times that j is backlogged, the number
- of tasks other than tsk that are scheduled is exactly the number
- of processors in the system. This is required to prove lemma (4). *)
- Lemma bertogna_edf_all_cpus_are_busy:
- forall t,
- job_arrival j <= t < job_arrival j + R ->
- backlogged job_arrival job_cost sched j t ->
- count (other_scheduled_task t) ts = num_cpus.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk,
- H_sporadic_tasks into SPO,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into RESTR,
- H_work_conserving into WORK.
- unfold x, X, total_interference, task_interference.
- move => t /andP [LEt LTt] BACK.
- have PLAT := platform_cpus_busy_with_interfering_tasks task_cost task_period task_deadline
- job_arrival job_cost job_task arr_seq sched.
- apply PLAT with (j := j); try (by done);
- first by apply PARAMS; rewrite -JOBtsk; apply FROMTS.
- intros j0 tsk0 ARR0 TSK0 LE.
- cut (tsk0 \in unzip1 rt_bounds = true); last by rewrite UNZIP -TSK0 FROMTS.
- move => /mapP [p IN EQ]; destruct p as [tsk' R0]; simpl in *; subst tsk'.
- try ( apply completion_monotonic with (t0 := job_arrival j0 + R0); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j0 + R0); try (by done).
- {
- rewrite leq_add2l TSK0.
- apply leq_trans with (n := task_deadline tsk0); first by apply NOMISS.
- by apply RESTR; rewrite -TSK0 FROMTS.
- }
- {
- apply BEFOREok with (tsk_other := tsk0); try (by done).
- apply leq_ltn_trans with (n := t); last by done.
- apply leq_trans with (n := job_arrival j0 + task_period tsk0); last by done.
- rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk0); first by apply NOMISS.
- by apply RESTR; rewrite -TSK0 FROMTS.
- }
- Qed.
-
- (* 4) Next, we prove that the sum of the interference of each task is equal
- to the total interference multiplied by the number of processors. This
- holds because interference only occurs when all processors are busy.
- With this lemma we can relate per-task interference with the total
- interference incurred by j (backlogged time). *)
- Lemma bertogna_edf_interference_on_all_cpus :
- \sum_(tsk_k <- other_tasks) x tsk_k = X * num_cpus.
- Proof.
- have DIFFTASK := bertogna_edf_interference_by_different_tasks.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into CONSTR.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last first.
- {
- rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- by intros i _; rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- }
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus) 1); last by simpl_sum_const.
- apply eq_bigr; intros cpu _.
- move: (WORK j t H_j_arrives BACK cpu) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- have ARRother: arrives_in arr_seq j_other.
- by apply (FROMSEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- rewrite big_const_seq iter_addn mul0n 2!addn0; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu; apply/eqP.
- Qed.
-
- (* Before stating the next lemma, let (num_tasks_exceeding delta) be the
- number of interfering tasks whose interference x is larger than delta. *)
- Let num_tasks_exceeding delta := count (fun i => x i >= delta) (other_tasks).
-
- (* 5) Now we prove that, for any delta, if (num_task_exceeding delta > 0), then the
- cumulative interference caused by the complementary set of interfering tasks fills
- the remaining, not-completely-full (num_cpus - num_tasks_exceeding delta)
- processors. *)
- Lemma bertogna_edf_interference_in_non_full_processors :
- forall delta,
- 0 < num_tasks_exceeding delta < num_cpus ->
- \sum_(i <- other_tasks | x i < delta) x i >= delta * (num_cpus - num_tasks_exceeding delta).
- Proof.
- have COMP := bertogna_edf_all_previous_jobs_complete_by_their_period.
- have INV := bertogna_edf_all_cpus_are_busy.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk,
- H_sporadic_tasks into SPO,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_constrained_deadlines into CONSTR,
- H_sequential_jobs into SEQ.
- unfold sporadic_task_model in *.
- move => delta /andP [HAS LT].
- rewrite -has_count in HAS.
-
- set some_interference_A := fun t =>
- has (fun tsk_k => backlogged job_arrival job_cost sched j t &&
- (x tsk_k >= delta) &&
- task_is_scheduled job_task sched tsk_k t) other_tasks.
- set total_interference_B := fun t =>
- backlogged job_arrival job_cost sched j t *
- count (fun tsk_k => (x tsk_k < delta) &&
- task_is_scheduled job_task sched tsk_k t) other_tasks.
-
- apply leq_trans with ((\sum_(job_arrival j <= t < job_arrival j + R)
- some_interference_A t) * (num_cpus - num_tasks_exceeding delta)).
- {
- rewrite leq_mul2r; apply/orP; right.
- move: HAS => /hasP HAS; destruct HAS as [tsk_a INa LEa].
- apply leq_trans with (n := x tsk_a); first by apply LEa.
- unfold x, task_interference, some_interference_A.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- last by rewrite (eq_bigr (fun x => 0)); [by simpl_sum_const | by ins].
- destruct ([exists cpu, task_scheduled_on job_task sched tsk_a cpu t]) eqn:SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED; move: SCHED => /forallP ALL.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (ALL cpu); apply negbTE in ALL; rewrite ALL.
- }
- move: SCHED => /existsP [cpu SCHED].
- apply leq_trans with (n := 1); last first.
- {
- rewrite lt0b; apply/hasP; exists tsk_a; first by done.
- by rewrite LEa 2!andTb; apply/existsP; exists cpu.
- }
- rewrite (bigD1 cpu) /= // SCHED.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const; rewrite leq_b1.
- intros cpu' DIFF.
- apply/eqP; rewrite eqb0; apply/negP.
- intros SCHED'.
- move: DIFF => /negP DIFF; apply DIFF; apply/eqP.
- unfold task_scheduled_on in *.
- destruct (sched cpu t) as [j1|] eqn:SCHED1; last by done.
- destruct (sched cpu' t) as [j2|] eqn:SCHED2; last by done.
- move: SCHED SCHED' => /eqP JOB /eqP JOB'.
- subst tsk_a; symmetry in JOB'.
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu'; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu; apply/eqP.
- }
- assert (PENDING2: pending job_arrival job_cost sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu'; apply/eqP.
- }
- assert (BUG: j1 = j2).
- {
- ( try ( apply platform_at_most_one_pending_job_of_each_task with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (tsk0 := tsk)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) (j0 := j) (t0 := t)
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq) ) ||
- apply platform_at_most_one_pending_job_of_each_task with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (tsk := tsk)
- (job_cost := job_cost) (job_task := job_task) (sched := sched) (j := j) (t := t)
- (job_arrival := job_arrival) (arr_seq := arr_seq));
- rewrite ?JOBtsk ?SAMEtsk //; first by apply PARAMS; rewrite -JOBtsk FROMTS.
- intros j0 tsk0 ARR0 TSK0 LE.
- by apply (COMP t); rewrite ?TSK0.
- }
- by subst j2; apply SEQ with (j := j1) (t := t).
- }
-
- apply leq_trans with (\sum_(job_arrival j <= t < job_arrival j + R)
- total_interference_B t).
- {
- rewrite big_distrl /=.
- apply leq_sum_nat; move => t LEt _.
- unfold some_interference_A, total_interference_B.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- [rewrite mul1n /= | by rewrite has_pred0 //].
-
- destruct (has (fun tsk_k : sporadic_task => (delta <= x tsk_k) &&
- task_is_scheduled job_task sched tsk_k t) other_tasks) eqn:HAS';
- last by done.
- rewrite mul1n; move: HAS => /hasP [tsk_k INk LEk].
- unfold num_tasks_exceeding.
- apply leq_trans with (n := num_cpus -
- count (fun i => (x i >= delta) &&
- task_is_scheduled job_task sched i t) other_tasks).
- {
- apply leq_sub2l.
- rewrite -2!sum1_count big_mkcond /=.
- rewrite [\sum_(_ <- _ | _ <= _)_]big_mkcond /=.
- apply leq_sum; intros i _.
- by destruct (task_is_scheduled job_task sched i t);
- [by rewrite andbT | by rewrite andbF].
- }
- rewrite -count_filter -[count _ other_tasks]count_filter.
- eapply leq_trans with (n := count (predC (fun tsk => delta <= x tsk)) _);
- last by apply eq_leq, eq_in_count; red; ins; rewrite ltnNge.
- rewrite leq_subLR count_predC size_filter.
- by apply leq_trans with (n := count (other_scheduled_task t) ts);
- [by rewrite INV | by rewrite count_filter].
- }
- {
- unfold x at 2, total_interference_B.
- rewrite exchange_big /=; apply leq_sum; intros t _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last by ins.
- rewrite mul1n -sum1_count.
- rewrite big_mkcond [\sum_(i <- other_tasks | _ < _) _]big_mkcond /=.
- apply leq_sum_seq; move => tsk_k IN _.
- destruct (x tsk_k < delta); [rewrite andTb | by rewrite andFb].
- destruct (task_is_scheduled job_task sched tsk_k t) eqn:SCHED; last by done.
- move: SCHED => /existsP [cpu SCHED].
- by rewrite (bigD1 cpu) /= // SCHED.
- }
- Qed.
-
- (* 6) Based on lemma (5), we prove that, for any interval delta, if the sum of per-task
- interference exceeds (delta * num_cpus), the same applies for the
- sum of the minimum of the interference and delta. *)
- Lemma bertogna_edf_minimum_exceeds_interference :
- forall delta,
- \sum_(tsk_k <- other_tasks) x tsk_k >= delta * num_cpus ->
- \sum_(tsk_k <- other_tasks) minn (x tsk_k) delta >=
- delta * num_cpus.
- Proof.
- intros delta SUMLESS.
- set more_interf := fun tsk_k => x tsk_k >= delta.
- rewrite [\sum_(_ <- _) minn _ _](bigID more_interf) /=.
- unfold more_interf, minn.
- rewrite [\sum_(_ <- _ | delta <= _)_](eq_bigr (fun i => delta));
- last by intros i COND; rewrite leqNgt in COND; destruct (delta > x i).
- rewrite [\sum_(_ <- _ | ~~_)_](eq_big (fun i => x i < delta)
- (fun i => x i));
- [| by red; ins; rewrite ltnNge
- | by intros i COND; rewrite -ltnNge in COND; rewrite COND].
-
- (* Case 1: num_tasks_exceeding = 0 *)
- destruct (~~ has (fun i => delta <= x i) other_tasks) eqn:HASa.
- {
- rewrite [\sum_(_ <- _ | _ <= _) _]big_hasC; last by apply HASa.
- rewrite big_seq_cond; move: HASa => /hasPn HASa.
- rewrite add0n (eq_bigl (fun i => (i \in other_tasks) && true));
- last by red; intros tsk_k; destruct (tsk_k \in other_tasks) eqn:INk;
- [by rewrite andTb ltnNge; apply HASa | by rewrite andFb].
- by rewrite -big_seq_cond.
- } apply negbFE in HASa.
-
- (* Case 2: num_tasks_exceeding >= num_cpus *)
- destruct (num_tasks_exceeding delta >= num_cpus) eqn:CARD.
- {
- apply leq_trans with (delta * num_tasks_exceeding delta);
- first by rewrite leq_mul2l; apply/orP; right.
- unfold num_tasks_exceeding; rewrite -sum1_count big_distrr /=.
- rewrite -[\sum_(_ <- _ | _) _]addn0.
- by apply leq_add; [by apply leq_sum; ins; rewrite muln1|by ins].
- } apply negbT in CARD; rewrite -ltnNge in CARD.
-
- (* Case 3: num_tasks_exceeding < num_cpus *)
- rewrite big_const_seq iter_addn addn0; fold num_tasks_exceeding.
- apply leq_trans with (n := delta * num_tasks_exceeding delta +
- delta * (num_cpus - num_tasks_exceeding delta));
- first by rewrite -mulnDr subnKC //; apply ltnW.
- rewrite leq_add2l; apply bertogna_edf_interference_in_non_full_processors.
- by apply/andP; split; first by rewrite -has_count.
- Qed.
-
- (* 7) Next, using lemmas (0), (4) and (6) we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_edf_sum_exceeds_total_interference:
- \sum_((tsk_other, R_other) <- rt_bounds | other_task tsk_other)
- minn (x tsk_other) (R - task_cost tsk + 1) > I tsk R.
- Proof.
- have GE_COST := bertogna_edf_R_other_ge_cost.
- have EXCEEDS := bertogna_edf_minimum_exceeds_interference.
- have ALLBUSY := bertogna_edf_interference_on_all_cpus.
- have TOOMUCH := bertogna_edf_too_much_interference.
- rename H_rt_bounds_contains_all_tasks into UNZIP,
- H_response_time_is_fixed_point into REC.
- apply leq_trans with (n := \sum_(tsk_other <- other_tasks) minn (x tsk_other) (R - task_cost tsk + 1));
- last first.
- {
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- move: UNZIP => UNZIP.
- assert (FILTER: filter other_task (unzip1 rt_bounds) =
- filter other_task ts).
- by f_equal.
- unfold other_tasks; rewrite -FILTER; clear FILTER.
- rewrite -[\sum_(_ <- rt_bounds | _)_]big_filter.
- assert (SUBST: [seq i <- rt_bounds
- | let '(tsk_other, _) := i in other_task tsk_other] =
- [seq i <- rt_bounds | other_task (fst i)]).
- {
- by apply eq_filter; red; intro i; destruct i.
- } rewrite SUBST; clear SUBST.
- have MAP := big_map (fun x => fst x) (fun i => true) (fun i => minn (x i) (R - task_cost tsk + 1)).
- by rewrite -MAP; apply eq_leq; f_equal; rewrite filter_map.
- }
-
- apply ltn_div_trunc with (d := num_cpus); first by apply H_at_least_one_cpu.
- rewrite -(ltn_add2l (task_cost tsk)) -REC; last by done.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by apply GE_COST.
- rewrite leq_divRL; last by apply H_at_least_one_cpu.
- apply EXCEEDS.
- apply leq_trans with (n := X * num_cpus);
- last by rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 8) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k, I_edf, R - e_i + 1).
- This implies that either x_k > W_k or x_k > I_edf, which is a contradiction,
- since both W_k and I_edf are valid task interference bounds. *)
- Lemma bertogna_edf_exists_task_that_exceeds_bound :
- exists tsk_other R_other,
- (tsk_other, R_other) \in rt_bounds /\
- (minn (x tsk_other) (R - task_cost tsk + 1) > interference_bound tsk_other R_other).
- Proof.
- have SUM := bertogna_edf_sum_exceeds_total_interference.
- have BOUND := bertogna_edf_workload_bounds_interference.
- have EDFBOUND := bertogna_edf_specific_bound_holds.
- rename H_rt_bounds_contains_all_tasks into UNZIP.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_other, R_other) := tup in
- (tsk_other \in ts) && other_task tsk_other &&
- (minn (x tsk_other) (R - task_cost tsk + 1) >
- interference_bound tsk_other R_other))
- rt_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- unfold I, total_interference_bound_edf.
- rewrite big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => tsk_k /andP [INBOUNDSk INTERFk]; destruct tsk_k as [tsk_k R_k].
- specialize (ALL (tsk_k, R_k) INBOUNDSk).
- unfold interference_bound_edf; simpl in *.
- rewrite leq_min; apply/andP; split.
- {
- unfold interference_bound; rewrite leq_min; apply/andP; split;
- last by rewrite geq_minr.
- apply leq_trans with (n := x tsk_k); first by rewrite geq_minl.
- by apply BOUND.
- }
- {
- apply leq_trans with (n := x tsk_k); first by rewrite geq_minl.
- by apply EDFBOUND.
- }
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MIN].
- move: MIN => /andP [/andP [INts INTERFk] MINk].
- by exists tsk_k, R_k; repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- Section MainProof.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Using the lemmas above, we prove that R bounds the response time of task tsk. *)
- Theorem bertogna_cirinei_response_time_bound_edf :
- response_time_bounded_by tsk R.
- Proof.
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + R) as ctime.
-
- revert H_tsk_R_in_rt_bounds.
- generalize dependent R; generalize dependent tsk; generalize dependent j.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj tsk' JOBtsk R' EQc INbounds; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0 tsk R0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- (tsk, R0) \in rt_bounds ->
- job_arrival j0 + R0 < job_arrival j + R' ->
- service sched j0 (job_arrival j0 + R0) >= job_cost j0).
- {
- by ins; apply IH with (tsk := tsk0) (R := R0).
- }
- clear IH.
-
- (* The proof follows by contradiction. Assume that job j does not complete by its
- response-time bound. By the induction hypothesis, all jobs with absolute
- response-time bound t < (job_arrival j + R) have correct response-time bounds. *)
- destruct (completed job_cost sched j (job_arrival j + R')) eqn:NOTCOMP;
- first by done.
- apply negbT in NOTCOMP; exfalso.
-
- (* Next, we derive a contradiction using the previous lemmas. *)
- exploit (bertogna_edf_exists_task_that_exceeds_bound tsk' R' INbounds j ARRj JOBtsk NOTCOMP).
- {
- by ins; apply IH with (tsk := tsk_other) (R := R_other).
- }
- intro EX; destruct EX as [tsk_other [R_other [HP LTmin]]].
- unfold interference_bound_edf, interference_bound_generic in LTmin.
- rewrite minnAC in LTmin; apply min_lt_same in LTmin.
- have BASICBOUND := bertogna_edf_workload_bounds_interference R' j BEFOREok tsk_other R_other HP.
- have EDFBOUND := (bertogna_edf_specific_bound_holds tsk' R' j ARRj
- JOBtsk BEFOREok tsk_other R_other HP).
- unfold minn in LTmin; clear -LTmin HP BASICBOUND EDFBOUND tsk; desf.
- {
- by apply (leq_ltn_trans BASICBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- {
- by apply (leq_ltn_trans EDFBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- Qed.
-
- End MainProof.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisEDF.
diff --git a/classic/analysis/global/basic/bertogna_fp_comp.v b/classic/analysis/global/basic/bertogna_fp_comp.v
deleted file mode 100644
index c2cd7bc75761f6bd5ba4c1c5dee7605d8e2f39ec..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/bertogna_fp_comp.v
+++ /dev/null
@@ -1,711 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.global.basic.bertogna_fp_theory.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationFP.
-
- Import ResponseTimeAnalysisFP.
-
- (* In this section, we define the algorithm of Bertogna and Cirinei's
- response-time analysis for FP scheduling. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* As input for each iteration of the algorithm, we consider pairs
- of tasks and computed response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider a platform with num_cpus processors, ... *)
- Variable num_cpus: nat.
-
- (* ..., and priorities based on an FP policy. *)
- Variable higher_priority: FP_policy sporadic_task.
-
- (* Next we define the fixed-point iteration for computing
- Bertogna's response-time bound of a task set. *)
-
- (* First, given a sequence of pairs R_prev = <..., (tsk_hp, R_hp)> of
- response-time bounds for the higher-priority tasks, we define an
- iteration that computes the response-time bound of the current task:
-
- R_tsk (0) = task_cost tsk
- R_tsk (step + 1) = f (R step),
-
- where f is the response-time recurrence, step is the number of iterations,
- and R_tsk (0) is the initial state. *)
- Definition per_task_rta (tsk: sporadic_task)
- (R_prev: seq task_with_response_time) (step: nat) :=
- iter step
- (fun t => task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period tsk
- R_prev t)
- num_cpus)
- (task_cost tsk).
-
- (* To ensure that the iteration converges, we will apply per_task_rta
- a "sufficient" number of times: task_deadline tsk - task_cost tsk + 1.
- This corresponds to the time complexity of the iteration. *)
- Definition max_steps (tsk: sporadic_task) := task_deadline tsk - task_cost tsk + 1.
-
- (* Next we compute the response-time bounds for the entire task set.
- Since high-priority tasks may not be schedulable, we allow the
- computation to fail.
- Thus, given the response-time bound of previous tasks, we either
- (a) append the computed response-time bound (tsk, R) of the current task
- to the list of pairs, or,
- (b) return None if the response-time analysis failed. *)
- Definition fp_bound_of_task hp_pairs tsk :=
- if hp_pairs is Some rt_bounds then
- let R := per_task_rta tsk rt_bounds (max_steps tsk) in
- if R <= task_deadline tsk then
- Some (rcons rt_bounds (tsk, R))
- else None
- else None.
-
- (* The response-time analysis for a given task set is defined
- as a left-fold (reduce) based on the function above.
- This either returns a list of task and response-time bounds, or None. *)
- Definition fp_claimed_bounds (ts: seq sporadic_task) :=
- foldl fp_bound_of_task (Some [::]) ts.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition fp_schedulable (ts: seq sporadic_task) :=
- fp_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of response-time bounds. The results seem trivial, but must be proven
- nonetheless since the list of response-time bounds is computed with
- a specific algorithm and there are no lemmas in the library for that. *)
- Section SimpleLemmas.
-
- (* First, we show that the first component of the computed list is the set of tasks. *)
- Lemma fp_claimed_bounds_unzip :
- forall ts hp_bounds,
- fp_claimed_bounds ts = Some hp_bounds ->
- unzip1 hp_bounds = ts.
- Proof.
- unfold fp_claimed_bounds in *; intros ts.
- induction ts using last_ind; first by destruct hp_bounds.
- {
- intros hp_bounds SOME.
- destruct (lastP hp_bounds) as [| hp_bounds'].
- {
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- by destruct l.
- }
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- move: H0 => /eqP EQSEQ.
- rewrite eqseq_rcons in EQSEQ.
- move: EQSEQ => /andP [/eqP SUBST /eqP EQSEQ]; subst.
- unfold unzip1; rewrite map_rcons; f_equal.
- by apply IHts.
- }
- Qed.
-
- (* Next, we show that some properties of the analysis are preserved for the
- prefixes of the list: (a) the tasks do not change, (b) R <= deadline,
- (c) R is computed using the response-time equation, ... *)
- Lemma fp_claimed_bounds_rcons :
- forall ts' hp_bounds tsk1 tsk2 R,
- (fp_claimed_bounds (rcons ts' tsk1) = Some (rcons hp_bounds (tsk2, R)) ->
- (fp_claimed_bounds ts' = Some hp_bounds /\
- tsk1 = tsk2 /\
- R = per_task_rta tsk1 hp_bounds (max_steps tsk1) /\
- R <= task_deadline tsk1)).
- Proof.
- intros ts hp_bounds tsk tsk' R.
- rewrite -cats1.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /=.
- unfold fp_bound_of_task at 1; simpl; desf.
- intros EQ; inversion EQ; move: EQ H0 => _ /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [/eqP EQ /eqP RESP].
- by inversion RESP; repeat split; subst.
- Qed.
-
- (* ..., which implies that any prefix of the computation is the computation
- of the prefix. *)
- Lemma fp_claimed_bounds_take :
- forall ts hp_bounds i,
- fp_claimed_bounds ts = Some hp_bounds ->
- i <= size hp_bounds ->
- fp_claimed_bounds (take i ts) = Some (take i hp_bounds).
- Proof.
- intros ts hp_bounds i SOME LTi.
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
- rewrite <- UNZIP in *.
- rewrite -[hp_bounds]take_size /unzip1 map_take in SOME.
- fold (unzip1 hp_bounds) in *; clear UNZIP.
- rewrite leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LTi]; first by subst.
- remember (size hp_bounds) as len; apply eq_leq in Heqlen.
- induction len; first by rewrite ltn0 in LTi.
- {
- assert (TAKElen: fp_claimed_bounds (take len (unzip1 (hp_bounds))) =
- Some (take len (hp_bounds))).
- {
- assert (exists p, p \in hp_bounds).
- {
- destruct hp_bounds; first by rewrite ltn0 in Heqlen.
- by exists t; rewrite in_cons eq_refl orTb.
- } destruct H as [[tsk R] _].
- rewrite (take_nth tsk) in SOME; last by rewrite size_map.
- rewrite (take_nth (tsk,R)) in SOME; last by done.
- destruct (nth (tsk, R) hp_bounds len) as [tsk_len R_len].
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- rewrite ltnS leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LESS]; first by subst.
- apply ltnW in Heqlen.
- by specialize (IHlen Heqlen TAKElen LESS).
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadlines ... *)
- Lemma fp_claimed_bounds_le_deadline :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R <= task_deadline tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by apply Heq0.
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* ... and no smaller than the task costs. *)
- Lemma fp_claimed_bounds_ge_cost :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R >= task_cost tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by destruct (max_steps tsk_lst');
- [by apply leqnn | by apply leq_addr].
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* Short lemma about unfolding the iteration one step. *)
- Lemma per_task_rta_fold :
- forall tsk rt_bounds,
- task_cost tsk +
- div_floor (total_interference_bound_fp task_cost task_period tsk rt_bounds
- (per_task_rta tsk rt_bounds (max_steps tsk))) num_cpus
- = per_task_rta tsk rt_bounds (max_steps tsk).+1.
- Proof.
- by done.
- Qed.
-
- End SimpleLemmas.
-
- (* In this section, we prove that if the task set is sorted by priority,
- the tasks in fp_claimed_bounds are interfering tasks. *)
- Section HighPriorityTasks.
-
- (* Consider a list of previous tasks and a task tsk to be analyzed. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that the task set is sorted by unique priorities, ... *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
-
- (* ...the priority order is transitive, ...*)
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* ... and that the response-time analysis succeeds. *)
- Variable hp_bounds: seq task_with_response_time.
- Variable R: time.
- Hypothesis H_analysis_succeeds: fp_claimed_bounds ts = Some hp_bounds.
-
- (* Let's refer to tasks by index. *)
- Variable elem: sporadic_task.
- Let TASK := nth elem ts.
-
- (* We prove that higher-priority tasks have smaller index. *)
- Lemma fp_claimed_bounds_hp_tasks_have_smaller_index :
- forall hp_idx idx,
- hp_idx < size ts ->
- idx < size ts ->
- hp_idx != idx ->
- higher_priority (TASK hp_idx) (TASK idx) ->
- hp_idx < idx.
- Proof.
- unfold TASK; clear TASK.
- rename ts into ts'; destruct ts' as [ts UNIQ]; simpl in *.
- intros hp_idx idx LThp LT NEQ HP.
- rewrite ltn_neqAle; apply/andP; split; first by done.
- by apply sorted_rel_implies_le_idx with (leT := higher_priority) (xs := ts) (default := elem).
- Qed.
-
- End HighPriorityTasks.
-
- (* In this section, we show that the fixed-point iteration converges. *)
- Section Convergence.
-
- (* Consider any list of higher-priority tasks. *)
- Variable ts_hp: list sporadic_task.
-
- (* Assume that the response-time analysis succeeds for the higher-priority tasks. *)
- Variable rt_bounds: seq task_with_response_time.
- Hypothesis H_test_succeeds: fp_claimed_bounds ts_hp = Some rt_bounds.
-
- (* Consider any task tsk to be analyzed, ... *)
- Variable tsk: sporadic_task.
-
- (* ... and assume all tasks have valid parameters. *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline (rcons ts_hp tsk).
-
- (* To simplify, let f denote the fixed-point iteration. *)
- Let f := per_task_rta tsk rt_bounds.
-
- (* Assume that f (max_steps tsk) is no larger than the deadline. *)
- Hypothesis H_no_larger_than_deadline: f (max_steps tsk) <= task_deadline tsk.
-
- (* First, we show that f is monotonically increasing. *)
- Lemma bertogna_fp_comp_f_monotonic :
- forall x1 x2, x1 <= x2 -> f x1 <= f x2.
- Proof.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_test_succeeds into SOME,
- H_valid_task_parameters into VALID.
- intros x1 x2 LEx; unfold f, per_task_rta.
- apply fun_mon_iter_mon; [by ins | by ins; apply leq_addr |].
- clear LEx x1 x2; intros x1 x2 LEx.
- unfold div_floor, total_interference_bound_fp.
- rewrite big_seq_cond.
- rewrite [\sum_(_ <- _ | true) _]big_seq_cond.
- rewrite leq_add2l leq_div2r //.
- apply leq_sum; move => i /andP [IN _].
- destruct i as [i R].
- have GE_COST := fp_claimed_bounds_ge_cost ts_hp rt_bounds i R SOME IN.
- have UNZIP := fp_claimed_bounds_unzip ts_hp rt_bounds SOME.
- assert (IN': i \in ts_hp).
- {
- by rewrite -UNZIP; apply/mapP; exists (i,R).
- }
- unfold interference_bound_generic; simpl.
- rewrite leq_min; apply/andP; split.
- {
- apply leq_trans with (n := W task_cost task_period i R x1); first by apply geq_minl.
- exploit (VALID i); [by rewrite mem_rcons in_cons IN' orbT | ins; des].
- by apply W_monotonic; try (by done); apply GE_COST.
- }
- {
- apply leq_trans with (n := x1 - task_cost tsk + 1); first by apply geq_minr.
- by rewrite leq_add2r leq_sub2r //.
- }
- Qed.
-
- (* If the iteration converged at an earlier step, it remains as a fixed point. *)
- Lemma bertogna_fp_comp_f_converges_early :
- (exists k, k <= max_steps tsk /\ f k = f k.+1) ->
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- by intros EX; des; apply fixedpoint.iter_fix with (k := k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume instead that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps tsk -> f k != f k.+1.
-
- (* By monotonicity, it follows that the value always increases. *)
- Lemma bertogna_fp_comp_f_increases :
- forall k,
- k <= max_steps tsk ->
- f k < f k.+1.
- Proof.
- intros k LT.
- rewrite ltn_neqAle; apply/andP; split.
- by apply H_keeps_diverging.
- by apply bertogna_fp_comp_f_monotonic, leqnSn.
- Qed.
-
- (* In the end, the response-time bound must exceed the deadline. Contradiction! *)
- Lemma bertogna_fp_comp_rt_grows_too_much :
- forall k,
- k <= max_steps tsk ->
- f k > k + task_cost tsk - 1.
- Proof.
- have INC := bertogna_fp_comp_f_increases.
- rename H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- induction k.
- {
- intros _; rewrite add0n -addn1 addnBAC;
- first by rewrite -addnBA // subnn addn0 /= leqnn.
- by apply PARAMS.
- }
- {
- intros LT.
- specialize (IHk (ltnW LT)).
- apply leq_ltn_trans with (n := f k); last by apply INC, ltnW.
- rewrite -addn1 -addnA [1 + _]addnC addnA -addnBA // subnn addn0.
- rewrite -(ltn_add2r 1) in IHk.
- rewrite addnBAC in IHk;
- last by apply leq_trans with (n := task_cost tsk);
- [by apply PARAMS | by apply leq_addl].
- by rewrite -addnBA // subnn addn0 addn1 ltnS in IHk.
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove the convergence of the iteration after max_steps. *)
- Lemma per_task_rta_converges:
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- have TOOMUCH := bertogna_fp_comp_rt_grows_too_much.
- have INC := bertogna_fp_comp_f_increases.
- rename H_no_larger_than_deadline into LE,
- H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_(max_steps tsk).+1, f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- apply bertogna_fp_comp_f_converges_early.
- by exists k; split; [by rewrite -ltnS; apply ltn_ord | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
- rewrite leqNgt in LE; move: LE => /negP LE.
- exfalso; apply LE.
-
- assert (DIFF: forall k : nat, k <= max_steps tsk -> f k != f k.+1).
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | intro DIFF; apply DIFF].
- }
- exploit TOOMUCH; [by apply DIFF | by apply leq_addr |].
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- rewrite addnBAC; last by apply PARAMS2.
- rewrite -addnBA // subnn addn0 subn1 prednK //.
- intros LT; apply (leq_ltn_trans LT).
- by rewrite /max_steps [_ - _ + 1]addn1; apply INC, leq_addr.
- Qed.
-
- End Convergence.
-
- Section MainProof.
-
- (* Consider a task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all tasks have valid parameters, ... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ...constrained deadlines.*)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Assume that the task set is totally ordered by unique priorities,
- and that the priority order is transitive. *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
- Hypothesis H_priority_is_total:
- FP_is_total_over_task_set higher_priority ts.
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* Next, consider any arrival sequence such that...*)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...jobs have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any schedule of this arrival sequence such that... *)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after they arrived and no longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that jobs are sequential (as required by the workload bound). *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assume that the scheduler is work-conserving and respects the FP policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy job_arrival job_cost job_task arr_seq sched higher_priority.
-
- Let no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in fp_claimed_bounds is safe. The proof follows by induction on the task set:
-
- Induction hypothesis: assume all higher-priority tasks have safe response-time bounds.
- Inductive step: we prove that the response-time bound of the current task is safe.
-
- Note that the inductive step is a direct application of the main Theorem from
- bertogna_fp_theory.v. *)
- Theorem fp_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In fp_claimed_bounds ts ->
- response_time_bounded_by tsk R.
- Proof.
- rename H_valid_job_parameters into JOBPARAMS, H_valid_task_parameters into TASKPARAMS.
- unfold valid_sporadic_taskset in *.
- intros tsk R MATCH.
- assert (SOME: exists hp_bounds, fp_claimed_bounds ts = Some hp_bounds /\
- (tsk, R) \in hp_bounds).
- {
- destruct (fp_claimed_bounds ts); last by done.
- by exists l; split.
- } clear MATCH; des; rename SOME0 into IN.
-
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
-
- set elem := (tsk,R).
- move: IN => /(nthP elem) [idx LTidx EQ].
- set NTH := fun k => nth elem hp_bounds k.
- set TASK := fun k => (NTH k).1.
- set RESP := fun k => (NTH k).2.
- cut (response_time_bounded_by (TASK idx) (RESP idx));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- clear EQ.
-
- assert (PAIR: forall idx, (TASK idx, RESP idx) = NTH idx).
- by intros i; unfold TASK, RESP; destruct (NTH i).
-
- assert (SUBST: forall i, i < size hp_bounds -> TASK i = nth tsk ts i).
- by intros i LTi; rewrite /TASK /NTH -UNZIP (nth_map elem) //.
-
- assert (SIZE: size hp_bounds = size ts).
- by rewrite -UNZIP size_map.
-
- induction idx as [idx IH'] using strong_ind.
-
- assert (IH: forall tsk_hp R_hp, (tsk_hp, R_hp) \in take idx hp_bounds -> response_time_bounded_by tsk_hp R_hp).
- {
- intros tsk_hp R_hp INhp.
- move: INhp => /(nthP elem) [k LTk EQ].
- rewrite size_take LTidx in LTk.
- rewrite nth_take in EQ; last by done.
- cut (response_time_bounded_by (TASK k) (RESP k));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- by apply IH'; try (by done); apply (ltn_trans LTk).
- } clear IH'.
-
- unfold response_time_bounded_by in *.
-
- exploit (fp_claimed_bounds_rcons (take idx ts) (take idx hp_bounds) (TASK idx) (TASK idx) (RESP idx)).
- {
- by rewrite PAIR SUBST // -2?take_nth -?SIZE // (fp_claimed_bounds_take _ hp_bounds).
- }
- intros [_ [_ [REC DL]]].
-
- ( try ( apply bertogna_cirinei_response_time_bound_fp with
- (task_cost0 := task_cost) (task_period0 := task_period)
- (task_deadline0 := task_deadline) (job_deadline0 := job_deadline) (tsk0 := (TASK idx))
- (job_task0 := job_task) (ts0 := ts) (hp_bounds0 := take idx hp_bounds)
- (higher_eq_priority := higher_priority) ) ||
- apply bertogna_cirinei_response_time_bound_fp with
- (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (job_deadline := job_deadline) (tsk := (TASK idx))
- (job_task := job_task) (ts := ts) (hp_bounds := take idx hp_bounds)
- (higher_eq_priority := higher_priority) ); try (by done).
- {
- cut (NTH idx \in hp_bounds = true); [intros IN | by apply mem_nth].
- by rewrite set_mem -UNZIP; apply/mapP; exists (TASK idx, RESP idx); rewrite PAIR.
- }
- {
- intros hp_tsk IN INTERF.
- exists (RESP (index hp_tsk ts)).
- move: (IN) => INDEX; apply nth_index with (x0 := tsk) in INDEX.
- rewrite -{1}[hp_tsk]INDEX -SUBST; last by rewrite SIZE index_mem.
- assert (UNIQ: uniq hp_bounds).
- {
- apply map_uniq with (f := fst); unfold unzip1 in *; rewrite UNZIP.
- by destruct ts.
- }
- rewrite -filter_idx_lt_take //.
- {
- rewrite PAIR mem_filter; apply/andP; split;
- last by apply mem_nth; rewrite SIZE index_mem.
- {
- rewrite /NTH index_uniq; [| by rewrite SIZE index_mem | by done ].
- {
- move: INTERF => /andP [HP NEQ].
- apply fp_claimed_bounds_hp_tasks_have_smaller_index with
- (ts := ts) (elem := tsk) (hp_bounds := hp_bounds);
- try (by done);
- [by rewrite index_mem | by rewrite -SIZE | | by rewrite INDEX -SUBST].
- apply/eqP; intro BUG; subst idx.
- rewrite SUBST -{1}INDEX in NEQ;
- first by rewrite eq_refl in NEQ.
- by rewrite SIZE index_mem INDEX.
- }
- }
- }
- }
- {
- intros hp_tsk R_hp IN; apply mem_take in IN.
- by apply fp_claimed_bounds_ge_cost with (ts' := ts) (rt_bounds := hp_bounds).
- }
- {
- intros hp_tsk R_hp IN; apply mem_take in IN.
- by apply fp_claimed_bounds_le_deadline with (ts' := ts) (rt_bounds := hp_bounds).
- }
- {
- rewrite REC per_task_rta_fold.
- apply per_task_rta_converges with (ts_hp := take idx ts);
- [by apply fp_claimed_bounds_take; try (by apply ltnW) | | by rewrite -REC ].
- rewrite SUBST // -take_nth -?SIZE //.
- by intros i IN; eapply TASKPARAMS, mem_take, IN.
- }
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: fp_schedulable ts.
-
- (*..., no task misses its deadline. *)
- Theorem taskset_schedulable_by_fp_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (fp_analysis_yields_response_time_bounds).
- have UNZIP := (fp_claimed_bounds_unzip ts).
- have DL := (fp_claimed_bounds_le_deadline ts).
-
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- fp_schedulable, valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS.
- move => tsk INtsk j ARRj JOBtsk.
- destruct (fp_claimed_bounds ts) as [rt_bounds |]; last by ins.
- feed (UNZIP rt_bounds); first by done.
- assert (EX: exists R, (tsk, R) \in rt_bounds).
- {
- rewrite set_mem -UNZIP in INtsk; move: INtsk => /mapP EX.
- by destruct EX as [p]; destruct p as [tsk' R]; simpl in *; subst tsk'; exists R.
- } des.
- exploit (RLIST tsk R EX j ARRj); [by done | intro COMPLETED].
- exploit (DL rt_bounds tsk R); [by ins | by ins | clear DL; intro DL].
- apply leq_trans with (n := service sched j (job_arrival j + R)); first by done.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- apply extend_sum; rewrite // leq_add2l.
- specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS1.
- by rewrite JOBtsk.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we also conclude that no job in
- the schedule misses its deadline. *)
- Theorem jobs_schedulable_by_fp_rta :
- forall j, arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_fp_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationFP.
diff --git a/classic/analysis/global/basic/bertogna_fp_theory.v b/classic/analysis/global/basic/bertogna_fp_theory.v
deleted file mode 100644
index 226c0fec894f68eb264dccf2114f59097b2bfb91..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/bertogna_fp_theory.v
+++ /dev/null
@@ -1,807 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.schedulability
- prosa.classic.model.schedule.global.response_time.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform
- prosa.classic.model.schedule.global.basic.constrained_deadlines prosa.classic.model.schedule.global.basic.interference.
-Require Import prosa.classic.analysis.global.basic.workload_bound
- prosa.classic.analysis.global.basic.interference_bound_fp.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisFP.
-
- Export Job SporadicTaskset ScheduleOfSporadicTask Workload Interference
- InterferenceBoundFP Platform Schedulability ResponseTime
- Priority TaskArrival WorkloadBound ConstrainedDeadlines.
-
- (* In this section, we prove that any fixed point in Bertogna and
- Cirinei's RTA for FP scheduling is a safe response-time bound.
- This analysis can be found in Chapter 18.2 of Baruah et al.'s
- book Multiprocessor Scheduling for Real-time Systems. *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Next, consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs are sequential and do not execute before their
- arrival times nor longer than their execution costs. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume that there exists at least one processor. *)
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Consider a given FP policy, ... *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ... and assume that the schedule is a work-conserving
- schedule that respects this policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy job_arrival job_cost job_task arr_seq sched higher_eq_priority.
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Next, we consider the response-time recurrence.
- Let tsk be a task in ts that is to be analyzed. *)
- Variable tsk: sporadic_task.
- Hypothesis task_in_ts: tsk \in ts.
-
- (* Let is_hp_task denote whether a task is a higher-priority task
- (with respect to tsk). *)
- Let is_hp_task := higher_priority_task higher_eq_priority tsk.
-
- (* Assume a response-time bound is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable hp_bounds: seq task_with_response_time.
- Hypothesis H_response_time_of_interfering_tasks_is_known:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds ->
- response_time_bounded_by hp_tsk R.
-
- (* ... for every higher-priority task. *)
- Hypothesis H_hp_bounds_has_interfering_tasks:
- forall hp_tsk,
- hp_tsk \in ts ->
- is_hp_task hp_tsk ->
- exists R, (hp_tsk, R) \in hp_bounds.
-
- (* Assume that the response-time bounds are larger than task costs. *)
- Hypothesis H_response_time_bounds_ge_cost:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds -> R >= task_cost hp_tsk.
-
- (* Assume that no deadline is missed by any higher-priority task. *)
- Hypothesis H_interfering_tasks_miss_no_deadlines:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds -> R <= task_deadline hp_tsk.
-
- (* Let R be the fixed point of Bertogna and Cirinei's recurrence, ...*)
- Variable R: time.
- Hypothesis H_response_time_recurrence_holds :
- R = task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period tsk hp_bounds R)
- num_cpus.
-
- (* ... and assume that R is no larger than the deadline of tsk.*)
- Hypothesis H_response_time_no_larger_than_deadline:
- R <= task_deadline tsk.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Assume that job j is the first job of tsk not to complete by the response time bound. *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (job_arrival j + R).
- Hypothesis H_previous_jobs_of_tsk_completed :
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + R).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task sched j tsk_other
- (job_arrival j) (job_arrival j + R).
-
- (* ...and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost sched j (job_arrival j) (job_arrival j + R).
-
- (* Recall Bertogna and Cirinei's workload bound. *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W task_cost task_period tsk_other R_other R.
-
- (* Let hp_tasks denote the set of higher-priority tasks. *)
- Let hp_tasks := [seq tsk_other <- ts | is_hp_task tsk_other].
-
- (* Now we establish results about the higher-priority tasks. *)
- Section LemmasAboutHPTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task and
- response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_response_time_of_tsk_other: (tsk_other, R_other) \in hp_bounds.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_fp_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold response_time_bounded_by, is_response_time_bound_of_task,
- completed, completed_jobs_dont_execute, valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS,
- H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into TASK_PARAMS,
- H_constrained_deadlines into RESTR,
- H_response_time_of_interfering_tasks_is_known into RESP,
- H_interfering_tasks_miss_no_deadlines into NOMISS,
- H_response_time_bounds_ge_cost into GE_COST.
- unfold x, workload_bound.
- destruct ([exists t: 'I_(job_arrival j + R),
- task_is_scheduled job_task sched tsk_other t]) eqn: SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED.
- move: SCHED => /forallP SCHED.
- apply leq_trans with (n := 0); last by done.
- apply leq_trans with (n := \sum_(job_arrival j <= t < job_arrival j + R) 0);
- last by rewrite big1.
- apply leq_sum_nat; move => i /andP [_ LTi] _.
- specialize (SCHED (Ordinal LTi)).
- rewrite negb_exists in SCHED; move: SCHED => /forallP SCHED.
- rewrite big1 //; intros cpu _.
- specialize (SCHED cpu); apply negbTE in SCHED.
- by rewrite SCHED andbF.
- }
- move: SCHED => /existsP [t /existsP [cpu SCHED]].
- unfold task_scheduled_on in SCHED.
- destruct (sched cpu t) as [j0 |] eqn:SCHED'; last by done.
- assert (INts: tsk_other \in ts).
- {
- move: SCHED => /eqP <-. apply FROMTS, (H_jobs_come_from_arrival_sequence j0 t).
- by apply/existsP; exists cpu; apply/eqP.
- }
- apply leq_trans with (n := workload job_task sched tsk_other
- (job_arrival j) (job_arrival j + R));
- first by apply task_interference_le_workload.
- by ( try ( apply workload_bounded_by_W with (task_deadline0 := task_deadline) (arr_seq0 := arr_seq)
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (job_deadline0 := job_deadline) ) ||
- apply workload_bounded_by_W with (task_deadline := task_deadline) (arr_seq := arr_seq)
- (job_arrival := job_arrival) (job_cost := job_cost) (job_deadline := job_deadline));
- try (by ins); last 2 first;
- [ by ins; apply GE_COST
- | by ins; apply NOMISS
- | by ins; apply TASK_PARAMS
- | by ins; apply RESTR
- | by ins; apply RESP with (hp_tsk := tsk_other)].
- Qed.
-
- End LemmasAboutHPTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X >= R - e_k + 1. *)
- Lemma bertogna_fp_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS,
- H_response_time_recurrence_holds into REC,
- H_job_of_tsk into JOBtsk, H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite [R](REC) // leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
- apply leq_ltn_trans with (n := (\sum_(job_arrival j <= t < job_arrival j + R)
- backlogged job_arrival job_cost sched j t) +
- service sched j (job_arrival j + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_j_arrives); des; rewrite -JOBtsk.
- }
- unfold service; rewrite service_before_arrival_eq_service_during //.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(job_arrival j <= i < job_arrival j + R) 1);
- first by rewrite big_const_nat iter_addn mul1n addn0 addKn.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [GEi LTi] _].
- destruct (backlogged job_arrival job_cost sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* 1) Next, we prove that during the scheduling window of j, any job that is
- scheduled while j is backlogged comes from a different task.
- This follows from the fact that j is the first job not to complete
- by its response-time bound, so previous jobs of j's task must have
- completed by their periods and cannot be pending. *)
- Lemma bertogna_fp_interference_by_different_tasks :
- forall t j_other,
- job_arrival j <= t < job_arrival j + R ->
- arrives_in arr_seq j_other ->
- backlogged job_arrival job_cost sched j t ->
- scheduled sched j_other t ->
- job_task j_other != tsk.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_constrained_deadlines into CONSTR,
- H_previous_jobs_of_tsk_completed into PREV,
- H_response_time_no_larger_than_deadline into NOMISS.
- move => t j_other /andP [LEt GEt] ARRother BACK SCHED.
- apply/eqP; red; intro SAMEtsk.
- move: SCHED => /existsP [cpu SCHED].
- assert (SCHED': scheduled sched j_other t).
- by apply/existsP; exists cpu.
- clear SCHED; rename SCHED' into SCHED.
- move: (SCHED) => PENDING.
- try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) in PENDING; try (by done) ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := job_cost) in PENDING; try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- move: (BEFOREother) => LT; rewrite -(ltn_add2r R) in LT.
- specialize (PREV j_other ARRother SAMEtsk BEFOREother).
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- try ( apply completion_monotonic with (t0 := job_arrival j_other + R); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j_other + R); try (by done).
- apply leq_trans with (n := job_arrival j); last by done.
- apply leq_trans with (n := job_arrival j_other + task_deadline tsk);
- first by rewrite leq_add2l; apply NOMISS.
- apply leq_trans with (n := job_arrival j_other + task_period tsk);
- first by rewrite leq_add2l; apply CONSTR; rewrite -JOBtsk FROMTS.
- rewrite -SAMEtsk; apply SPO; try (by done); [ | by rewrite JOBtsk | by apply ltnW].
- by intro EQ; subst j_other; rewrite ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge.
- apply leq_ltn_trans with (n := t); first by done.
- apply leq_trans with (n := job_arrival j + R); first by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by rewrite JOBtsk CONSTR // -JOBtsk FROMTS].
- }
- by red; intros EQtsk; subst j_other; rewrite /backlogged SCHED andbF in BACK.
- }
- Qed.
-
- (* Let's define a predicate to identify the other tasks that are scheduled. *)
- Let other_scheduled_task (t: time) (tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- is_hp_task tsk_other.
-
- (* 2) Now we prove that, at all times that j is backlogged, the number
- of tasks other than tsk that are scheduled is exactly the number
- of processors in the system. This is required to prove lemma (3). *)
- Lemma bertogna_fp_all_cpus_are_busy:
- forall t,
- job_arrival j <= t < job_arrival j + R ->
- backlogged job_arrival job_cost sched j t ->
- count (other_scheduled_task t) ts = num_cpus.
- Proof.
- rename H_valid_task_parameters into PARAMS,
- H_all_jobs_from_taskset into FROMTS,
- H_job_of_tsk into JOBtsk,
- H_sporadic_tasks into SPO,
- H_valid_job_parameters into JOBPARAMS,
- H_constrained_deadlines into RESTR,
- H_hp_bounds_has_interfering_tasks into HAS,
- H_interfering_tasks_miss_no_deadlines into NOMISS,
- H_response_time_of_interfering_tasks_is_known into PREV.
- unfold sporadic_task_model, is_response_time_bound_of_task in *.
- move => t /andP [LEt LTt] BACK.
- (try ( apply platform_fp_cpus_busy_with_interfering_tasks with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (job_task0 := job_task)
- (arr_seq0 := arr_seq) (ts0 := ts) (tsk0 := tsk) (higher_eq_priority0 := higher_eq_priority)
- in BACK ) ||
- apply platform_fp_cpus_busy_with_interfering_tasks with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (job_task := job_task)
- (arr_seq := arr_seq) (ts := ts) (tsk := tsk) (higher_eq_priority := higher_eq_priority)
- in BACK); try (by done); first by apply PARAMS.
- {
- apply leq_trans with (n := job_arrival j + R); first by done.
- rewrite leq_add2l.
- by apply leq_trans with (n := task_deadline tsk); last by apply RESTR.
- }
- {
- intros j_other tsk_other ARRother JOBother INTERF.
- feed (HAS tsk_other); first by rewrite -JOBother FROMTS.
- move: (HAS INTERF) => [R' IN].
- ( try ( apply completion_monotonic with (t0 := job_arrival j_other + R'); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j_other + R'); try (by done));
- last by apply PREV with (hp_tsk := tsk_other).
- {
- rewrite leq_add2l.
- apply leq_trans with (n := task_deadline tsk_other); first by apply NOMISS.
- by apply RESTR; rewrite -JOBother FROMTS.
- }
- }
- {
- ins; ( try ( apply completion_monotonic with (t0 := job_arrival j0 + R) ) ||
- apply completion_monotonic with (t := job_arrival j0 + R)); try (by done);
- last by apply H_previous_jobs_of_tsk_completed.
- rewrite leq_add2l.
- by apply leq_trans with (n := task_deadline tsk); last by apply RESTR.
- }
- Qed.
-
- (* 3) Now we prove that, at all times that j is backlogged, the number
- of tasks other than tsk that are scheduled is exactly the number
- of processors in the system. This is required to prove lemma (4). *)
- Lemma bertogna_fp_interference_on_all_cpus :
- \sum_(tsk_k <- hp_tasks) x tsk_k = X * num_cpus.
- Proof.
- have DIFFTASK := bertogna_fp_interference_by_different_tasks.
- rename H_work_conserving into WORK, H_respects_FP_policy into FP,
- H_jobs_come_from_arrival_sequence into SEQ,
- H_all_jobs_from_taskset into FROMTS, H_job_of_tsk into JOBtsk.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- last by rewrite big1 //; ins; rewrite big1.
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus) 1); last by simpl_sum_const.
- apply eq_bigr; intros cpu _.
- move: (WORK j t H_j_arrives BACK cpu) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- rewrite big_const_seq iter_addn mul0n 2!addn0; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- have ARRother: arrives_in arr_seq j_other.
- by apply (SEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- apply/andP; split.
- {
- rewrite -JOBtsk; apply FP with (t := t); try by done.
- by apply/existsP; exists cpu; apply/eqP.
- }
- apply DIFFTASK with (t := t); try (by done); first by auto.
- by apply/existsP; exists cpu; apply/eqP.
- Qed.
-
- (* Before stating the next lemma, let (num_tasks_exceeding delta) be the
- number of interfering tasks whose interference x is larger than delta. *)
- Let num_tasks_exceeding delta := count (fun i => x i >= delta) (hp_tasks).
-
- (* 4) Now we prove that, for any delta, if (num_task_exceeding delta > 0), then the
- cumulative interference caused by the complementary set of interfering tasks fills
- the remaining, not-completely-full (num_cpus - num_tasks_exceeding delta)
- processors. *)
- Lemma bertogna_fp_interference_in_non_full_processors :
- forall delta,
- 0 < num_tasks_exceeding delta < num_cpus ->
- \sum_(i <- hp_tasks | x i < delta) x i >= delta * (num_cpus - num_tasks_exceeding delta).
- Proof.
- have INV := bertogna_fp_all_cpus_are_busy.
- rename H_all_jobs_from_taskset into FROMTS, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_valid_task_parameters into PARAMS, H_job_of_tsk into JOBtsk,
- H_sporadic_tasks into SPO, H_previous_jobs_of_tsk_completed into BEFOREok,
- H_response_time_no_larger_than_deadline into NOMISS,
- H_constrained_deadlines into CONSTR, H_sequential_jobs into SEQ,
- H_respects_FP_policy into FP, H_hp_bounds_has_interfering_tasks into HASHP,
- H_interfering_tasks_miss_no_deadlines into NOMISSHP.
- unfold sporadic_task_model in *.
- move => delta /andP [HAS LT].
- rewrite -has_count in HAS.
-
- set some_interference_A := fun t =>
- has (fun tsk_k => backlogged job_arrival job_cost sched j t &&
- (x tsk_k >= delta) &&
- task_is_scheduled job_task sched tsk_k t) hp_tasks.
- set total_interference_B := fun t =>
- backlogged job_arrival job_cost sched j t *
- count (fun tsk_k => (x tsk_k < delta) &&
- task_is_scheduled job_task sched tsk_k t) hp_tasks.
-
- apply leq_trans with ((\sum_(job_arrival j <= t < job_arrival j + R)
- some_interference_A t) * (num_cpus - num_tasks_exceeding delta)).
- {
- rewrite leq_mul2r; apply/orP; right.
- move: HAS => /hasP HAS; destruct HAS as [tsk_a INa LEa].
- apply leq_trans with (n := x tsk_a); first by apply LEa.
- unfold x, task_interference, some_interference_A.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- last by rewrite (eq_bigr (fun x => 0)); [by simpl_sum_const | by ins].
- destruct ([exists cpu, task_scheduled_on job_task sched tsk_a cpu t]) eqn:SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED; move: SCHED => /forallP ALL.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (ALL cpu); apply negbTE in ALL; rewrite ALL.
- }
- move: SCHED => /existsP [cpu SCHED].
- apply leq_trans with (n := 1); last first.
- {
- rewrite lt0b; apply/hasP; exists tsk_a; first by done.
- by rewrite LEa 2!andTb; apply/existsP; exists cpu.
- }
- rewrite (bigD1 cpu) /= // SCHED.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const; rewrite leq_b1.
- intros cpu' DIFF.
- apply/eqP; rewrite eqb0; apply/negP.
- intros SCHED'.
- move: DIFF => /negP DIFF; apply DIFF; apply/eqP.
- unfold task_scheduled_on in *.
- destruct (sched cpu t) as [j1|] eqn:SCHED1; last by done.
- destruct (sched cpu' t) as [j2|] eqn:SCHED2; last by done.
- move: SCHED SCHED' => /eqP JOB /eqP JOB'.
- subst tsk_a; symmetry in JOB'.
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu'; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu; apply/eqP.
- }
- assert (PENDING2: pending job_arrival job_cost sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu'; apply/eqP.
- }
- assert (BUG: j1 = j2).
- {
- destruct (job_task j1 == tsk) eqn:SAMEtsk.
- {
- move: SAMEtsk => /eqP SAMEtsk.
- move: (PENDING1) => SAMEjob.
- ( try ( apply platform_fp_no_multiple_jobs_of_tsk with (task_cost0 := task_cost)
- (arr_seq0 := arr_seq) (task_period0 := task_period) (task_deadline0 := task_deadline)
- (job_task0 := job_task) (tsk0 := tsk) (j0 := j) in SAMEjob ) ||
- apply platform_fp_no_multiple_jobs_of_tsk with (task_cost := task_cost)
- (arr_seq := arr_seq) (task_period := task_period) (task_deadline := task_deadline)
- (job_task := job_task) (tsk := tsk) (j := j) in SAMEjob); try (by done);
- [ | by apply PARAMS | |]; last 2 first.
- {
- apply (leq_trans LTt); rewrite leq_add2l.
- by apply leq_trans with (n := task_deadline tsk); last by apply CONSTR.
- }
- {
- intros j0 ARR0 JOB0 LT0.
- ( try ( apply completion_monotonic with (t0 := job_arrival j0 + R) ) ||
- apply completion_monotonic with (t := job_arrival j0 + R)); try (by done);
- last by apply BEFOREok.
- rewrite leq_add2l.
- by apply leq_trans with (n := task_deadline tsk); last by apply CONSTR.
- }
- move: BACK => /andP [_ /negP NOTSCHED]; exfalso; apply NOTSCHED.
- by rewrite -SAMEjob; apply/existsP; exists cpu; apply/eqP.
- }
- {
- assert (INTERF: is_hp_task (job_task j1)).
- {
- apply/andP; split; last by rewrite SAMEtsk.
- rewrite -JOBtsk; apply FP with (t := t); try (by done).
- by apply/existsP; exists cpu; apply/eqP.
- }
- ( try ( apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq) (task_period0 := task_period)
- (tsk0 := tsk) (higher_eq_priority0 := higher_eq_priority)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) (t0 := t) ) ||
- apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (job_arrival := job_arrival) (arr_seq := arr_seq) (task_period := task_period)
- (tsk := tsk) (higher_eq_priority := higher_eq_priority)
- (job_cost := job_cost) (job_task := job_task) (sched := sched) (t := t));
- rewrite ?JOBtsk ?SAMEtsk //.
- {
- intros j0 tsk0 ARR0 JOB0 INTERF0.
- feed (HASHP tsk0); first by rewrite -JOB0 FROMTS.
- move: (HASHP INTERF0) => [R0 IN0].
- ( try ( apply completion_monotonic with (t0 := job_arrival j0 + R0); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j0 + R0); try (by done));
- last by eapply H_response_time_of_interfering_tasks_is_known; first by apply IN0.
- rewrite leq_add2l.
- by apply leq_trans with (n := task_deadline tsk0);
- [by apply NOMISSHP | by apply CONSTR; rewrite -JOB0 FROMTS].
- }
- }
- }
- by subst j2; apply SEQ with (j := j1) (t := t).
- }
-
- apply leq_trans with (\sum_(job_arrival j <= t < job_arrival j + R)
- total_interference_B t).
- {
- rewrite big_distrl /=.
- apply leq_sum_nat; move => t LEt _.
- unfold some_interference_A, total_interference_B.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- [rewrite mul1n /= | by rewrite has_pred0 //].
-
- destruct (has (fun tsk_k : sporadic_task => (delta <= x tsk_k) &&
- task_is_scheduled job_task sched tsk_k t) hp_tasks) eqn:HAS';
- last by done.
- rewrite mul1n; move: HAS => /hasP [tsk_k INk LEk].
- unfold num_tasks_exceeding.
- apply leq_trans with (n := num_cpus -
- count (fun i => (x i >= delta) &&
- task_is_scheduled job_task sched i t) hp_tasks).
- {
- apply leq_sub2l.
- rewrite -2!sum1_count big_mkcond /=.
- rewrite [\sum_(_ <- _ | _ <= _)_]big_mkcond /=.
- apply leq_sum; intros i _.
- by destruct (task_is_scheduled job_task sched i t);
- [by rewrite andbT | by rewrite andbF].
- }
- rewrite -count_filter -[count _ hp_tasks]count_filter.
- eapply leq_trans with (n := count (predC (fun tsk => delta <= x tsk)) _);
- last by apply eq_leq, eq_in_count; red; ins; rewrite ltnNge.
- rewrite leq_subLR count_predC size_filter.
- apply leq_trans with (n := count (other_scheduled_task t) ts);
- [by rewrite INV | by rewrite count_filter].
- }
- {
- unfold x at 2, total_interference_B.
- rewrite exchange_big /=; apply leq_sum; intros t _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last by ins.
- rewrite mul1n -sum1_count.
- rewrite big_mkcond [\sum_(i <- hp_tasks | _ < _) _]big_mkcond /=.
- apply leq_sum_seq; move => tsk_k IN _.
- destruct (x tsk_k < delta); [rewrite andTb | by rewrite andFb].
- destruct (task_is_scheduled job_task sched tsk_k t) eqn:SCHED; last by done.
- move: SCHED => /existsP [cpu SCHED].
- by rewrite (bigD1 cpu) /= // SCHED.
- }
- Qed.
-
- (* 5) Based on lemma (4), we prove that, for any interval delta, if the sum of per-task
- interference exceeds (delta * num_cpus), the same applies for the
- sum of the minimum of the interference and delta. *)
- Lemma bertogna_fp_minimum_exceeds_interference :
- forall delta,
- \sum_(tsk_k <- hp_tasks) x tsk_k >= delta * num_cpus ->
- \sum_(tsk_k <- hp_tasks) minn (x tsk_k) delta >=
- delta * num_cpus.
- Proof.
- intros delta SUMLESS.
- set more_interf := fun tsk_k => x tsk_k >= delta.
- rewrite [\sum_(_ <- _) minn _ _](bigID more_interf) /=.
- unfold more_interf, minn.
- rewrite [\sum_(_ <- _ | delta <= _)_](eq_bigr (fun i => delta));
- last by intros i COND; rewrite leqNgt in COND; destruct (delta > x i).
- rewrite [\sum_(_ <- _ | ~~_)_](eq_big (fun i => x i < delta)
- (fun i => x i));
- [| by red; ins; rewrite ltnNge
- | by intros i COND; rewrite -ltnNge in COND; rewrite COND].
-
- (* Case 1: num_tasks_exceeding = 0 *)
- destruct (~~ has (fun i => delta <= x i) hp_tasks) eqn:HASa.
- {
- rewrite [\sum_(_ <- _ | _ <= _) _]big_hasC; last by apply HASa.
- rewrite big_seq_cond; move: HASa => /hasPn HASa.
- rewrite add0n (eq_bigl (fun i => (i \in hp_tasks) && true));
- last by red; intros tsk_k; destruct (tsk_k \in hp_tasks) eqn:INk;
- [by rewrite andTb ltnNge; apply HASa | by rewrite andFb].
- by rewrite -big_seq_cond.
- } apply negbFE in HASa.
-
- (* Case 2: num_tasks_exceeding >= num_cpus *)
- destruct (num_tasks_exceeding delta >= num_cpus) eqn:CARD.
- {
- apply leq_trans with (delta * num_tasks_exceeding delta);
- first by rewrite leq_mul2l; apply/orP; right.
- unfold num_tasks_exceeding; rewrite -sum1_count big_distrr /=.
- rewrite -[\sum_(_ <- _ | _) _]addn0.
- by apply leq_add; [by apply leq_sum; ins; rewrite muln1|by ins].
- } apply negbT in CARD; rewrite -ltnNge in CARD.
-
- (* Case 3: num_tasks_exceeding < num_cpus *)
- rewrite big_const_seq iter_addn addn0; fold num_tasks_exceeding.
- apply leq_trans with (n := delta * num_tasks_exceeding delta +
- delta * (num_cpus - num_tasks_exceeding delta));
- first by rewrite -mulnDr subnKC //; apply ltnW.
- rewrite leq_add2l; apply bertogna_fp_interference_in_non_full_processors.
- by apply/andP; split; first by rewrite -has_count.
- Qed.
-
- (* 6) Next, using lemmas (0), (3) and (5) we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_fp_sum_exceeds_total_interference:
- \sum_((tsk_k, R_k) <- hp_bounds)
- minn (x tsk_k) (R - task_cost tsk + 1) >
- total_interference_bound_fp task_cost task_period tsk hp_bounds R.
- Proof.
- have EXCEEDS := bertogna_fp_minimum_exceeds_interference.
- have ALLBUSY := bertogna_fp_interference_on_all_cpus.
- have TOOMUCH := bertogna_fp_too_much_interference.
- rename H_hp_bounds_has_interfering_tasks into HAS,
- H_response_time_recurrence_holds into REC.
- apply leq_trans with (n := \sum_(tsk_k <- hp_tasks) minn (x tsk_k) (R - task_cost tsk + 1));
- last first.
- {
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) hp_bounds (fun x => true) (fun y => minn (x y) (R - task_cost tsk + 1)).
- rewrite -MAP.
- apply leq_sum_sub_uniq; first by apply filter_uniq; destruct ts.
- red; move => tsk0 IN0.
- rewrite mem_filter in IN0; move: IN0 => /andP [INTERF0 IN0].
- apply/mapP.
- feed (HAS tsk0); first by done.
- move: (HAS INTERF0) => [R0 IN].
- by exists (tsk0, R0).
- }
- apply ltn_div_trunc with (d := num_cpus);
- first by apply H_at_least_one_cpu.
- rewrite -(ltn_add2l (task_cost tsk)) -REC.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by rewrite REC; apply leq_addr.
- rewrite leq_divRL; last by apply H_at_least_one_cpu.
- apply EXCEEDS.
- apply leq_trans with (n := X * num_cpus); last by rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 7) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k, R - e_i + 1).
- This implies that x_k > W_k, which is of course a contradiction,
- since W_k is a valid task interference bound. *)
- Lemma bertogna_fp_exists_task_that_exceeds_bound :
- exists tsk_k R_k,
- (tsk_k, R_k) \in hp_bounds /\
- (minn (x tsk_k) (R - task_cost tsk + 1) >
- minn (workload_bound tsk_k R_k) (R - task_cost tsk + 1)).
- Proof.
- have SUM := bertogna_fp_sum_exceeds_total_interference.
- rename H_hp_bounds_has_interfering_tasks into HASHP.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_k, R_k) := tup in
- (minn (x tsk_k) (R - task_cost tsk + 1) >
- minn (workload_bound tsk_k R_k)(R - task_cost tsk + 1)))
- hp_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- unfold total_interference_bound_fp.
- rewrite big_seq_cond.
- rewrite [\sum_(_ <- _ | true)_]big_seq_cond.
- apply leq_sum.
- intros p; rewrite andbT; intros IN.
- by specialize (ALL p IN); destruct p; rewrite leqNgt.
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MINk]; exists tsk_k, R_k.
- by repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- (* Using the lemmas above, we prove that R bounds the response time of task tsk. *)
- Theorem bertogna_cirinei_response_time_bound_fp :
- response_time_bounded_by tsk R.
- Proof.
- have WORKLOAD := bertogna_fp_workload_bounds_interference.
- have EX := bertogna_fp_exists_task_that_exceeds_bound.
- rename H_response_time_bounds_ge_cost into GE_COST,
- H_interfering_tasks_miss_no_deadlines into NOMISS,
- H_response_time_recurrence_holds into REC,
- H_response_time_of_interfering_tasks_is_known into RESP,
- H_hp_bounds_has_interfering_tasks into HAS,
- H_response_time_no_larger_than_deadline into LEdl.
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + R) as ctime.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- generalize dependent j.
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj JOBtsk EQc; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- service sched j0 (job_arrival j0 + R) >= job_cost j0).
- {
- by ins; apply IH; try (by done); rewrite ltn_add2r.
- } clear IH.
-
- unfold response_time_bounded_by, is_response_time_bound_of_task,
- completed, completed_jobs_dont_execute, valid_sporadic_job in *.
-
- (* Now we start the proof. Assume by contradiction that job j
- is not complete at time (job_arrival j + R). *)
- destruct (completed job_cost sched j (job_arrival j + R)) eqn:NOTCOMP;
- first by done.
- apply negbT in NOTCOMP; exfalso.
-
- (* We derive a contradiction using the previous lemmas. *)
- specialize (EX j ARRj JOBtsk NOTCOMP BEFOREok).
- destruct EX as [tsk_k [R_k [HPk LTmin]]].
- unfold minn at 1 in LTmin.
- specialize (WORKLOAD j tsk_k R_k HPk).
- destruct (W task_cost task_period tsk_k R_k R < R - task_cost tsk + 1); rewrite leq_min in LTmin;
- last by move: LTmin => /andP [_ BUG]; rewrite ltnn in BUG.
- move: LTmin => /andP [BUG _]; des.
- apply leq_trans with (p := W task_cost task_period tsk_k R_k R) in BUG; last by done.
- by rewrite ltnn in BUG.
- Qed.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/analysis/global/basic/interference_bound.v b/classic/analysis/global/basic/interference_bound.v
deleted file mode 100644
index aeec7a9fa288ce6ac89f31b2a353b1bdbdae2377..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/interference_bound.v
+++ /dev/null
@@ -1,43 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.analysis.global.basic.workload_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundGeneric.
-
- Section Definitions.
-
- Import Schedule WorkloadBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- Section PerTask.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* Based on the workload bound, Bertogna and Cirinei define the
- following interference bound for a task. *)
- Definition interference_bound_generic :=
- minn (W task_cost task_period tsk_other R_other delta) (delta - task_cost tsk + 1).
-
- End PerTask.
-
- End Definitions.
-
-End InterferenceBoundGeneric.
\ No newline at end of file
diff --git a/classic/analysis/global/basic/interference_bound_edf.v b/classic/analysis/global/basic/interference_bound_edf.v
deleted file mode 100644
index 52e6ba306950a998dc814b51d8db73db003e5e55..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/interference_bound_edf.v
+++ /dev/null
@@ -1,1227 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.response_time prosa.classic.model.schedule.global.workload
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform
- prosa.classic.model.schedule.global.basic.interference prosa.classic.model.schedule.global.basic.interference_edf.
-Require Import prosa.classic.analysis.global.basic.workload_bound
- prosa.classic.analysis.global.basic.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module InterferenceBoundEDF.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask Schedulability
- WorkloadBound ResponseTime Priority
- TaskArrival Interference InterferenceEDF.
- Export InterferenceBoundGeneric.
-
- (* In this section, we define Bertogna and Cirinei's EDF-specific
- interference bound. *)
- Section SpecificBoundDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- (* Consider the interference incurred by tsk in a window of length delta... *)
- Variable delta: time.
-
- (* ... due to a different task tsk_other, with response-time bound R_other. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
-
- (* Bertogna and Cirinei define the following bound for task interference
- under EDF scheduling. *)
- Definition edf_specific_interference_bound :=
- let d_tsk := task_deadline tsk in
- let e_other := task_cost tsk_other in
- let p_other := task_period tsk_other in
- let d_other := task_deadline tsk_other in
- (div_floor d_tsk p_other) * e_other +
- minn e_other ((d_tsk %% p_other) - (d_other - R_other)).
-
- End SpecificBoundDef.
-
- (* Next, we define the total interference bound for EDF, which combines the generic
- and the EDF-specific bounds. *)
- Section TotalInterferenceBoundEDF.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- Section RecallInterferenceBounds.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* By combining Bertogna's interference bound for a work-conserving
- scheduler ... *)
- Let basic_interference_bound := interference_bound_generic task_cost task_period tsk delta tsk_R.
-
- (* ... with and EDF-specific interference bound, ... *)
- Let edf_specific_bound := edf_specific_interference_bound task_cost task_period task_deadline tsk tsk_other R_other.
-
- (* ... Bertogna and Cirinei define the following interference bound
- under EDF scheduling. *)
- Definition interference_bound_edf :=
- minn basic_interference_bound edf_specific_bound.
-
- End RecallInterferenceBounds.
-
- (* Next we define the computation of the total interference for APA scheduling. *)
- Section TotalInterference.
-
- (* Let other_task denote tasks different from tsk. *)
- Let other_task := different_task tsk.
-
- (* The total interference incurred by tsk is bounded by the sum
- of individual task interferences of the other tasks. *)
- Definition total_interference_bound_edf :=
- \sum_((tsk_other, R_other) <- R_prev | other_task tsk_other)
- interference_bound_edf (tsk_other, R_other).
-
- End TotalInterference.
-
- End TotalInterferenceBoundEDF.
-
- (* In this section, we show that the EDF-specific interference bound is safe. *)
- Section ProofSpecificBound.
-
- Import Schedule Interference Platform SporadicTaskset.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs do not execute before their arrival times nor longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that jobs are sequential and that there exists at
- least one processor. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Consider a task set ts where all jobs come from the task set
- and tasks have valid parameters and constrained deadlines. *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Assume that the scheduler is a work-conserving EDF scheduler. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_edf_scheduler:
- respects_JLFP_policy job_arrival job_cost arr_seq sched (EDF job_arrival job_deadline).
-
- (* Let tsk_i be the task to be analyzed, ...*)
- Variable tsk_i: sporadic_task.
- Hypothesis H_tsk_i_in_task_set: tsk_i \in ts.
-
- (* ... and j_i one of its jobs. *)
- Variable j_i: Job.
- Hypothesis H_j_i_arrives: arrives_in arr_seq j_i.
- Hypothesis H_job_of_tsk_i: job_task j_i = tsk_i.
-
- (* Let tsk_k denote any interfering task, ... *)
- Variable tsk_k: sporadic_task.
- Hypothesis H_tsk_k_in_task_set: tsk_k \in ts.
-
- (* ...and R_k its response-time bound. *)
- Variable R_k: time.
- Hypothesis H_R_k_le_deadline: R_k <= task_deadline tsk_k.
-
- (* Consider a time window of length delta <= D_i, starting with j_i's arrival time. *)
- Variable delta: time.
- Hypothesis H_delta_le_deadline: delta <= task_deadline tsk_i.
-
- (* Assume that the jobs of tsk_k satisfy the response-time bound before the end of the interval *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_k,
- arrives_in arr_seq j_k ->
- job_task j_k = tsk_k ->
- job_arrival j_k + R_k < job_arrival j_i + delta ->
- completed job_cost sched j_k (job_arrival j_k + R_k).
-
- (* In this section, we prove that Bertogna and Cirinei's EDF interference bound
- indeed bounds the interference caused by task tsk_k in the interval [t1, t1 + delta). *)
- Section MainProof.
-
- (* Let's call x the task interference incurred by job j due to tsk_k. *)
- Let x :=
- task_interference job_arrival job_cost job_task sched j_i tsk_k
- (job_arrival j_i) (job_arrival j_i + delta).
-
- (* Also, recall the EDF-specific interference bound for EDF. *)
- Let interference_bound :=
- edf_specific_interference_bound task_cost task_period task_deadline tsk_i tsk_k R_k.
-
- (* Let's simplify the names a bit. *)
- Let t1 := job_arrival j_i.
- Let t2 := job_arrival j_i + delta.
- Let D_i := task_deadline tsk_i.
- Let D_k := task_deadline tsk_k.
- Let p_k := task_period tsk_k.
-
- Let n_k := div_floor D_i p_k.
-
- (* Let's give a simpler name to job interference. *)
- Let interference_caused_by := job_interference job_arrival job_cost sched j_i.
-
- (* Identify the subset of jobs that actually cause interference *)
- Let interfering_jobs :=
- filter (fun j' =>
- (job_task j' == tsk_k) && (interference_caused_by j' t1 t2 != 0))
- (jobs_scheduled_between sched t1 t2).
-
- (* Now, consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := sort earlier_arrival interfering_jobs.
-
- (* Now we proceed with the proof. The first step consists in simplifying the sum corresponding to the workload. *)
- Section SimplifyJobSequence.
-
- (* Use the alternative definition of task interference, based on
- individual job interference. *)
- Lemma interference_bound_edf_use_another_definition :
- x <= \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2.
- Proof.
- apply interference_le_interference_joblist.
- Qed.
-
- (* Remove the elements that we don't care about from the sum *)
- Lemma interference_bound_edf_simpl_by_filtering_interfering_jobs :
- \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2 =
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2.
- Proof.
- unfold interfering_jobs; rewrite big_filter.
- rewrite big_mkcond; rewrite [\sum_(_ <- _ | _) _]big_mkcond /=.
- apply eq_bigr; intros i _; clear -i.
- destruct (job_task i == tsk_k); rewrite ?andTb ?andFb; last by done.
- destruct (interference_caused_by i t1 t2 != 0) eqn:DIFF; first by done.
- by apply negbT in DIFF; rewrite negbK in DIFF; apply/eqP.
- Qed.
-
- (* Then, we consider the sum over the sorted sequence of jobs. *)
- Lemma interference_bound_edf_simpl_by_sorting_interfering_jobs :
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2 =
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2.
- Proof.
- by rewrite (perm_big sorted_jobs) /=; last by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Note that both sequences have the same set of elements. *)
- Lemma interference_bound_edf_job_in_same_sequence :
- forall j,
- (j \in interfering_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Also recall that all jobs in the sorted sequence is an interfering job of tsk_k, ... *)
- Lemma interference_bound_edf_all_jobs_from_tsk_k :
- forall j,
- j \in sorted_jobs ->
- arrives_in arr_seq j /\
- job_task j = tsk_k /\
- interference_caused_by j t1 t2 != 0 /\
- j \in jobs_scheduled_between sched t1 t2.
- Proof.
- rename H_jobs_come_from_arrival_sequence into FROMarr.
- intros j LTi.
- rewrite -interference_bound_edf_job_in_same_sequence mem_filter in LTi; des.
- have IN := LTi0.
- unfold jobs_scheduled_between in *; rewrite mem_undup in IN.
- apply mem_bigcat_nat_exists in IN; des.
- rewrite mem_scheduled_jobs_eq_scheduled in IN.
- repeat split; try (by done).
- by apply (FROMarr j i).
- Qed.
-
- (* ...and consecutive jobs are ordered by arrival. *)
- Lemma interference_bound_edf_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- (* Finally, for any job of task tsk_k, the interference is bounded by the task cost. *)
- Lemma interference_bound_edf_interference_le_task_cost :
- forall j,
- j \in interfering_jobs ->
- interference_caused_by j t1 t2 <= task_cost tsk_k.
- Proof.
- rename H_valid_job_parameters into PARAMS.
- intros j IN.
- feed (interference_bound_edf_all_jobs_from_tsk_k j);
- first by rewrite -interference_bound_edf_job_in_same_sequence.
- move => [ARRj [TSKj _]].
- apply leq_trans with (n := service_during sched j t1 t2);
- first by apply job_interference_le_service.
- ( try ( apply cumulative_service_le_task_cost with (job_task0 := job_task)
- (task_deadline0 := task_deadline) (job_cost0 := job_cost) (job_deadline0 := job_deadline) ) ||
- apply cumulative_service_le_task_cost with (job_task := job_task)
- (task_deadline := task_deadline) (job_cost := job_cost) (job_deadline := job_deadline));
- try (by done).
- by apply PARAMS.
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section InterferenceFewJobs.
-
- Hypothesis H_few_jobs: size sorted_jobs <= n_k.
-
- Lemma interference_bound_edf_holds_for_at_most_n_k_jobs :
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2 <=
- interference_bound.
- Proof.
- rewrite -[\sum_(_ <- _ | _) _]addn0 leq_add //.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk_k);
- last by rewrite big_const_seq iter_addn addn0 mulnC leq_mul2r; apply/orP; right.
- {
- rewrite [\sum_(_ <- _) interference_caused_by _ _ _]big_seq_cond.
- rewrite [\sum_(_ <- _) task_cost _]big_seq_cond.
- apply leq_sum; intros i; move/andP => [INi _].
- rewrite -interference_bound_edf_job_in_same_sequence in INi.
- by apply interference_bound_edf_interference_le_task_cost.
- }
- Qed.
-
- End InterferenceFewJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0. *)
- Section InterferenceManyJobs.
-
- Hypothesis H_many_jobs: n_k < size sorted_jobs.
-
- (* This trivially implies that there's at least one job. *)
- Lemma interference_bound_edf_at_least_one_job: size sorted_jobs > 0.
- Proof.
- by apply leq_ltn_trans with (n := n_k).
- Qed.
-
- (* Let j_fst be the first job, and a_fst its arrival time. *)
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let a_fst := job_arrival j_fst.
-
- (* In this section, we prove some basic lemmas about j_fst. *)
- Section FactsAboutFirstJob.
-
- (* The first job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_fst_is_job_of_tsk_k :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk_k /\
- interference_caused_by j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth,
- interference_bound_edf_at_least_one_job.
- Qed.
-
- (* The deadline of j_fst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_fst_deadline :
- job_deadline j_fst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- by specialize (PARAMS j_fst FSTarr); des; rewrite PARAMS1 FSTtask.
- Qed.
-
- (* The deadline of j_i is the deadline of tsk_i. *)
- Lemma interference_bound_edf_j_i_deadline :
- job_deadline j_i = task_deadline tsk_i.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS,
- H_job_of_tsk_i into JOBtsk.
- by specialize (PARAMS j_i H_j_i_arrives); des; rewrite PARAMS1 JOBtsk.
- Qed.
-
- (* If j_fst completes by its response-time bound, then t1 <= a_fst + R_k,
- where t1 is the beginning of the time window (arrival of j_i). *)
- Lemma interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval :
- completed job_cost sched j_fst (a_fst + R_k) ->
- t1 <= a_fst + R_k.
- Proof.
- intros RBOUND.
- rewrite leqNgt; apply/negP; unfold not; intro BUG.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [_ [ FSTserv _]]].
- move: FSTserv => /negP FSTserv; apply FSTserv.
- rewrite -leqn0; apply leq_trans with (n := service_during sched j_fst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_after_job_rt_zero with (job_cost0 := job_cost) (R := R_k)
- (job_arrival0 := job_arrival); try (by done); apply ltnW ) ||
- by apply cumulative_service_after_job_rt_zero with (job_cost := job_cost) (R := R_k)
- (job_arrival := job_arrival); try (by done); apply ltnW.
- Qed.
-
- End FactsAboutFirstJob.
-
- (* Now, let's prove the interference bound for the particular case of a single job.
- This case must be solved separately because the single job can simultaneously
- be carry-in and carry-out job, so its response time is not necessarily
- bounded by R_k (from the hypothesis H_all_previous_jobs_completed_on_time). *)
- Section InterferenceSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_only_one_job: size sorted_jobs = 1.
-
- (* Since there's only one job, we simplify the terms in the interference bound. *)
- Lemma interference_bound_edf_simpl_when_there's_one_job :
- D_i %% p_k - (D_k - R_k) = D_i - (D_k - R_k).
- Proof.
- rename H_many_jobs into NUM,
- H_valid_task_parameters into TASK_PARAMS,
- H_tsk_k_in_task_set into INk.
- unfold valid_sporadic_taskset, is_valid_sporadic_task,
- interference_bound, edf_specific_interference_bound in *.
- rewrite H_only_one_job in NUM.
- rewrite ltnS leqn0 in NUM; move: NUM => /eqP EQnk.
- move: EQnk => /eqP EQnk; unfold n_k, div_floor in EQnk.
- rewrite -leqn0 leqNgt divn_gt0 in EQnk;
- last by specialize (TASK_PARAMS tsk_k INk); des.
- by rewrite -ltnNge in EQnk; rewrite modn_small //.
- Qed.
-
- (* Next, we show that if j_fst completes by its response-time bound R_k,
- then then interference bound holds. *)
- Section ResponseTimeOfSingleJobBounded.
-
- Hypothesis H_j_fst_completed_by_rt_bound :
- completed job_cost sched j_fst (a_fst + R_k).
-
- Lemma interference_bound_edf_holds_for_single_job_that_completes_on_time :
- job_interference job_arrival job_cost sched j_i j_fst t1 t2 <= D_i - (D_k - R_k).
- Proof.
- rename H_j_fst_completed_by_rt_bound into RBOUND.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval RBOUND.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [_ [ LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- destruct (D_k - R_k <= D_i) eqn:LEdk; last first.
- {
- apply negbT in LEdk; rewrite -ltnNge in LEdk.
- apply leq_trans with (n := 0); last by done.
- apply leq_trans with (n := job_interference job_arrival job_cost sched j_i j_fst
- (a_fst + R_k) t2).
- {
- apply extend_sum; last by apply leqnn.
- rewrite -(leq_add2r D_i).
- rewrite interference_bound_edf_j_fst_deadline
- interference_bound_edf_j_i_deadline in LEdl.
- apply leq_trans with (n := a_fst + D_k); last by done.
- rewrite -addnA leq_add2l.
- by apply ltnW; rewrite -ltn_subRL.
- }
- apply leq_trans with (n := service_during sched j_fst (a_fst + R_k) t2);
- first by apply job_interference_le_service.
- unfold service_during; rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_after_job_rt_zero with (job_cost0 := job_cost) (R := R_k)
- (job_arrival0 := job_arrival); try (by done); apply leqnn ) ||
- by apply cumulative_service_after_job_rt_zero with (job_cost := job_cost) (R := R_k)
- (job_arrival := job_arrival); try (by done); apply leqnn.
- }
- {
- rewrite -(leq_add2r (D_k - R_k)) addnBAC // -addnBA // subnn addn0.
- assert (SUBST: D_k - R_k = \sum_(a_fst + R_k <= i < a_fst + D_k) 1).
- {
- rewrite big_const_nat iter_addn mul1n addn0.
- rewrite addnC -subnBA; last by apply leq_addr.
- by rewrite addnC -addnBA // subnn addn0.
- }
- apply leq_trans with (n := job_interference job_arrival job_cost sched j_i j_fst t1
- (a_fst + D_k) + (D_k - R_k)).
- {
- rewrite leq_add2r.
- destruct (t2 <= a_fst + R_k) eqn:LEt2.
- {
- apply extend_sum; first by apply leqnn.
- apply leq_trans with (n := a_fst + R_k); first by done.
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- {
- unfold job_interference.
- apply negbT in LEt2; rewrite -ltnNge in LEt2.
- rewrite -> big_cat_nat with (n := a_fst + R_k);
- [simpl | by apply AFTERt1 | by apply ltnW].
- apply leq_trans with (n := job_interference job_arrival job_cost sched j_i j_fst t1
- (a_fst + R_k) + service_during sched j_fst (a_fst + R_k) t2).
- {
- rewrite leq_add2l.
- by apply job_interference_le_service.
- }
- unfold service_during.
- try ( rewrite -> cumulative_service_after_job_rt_zero with
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (R := R_k); try (by done) ) ||
- rewrite -> cumulative_service_after_job_rt_zero with
- (job_arrival := job_arrival) (job_cost := job_cost) (R := R_k); try (by done).
- rewrite addn0; apply extend_sum; first by apply leqnn.
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- }
-
- unfold job_interference.
- rewrite -> big_cat_nat with (n := a_fst + R_k);
- [simpl| by apply AFTERt1 | by rewrite leq_add2l; apply H_R_k_le_deadline].
- apply leq_trans with (n := job_interference job_arrival job_cost sched j_i j_fst t1
- (a_fst+R_k) + service_during sched j_fst (a_fst+R_k) (a_fst+D_k) + (D_k-R_k)).
- {
- rewrite leq_add2r leq_add2l.
- by apply job_interference_le_service.
- }
- unfold service_during.
- try ( rewrite -> cumulative_service_after_job_rt_zero with
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (R:=R_k); try (by done) ) ||
- rewrite -> cumulative_service_after_job_rt_zero with
- (job_arrival := job_arrival) (job_cost := job_cost) (R:=R_k); try (by done).
- rewrite addn0.
- apply leq_trans with (n := (\sum_(t1 <= t < a_fst + R_k) 1) +
- \sum_(a_fst + R_k <= t < a_fst + D_k) 1).
- {
- apply leq_add; last by rewrite SUBST.
- rewrite big_const_nat iter_addn mul1n addn0.
- rewrite -{1}[a_fst + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- rewrite -big_cat_nat;
- [simpl | by apply AFTERt1 | by rewrite leq_add2l; apply H_R_k_le_deadline ].
- rewrite big_const_nat iter_addn mul1n addn0 leq_subLR.
- by unfold D_i, D_k, t1, a_fst; rewrite -interference_bound_edf_j_fst_deadline
- -interference_bound_edf_j_i_deadline.
- }
- Qed.
-
- End ResponseTimeOfSingleJobBounded.
-
- (* Else, if j_fst did not complete by its response-time bound, then
- we need a separate proof. *)
- Section ResponseTimeOfSingleJobNotBounded.
-
- Hypothesis H_j_fst_not_complete_by_rt_bound :
- ~~ completed job_cost sched j_fst (a_fst + R_k).
-
- (* This trivially implies that a_fst + R_k lies after the end of the interval,
- otherwise j_fst would have completed by its response-time bound. *)
- Lemma interference_bound_edf_response_time_bound_of_j_fst_after_interval :
- job_arrival j_fst + R_k >= job_arrival j_i + delta.
- Proof.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- rewrite leqNgt; apply/negP; intro LT.
- move: H_j_fst_not_complete_by_rt_bound => /negP BUG; apply BUG.
- by apply H_all_previous_jobs_completed_on_time.
- Qed.
-
- (* If the slack is too big (D_i < D_k - R_k), j_fst causes no interference. *)
- Lemma interference_bound_edf_holds_for_single_job_with_big_slack :
- D_i < D_k - R_k ->
- interference_caused_by j_fst t1 t2 = 0.
- Proof.
- intro LTdk.
- rewrite ltn_subRL in LTdk.
- rewrite -(ltn_add2l a_fst) addnA in LTdk.
- apply leq_ltn_trans with (m := t1 + D_i) in LTdk; last first.
- {
- rewrite leq_add2r.
- apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- by apply interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- }
- apply/eqP; rewrite -[_ _ _ _ == 0]negbK; apply/negP; red; intro BUG.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [_ [LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in BUG; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in BUG; try (by done).
- rewrite interference_bound_edf_j_fst_deadline
- interference_bound_edf_j_i_deadline in BUG.
- by apply (leq_trans LTdk) in BUG; rewrite ltnn in BUG.
- Qed.
-
- (* Else, if the slack is small, j_fst causes interference for no longer than
- D_i - (D_k - R_k). *)
- Lemma interference_bound_edf_holds_for_single_job_with_small_slack :
- D_i >= D_k - R_k ->
- interference_caused_by j_fst t1 t2 <= D_i - (D_k - R_k).
- Proof.
- intro LEdk.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask [LEdl _]]].
- have LTr := interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- apply leq_subRL_impl; rewrite addnC.
- apply leq_trans with (n := job_interference job_arrival job_cost sched j_i j_fst t1
- (job_arrival j_fst + R_k) + (D_k - R_k));
- first by rewrite leq_add2r; apply extend_sum; [by apply leqnn|].
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 +
- \sum_(a_fst + R_k <= t < a_fst + D_k)1).
- {
- apply leq_add.
- {
- rewrite big_const_nat iter_addn mul1n addn0.
- rewrite -{1}[job_arrival j_fst + R_k](addKn t1) -addnBA;
- first by apply job_interference_le_delta.
- by apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- }
- rewrite big_const_nat iter_addn mul1n addn0 addnC.
- rewrite -subnBA; last by apply leq_addr.
- by rewrite addnC -addnBA // subnn addn0.
- }
- rewrite -big_cat_nat; simpl; last 2 first.
- {
- apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- by apply interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- }
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- rewrite big_const_nat iter_addn mul1n addn0 leq_subLR.
- unfold D_i, D_k, t1, a_fst; rewrite -interference_bound_edf_j_fst_deadline
- -interference_bound_edf_j_i_deadline.
- try ( by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl ) ||
- by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl.
- Qed.
-
- End ResponseTimeOfSingleJobNotBounded.
-
- (* By combining the results above, we prove that the interference caused by the single job
- is bounded by D_i - (D_k - R_k), ... *)
- Lemma interference_bound_edf_interference_of_j_fst_limited_by_slack :
- interference_caused_by j_fst t1 t2 <= D_i - (D_k - R_k).
- Proof.
- destruct (completed job_cost sched j_fst (a_fst + R_k)) eqn:COMP;
- first by apply interference_bound_edf_holds_for_single_job_that_completes_on_time.
- apply negbT in COMP.
- destruct (ltnP D_i (D_k - R_k)) as [LEdk | LTdk].
- by rewrite interference_bound_edf_holds_for_single_job_with_big_slack.
- by apply interference_bound_edf_holds_for_single_job_with_small_slack.
- Qed.
-
- (* ... and thus the interference bound holds. *)
- Lemma interference_bound_edf_holds_for_a_single_job :
- interference_caused_by j_fst t1 t2 <= interference_bound.
- Proof.
- have ONE := interference_bound_edf_simpl_when_there's_one_job.
- have SLACK := interference_bound_edf_interference_of_j_fst_limited_by_slack.
- rename H_many_jobs into NUM, H_only_one_job into SIZE.
- unfold interference_caused_by, interference_bound, edf_specific_interference_bound.
- fold D_i D_k p_k n_k.
- rewrite SIZE ltnS leqn0 in NUM; move: NUM => /eqP EQnk.
- rewrite EQnk mul0n add0n.
- rewrite leq_min; apply/andP; split.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite SIZE.
- }
- by rewrite ONE; apply SLACK.
- Qed.
-
- End InterferenceSingleJob.
-
- (* Next, consider the other case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section InterferenceTwoOrMoreJobs.
-
- (* Assume there are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- (* Let j_lst be the last job of the sequence and a_lst its arrival time. *)
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
- Let a_lst := job_arrival j_lst.
-
- (* In this section, we prove some basic lemmas about the first and last jobs. *)
- Section FactsAboutFirstAndLastJobs.
-
- (* The last job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_lst_is_job_of_tsk_k :
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk_k /\
- interference_caused_by j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The deadline of j_lst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_lst_deadline :
- job_deadline j_lst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [LSTtask _]].
- by specialize (PARAMS j_lst LSTarr); des; rewrite PARAMS1 LSTtask.
- Qed.
-
- (* The first job arrives before the last job. *)
- Lemma interference_bound_edf_j_fst_before_j_lst :
- job_arrival j_fst <= job_arrival j_lst.
- Proof.
- rename H_at_least_two_jobs into SIZE.
- unfold j_fst, j_lst; rewrite -[num_mid_jobs.+1]add0n.
- apply prev_le_next; last by rewrite SIZE leqnn.
- by intros i LT; apply interference_bound_edf_jobs_ordered_by_arrival.
- Qed.
-
- (* The last job arrives before the end of the interval. *)
- Lemma interference_bound_edf_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- exploit interference_bound_edf_all_jobs_from_tsk_k.
- {
- apply mem_nth; instantiate (1 := num_mid_jobs.+1).
- by rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- }
- instantiate (1 := elem); move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- apply LSTserv; apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := service_during sched j_lst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP; unfold service_during.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- Qed.
-
- (* Since there are multiple jobs, j_fst is far enough from the end of
- the interval that its response-time bound is valid
- (by the assumption H_all_previous_jobs_completed_on_time). *)
- Lemma interference_bound_edf_j_fst_completed_on_time :
- completed job_cost sched j_fst (a_fst + R_k).
- Proof.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k; des.
- set j_snd := nth elem sorted_jobs 1.
- exploit interference_bound_edf_all_jobs_from_tsk_k.
- {
- by apply mem_nth; instantiate (1 := 1); rewrite H_at_least_two_jobs.
- }
- instantiate (1 := elem); move => [SNDarr [SNDtsk [/eqP SNDserv _]]].
- apply H_all_previous_jobs_completed_on_time; try (by done).
- apply leq_ltn_trans with (n := job_arrival j_snd); last first.
- {
- rewrite ltnNge; apply/negP; red; intro BUG; apply SNDserv.
- apply/eqP; rewrite -leqn0; apply leq_trans with (n := service_during
- sched j_snd t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- }
- apply leq_trans with (n := a_fst + p_k).
- {
- by rewrite leq_add2l; apply leq_trans with (n := D_k);
- [by apply H_R_k_le_deadline | by apply H_constrained_deadlines].
- }
-
- (* Since jobs are sporadic, we know that the first job arrives
- at least p_k units before the second. *)
- unfold p_k; rewrite -FST0.
- apply H_sporadic_tasks; try (by done); [| by rewrite SNDtsk | ]; last first.
- {
- apply interference_bound_edf_jobs_ordered_by_arrival.
- by rewrite H_at_least_two_jobs.
- }
- red; move => /eqP BUG.
- by rewrite nth_uniq in BUG; rewrite ?SIZE //;
- [ by apply interference_bound_edf_at_least_one_job
- | by rewrite H_at_least_two_jobs
- | by rewrite sort_uniq; apply filter_uniq, undup_uniq].
- Qed.
-
- End FactsAboutFirstAndLastJobs.
-
- (* Next, we prove that the distance between the first and last jobs is at least
- num_mid_jobs + 1 periods. *)
- Lemma interference_bound_edf_many_periods_in_between :
- a_lst - a_fst >= num_mid_jobs.+1 * p_k.
- Proof.
- clear H_at_least_one_cpu H_tsk_i_in_task_set H_delta_le_deadline.
- unfold a_fst, a_lst, j_fst, j_lst.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- rewrite EQnk telescoping_sum;
- last by ins; apply interference_bound_edf_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk_k]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply interference_bound_edf_jobs_ordered_by_arrival.
-
- feed (interference_bound_edf_all_jobs_from_tsk_k cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (interference_bound_edf_all_jobs_from_tsk_k next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first by move: EQ => /eqP EQ; lia.
- by apply ltn_trans with (n := (size sorted_jobs).-1); destruct sorted_jobs; ins.
- by destruct sorted_jobs; ins.
- by rewrite sort_uniq -/interfering_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk.
- }
- by rewrite leq_subRL_impl // /p_k -CURtsk.
- Qed.
-
- (* Using the lemma above, we prove that the ratio n_k is at least the number of
- middle jobs + 1, ... *)
- Lemma interference_bound_edf_n_k_covers_middle_jobs_plus_one :
- n_k >= num_mid_jobs.+1.
- Proof.
- have DIST := interference_bound_edf_many_periods_in_between.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- rename H_valid_task_parameters into TASK_PARAMS,
- H_tsk_k_in_task_set into INk.
- unfold valid_sporadic_taskset, is_valid_sporadic_task,
- interference_bound, edf_specific_interference_bound in *.
- rewrite leqNgt; apply/negP; unfold not; intro LTnk; unfold n_k in LTnk.
- rewrite ltn_divLR in LTnk; last by specialize (TASK_PARAMS tsk_k INk); des.
- apply (leq_trans LTnk) in DIST; rewrite ltn_subRL in DIST.
- rewrite -(ltn_add2r D_k) -addnA [D_i + _]addnC addnA in DIST.
- apply leq_ltn_trans with (m := job_arrival j_i + D_i) in DIST; last first.
- {
- rewrite leq_add2r; apply (leq_trans AFTERt1).
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [ LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- unfold D_i, D_k in DIST; rewrite interference_bound_edf_j_lst_deadline
- interference_bound_edf_j_i_deadline in LEdl.
- by rewrite ltnNge LEdl in DIST.
- Qed.
-
- (* ... which allows bounding the interference of the middle and last jobs
- using n_k multiplied by the cost. *)
- Lemma interference_bound_edf_holds_for_middle_and_last_jobs :
- interference_caused_by j_lst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- interference_caused_by (nth elem sorted_jobs i.+1) t1 t2
- <= n_k * task_cost tsk_k.
- Proof.
- apply leq_trans with (n := num_mid_jobs.+1 * task_cost tsk_k); last first.
- {
- rewrite leq_mul2r; apply/orP; right.
- by apply interference_bound_edf_n_k_covers_middle_jobs_plus_one.
- }
- rewrite mulSn; apply leq_add.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- {
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs) task_cost tsk_k);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < num_mid_jobs) task_cost _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- apply mem_nth; rewrite H_at_least_two_jobs.
- by rewrite ltnS; apply leq_trans with (n := num_mid_jobs).
- }
- Qed.
-
- (* Now, since n_k < sorted_jobs = num_mid_jobs + 2, it follows that
- n_k = num_mid_jobs + 1. *)
- Lemma interference_bound_edf_n_k_equals_num_mid_jobs_plus_one :
- n_k = num_mid_jobs.+1.
- Proof.
- have NK := interference_bound_edf_n_k_covers_middle_jobs_plus_one.
- rename H_many_jobs into NUM, H_at_least_two_jobs into SIZE.
- move: NK; rewrite leq_eqVlt orbC; move => /orP NK; des;
- [by rewrite SIZE ltnS leqNgt NK in NUM | by done].
- Qed.
-
- (* After proving the bounds of the middle and last jobs, we do the same for
- the first job. This requires a different proof in order to exploit the slack. *)
- Section InterferenceOfFirstJob.
-
- (* As required by the next lemma, in order to move (D_i %% p_k) to the left of
- the inequality (<=), we must show that it is no smaller than the slack. *)
- Lemma interference_bound_edf_remainder_ge_slack :
- D_k - R_k <= D_i %% p_k.
- Proof.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- have NK := interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
- have DIST := interference_bound_edf_many_periods_in_between.
- rewrite -NK in DIST.
- rewrite -subndiv_eq_mod leq_subLR.
- fold (div_floor D_i p_k) n_k.
- rewrite addnBA; last by apply leq_trunc_div.
- apply leq_trans with (n := R_k + D_i - (a_lst - a_fst)); last by apply leq_sub2l.
- rewrite subnBA; last by apply interference_bound_edf_j_fst_before_j_lst.
- rewrite -(leq_add2r a_lst) addnBAC; last first.
- {
- apply leq_trans with (n := t2);
- [by apply ltnW, interference_bound_edf_last_job_arrives_before_end_of_interval|].
- rewrite addnC addnA.
- apply leq_trans with (n := t1 + D_i).
- unfold t2; rewrite leq_add2l; apply H_delta_le_deadline.
- by rewrite leq_add2r; apply AFTERt1.
- }
- rewrite -addnBA // subnn addn0 [D_k + _]addnC.
- apply leq_trans with (n := t1 + D_i);
- last by rewrite -addnA [D_i + _]addnC addnA leq_add2r addnC AFTERt1.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [ LSTserv _]]].
- unfold D_i, D_k, a_lst, t1; rewrite -interference_bound_edf_j_lst_deadline
- -interference_bound_edf_j_i_deadline.
- try ( by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LSTserv ) ||
- by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LSTserv.
- Qed.
-
- (* To conclude that the interference bound holds, it suffices to show that
- this reordered inequality holds. *)
- Lemma interference_bound_edf_simpl_by_moving_to_left_side :
- interference_caused_by j_fst t1 t2 + (D_k - R_k) + D_i %/ p_k * p_k <= D_i ->
- interference_caused_by j_fst t1 t2 <= D_i %% p_k - (D_k - R_k).
- Proof.
- intro LE.
- apply leq_subRL_impl.
- by rewrite addnC -subndiv_eq_mod; apply leq_subRL_impl; rewrite addnC.
- Qed.
-
- (* Next, we prove that interference caused by j_fst is bounded by the length
- of the interval [t1, a_fst + R_k), ... *)
- Lemma interference_bound_edf_interference_of_j_fst_bounded_by_response_time :
- interference_caused_by j_fst t1 t2 <= \sum_(t1 <= t < a_fst + R_k) 1.
- Proof.
- assert (AFTERt1: t1 <= a_fst + R_k).
- {
- apply interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval.
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- destruct (leqP t2 (a_fst + R_k)) as [LEt2 | GTt2].
- {
- apply leq_trans with (n := job_interference job_arrival job_cost sched j_i j_fst t1
- (a_fst + R_k));
- first by apply extend_sum; rewrite ?leqnn.
- simpl_sum_const; rewrite -{1}[_ + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- {
- unfold interference_caused_by, job_interference.
- rewrite -> big_cat_nat with (n := a_fst + R_k);
- [simpl | by apply AFTERt1 | by apply ltnW].
- rewrite -[\sum_(_ <= _ < _) 1]addn0; apply leq_add.
- {
- simpl_sum_const; rewrite -{1}[_ + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- apply leq_trans with (n := service_during sched j_fst (a_fst + R_k) t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- (try ( apply cumulative_service_after_job_rt_zero with (job_cost0 := job_cost) (R := R_k)
- (job_arrival0 := job_arrival) ) ||
- apply cumulative_service_after_job_rt_zero with (job_cost := job_cost) (R := R_k)
- (job_arrival := job_arrival)); [ by done | | by apply leqnn].
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- Qed.
-
- (* ..., which leads to the following bounds based on interval lengths. *)
- Lemma interference_bound_edf_bounding_interference_with_interval_lengths :
- interference_caused_by j_fst t1 t2 + (D_k - R_k) + D_i %/ p_k * p_k <=
- \sum_(t1 <= t < a_fst + R_k) 1
- + \sum_(a_fst + R_k <= t < a_fst + D_k) 1
- + \sum_(a_fst + D_k <= t < a_lst + D_k) 1.
- Proof.
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 + (D_k - R_k) +
- D_i %/ p_k * p_k).
- {
- rewrite 2!leq_add2r.
- apply interference_bound_edf_interference_of_j_fst_bounded_by_response_time.
- }
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 + (D_k - R_k) +
- (a_lst - a_fst)).
- {
- rewrite leq_add2l; fold (div_floor D_i p_k) n_k.
- rewrite interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
- by apply interference_bound_edf_many_periods_in_between.
- }
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + R_k) 1 +
- \sum_(a_fst + R_k <= t < a_fst + D_k) 1 + \sum_(a_fst + D_k <= t < a_lst + D_k) 1).
- {
- by rewrite -2!addnA leq_add2l; apply leq_add;
- rewrite big_const_nat iter_addn mul1n addn0;
- rewrite ?subnDl ?subnDr leqnn.
- }
- by apply leqnn.
- Qed.
-
- (* To conclude, we show that the concatenation of these interval lengths equals
- (a_lst + D_k) - 1, ... *)
- Lemma interference_bound_edf_simpl_by_concatenation_of_intervals :
- \sum_(t1 <= t < a_fst + R_k) 1
- + \sum_(a_fst + R_k <= t < a_fst + D_k) 1
- + \sum_(a_fst + D_k <= t < a_lst + D_k) 1 = (a_lst + D_k) - t1.
- Proof.
- assert (AFTERt1: t1 <= a_fst + R_k).
- {
- apply interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval.
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- rewrite -big_cat_nat;
- [simpl | by apply AFTERt1 | by rewrite leq_add2l; apply H_R_k_le_deadline].
- rewrite -big_cat_nat; simpl; last 2 first.
- {
- apply leq_trans with (n := a_fst + R_k); first by apply AFTERt1.
- by rewrite leq_add2l; apply H_R_k_le_deadline.
- }
- {
- rewrite leq_add2r; unfold a_fst, a_lst, j_fst, j_lst.
- rewrite -[num_mid_jobs.+1]add0n; apply prev_le_next;
- last by rewrite add0n H_at_least_two_jobs ltnSn.
- by ins; apply interference_bound_edf_jobs_ordered_by_arrival.
- }
- by rewrite big_const_nat iter_addn mul1n addn0.
- Qed.
-
- (* ... which results in proving that (a_lst + D_k) - t1 <= D_i.
- This holds because high-priority jobs have earlier deadlines. Therefore,
- the interference caused by the first job is bounded by D_i %% p_k - (D_k - R_k). *)
- Lemma interference_bound_edf_interference_of_j_fst_limited_by_remainder_and_slack :
- interference_caused_by j_fst t1 t2 <= D_i %% p_k - (D_k - R_k).
- Proof.
- apply interference_bound_edf_simpl_by_moving_to_left_side.
- apply (leq_trans interference_bound_edf_bounding_interference_with_interval_lengths).
- rewrite interference_bound_edf_simpl_by_concatenation_of_intervals leq_subLR.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [ LSTserv _]]].
- unfold D_i, D_k, a_lst, t1; rewrite -interference_bound_edf_j_lst_deadline
- -interference_bound_edf_j_i_deadline.
- try ( by apply interference_under_edf_implies_shorter_deadlines
- with (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LSTserv ) ||
- by apply interference_under_edf_implies_shorter_deadlines
- with (arr_seq := arr_seq) (job_deadline := job_deadline) in LSTserv.
- Qed.
-
- End InterferenceOfFirstJob.
-
- (* Using the lemmas above we show that the interference bound works in the
- case of two or more jobs. *)
- Lemma interference_bound_edf_holds_for_multiple_jobs :
- \sum_(0 <= i < num_mid_jobs.+2)
- interference_caused_by (nth elem sorted_jobs i) t1 t2 <= interference_bound.
- Proof.
- (* Knowing that we have at least two elements, we take first and last out of the sum *)
- rewrite [nth]lock big_nat_recl // big_nat_recr // /= -lock.
- rewrite addnA addnC addnA.
-
- have NK := interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
-
- (* We use the lemmas we proved to show that the interference bound holds. *)
- unfold interference_bound, edf_specific_interference_bound.
- fold D_i D_k p_k n_k.
- rewrite addnC addnA; apply leq_add;
- first by rewrite addnC interference_bound_edf_holds_for_middle_and_last_jobs.
- rewrite leq_min; apply/andP; split.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- by apply interference_bound_edf_interference_of_j_fst_limited_by_remainder_and_slack.
- Qed.
-
- End InterferenceTwoOrMoreJobs.
-
- End InterferenceManyJobs.
-
- Theorem interference_bound_edf_bounds_interference :
- x <= interference_bound.
- Proof.
- (* Use the definition of workload based on list of jobs. *)
- apply (leq_trans interference_bound_edf_use_another_definition).
-
- (* We only care about the jobs that cause interference. *)
- rewrite interference_bound_edf_simpl_by_filtering_interfering_jobs.
-
- (* Now we order the list by job arrival time. *)
- rewrite interference_bound_edf_simpl_by_sorting_interfering_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply interference_bound_edf_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs as [| j]; [by rewrite ltn0 in NUM | by exists j].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a single job, or for multiple jobs. *)
- destruct n as [| num_mid_jobs].
- {
- rewrite big_nat_recr // big_geq //.
- rewrite [nth]lock /= -lock add0n.
- by apply interference_bound_edf_holds_for_a_single_job; rewrite SIZE.
- }
- {
- by apply interference_bound_edf_holds_for_multiple_jobs; first by rewrite SIZE.
- }
- Qed.
-
- End MainProof.
-
- End ProofSpecificBound.
-
- (* As required by the proof of convergence of EDF RTA, we show that the
- EDF-specific bound is monotonically increasing with both the size
- of the interval and the value of the previous response-time bounds. *)
- Section MonotonicitySpecificBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Variable tsk tsk_other: sporadic_task.
- Hypothesis H_period_positive: task_period tsk_other > 0.
-
- Variable delta delta' R R': time.
- Hypothesis H_delta_monotonic: delta <= delta'.
- Hypothesis H_response_time_monotonic: R <= R'.
- Hypothesis H_cost_le_rt_bound: task_cost tsk_other <= R.
-
- Lemma interference_bound_edf_monotonic :
- interference_bound_edf task_cost task_period task_deadline tsk delta (tsk_other, R) <=
- interference_bound_edf task_cost task_period task_deadline tsk delta' (tsk_other, R').
- Proof.
- rename H_response_time_monotonic into LEr, H_delta_monotonic into LEx,
- H_cost_le_rt_bound into LEcost, H_period_positive into GEperiod.
- unfold interference_bound_edf, interference_bound_generic.
- rewrite leq_min; apply/andP; split.
- {
- rewrite leq_min; apply/andP; split.
- apply leq_trans with (n := (minn (W task_cost task_period (fst (tsk_other, R))
- (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1)));
- first by apply geq_minl.
- apply leq_trans with (n := W task_cost task_period (fst (tsk_other, R))
- (snd (tsk_other, R)) delta);
- [by apply geq_minl | by apply W_monotonic].
- apply leq_trans with (n := minn (W task_cost task_period (fst (tsk_other, R)) (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1));
- first by apply geq_minl.
- apply leq_trans with (n := delta - task_cost tsk + 1);
- first by apply geq_minr.
- by rewrite leq_add2r leq_sub2r.
- }
- {
- apply leq_trans with (n := edf_specific_interference_bound task_cost task_period
- task_deadline tsk tsk_other R);
- first by apply geq_minr.
- unfold edf_specific_interference_bound; simpl.
- rewrite leq_add2l leq_min; apply/andP; split; first by apply geq_minl.
- apply leq_trans with (n := task_deadline tsk %% task_period tsk_other -
- (task_deadline tsk_other - R));
- [by apply geq_minr | by rewrite 2?leq_sub2l 2?leq_sub2r // leq_sub2l].
- }
- Qed.
-
- End MonotonicitySpecificBound.
-
-End InterferenceBoundEDF.
diff --git a/classic/analysis/global/basic/interference_bound_fp.v b/classic/analysis/global/basic/interference_bound_fp.v
deleted file mode 100644
index 010134f94e83ee1dc861b023b52d58cbe24cd67a..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/interference_bound_fp.v
+++ /dev/null
@@ -1,46 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.interference.
-Require Import prosa.classic.analysis.global.basic.workload_bound
- prosa.classic.analysis.global.basic.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundFP.
-
- Import Schedule WorkloadBound Priority Interference.
- Export InterferenceBoundGeneric.
-
- Section Definitions.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each higher-priority task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... in any interval of length delta. *)
- Variable delta: time.
-
- (* Assume an FP policy. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* Recall the generic interference bound. *)
- Let total_interference_bound := interference_bound_generic task_cost task_period tsk delta.
-
- (* The total interference incurred by tsk is bounded by the sum
- of individual task interferences. *)
- Definition total_interference_bound_fp :=
- \sum_((tsk_other, R_other) <- R_prev)
- total_interference_bound (tsk_other, R_other).
-
- End Definitions.
-
-End InterferenceBoundFP.
\ No newline at end of file
diff --git a/classic/analysis/global/basic/workload_bound.v b/classic/analysis/global/basic/workload_bound.v
deleted file mode 100644
index 5380757d7c29fc5a3981bd787d4001e922217455..0000000000000000000000000000000000000000
--- a/classic/analysis/global/basic/workload_bound.v
+++ /dev/null
@@ -1,747 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.response_time
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq div fintype bigop path.
-
-Module WorkloadBound.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask TaskArrival ResponseTime Schedulability Workload.
-
- Section WorkloadBoundDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
-
- (* Consider any task tsk with response-time bound R_tsk,
- that is scheduled in an interval of length delta. *)
- Variable tsk: sporadic_task.
- Variable R_tsk: time.
- Variable delta: time.
-
- (* Based on the number of jobs that execute completely in the interval, ... *)
- Definition max_jobs :=
- div_floor (delta + R_tsk - task_cost tsk) (task_period tsk).
-
- (* ... Bertogna and Cirinei's workload bound is defined as follows. *)
- Definition W :=
- let e_k := (task_cost tsk) in
- let p_k := (task_period tsk) in
- minn e_k (delta + R_tsk - e_k - max_jobs * p_k) + max_jobs * e_k.
-
- End WorkloadBoundDef.
-
- Section BasicLemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
-
- (* Let tsk be any task...*)
- Variable tsk: sporadic_task.
-
- (* ... with period > 0. *)
- Hypothesis H_period_positive: task_period tsk > 0.
-
- (* Let R1 <= R2 be two response-time bounds that
- are larger than the cost of the tsk. *)
- Variable R1 R2: time.
- Hypothesis H_R_lower_bound: R1 >= task_cost tsk.
- Hypothesis H_R1_le_R2: R1 <= R2.
-
- Let workload_bound := W task_cost task_period tsk.
-
- (* Then, Bertogna and Cirinei's workload bound is monotonically increasing. *)
- Lemma W_monotonic :
- forall t1 t2,
- t1 <= t2 ->
- workload_bound R1 t1 <= workload_bound R2 t2.
- Proof.
- intros t1 t2 LEt.
- unfold workload_bound, W, max_jobs, div_floor; rewrite 2!subndiv_eq_mod.
- set e := task_cost tsk; set p := task_period tsk.
- set x1 := t1 + R1.
- set x2 := t2 + R2.
- set delta := x2 - x1.
- rewrite -[x2](addKn x1) -addnBA; fold delta;
- last by apply leq_add.
-
- induction delta; first by rewrite addn0 leqnn.
- {
- apply (leq_trans IHdelta).
-
- (* Prove special case for p <= 1. *)
- destruct (leqP p 1) as [LTp | GTp].
- {
- rewrite leq_eqVlt in LTp; move: LTp => /orP LTp; des;
- last by rewrite ltnS in LTp; apply (leq_trans H_period_positive) in LTp.
- {
- rewrite LTp 2!modn1 2!divn1.
- rewrite leq_add2l leq_mul2r; apply/orP; right.
- by rewrite leq_sub2r // leq_add2l.
- }
- }
- (* Harder case: p > 1. *)
- {
- assert (EQ: (x1 + delta.+1 - e) = (x1 + delta - e).+1).
- {
- rewrite -[(x1 + delta - e).+1]addn1.
- rewrite [_+1]addnC addnBA; last first.
- {
- apply (leq_trans H_R_lower_bound).
- by rewrite -addnA addnC -addnA leq_addr.
- }
- by rewrite [1 + _]addnC -addnA addn1.
- } rewrite -> EQ in *; clear EQ.
-
- have DIV := divSn_cases (x1 + delta - e) p GTp; des.
- {
- rewrite DIV leq_add2r leq_min; apply/andP; split;
- first by rewrite geq_minl.
- by apply leq_trans with (n := (x1 + delta - e) %% p);
- [by rewrite geq_minr | by rewrite -DIV0 addn1 leqnSn].
- }
- {
- rewrite -[minn e _]add0n -addnA; apply leq_add; first by ins.
- rewrite -DIV mulnDl mul1n [_ + e]addnC.
- by apply leq_add; [by rewrite geq_minl | by ins].
- }
- }
- }
- Qed.
-
- End BasicLemmas.
-
- Section ProofWorkloadBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_deadline: Job -> time.
-
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume that all jobs have valid parameters *)
- Hypothesis H_jobs_have_valid_parameters :
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider any schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Assumption: jobs only execute if they arrived.
- This is used to eliminate jobs that arrive after end of the interval t1 + delta. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Assumption: jobs do not execute after they completed.
- This is used to eliminate jobs that complete before the start of the interval t1. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assumption: Jobs are sequential.
- This is required to use interval lengths as a measure of service. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assumption: sporadic task model.
- This is necessary to conclude that consecutive jobs ordered by arrival times
- are separated by at least 'period' times units. *)
- Hypothesis H_sporadic_tasks: sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Before starting the proof, let's give simpler names to the definitions. *)
- Let job_has_completed_by := completed job_cost sched.
-
- Let workload_of (tsk: sporadic_task) (t1 t2: time) :=
- workload job_task sched tsk t1 t2.
-
- (* Now we define the theorem. Let tsk be any task in the taskset. *)
- Variable tsk: sporadic_task.
-
- (* Assumption: the task must have valid parameters:
- a) period > 0 (used in divisions)
- b) deadline of the jobs = deadline of the task
- c) cost <= period
- (used to prove that the distance between the first and last
- jobs is at least (cost + n*period), where n is the number
- of middle jobs. If cost >> period, the claim does not hold
- for every task set. *)
- Hypothesis H_valid_task_parameters:
- is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (* Assumption: the task must have a constrained deadline.
- This is required to prove that n_k (max_jobs) from Bertogna
- and Cirinei's formula accounts for at least the number of
- middle jobs (i.e., number of jobs - 2 in the worst case). *)
- Hypothesis H_constrained_deadline: task_deadline tsk <= task_period tsk.
-
- (* Consider an interval [t1, t1 + delta). *)
- Variable t1 delta: time.
-
- (* Assume that a response-time bound R_tsk for that task in any
- schedule of this processor platform is also given, ... *)
- Variable R_tsk: time.
-
- Hypothesis H_response_time_bound :
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_arrival j + R_tsk < t1 + delta ->
- job_has_completed_by j (job_arrival j + R_tsk).
-
- (* ... such that R_tsk >= task_cost tsk and R_tsk <= task_deadline tsk. *)
- Hypothesis H_response_time_ge_cost: R_tsk >= task_cost tsk.
- Hypothesis H_no_deadline_miss: R_tsk <= task_deadline tsk.
-
- Section MainProof.
-
- (* In this section, we prove that the workload of a task in the
- interval [t1, t1 + delta) is bounded by W. *)
-
- (* Let's simplify the names a bit. *)
- Let t2 := t1 + delta.
- Let n_k := max_jobs task_cost task_period tsk R_tsk delta.
- Let workload_bound := W task_cost task_period tsk R_tsk delta.
-
- (* Since we only care about the workload of tsk, we restrict
- our view to the set of jobs of tsk scheduled in [t1, t2). *)
- Let scheduled_jobs :=
- jobs_of_task_scheduled_between job_task sched tsk t1 t2.
-
- (* Now, let's consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := sort earlier_arrival scheduled_jobs.
-
- (* The first step consists in simplifying the sum corresponding
- to the workload. *)
- Section SimplifyJobSequence.
-
- (* After switching to the definition of workload based on a list
- of jobs, we show that sorting the list preserves the sum. *)
- Lemma workload_bound_simpl_by_sorting_scheduled_jobs :
- workload_joblist job_task sched tsk t1 t2 =
- \sum_(i <- sorted_jobs) service_during sched i t1 t2.
- Proof.
- unfold workload_joblist; fold scheduled_jobs.
- rewrite (perm_big sorted_jobs) /= //.
- by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that both sequences have the same set of elements *)
- Lemma workload_bound_job_in_same_sequence :
- forall j,
- (j \in scheduled_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that all jobs in the sorted sequence is an
- interfering job of task tsk. *)
- Lemma workload_bound_all_jobs_from_tsk :
- forall j_i,
- j_i \in sorted_jobs ->
- arrives_in arr_seq j_i /\
- job_task j_i = tsk /\
- service_during sched j_i t1 t2 != 0 /\
- j_i \in jobs_scheduled_between sched t1 t2.
- Proof.
- rename H_jobs_come_from_arrival_sequence into FROMarr.
- intros j_i LTi.
- rewrite -workload_bound_job_in_same_sequence mem_filter in LTi; des.
- have IN := LTi0.
- unfold jobs_scheduled_between in *; rewrite mem_undup in IN.
- apply mem_bigcat_nat_exists in IN; des.
- rewrite mem_scheduled_jobs_eq_scheduled in IN.
- repeat split; try (by done); first by apply (FROMarr j_i i).
- unfold jobs_scheduled_between in *; rewrite mem_undup in LTi0.
- apply mem_bigcat_nat_exists in LTi0; des.
- rewrite mem_scheduled_jobs_eq_scheduled in LTi0.
- apply service_implies_cumulative_service with (t := i); first by apply/andP; split.
- by rewrite -not_scheduled_no_service negbK.
- Qed.
-
- (* Remember that consecutive jobs are ordered by arrival. *)
- Lemma workload_bound_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section WorkloadNotManyJobs.
-
- Lemma workload_bound_holds_for_at_most_n_k_jobs :
- size sorted_jobs <= n_k ->
- \sum_(i <- sorted_jobs) service_during sched i t1 t2 <=
- workload_bound.
- Proof.
- intros LEnk.
- rewrite -[\sum_(_ <- _ | _) _]add0n leq_add //.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk);
- last by rewrite big_const_seq iter_addn addn0 mulnC leq_mul2r; apply/orP; right.
- {
- rewrite [\sum_(_ <- _) service_during _ _ _ _]big_seq_cond.
- rewrite [\sum_(_ <- _) task_cost _]big_seq_cond.
- apply leq_sum; intros j_i; move/andP => [INi _].
- apply workload_bound_all_jobs_from_tsk in INi; des.
- eapply cumulative_service_le_task_cost;
- [by apply H_completed_jobs_dont_execute | by apply INi0 |].
- by apply H_jobs_have_valid_parameters.
- }
- Qed.
-
- End WorkloadNotManyJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0.
- First, consider the simple case with only one job. *)
- Section WorkloadSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_at_least_one_job: size sorted_jobs > 0.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
-
- (* The first job is an interfering job of task tsk. *)
- Lemma workload_bound_j_fst_is_job_of_tsk :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk /\
- service_during sched j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply workload_bound_all_jobs_from_tsk, mem_nth.
- Qed.
-
- (* The workload bound holds for the single job. *)
- Lemma workload_bound_holds_for_a_single_job :
- \sum_(0 <= i < 1) service_during sched (nth elem sorted_jobs i) t1 t2 <=
- workload_bound.
- Proof.
- unfold workload_bound, W; fold n_k.
- have INfst := workload_bound_j_fst_is_job_of_tsk; des.
- rewrite big_nat_recr // big_geq // [nth]lock /= -lock add0n.
- destruct n_k; last first.
- {
- rewrite -[service_during _ _ _ _]add0n; rewrite leq_add //.
- rewrite -[service_during _ _ _ _]add0n [_* task_cost tsk]mulSnr.
- apply leq_add; first by done.
- by eapply cumulative_service_le_task_cost;
- [| by apply INfst0
- | by apply H_jobs_have_valid_parameters].
- }
- {
- rewrite 2!mul0n addn0 subn0 leq_min; apply/andP; split.
- {
- by eapply cumulative_service_le_task_cost;
- [| by apply INfst0
- | by apply H_jobs_have_valid_parameters].
- }
- {
- rewrite -addnBA // -[service_during _ _ _ _]addn0.
- apply leq_add; last by done.
- by apply cumulative_service_le_delta.
- }
- }
- Qed.
-
- End WorkloadSingleJob.
-
- (* Next, consider the last case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section WorkloadTwoOrMoreJobs.
-
- (* There are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
-
- (* The last job is an interfering job of task tsk. *)
- Lemma workload_bound_j_lst_is_job_of_tsk :
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk /\
- service_during sched j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply workload_bound_all_jobs_from_tsk, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The response time of the first job must fall inside the interval. *)
- Lemma workload_bound_response_time_of_first_job_inside_interval :
- t1 <= job_arrival j_fst + R_tsk.
- Proof.
- rewrite leqNgt; apply /negP; unfold not; intro LTt1.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := 0).
- apply ltn_trans with (n := 1); [by done | by rewrite H_at_least_two_jobs].
- }
- instantiate (1 := elem); move => [FSTarr [FSTtsk [/eqP FSTserv FSTin]]].
- apply FSTserv.
- apply (cumulative_service_after_job_rt_zero job_arrival job_cost) with (R := R_tsk);
- try (by done); last by apply ltnW.
- apply H_response_time_bound; try (by done).
- by apply leq_trans with (n := t1); last by apply leq_addr.
- Qed.
-
- (* The arrival of the last job must also fall inside the interval. *)
- Lemma workload_bound_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := num_mid_jobs.+1).
- by rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- }
- instantiate (1 := elem); move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- unfold service_during; apply LSTserv.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- Qed.
-
- (* Next, we upper-bound the service of the first and last jobs using their arrival times. *)
- Lemma workload_bound_service_of_first_and_last_jobs :
- service_during sched j_fst t1 t2 +
- service_during sched j_lst t1 t2 <=
- (job_arrival j_fst + R_tsk - t1) + (t2 - job_arrival j_lst).
- Proof.
- apply leq_add; unfold service_during.
- {
- rewrite -[_ + _ - _]mul1n -[1*_]addn0 -iter_addn -big_const_nat.
- apply leq_trans with (n := \sum_(t1 <= t < job_arrival j_fst + R_tsk)
- service_at sched j_fst t);
- last by apply leq_sum; ins; apply service_at_most_one.
- destruct (job_arrival j_fst + R_tsk < t2) eqn:LEt2; last first.
- {
- unfold t2; apply negbT in LEt2; rewrite -ltnNge in LEt2.
- rewrite -> big_cat_nat with (n := t1 + delta) (p := job_arrival j_fst + R_tsk);
- [by apply leq_addr | by apply leq_addr | by done].
- }
- {
- rewrite -> big_cat_nat with (n := job_arrival j_fst + R_tsk);
- [| by apply workload_bound_response_time_of_first_job_inside_interval
- | by apply ltnW].
- rewrite -{2}[\sum_(_ <= _ < _) _]addn0 /= leq_add2l leqn0; apply/eqP.
- apply (cumulative_service_after_job_rt_zero job_arrival job_cost) with
- (R := R_tsk); try (by done).
- feed (workload_bound_all_jobs_from_tsk j_fst).
- by apply mem_nth; rewrite H_at_least_two_jobs.
- move => [FSTarr [FSTtsk _]].
- by apply H_response_time_bound.
- }
- }
- {
- rewrite -[_ - _]mul1n -[1 * _]addn0 -iter_addn -big_const_nat.
- destruct (job_arrival j_lst <= t1) eqn:LT.
- {
- apply leq_trans with (n := \sum_(job_arrival j_lst <= t < t2)
- service_at sched j_lst t);
- first by rewrite -> big_cat_nat with (m := job_arrival j_lst) (n := t1);
- [by apply leq_addl | by ins | by apply leq_addr].
- by apply leq_sum; ins; apply service_at_most_one.
- }
- {
- apply negbT in LT; rewrite -ltnNge in LT.
- rewrite -> big_cat_nat with (n := job_arrival j_lst);
- [| by apply ltnW
- | by apply ltnW, workload_bound_last_job_arrives_before_end_of_interval].
- rewrite /= -[\sum_(_ <= _ < _) 1]add0n; apply leq_add.
- rewrite (cumulative_service_before_job_arrival_zero job_arrival);
- [by apply leqnn | by ins | by apply leqnn].
- by apply leq_sum; ins; apply service_at_most_one.
- }
- }
- Qed.
-
- (* Simplify the expression from the previous lemma. *)
- Lemma workload_bound_simpl_expression_with_first_and_last :
- job_arrival j_fst + R_tsk - t1 + (t2 - job_arrival j_lst) =
- delta + R_tsk - (job_arrival j_lst - job_arrival j_fst).
- Proof.
- have lemma1 := workload_bound_last_job_arrives_before_end_of_interval.
- have lemma2 := workload_bound_response_time_of_first_job_inside_interval.
- rewrite addnBA; last by apply ltnW.
- rewrite addnBAC // -addnBA; last by apply leq_addr.
- rewrite addnC [job_arrival _ + _]addnC.
- unfold t2; rewrite [t1 + _]addnC -[delta + t1 - _]subnBA // subnn subn0.
- rewrite addnA -subnBA; first by ins.
- unfold j_fst, j_lst. rewrite -[_.+1]add0n.
- apply prev_le_next; last by rewrite H_at_least_two_jobs add0n leqnn.
- by ins; apply workload_bound_jobs_ordered_by_arrival.
- Qed.
-
- (* Bound the service of the middle jobs. *)
- Lemma workload_bound_service_of_middle_jobs :
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2 <=
- num_mid_jobs * task_cost tsk.
- Proof.
- apply leq_trans with (n := num_mid_jobs * task_cost tsk);
- last by rewrite leq_mul2l; apply/orP; right.
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs) task_cost tsk);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < num_mid_jobs) task_cost _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- exploit workload_bound_all_jobs_from_tsk.
- {
- instantiate (1 := nth elem sorted_jobs i.+1).
- apply mem_nth; rewrite H_at_least_two_jobs.
- by rewrite ltnS; apply leq_trans with (n := num_mid_jobs).
- }
- move => [ARR [TSK _]].
- by eapply cumulative_service_le_task_cost; eauto 2.
- Qed.
-
- (* Conclude that the distance between first and last is at least num_mid_jobs + 1 periods. *)
- Lemma workload_bound_many_periods_in_between :
- job_arrival j_lst - job_arrival j_fst >= num_mid_jobs.+1 * (task_period tsk).
- Proof.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- unfold j_fst, j_lst; rewrite EQnk telescoping_sum;
- last by ins; apply workload_bound_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply workload_bound_jobs_ordered_by_arrival.
-
- feed (workload_bound_all_jobs_from_tsk cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (workload_bound_all_jobs_from_tsk next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first by move: EQ => /eqP EQ; try lia.
- by apply ltn_trans with (n := (size sorted_jobs).-1); destruct sorted_jobs; ins.
- by destruct sorted_jobs; ins.
- by rewrite sort_uniq -/scheduled_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk.
- }
- by rewrite leq_subRL_impl // -CURtsk.
- Qed.
-
- (* Prove that n_k is at least the number of the middle jobs *)
- Lemma workload_bound_n_k_covers_middle_jobs :
- n_k >= num_mid_jobs.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *; des.
- rewrite leqNgt; apply/negP; unfold not; intro LTnk.
- assert (DISTmax: job_arrival j_lst - job_arrival j_fst >= delta + task_period tsk).
- {
- apply leq_trans with (n := n_k.+2 * task_period tsk).
- {
- rewrite -addn1 mulnDl mul1n leq_add2r.
- apply leq_trans with (n := delta + R_tsk - task_cost tsk);
- first by rewrite -addnBA //; apply leq_addr.
- by apply ltnW, ltn_ceil, PARAMS0.
- }
- apply leq_trans with (num_mid_jobs.+1 * task_period tsk);
- first by rewrite leq_mul2r; apply/orP; right.
- by apply workload_bound_many_periods_in_between.
- }
- rewrite <- leq_add2r with (p := job_arrival j_fst) in DISTmax.
- rewrite addnC addnBAC in DISTmax; last first.
- {
- unfold j_fst, j_lst; rewrite -[_.+1]add0n.
- apply prev_le_next; last by rewrite H_at_least_two_jobs add0n leqnn.
- by ins; apply workload_bound_jobs_ordered_by_arrival.
- }
- rewrite -subnBA // subnn subn0 in DISTmax.
- rewrite [delta + task_period tsk]addnC addnA in DISTmax.
- have BEFOREt2 := workload_bound_last_job_arrives_before_end_of_interval.
- generalize BEFOREt2; move: BEFOREt2; rewrite {1}ltnNge; move => /negP BEFOREt2'.
- intros BEFOREt2; apply BEFOREt2'; clear BEFOREt2'.
- apply leq_trans with (n := job_arrival j_fst + task_deadline tsk + delta);
- last by apply leq_trans with (n := job_arrival j_fst + task_period tsk + delta);
- [rewrite leq_add2r leq_add2l; apply H_constrained_deadline | apply DISTmax].
- unfold t2; rewrite leq_add2r.
- apply leq_trans with (n := job_arrival j_fst + R_tsk);
- last by rewrite leq_add2l.
- by apply workload_bound_response_time_of_first_job_inside_interval.
- Qed.
-
- (* If n_k = num_mid_jobs, then the workload bound holds. *)
- Lemma workload_bound_n_k_equals_num_mid_jobs :
- num_mid_jobs = n_k ->
- service_during sched j_lst t1 t2 +
- service_during sched j_fst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2
- <= workload_bound.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *; des.
- unfold workload_bound, W; fold n_k.
- move => NK; rewrite -NK.
- apply leq_add;
- last by apply workload_bound_service_of_middle_jobs.
- apply leq_trans with (delta + R_tsk - (job_arrival j_lst - job_arrival j_fst)).
- {
- rewrite addnC -workload_bound_simpl_expression_with_first_and_last.
- by apply workload_bound_service_of_first_and_last_jobs.
- }
- rewrite leq_min; apply/andP; split.
- {
- rewrite leq_subLR [_ + task_cost _]addnC -leq_subLR.
- apply leq_trans with (num_mid_jobs.+1 * task_period tsk);
- last by apply workload_bound_many_periods_in_between.
- rewrite NK ltnW // -ltn_divLR;
- last by apply PARAMS0.
- by unfold n_k, max_jobs, div_floor.
- }
- {
- rewrite -subnDA; apply leq_sub2l.
- apply leq_trans with (n := num_mid_jobs.+1 * task_period tsk);
- last by apply workload_bound_many_periods_in_between.
- rewrite -addn1 addnC mulnDl mul1n.
- by rewrite leq_add2l; last by apply PARAMS3.
- }
- Qed.
-
- (* If n_k = num_mid_jobs + 1, then the workload bound holds. *)
- Lemma workload_bound_n_k_equals_num_mid_jobs_plus_1 :
- num_mid_jobs.+1 = n_k ->
- service_during sched j_lst t1 t2 +
- service_during sched j_fst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2
- <= workload_bound.
- Proof.
- unfold workload_bound, W; fold n_k.
- move => NK; rewrite -NK.
- rewrite -{2}addn1 mulnDl mul1n [_* _ + _]addnC addnA addn_minl.
- apply leq_add; last by apply workload_bound_service_of_middle_jobs.
- rewrite leq_min; apply/andP; split.
- {
- assert (SIZE: 0 < size sorted_jobs).
- by rewrite H_at_least_two_jobs.
- have INfst := workload_bound_j_fst_is_job_of_tsk SIZE elem;
- have INlst := workload_bound_j_lst_is_job_of_tsk; des.
- try ( by apply leq_add; apply cumulative_service_le_task_cost with
- (task_deadline0 := task_deadline) (job_cost0 := job_cost)
- (job_deadline0 := job_deadline) (job_task0 := job_task); eauto 2 ) ||
- by apply leq_add; apply cumulative_service_le_task_cost with
- (task_deadline := task_deadline) (job_cost := job_cost)
- (job_deadline := job_deadline) (job_task := job_task); eauto 2.
- }
- {
- rewrite subnAC subnK; last first.
- {
- assert (TMP: delta + R_tsk = task_cost tsk + (delta + R_tsk - task_cost tsk));
- first by rewrite subnKC; [by ins | by rewrite -[task_cost _]add0n; apply leq_add].
- rewrite TMP; clear TMP.
- rewrite -{1}[task_cost _]addn0 -addnBA NK; [by apply leq_add | by apply leq_trunc_div].
- }
- apply leq_trans with (delta + R_tsk - (job_arrival j_lst - job_arrival j_fst)).
- {
- rewrite addnC -workload_bound_simpl_expression_with_first_and_last.
- by apply workload_bound_service_of_first_and_last_jobs.
- }
- {
- by apply leq_sub2l, workload_bound_many_periods_in_between.
- }
- }
- Qed.
-
- End WorkloadTwoOrMoreJobs.
-
- (* Using the lemmas above, we prove the main theorem about the workload bound. *)
- Theorem workload_bounded_by_W :
- workload_of tsk t1 (t1 + delta) <= workload_bound.
- Proof.
- unfold workload_of, workload_bound, W in *; ins; des.
- fold n_k.
-
- (* Use the definition of workload based on list of jobs. *)
- rewrite workload_eq_workload_joblist.
-
- (* Now we order the list by job arrival time. *)
- rewrite workload_bound_simpl_by_sorting_scheduled_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply workload_bound_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs; [ by rewrite ltn0 in NUM | by exists s].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a singleton set of jobs. *)
- destruct n as [| num_mid_jobs];
- first by apply workload_bound_holds_for_a_single_job; rewrite SIZE.
-
- (* Knowing that we have at least two elements, we take first and last out of the sum *)
- rewrite [nth]lock big_nat_recl // big_nat_recr // /= -lock.
- rewrite addnA addnC addnA.
-
- (* There are two cases to be analyze since n <= n_k < n + 2,
- where n is the number of middle jobs. *)
- have NK := workload_bound_n_k_covers_middle_jobs num_mid_jobs SIZE elem.
- move: NK; rewrite leq_eqVlt orbC leq_eqVlt; move => /orP [NK | /eqP NK].
- move: NK => /orP [/eqP NK | NK]; last by rewrite ltnS leqNgt NK in NUM.
- {
- (* Case 1: n_k = n + 1, where n is the number of middle jobs. *)
- by apply (workload_bound_n_k_equals_num_mid_jobs_plus_1 num_mid_jobs).
- }
- {
- (* Case 2: n_k = n, where n is the number of middle jobs. *)
- by apply (workload_bound_n_k_equals_num_mid_jobs num_mid_jobs).
- }
- Qed.
-
- End MainProof.
-
- End ProofWorkloadBound.
-
-End WorkloadBound.
diff --git a/classic/analysis/global/jitter/bertogna_edf_comp.v b/classic/analysis/global/jitter/bertogna_edf_comp.v
deleted file mode 100755
index ac4e387c97daf422f044a9b4c131c753eb1c89c1..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/bertogna_edf_comp.v
+++ /dev/null
@@ -1,1084 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.global.jitter.bertogna_edf_theory.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationEDF.
-
- Import ResponseTimeAnalysisEDFJitter.
-
- (* In this section, we define the algorithm for Bertogna and Cirinei's
- response-time analysis for EDF scheduling with release jitter. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- (* As input for each iteration of the algorithm, we consider pairs
- of tasks and computed response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Consider a platform with num_cpus processors. *)
- Variable num_cpus: nat.
-
- (* First, recall the interference bound under EDF, ... *)
- Let I (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline task_jitter tsk rt_bounds delta.
-
- (* ..., which yields the following response-time bound. *)
- Definition edf_response_time_bound (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- task_cost tsk + div_floor (I rt_bounds tsk delta) num_cpus.
-
- (* Also note that a response-time R is only valid if R + jitter is no larger
- than the deadline. *)
- Definition jitter_plus_R_le_deadline (pair: task_with_response_time) :=
- let (tsk, R) := pair in
- task_jitter tsk + R <= task_deadline tsk.
-
- (* Next we define the fixed-point iteration for computing
- Bertogna's response-time bound of a task set. *)
-
- (* Given a sequence 'rt_bounds' of task and response-time bounds
- from the previous iteration, we compute the response-time
- bound of a single task using the RTA for EDF. *)
- Definition update_bound (rt_bounds: seq task_with_response_time)
- (pair : task_with_response_time) :=
- let (tsk, R) := pair in
- (tsk, edf_response_time_bound rt_bounds tsk R).
-
- (* To compute the response-time bounds of the entire task set,
- We start the iteration with a sequence of tasks and costs:
- <(task1, cost1), (task2, cost2), ...>. *)
- Let initial_state (ts: seq sporadic_task) :=
- map (fun t => (t, task_cost t)) ts.
-
- (* Then, we successively update the the response-time bounds based
- on the slack computed in the previous iteration. *)
- Definition edf_rta_iteration (rt_bounds: seq task_with_response_time) :=
- map (update_bound rt_bounds) rt_bounds.
-
- (* To ensure that the procedure converges, we run the iteration a
- "sufficient" number of times: task_deadline tsk - task_cost tsk + 1.
- This corresponds to the time complexity of the procedure. *)
- Let max_steps (ts: seq sporadic_task) :=
- \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1.
-
- (* This yields the following definition for the RTA. At the end of
- the iteration, we check if all computed response-time bounds
- are less than or equal to the deadline, in which case they are
- valid. *)
- Definition edf_claimed_bounds (ts: seq sporadic_task) :=
- let R_values := iter (max_steps ts) edf_rta_iteration (initial_state ts) in
- if (all jitter_plus_R_le_deadline R_values) then
- Some R_values
- else None.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition edf_schedulable (ts: seq sporadic_task) :=
- edf_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of tasks/response-time bounds. *)
- Section SimpleLemmas.
-
- (* Updating a single response-time bound does not modify the task. *)
- Lemma edf_claimed_bounds_unzip1_update_bound :
- forall l rt_bounds,
- unzip1 (map (update_bound rt_bounds) l) = unzip1 l.
- Proof.
- induction l; first by done.
- intros rt_bounds.
- simpl; f_equal; last by done.
- by unfold update_bound; desf.
- Qed.
-
- (* At any point of the iteration, the tasks are the same. *)
- Lemma edf_claimed_bounds_unzip1_iteration :
- forall l k,
- unzip1 (iter k edf_rta_iteration (initial_state l)) = l.
- Proof.
- intros l k; clear -k.
- induction k; simpl.
- {
- unfold initial_state.
- induction l; first by done.
- by simpl; rewrite IHl.
- }
- {
- unfold edf_rta_iteration.
- by rewrite edf_claimed_bounds_unzip1_update_bound.
- }
- Qed.
-
- (* The iteration preserves the size of the list. *)
- Lemma edf_claimed_bounds_size :
- forall l k,
- size (iter k edf_rta_iteration (initial_state l)) = size l.
- Proof.
- intros l k; clear -k.
- induction k; simpl; first by rewrite size_map.
- by rewrite size_map.
- Qed.
-
- (* If the analysis succeeds, the computed response-time bounds are no smaller
- than the task cost. *)
- Lemma edf_claimed_bounds_ge_cost :
- forall l k tsk R,
- (tsk, R) \in (iter k edf_rta_iteration (initial_state l)) ->
- R >= task_cost tsk.
- Proof.
- intros l k tsk R IN.
- destruct k.
- {
- move: IN => /mapP IN; destruct IN as [x IN EQ]; inversion EQ.
- by apply leqnn.
- }
- {
- rewrite iterS in IN.
- move: IN => /mapP IN; destruct IN as [x IN EQ].
- unfold update_bound in EQ; destruct x; inversion EQ.
- by unfold edf_response_time_bound; apply leq_addr.
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadline. *)
- Lemma edf_claimed_bounds_le_deadline :
- forall ts rt_bounds tsk R,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- task_jitter tsk + R <= task_deadline tsk.
- Proof.
- intros ts rt_bounds tsk R SOME PAIR; unfold edf_claimed_bounds in SOME.
- destruct (all jitter_plus_R_le_deadline (iter (max_steps ts)
- edf_rta_iteration (initial_state ts))) eqn:DEADLINE;
- last by done.
- move: DEADLINE => /allP DEADLINE.
- inversion SOME as [EQ]; rewrite -EQ in PAIR.
- by specialize (DEADLINE (tsk, R) PAIR).
- Qed.
-
- (* The list contains a response-time bound for every task in the task set. *)
- Lemma edf_claimed_bounds_has_R_for_every_task :
- forall ts rt_bounds tsk,
- edf_claimed_bounds ts = Some rt_bounds ->
- tsk \in ts ->
- exists R,
- (tsk, R) \in rt_bounds.
- Proof.
- intros ts rt_bounds tsk SOME IN.
- unfold edf_claimed_bounds in SOME.
- destruct (all jitter_plus_R_le_deadline (iter (max_steps ts) edf_rta_iteration (initial_state ts)));
- last by done.
- inversion SOME as [EQ]; clear SOME EQ.
- generalize dependent tsk.
- induction (max_steps ts) as [| step]; simpl in *.
- {
- intros tsk IN; unfold initial_state.
- exists (task_cost tsk).
- by apply/mapP; exists tsk.
- }
- {
- intros tsk IN.
- set prev_state := iter step edf_rta_iteration (initial_state ts).
- fold prev_state in IN, IHstep.
- specialize (IHstep tsk IN); des.
- exists (edf_response_time_bound prev_state tsk R).
- by apply/mapP; exists (tsk, R); [by done | by f_equal].
- }
- Qed.
-
- End SimpleLemmas.
-
- (* As required by the proof of convergence, we show that the
- interference bound is monotonically increasing with both
- the size of the interval and the value of the previous
- response-time bounds.
- TODO: move to bertogna_edf_theory.v? *)
- Section MonotonicityOfInterferenceBound.
-
- Variable tsk tsk_other: sporadic_task.
- Hypothesis H_period_positive: task_period tsk_other > 0.
-
- Variable delta delta' R R': time.
- Hypothesis H_delta_monotonic: delta <= delta'.
- Hypothesis H_response_time_monotonic: R <= R'.
- Hypothesis H_cost_le_rt_bound: task_cost tsk_other <= R.
-
- Lemma interference_bound_edf_monotonic :
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk delta (tsk_other, R) <=
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk delta' (tsk_other, R').
- Proof.
- rename H_response_time_monotonic into LEr, H_delta_monotonic into LEx,
- H_cost_le_rt_bound into LEcost, H_period_positive into GEperiod.
- unfold interference_bound_edf, interference_bound_generic.
- rewrite leq_min; apply/andP; split.
- {
- rewrite leq_min; apply/andP; split.
- apply leq_trans with (n := (minn (W_jitter task_cost task_period task_jitter (fst (tsk_other, R))
- (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1)));
- first by apply geq_minl.
- apply leq_trans with (n := W_jitter task_cost task_period task_jitter (fst (tsk_other, R))
- (snd (tsk_other, R)) delta);
- [by apply geq_minl | by apply W_monotonic].
- apply leq_trans with (n := minn (W_jitter task_cost task_period task_jitter (fst (tsk_other, R)) (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1));
- first by apply geq_minl.
- apply leq_trans with (n := delta - task_cost tsk + 1);
- first by apply geq_minr.
- by rewrite leq_add2r leq_sub2r.
- }
- {
- apply leq_trans with (n := edf_specific_interference_bound task_cost task_period
- task_deadline task_jitter tsk tsk_other R);
- first by apply geq_minr.
- unfold edf_specific_interference_bound; simpl.
- rewrite leq_add2l leq_min; apply/andP; split; first by apply geq_minl.
- apply leq_trans with (n := task_deadline tsk %% task_period tsk_other -
- (task_deadline tsk_other - R - task_jitter tsk_other));
- [by apply geq_minr | by rewrite 2?leq_sub2l 2?leq_sub2r // leq_sub2l].
- }
- Qed.
-
- End MonotonicityOfInterferenceBound.
-
- (* In this section, we prove the convergence of the RTA procedure.
- Since we define the RTA procedure as the application of a function
- a fixed number of times, this translates into proving that the value
- of the iteration at (max_steps ts) is equal to the value at (max_steps ts) + 1. *)
- Section Convergence.
-
- (* Consider any list of tasks with valid parameters. *)
- Variable ts: list sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* To simplify, let f denote the RTA procedure. *)
- Let f (k: nat) := iter k edf_rta_iteration (initial_state ts).
-
- (* Since the iteration is applied directly to a list of tasks and response-times,
- we define a corresponding relation "<=" over those lists. *)
-
- (* Let 'all_le' be a binary relation over lists of tasks/response-time bounds.
- It states that every element of list l1 has a response-time bound R that is less
- than or equal to the corresponding response-time bound R' in list l2 (point-wise).
- In addition, the relation states that the tasks of both lists are unchanged. *)
- Let all_le := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- all (fun p => (snd (fst p)) <= (snd (snd p))) (zip l1 l2).
-
- (* Similarly, we define a strict version of 'all_le' called 'one_lt', which states that
- there exists at least one element whose response-time bound increases. *)
- Let one_lt := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- has (fun p => (snd (fst p)) < (snd (snd p))) (zip l1 l2).
-
- (* Next, we prove some basic properties about the relation all_le. *)
- Section RelationProperties.
-
- (* The relation is reflexive, ... *)
- Lemma all_le_reflexive : reflexive all_le.
- Proof.
- intros l; unfold all_le; rewrite eq_refl andTb.
- destruct l; first by done.
- by apply/(zipP t (fun x y => snd x <= snd y)).
- Qed.
-
- (* ... and transitive. *)
- Lemma all_le_transitive: transitive all_le.
- Proof.
- unfold transitive, all_le.
- move => y x z /andP [/eqP ZIPxy LExy] /andP [/eqP ZIPyz LEyz].
- apply/andP; split; first by rewrite ZIPxy -ZIPyz.
- move: LExy => /(zipP _ (fun x y => snd x <= snd y)) LExy.
- move: LEyz => /(zipP _ (fun x y => snd x <= snd y)) LEyz.
- assert (SIZExy: size (unzip1 x) = size (unzip1 y)).
- by rewrite ZIPxy.
- assert (SIZEyz: size (unzip1 y) = size (unzip1 z)).
- by rewrite ZIPyz.
- rewrite 2!size_map in SIZExy; rewrite 2!size_map in SIZEyz.
- destruct y.
- {
- apply size0nil in SIZExy; symmetry in SIZEyz.
- by apply size0nil in SIZEyz; subst.
- }
- specialize (LExy t); specialize (LEyz t).
- apply/(zipP t (fun x y => snd x <= snd y));
- first by rewrite SIZExy -SIZEyz.
- intros i LTi.
- exploit LExy; first by rewrite SIZExy.
- {
- rewrite size_zip -SIZEyz -SIZExy minnn in LTi.
- by rewrite size_zip -SIZExy minnn; apply LTi.
- }
- intro LE.
- exploit LEyz; first by apply SIZEyz.
- {
- rewrite size_zip SIZExy SIZEyz minnn in LTi.
- by rewrite size_zip SIZEyz minnn; apply LTi.
- }
- by intro LE'; apply (leq_trans LE).
- Qed.
-
- (* At any step of the iteration, the corresponding list
- is larger than or equal to the initial state. *)
- Lemma bertogna_edf_comp_iteration_preserves_minimum :
- forall step, all_le (initial_state ts) (f step).
- Proof.
- unfold f.
- intros step; destruct step; first by apply all_le_reflexive.
- apply/andP; split.
- {
- assert (UNZIP0 := edf_claimed_bounds_unzip1_iteration ts 0).
- by simpl in UNZIP0; rewrite UNZIP0 edf_claimed_bounds_unzip1_iteration.
- }
- destruct ts as [| tsk0 ts'].
- {
- clear -step; induction step; first by done.
- by rewrite iterSr IHstep.
- }
-
- apply/(zipP (tsk0,0) (fun x y => snd x <= snd y));
- first by rewrite edf_claimed_bounds_size size_map.
-
- intros i LTi; rewrite iterS; unfold edf_rta_iteration at 1.
- have MAP := @nth_map _ (tsk0,0) _ (tsk0,0).
- rewrite size_zip edf_claimed_bounds_size size_map minnn in LTi.
- rewrite MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- destruct (nth (tsk0, 0) (initial_state (tsk0 :: ts')) i) as [tsk_i R_i] eqn:SUBST.
- rewrite SUBST; unfold update_bound.
- unfold initial_state in SUBST.
- have MAP := @nth_map _ tsk0 _ (tsk0, 0).
- rewrite ?MAP // in SUBST; inversion SUBST; clear MAP.
- assert (EQtsk: tsk_i = fst (nth (tsk0, 0) (iter step edf_rta_iteration
- (initial_state (tsk0 :: ts'))) i)).
- {
- have MAP := @nth_map _ (tsk0,0) _ tsk0 (fun x => fst x).
- rewrite -MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- have UNZIP := edf_claimed_bounds_unzip1_iteration; unfold unzip1 in UNZIP.
- by rewrite UNZIP; symmetry.
- }
- destruct (nth (tsk0, 0) (iter step edf_rta_iteration (initial_state (tsk0 :: ts')))) as [tsk_i' R_i'].
- by simpl in EQtsk; rewrite -EQtsk; subst; apply leq_addr.
- Qed.
-
- (* The application of the function is inductive. *)
- Lemma bertogna_edf_comp_iteration_inductive (P : seq task_with_response_time -> Type) :
- P (initial_state ts) ->
- (forall k, P (f k) -> P (f (k.+1))) ->
- P (f (max_steps ts)).
- Proof.
- by intros P0 Pn; induction (max_steps ts); last by apply Pn.
- Qed.
-
- (* As a last step, we show that edf_rta_iteration preserves order, i.e., for any
- list l1 no smaller than the initial state, and list l2 such that
- l1 <= l2, we have (edf_rta_iteration l1) <= (edf_rta_iteration l2). *)
- Lemma bertogna_edf_comp_iteration_preserves_order :
- forall l1 l2,
- all_le (initial_state ts) l1 ->
- all_le l1 l2 ->
- all_le (edf_rta_iteration l1) (edf_rta_iteration l2).
- Proof.
- rename H_valid_task_parameters into VALID.
- intros x1 x2 LEinit LE.
- move: LE => /andP [/eqP ZIP LE]; unfold all_le.
-
- assert (UNZIP': unzip1 (edf_rta_iteration x1) = unzip1 (edf_rta_iteration x2)).
- {
- by rewrite 2!edf_claimed_bounds_unzip1_update_bound.
- }
-
- apply/andP; split; first by rewrite UNZIP'.
- apply f_equal with (B := nat) (f := fun x => size x) in UNZIP'.
- rename UNZIP' into SIZE.
- rewrite size_map [size (unzip1 _)]size_map in SIZE.
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- destruct x1 as [| p0 x1'], x2 as [| p0' x2']; try (by ins).
- apply/(zipP p0 (fun x y => snd x <= snd y)); first by done.
-
- intros i LTi.
- exploit LE; first by rewrite 2!size_map in SIZE.
- {
- by rewrite size_zip 2!size_map -size_zip in LTi; apply LTi.
- }
- rewrite 2!size_map in SIZE.
- instantiate (1 := p0); intro LEi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map -SIZE minnn in LTi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map SIZE minnn in LTi.
- unfold update_bound, edf_response_time_bound; desf; simpl.
- rename s into tsk_i, s0 into tsk_i', t into R_i, t0 into R_i', Heq into EQ, Heq0 into EQ'.
- assert (EQtsk: tsk_i = tsk_i').
- {
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0']; simpl in H2; subst.
- have MAP := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0) :: x1').
- have MAP' := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0') :: x2').
- assert (FSTeq: fst (nth (tsk0', R0)((tsk0', R0) :: x1') i) =
- fst (nth (tsk0',R0) ((tsk0', R0') :: x2') i)).
- {
- rewrite -MAP;
- last by simpl; rewrite size_zip 2!size_map /= -H0 minnn in LTi.
- rewrite -MAP';
- last by simpl; rewrite size_zip 2!size_map /= H0 minnn in LTi.
- by f_equal; simpl; f_equal.
- }
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ.
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ'.
- by rewrite FSTeq EQ' /= in EQ; rewrite EQ.
- }
- subst tsk_i'; rewrite leq_add2l.
- unfold I, total_interference_bound_edf; apply leq_div2r.
- rewrite 2!big_cons.
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0'].
- simpl in H2; subst tsk0'.
- rename R_i into delta, R_i' into delta'.
- rewrite EQ EQ' in LEi; simpl in LEi.
- rename H0 into SIZE, H1 into UNZIP; clear EQ EQ'.
-
- assert (SUBST: forall l delta,
- \sum_(j <- l | let '(tsk_other, _) := j in
- different_task tsk_i tsk_other)
- (let '(tsk_other, R_other) := j in
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk_i delta
- (tsk_other, R_other)) =
- \sum_(j <- l | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk_i delta j).
- {
- intros l x; clear -l.
- induction l; first by rewrite 2!big_nil.
- by rewrite 2!big_cons; rewrite IHl; desf; rewrite /= Heq in Heq0.
- } rewrite 2!SUBST; clear SUBST.
-
- assert (VALID': valid_sporadic_taskset task_cost task_period task_deadline
- (unzip1 ((tsk0, R0) :: x1'))).
- {
- move: LEinit => /andP [/eqP EQinit _].
- rewrite -EQinit; unfold valid_sporadic_taskset.
- move => tsk /mapP IN. destruct IN as [p INinit EQ]; subst.
- by move: INinit => /mapP INinit; destruct INinit as [tsk INtsk]; subst; apply VALID.
- }
-
- assert (GE_COST: all (fun p => task_cost (fst p) <= snd p) ((tsk0, R0) :: x1')).
- {
- clear LE; move: LEinit => /andP [/eqP UNZIP' LE].
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- specialize (LE (tsk0, R0)).
- apply/(all_nthP (tsk0,R0)).
- intros j LTj; generalize UNZIP'; simpl; intro SIZE'.
- have F := @f_equal _ _ size (unzip1 (initial_state ts)).
- apply F in SIZE'; clear F; rewrite /= 3!size_map in SIZE'.
- exploit LE; [by rewrite size_map /= | |].
- {
- rewrite size_zip size_map /= SIZE' minnn.
- by simpl in LTj; apply LTj.
- }
- clear LE; intro LE.
- unfold initial_state in LE.
- have MAP := @nth_map _ tsk0 _ (tsk0,R0).
- rewrite MAP /= in LE;
- [clear MAP | by rewrite SIZE'; simpl in LTj].
- apply leq_trans with (n := task_cost (nth tsk0 ts j));
- [apply eq_leq; f_equal | by done].
- have MAP := @nth_map _ (tsk0, R0) _ tsk0 (fun x => fst x).
- rewrite -MAP; [clear MAP | by done].
- unfold unzip1 in UNZIP'; rewrite -UNZIP'; f_equal.
- clear -ts; induction ts; [by done | by simpl; f_equal].
- }
- move: GE_COST => /allP GE_COST.
-
- assert (LESUM: \sum_(j <- x1' | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk_i delta j <=
- \sum_(j <- x2' | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk_i delta' j).
- {
- set elem := (tsk0, R0); rewrite 2!(big_nth elem).
- rewrite -SIZE.
- rewrite big_mkcond [\sum_(_ <- _ | different_task _ _)_]big_mkcond.
- rewrite big_seq_cond [\sum_(_ <- _ | true) _]big_seq_cond.
- apply leq_sum; intros j; rewrite andbT; intros INj.
- rewrite mem_iota add0n subn0 in INj; move: INj => /andP [_ INj].
- assert (FSTeq: fst (nth elem x1' j) = fst (nth elem x2' j)).
- {
- have MAP := @nth_map _ elem _ tsk0 (fun x => fst x).
- by rewrite -2?MAP -?SIZE //; f_equal.
- } rewrite -FSTeq.
- destruct (different_task tsk_i (fst (nth elem x1' j))) eqn:INTERF;
- last by done.
- {
- exploit (LE elem); [by rewrite /= SIZE | | intro LEj].
- {
- rewrite size_zip 2!size_map /= -SIZE minnn in LTi.
- by rewrite size_zip /= -SIZE minnn; apply (leq_ltn_trans INj).
- }
- simpl in LEj.
- exploit (VALID' (fst (nth elem x1' j))); last intro VALIDj.
- {
- apply/mapP; exists (nth elem x1' j); last by done.
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- exploit (GE_COST (nth elem x1' j)); last intro GE_COSTj.
- {
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- unfold is_valid_sporadic_task in *.
- destruct (nth elem x1' j) as [tsk_j R_j] eqn:SIMPL1,
- (nth elem x2' j) as [tsk_j' R_j'] eqn:SIMPL2.
- rewrite SIMPL1 SIMPL2 in LEj.
- simpl in FSTeq; rewrite -FSTeq; simpl in LEj; simpl in VALIDj; des.
- by apply interference_bound_edf_monotonic.
- }
- }
- destruct (different_task tsk_i tsk0) eqn:INTERFtsk0; last by done.
- apply leq_add; last by done.
- {
- exploit (LE (tsk0, R0)); [by rewrite /= SIZE | | intro LEj];
- first by instantiate (1 := 0); rewrite size_zip /= -SIZE minnn.
- exploit (VALID' tsk0); first by rewrite in_cons; apply/orP; left.
- exploit (GE_COST (tsk0, R0)); first by rewrite in_cons eq_refl orTb.
- unfold is_valid_sporadic_task; intros GE_COST0 VALID0; des; simpl in LEj.
- by apply interference_bound_edf_monotonic.
- }
- Qed.
-
- (* It follows from the properties above that the iteration is monotonically increasing. *)
- Lemma bertogna_edf_comp_iteration_monotonic: forall k, all_le (f k) (f k.+1).
- Proof.
- unfold f; intros k.
- apply fun_mon_iter_mon_generic with (x1 := k) (x2 := k.+1);
- try (by done);
- [ by apply all_le_reflexive
- | by apply all_le_transitive
- | by apply bertogna_edf_comp_iteration_preserves_order
- | by apply bertogna_edf_comp_iteration_preserves_minimum].
- Qed.
-
- End RelationProperties.
-
- (* Knowing that the iteration is monotonically increasing (with respect to all_le),
- we show that the RTA procedure converges to a fixed point. *)
-
- (* First, note that when there are no tasks, the iteration trivially converges. *)
- Lemma bertogna_edf_comp_f_converges_with_no_tasks :
- size ts = 0 ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- intro SIZE; destruct ts; last by inversion SIZE.
- unfold max_steps; rewrite big_nil /=.
- by unfold edf_rta_iteration.
- Qed.
-
- (* Otherwise, if the iteration reached a fixed point before (max_steps ts), then
- the value at (max_steps ts) is still at a fixed point. *)
- Lemma bertogna_edf_comp_f_converges_early :
- (exists k, k <= max_steps ts /\ f k = f k.+1) ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- by intros EX; des; apply fixedpoint.iter_fix with (k := k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume that there are tasks. *)
- Hypothesis H_at_least_one_task: size ts > 0.
-
- (* Assume that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps ts -> f k != f k.+1.
-
- (* Since the iteration is monotonically increasing, it must be
- strictly increasing. *)
- Lemma bertogna_edf_comp_f_increases :
- forall k,
- k <= max_steps ts -> one_lt (f k) (f k.+1).
- Proof.
- rename H_at_least_one_task into NONEMPTY.
- intros step LEstep; unfold one_lt; apply/andP; split;
- first by rewrite 2!edf_claimed_bounds_unzip1_iteration.
- rewrite -[has _ _]negbK; apply/negP; unfold not; intro ALL.
- rewrite -all_predC in ALL.
- move: ALL => /allP ALL.
- exploit (H_keeps_diverging step); [by done | intro DIFF].
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- }
- des; clear DUMMY.
- move: DIFF => /eqP DIFF; apply DIFF.
- apply eq_from_nth with (x0 := (tsk, 0));
- first by simpl; rewrite size_map.
- {
- intros i LTi.
- remember (nth (tsk, 0)(f step) i) as p_i;rewrite -Heqp_i.
- remember (nth (tsk, 0)(f step.+1) i) as p_i';rewrite -Heqp_i'.
- rename Heqp_i into EQ, Heqp_i' into EQ'.
- exploit (ALL (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- unfold predC; simpl; rewrite -ltnNge; intro LTp.
-
- have GROWS := bertogna_edf_comp_iteration_monotonic step.
- move: GROWS => /andP [_ /allP GROWS].
- exploit (GROWS (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- simpl; intros LE.
- destruct p_i as [tsk_i R_i], p_i' as [tsk_i' R_i'].
- simpl in *.
- assert (EQtsk: tsk_i = tsk_i').
- {
- unfold edf_rta_iteration in EQ'.
- rewrite (nth_map (tsk, 0)) in EQ'; last by done.
- by unfold update_bound in EQ'; desf.
- }
- rewrite EQtsk; f_equal.
- by apply/eqP; rewrite eqn_leq; apply/andP; split.
- }
- Qed.
-
- (* In the end, each response-time bound is so high that the sum
- of all response-time bounds exceeds the sum of all deadlines.
- Contradiction! *)
- Lemma bertogna_edf_comp_rt_grows_too_much :
- forall k,
- k <= max_steps ts ->
- \sum_((tsk, R) <- f k) (R - task_cost tsk) + 1 > k.
- Proof.
- have LT := bertogna_edf_comp_f_increases.
- have MONO := bertogna_edf_comp_iteration_monotonic.
- rename H_at_least_one_task into NONEMPTY.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_valid_task_parameters into VALID.
- intros step LE.
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- } destruct DUMMY as [elem _].
-
- induction step.
- {
- by rewrite addn1.
- }
- {
- rewrite -addn1 ltn_add2r.
- apply leq_ltn_trans with (n := \sum_(i <- f step) (let '(tsk, R) := i in R - task_cost tsk)).
- {
- rewrite -ltnS; rewrite addn1 in IHstep.
- by apply IHstep, ltnW.
- }
- rewrite (eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- rewrite [\sum_(_ <- f step.+1)_](eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- unfold f at 2; rewrite iterS.
- rewrite big_map; fold (f step).
- rewrite -(ltn_add2r (\sum_(i <- f step) task_cost (fst i))).
- rewrite -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun i => snd i)); last first.
- {
- intro i; rewrite andbT; intro IN;
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts step.
- by destruct i; apply GE_COST.
- }
- rewrite [\sum_(_ <- _ | _)(_ - _ + _)](eq_bigr (fun i => snd (update_bound (f step) i))); last first.
- {
- intro i; rewrite andbT; intro IN.
- unfold update_bound; destruct i; simpl.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- apply (edf_claimed_bounds_ge_cost ts step.+1).
- by rewrite iterS; apply/mapP; exists (s, t).
- }
- rewrite -2!big_seq_cond.
-
- specialize (LT step (ltnW LE)).
- specialize (MONO step).
-
- move: LT => /andP [_ LT]; move: LT => /hasP LT.
- destruct LT as [[x1 x2] INzip LT]; simpl in *.
- move: MONO => /andP [_ /(zipP _ (fun x y => snd x <= snd y)) MONO].
- rewrite 2!(big_nth (elem, 0)).
- apply mem_zip_exists with (elem := (elem, 0)) (elem' := (elem, 0)) in INzip; des;
- last by rewrite size_map.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite -addn1 -addnA; apply leq_add.
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0)); [by rewrite size_map | | intro LEi].
- {
- rewrite size_zip; apply (ltn_trans LT2).
- by apply leq_trans with (n := size (f step));
- [by done | by rewrite size_map minnn].
- }
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi;
- last by apply (ltn_trans LT2).
- }
- rewrite -addnA [_ + 1]addnC addnA; apply leq_add.
- {
- unfold edf_rta_iteration in INzip2; rewrite addn1.
- rewrite -> nth_map with (x1 := (elem, 0)) in INzip2; last by done.
- by rewrite -INzip2 -INzip1.
- }
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0));
- [ by rewrite size_map
- | by rewrite size_zip; apply (leq_trans LT2); rewrite size_map minnn | intro LEi ].
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi; last by done.
- }
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove that edf_rta_iteration reaches
- a fixed point after (max_steps ts) step, ... *)
- Lemma edf_claimed_bounds_finds_fixed_point_of_list :
- forall rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- valid_sporadic_taskset task_cost task_period task_deadline ts ->
- f (max_steps ts) = edf_rta_iteration (f (max_steps ts)).
- Proof.
- intros rt_bounds SOME VALID.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- unfold edf_claimed_bounds in SOME; desf.
- rename Heq into LE.
- fold (f (max_steps ts)) in *; fold (f (max_steps ts).+1).
-
- (* Either the task set is empty or not. *)
- destruct (size ts == 0) eqn:EMPTY;
- first by apply bertogna_edf_comp_f_converges_with_no_tasks; apply/eqP.
- apply negbT in EMPTY; rewrite -lt0n in EMPTY.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_((max_steps ts).+1), f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- destruct k as [k LTk]; simpl in ITERk.
- apply bertogna_edf_comp_f_converges_early.
- exists k; split; [by apply LTk | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
-
- assert (SAMESUM: \sum_(tsk <- ts) task_cost tsk = \sum_(p <- f (max_steps ts)) task_cost (fst p)).
- {
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_cost x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- by rewrite UNZIP in MAP; rewrite MAP.
- }
-
- (* Show that the sum is less than the sum of all deadlines. *)
- assert (SUM: \sum_(p <- f (max_steps ts)) (snd p - task_cost (fst p)) + 1 <= max_steps ts).
- {
- unfold max_steps at 2; rewrite leq_add2r.
- rewrite -(leq_add2r (\sum_(tsk <- ts) task_cost tsk)).
- rewrite {1}SAMESUM -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun x => snd x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts (max_steps ts).
- fold (f (max_steps ts)) in GE_COST.
- by destruct i; apply GE_COST.
- }
- rewrite (eq_bigr (fun x => task_deadline x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- by specialize (VALID i IN); des.
- }
- rewrite -2!big_seq_cond.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_deadline x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- rewrite UNZIP in MAP; rewrite MAP.
- rewrite big_seq_cond [\sum_(_ <- _|true)_]big_seq_cond.
- apply leq_sum; intro i; rewrite andbT; intro IN.
- move: LE => /allP LE; unfold jitter_plus_R_le_deadline in LE.
- specialize (LE i IN); destruct i; simpl.
- by apply leq_trans with (n := task_jitter s + s0); first by apply leq_addl.
- }
-
- have TOOMUCH :=
- bertogna_edf_comp_rt_grows_too_much EMPTY _ (max_steps ts) (leqnn (max_steps ts)).
- exploit TOOMUCH; [| intro BUG].
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | by ins].
- }
- rewrite (eq_bigr (fun i => snd i - task_cost (fst i))) in BUG;
- last by ins; destruct i.
- by apply (leq_ltn_trans SUM) in BUG; rewrite ltnn in BUG.
- Qed.
-
- (* ...and since there cannot be a vector of response-time bounds with values less than
- the task costs, this solution is also the least fixed point. *)
- Lemma edf_claimed_bounds_finds_least_fixed_point :
- forall v,
- all_le (initial_state ts) v ->
- v = edf_rta_iteration v ->
- all_le (f (max_steps ts)) v.
- Proof.
- intros v GE0 EQ.
- apply bertogna_edf_comp_iteration_inductive; first by done.
- intros k GEk.
- rewrite EQ.
- apply bertogna_edf_comp_iteration_preserves_order; last by done.
- by apply bertogna_edf_comp_iteration_preserves_minimum.
- Qed.
-
- (* Therefore, with regard to the response-time bound recurrence, ...*)
-
- (* ..., the individual response-time bounds (elements of the list) are also fixed points. *)
- Theorem edf_claimed_bounds_finds_fixed_point_for_each_bound :
- forall tsk R rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R = edf_response_time_bound rt_bounds tsk R.
- Proof.
- intros tsk R rt_bounds SOME IN.
- have CONV := edf_claimed_bounds_finds_fixed_point_of_list rt_bounds.
- rewrite -iterS in CONV; fold (f (max_steps ts).+1) in CONV.
- unfold edf_claimed_bounds in *; desf.
- exploit (CONV); [by done | by done | intro ITER; clear CONV].
- unfold f in ITER.
-
- cut (update_bound (iter (max_steps ts)
- edf_rta_iteration (initial_state ts)) (tsk,R) = (tsk, R)).
- {
- intros EQ.
- have F := @f_equal _ _ (fun x => snd x) _ (tsk, R).
- by apply F in EQ; simpl in EQ.
- }
- set s := iter (max_steps ts) edf_rta_iteration (initial_state ts).
- fold s in ITER, IN.
- move: IN => /(nthP (tsk,0)) IN; destruct IN as [i LT EQ].
- generalize EQ; rewrite ITER iterS in EQ; intro EQ'.
- fold s in EQ.
- unfold edf_rta_iteration in EQ.
- have MAP := @nth_map _ (tsk,0) _ _ (update_bound s).
- by rewrite MAP // EQ' in EQ; rewrite EQ.
- Qed.
-
- (* ..., which in turn implies that the response-time bound is the fixed
- point from Bertogna and Cirinei's equation. *)
- Lemma edf_claimed_bounds_converges :
- forall tsk R rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R = task_cost tsk + div_floor (I rt_bounds tsk R) num_cpus.
- Proof.
- intros tsk R rt_bounds SOME IN.
- have CONV := edf_claimed_bounds_finds_fixed_point_of_list rt_bounds.
- rewrite -iterS in CONV; fold (f (max_steps ts).+1) in CONV.
- unfold edf_claimed_bounds in *; desf.
- exploit (CONV); [by done | by done | intro ITER; clear CONV].
- unfold f in ITER.
-
- cut (update_bound (iter (max_steps ts)
- edf_rta_iteration (initial_state ts)) (tsk,R) = (tsk, R)).
- {
- intros EQ.
- have F := @f_equal _ _ (fun x => snd x) _ (tsk, R).
- by apply F in EQ; simpl in EQ.
- }
- set s := iter (max_steps ts) edf_rta_iteration (initial_state ts).
- fold s in ITER, IN.
- move: IN => /(nthP (tsk,0)) IN; destruct IN as [i LT EQ].
- generalize EQ; rewrite ITER iterS in EQ; intro EQ'.
- fold s in EQ.
- unfold edf_rta_iteration in EQ.
- have MAP := @nth_map _ (tsk,0) _ _ (update_bound s).
- by rewrite MAP // EQ' in EQ; rewrite EQ.
- Qed.
-
- End Convergence.
-
- Section MainProof.
-
- (* Consider a task set ts where... *)
- Variable ts: taskset_of sporadic_task.
-
- (* ...all tasks have valid parameters... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ...and constrained deadlines.*)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Next, consider any arrival sequence such that...*)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...they have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job_with_jitter task_cost task_deadline task_jitter job_cost
- job_deadline job_task job_jitter j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any schedule of this arrival sequence such that... *)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after jitter and no longer than their execution costs. *)
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that jobs are sequential. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assume that we have a work-conserving EDF scheduler. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_edf_policy: respects_JLFP_policy job_arrival job_cost job_jitter arr_seq sched
- (EDF job_arrival job_deadline).
-
- Let no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in edf_claimed_bounds is safe. The proof follows by direct application of
- the main Theorem from bertogna_edf_theory.v. *)
- Theorem edf_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In edf_claimed_bounds ts ->
- response_time_bounded_by tsk (task_jitter tsk + R).
- Proof.
- intros tsk R MATCH.
- assert (SOME: exists rt_bounds, edf_claimed_bounds ts = Some rt_bounds /\ (tsk, R) \in rt_bounds).
- {
- destruct (edf_claimed_bounds ts); last by done.
- by exists l; split.
- } clear MATCH; des.
- unfold edf_rta_iteration in *.
- have BOUND := bertogna_cirinei_response_time_bound_edf.
- unfold response_time_bounded_by, is_response_time_bound_of_task in *.
- intros j JOBtsk.
- apply BOUND with (task_cost := task_cost) (task_period := task_period)
- (arr_seq := arr_seq) (task_deadline := task_deadline) (job_deadline := job_deadline) (job_jitter := job_jitter)
- (job_task := job_task) (ts := ts) (tsk := tsk) (rt_bounds := rt_bounds); try (by ins).
- by unfold edf_claimed_bounds in SOME; desf; rewrite edf_claimed_bounds_unzip1_iteration.
- by ins; apply edf_claimed_bounds_finds_fixed_point_for_each_bound with (ts := ts).
- by ins; rewrite (edf_claimed_bounds_le_deadline ts rt_bounds).
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: edf_schedulable ts.
-
- (*... no task misses its deadline. *)
- Theorem taskset_schedulable_by_edf_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (edf_analysis_yields_response_time_bounds).
- have DL := (edf_claimed_bounds_le_deadline ts).
- have HAS := (edf_claimed_bounds_has_R_for_every_task ts).
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- edf_schedulable,
- valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS,
- H_valid_task_parameters into TASKPARAMS,
- H_constrained_deadlines into RESTR,
- H_completed_jobs_dont_execute into COMP,
- H_jobs_execute_after_jitter into AFTER,
- H_all_jobs_from_taskset into ALLJOBS,
- H_test_succeeds into TEST.
- move => tsk INtsk j ARRj JOBtsk.
- destruct (edf_claimed_bounds ts) as [rt_bounds |] eqn:SOME; last by ins.
- exploit (HAS rt_bounds tsk); [by ins | by ins | clear HAS; intro HAS; des].
- have COMPLETED := RLIST tsk R HAS j ARRj JOBtsk.
- exploit (DL rt_bounds tsk R);
- [by ins | by ins | clear DL; intro DL].
- apply leq_trans with (n := service sched j (job_arrival j + task_jitter tsk + R)); last first.
- {
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rewrite extend_sum // -addnA leq_add2l.
- specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS2.
- by rewrite JOBtsk.
- }
- by rewrite -addnA.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we conclude that no job misses
- its deadline. *)
- Theorem jobs_schedulable_by_edf_rta :
- forall j, arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_edf_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationEDF.
diff --git a/classic/analysis/global/jitter/bertogna_edf_theory.v b/classic/analysis/global/jitter/bertogna_edf_theory.v
deleted file mode 100644
index dcbf04c18afac9239d0473e1e91e39e4de7e08a7..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/bertogna_edf_theory.v
+++ /dev/null
@@ -1,870 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.schedulability
- prosa.classic.model.schedule.global.response_time.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.platform prosa.classic.model.schedule.global.jitter.interference
- prosa.classic.model.schedule.global.jitter.constrained_deadlines.
-Require Import prosa.classic.analysis.global.jitter.workload_bound
- prosa.classic.analysis.global.jitter.interference_bound_edf.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisEDFJitter.
-
- Export JobWithJitter SporadicTaskset ScheduleOfSporadicTaskWithJitter Workload
- Schedulability ResponseTime Priority TaskArrival WorkloadBoundJitter
- InterferenceBoundEDFJitter Platform Interference ConstrainedDeadlines.
-
- (* In this section, we prove that any fixed point in Bertogna and
- Cirinei's RTA for EDF scheduling modified to account for jitter
- yields a safe response-time bound. This is an extension of the
- analysis found in Chapter 17.1.2 of Baruah et al.'s book
- Multiprocessor Scheduling for Real-time Systems. *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Assume any job arrival sequence... *)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ... in which jobs arrive sporadically and have valid parameters.
- Note: the jitter of a valid job is bounded by the jitter of its task. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job_with_jitter task_cost task_deadline task_jitter job_cost
- job_deadline job_task job_jitter j.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
-
- (* Next, consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs are sequential, do not execute before the
- jitter has passed and nor longer than their execution costs. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that there exists at least one processor. *)
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Assume that the schedule is a work-conserving EDF schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_edf_policy: respects_JLFP_policy job_arrival job_cost job_jitter arr_seq sched
- (EDF job_arrival job_deadline).
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Next we consider the response-time recurrence.
- Assume that a response-time bound R is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable rt_bounds: seq task_with_response_time.
-
- (* ...for any task in the task set, ... *)
- Hypothesis H_rt_bounds_contains_all_tasks: unzip1 rt_bounds = ts.
-
- (* Also, assume that R is a fixed-point of the response-time recurrence, ... *)
- Let I (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline task_jitter tsk rt_bounds delta.
- Hypothesis H_response_time_is_fixed_point :
- forall tsk R,
- (tsk, R) \in rt_bounds ->
- R = task_cost tsk + div_floor (I tsk R) num_cpus.
-
- (* ..., and R is no larger than the deadline. *)
- Hypothesis H_tasks_miss_no_deadlines:
- forall tsk R,
- (tsk, R) \in rt_bounds ->
- task_jitter tsk + R <= task_deadline tsk.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Let t1 be the first point in time where j can actually be scheduled. *)
- Let t1 := job_arrival j + job_jitter j.
-
- (* Assume that job j did not complete on time, ... *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (t1 + R).
-
- (* ...and that it is the first job not to satisfy its response-time bound. *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_other tsk_other R_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- (tsk_other, R_other) \in rt_bounds ->
- job_arrival j_other + task_jitter tsk_other + R_other < job_arrival j + task_jitter tsk + R ->
- completed job_cost sched j_other (job_arrival j_other + task_jitter tsk_other + R_other).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task job_jitter sched j tsk_other t1 (t1 + R).
-
- (* and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost job_jitter sched j t1 (t1 + R).
-
- (* Recall Bertogna and Cirinei's workload bound ... *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W_jitter task_cost task_period task_jitter tsk_other R_other R.
-
- (*... and the EDF-specific bound, ... *)
- Let edf_specific_bound (tsk_other: sporadic_task) (R_other: time) :=
- edf_specific_interference_bound task_cost task_period task_deadline task_jitter tsk tsk_other R_other.
-
- (* ... which combined form the interference bound. *)
- Let interference_bound (tsk_other: sporadic_task) (R_other: time) :=
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk R (tsk_other, R_other).
-
- (* Based on the definition of a different task, ... *)
- Let other_task := different_task tsk.
-
- (* ...let other_tasks denote the set of tasks that are different from tsk. *)
- Let other_tasks :=
- [seq tsk_other <- ts | other_task tsk_other].
-
- (* Now we establish results the interfering tasks. *)
- Section LemmasAboutInterferingTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task and
- response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_response_time_of_tsk_other: (tsk_other, R_other) \in rt_bounds.
-
- (* Note that tsk_other is in task set ts ...*)
- Lemma bertogna_edf_tsk_other_in_ts: tsk_other \in ts.
- Proof.
- by rewrite set_mem -H_rt_bounds_contains_all_tasks; apply/mapP; exists (tsk_other, R_other).
- Qed.
-
- (* Also, R_other is larger than the cost of tsk_other. *)
- Lemma bertogna_edf_R_other_ge_cost :
- R_other >= task_cost tsk_other.
- Proof.
- by rewrite [R_other](H_response_time_is_fixed_point tsk_other);
- first by apply leq_addr.
- Qed.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_edf_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_all_previous_jobs_completed_on_time into BEFOREok,
- H_valid_job_parameters into PARAMS,
- H_valid_task_parameters into TASK_PARAMS,
- H_constrained_deadlines into RESTR,
- H_tasks_miss_no_deadlines into NOMISS.
- unfold x, task_interference, valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- have INts := bertogna_edf_tsk_other_in_ts.
- apply leq_trans with (n := workload job_task sched tsk_other t1 (t1 + R));
- first by apply task_interference_le_workload.
- have BOUND := workload_bounded_by_W task_cost task_period task_deadline task_jitter
- job_arrival job_cost job_task job_deadline job_jitter arr_seq _ sched.
- apply BOUND; try (by done); last 2 first;
- [ by apply NOMISS |
- | by ins; apply TASK_PARAMS
- | by apply RESTR
- | by apply bertogna_edf_R_other_ge_cost].
- {
- intros j0 ARR0 JOB0 LT0; apply BEFOREok; try (by done).
- unfold t1 in *.
- apply leq_trans with (n := job_arrival j + job_jitter j + R); first by done.
- rewrite leq_add2r leq_add2l.
- specialize (PARAMS j H_j_arrives); des.
- rewrite -H_job_of_tsk; apply PARAMS0.
- }
- Qed.
-
- (* Recall that the edf-specific interference bound also holds. *)
- Lemma bertogna_edf_specific_bound_holds :
- x tsk_other <= edf_specific_bound tsk_other R_other.
- Proof.
- by ( try ( apply interference_bound_edf_bounds_interference with (job_deadline0 := job_deadline)
- (arr_seq0 := arr_seq) (ts0 := ts) ) ||
- apply interference_bound_edf_bounds_interference with (job_deadline := job_deadline)
- (arr_seq := arr_seq) (ts := ts)); try (by done);
- [ by apply bertogna_edf_tsk_other_in_ts
- | by apply H_tasks_miss_no_deadlines
- | by ins; apply H_all_previous_jobs_completed_on_time with (tsk_other := tsk_other)].
- Qed.
-
- End LemmasAboutInterferingTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X >= R - e_k + 1. *)
- Lemma bertogna_edf_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS, H_response_time_is_fixed_point into REC,
- H_job_of_tsk into JOBtsk, H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite [R](REC tsk) // leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
- apply leq_ltn_trans with (n := (\sum_(t1 <= t < t1 + R)
- backlogged job_arrival job_cost job_jitter sched j t) +
- service sched j (t1 + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_j_arrives); des; rewrite -JOBtsk.
- }
- unfold service.
- rewrite -> big_cat_nat with (n := t1) (m := 0); rewrite ?leq_addr // /=.
- rewrite (cumulative_service_before_jitter_zero job_arrival job_jitter) // add0n.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(t1 <= i < t1 + R) 1);
- first by simpl_sum_const; rewrite addKn.
- apply leq_sum_nat; move => i /andP [GEi LTi] _.
- destruct (backlogged job_arrival job_cost job_jitter sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* 1) Next, we prove that during the scheduling window of j, any job that is
- scheduled while j is backlogged comes from a different task.
- This follows from the fact that j is the first job not to complete
- by its response-time bound, so previous jobs of j's task must have
- completed by their periods and cannot be pending. *)
- Lemma bertogna_edf_interference_by_different_tasks :
- forall t j_other,
- t1 <= t < t1 + R ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- scheduled sched j_other t ->
- job_task j_other != tsk.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_valid_job_parameters into JOBPARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_constrained_deadlines into CONSTR.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- move => t j_other /andP [LEt GEt] BACK SCHED.
- apply/eqP; red; intro SAMEtsk.
- move: SCHED => /existsP [cpu SCHED].
- have SCHED': scheduled sched j_other t by apply/existsP; exists cpu.
- clear SCHED; rename SCHED' into SCHED.
- have ARRother: arrives_in arr_seq j_other.
- by apply (H_jobs_come_from_arrival_sequence j_other t).
- move: (SCHED) => PENDING.
- ( try ( apply scheduled_implies_pending with (job_cost0 := job_cost) (job_jitter0 := job_jitter)
- (job_arrival0 := job_arrival) in PENDING ) ||
- apply scheduled_implies_pending with (job_cost := job_cost) (job_jitter := job_jitter)
- (job_arrival := job_arrival) in PENDING); try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- move: (BEFOREother) => LT; rewrite -(ltn_add2r R) in LT.
- exploit (BEFOREok j_other tsk R ARRother SAMEtsk INbounds).
- {
- rewrite -addnA [_ + R]addnC addnA -[(_ + _) + R]addnA [_ tsk + R]addnC addnA.
- by rewrite ltn_add2r.
- }
- intros COMP.
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- ( try ( apply completion_monotonic with (t0 := job_arrival j_other + task_jitter tsk + R) ) ||
- apply completion_monotonic with (t := job_arrival j_other + task_jitter tsk + R));
- try by done.
- apply leq_trans with (n := job_arrival j);
- last by apply leq_trans with (n := t1); [by apply leq_addr | by done].
- apply leq_trans with (n := job_arrival j_other + task_period tsk).
- {
- rewrite -addnA leq_add2l.
- by apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by apply CONSTR; rewrite -JOBtsk FROMTS].
- }
- rewrite -SAMEtsk; apply SPO; [ | by done | by done| by rewrite JOBtsk | by apply ltnW].
- by red; intro EQ; subst; rewrite ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge JOBtsk.
- apply leq_trans with (n := job_arrival j + task_deadline tsk);
- last by rewrite leq_add2l; apply CONSTR; rewrite -JOBtsk FROMTS.
- apply leq_trans with (n := job_arrival j + task_jitter tsk + R);
- last by rewrite -addnA leq_add2l; apply NOMISS.
- apply leq_trans with (n := t1 + R); last first.
- {
- rewrite leq_add2r leq_add2l -JOBtsk.
- by specialize (JOBPARAMS j H_j_arrives); des.
- }
- apply leq_ltn_trans with (n := job_arrival j_other + job_jitter j_other);
- first by apply leq_addr.
- by apply leq_ltn_trans with (n := t).
- }
- by intros EQtsk; subst j_other; rewrite /backlogged SCHED andbF in BACK.
- }
- Qed.
-
- (* 2) In order to use the lemmas in constrained_deadlines.v, we show that
- all jobs released before the end of the interval complete by their
- periods. This follows trivially from the hypothesis that all jobs
- before (t1 + R) complete by their response-time bounds.
- With this lemma, we can conclude that during job j's scheduling
- window there cannot be multiple pending jobs of each task.*)
- Lemma bertogna_edf_all_previous_jobs_complete_by_their_period:
- forall t j0,
- t < t1 + R ->
- arrives_in arr_seq j0 ->
- job_arrival j0 + task_period (job_task j0) <= t ->
- completed job_cost sched j0
- (job_arrival j0 + task_period (job_task j0)).
- Proof.
- rename H_valid_job_parameters into JOBPARAMS,
- H_rt_bounds_contains_all_tasks into UNZIP,
- H_job_of_tsk into JOBtsk,
- H_constrained_deadlines into CONSTR,
- H_tasks_miss_no_deadlines into NOMISS,
- H_all_jobs_from_taskset into FROMTS,
- H_all_previous_jobs_completed_on_time into BEFOREok.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- intros t j0 LEt ARR0 LE.
- cut ((job_task j0) \in unzip1 rt_bounds = true); last by rewrite UNZIP FROMTS.
- move => /mapP [p IN EQ]; destruct p as [tsk' R0]; simpl in *; subst tsk'.
- try ( apply completion_monotonic with (t0 := job_arrival j0 + task_jitter (job_task j0) + R0) ) ||
- apply completion_monotonic with (t := job_arrival j0 + task_jitter (job_task j0) + R0).
- {
- rewrite -addnA leq_add2l.
- apply leq_trans with (n := task_deadline (job_task j0));
- [by apply NOMISS | by apply CONSTR; rewrite FROMTS].
- }
- apply BEFOREok with (tsk_other := (job_task j0)); try by done.
- apply leq_ltn_trans with (n := t); last first.
- {
- apply leq_trans with (n := t1 + R); first by done.
- rewrite leq_add2r leq_add2l -JOBtsk.
- by specialize (JOBPARAMS j H_j_arrives); des.
- }
- apply leq_trans with (n := job_arrival j0 + task_period (job_task j0)); last by done.
- by rewrite -addnA leq_add2l; apply leq_trans with (n := task_deadline (job_task j0));
- [by apply NOMISS | apply CONSTR; rewrite FROMTS].
- Qed.
-
-
- (* Let's define a predicate to identify the other tasks that are scheduled. *)
- Let other_scheduled_task (t: time) (tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- other_task tsk_other.
-
- (* 3) Now we prove that, at all times that j is backlogged, the number
- of tasks other than tsk that are scheduled is exactly the number
- of processors in the system. This is required to prove lemma (4). *)
- Lemma bertogna_edf_all_cpus_are_busy:
- forall t,
- t1 <= t < t1 + R ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- count (other_scheduled_task t) ts = num_cpus.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_valid_job_parameters into JOBPARAMS,
- H_job_of_tsk into JOBtsk, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_sporadic_tasks into SPO,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into RESTR,
- H_work_conserving into WORK.
- unfold x, X, total_interference, task_interference,
- valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- move => t /andP [LEt LTt] BACK.
- have PLAT := platform_cpus_busy_with_interfering_tasks task_cost task_period task_deadline
- job_arrival job_cost job_task job_jitter arr_seq sched FROMSEQ WORK.
- apply PLAT with (j := j); try (by done);
- [by apply PARAMS; rewrite -JOBtsk; apply FROMTS | clear PLAT].
- intros j0 tsk0 ARR0 TSK0 LE.
- cut (tsk0 \in unzip1 rt_bounds = true); last by rewrite UNZIP -TSK0 FROMTS //.
- move => /mapP [p IN EQ]; destruct p as [tsk' R0]; simpl in *; subst tsk'.
- try ( apply completion_monotonic with (t0 := job_arrival j0 + task_jitter tsk0 + R0); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j0 + task_jitter tsk0 + R0); try (by done).
- {
- rewrite -addnA leq_add2l TSK0.
- apply leq_trans with (n := task_deadline tsk0); first by apply NOMISS.
- by apply RESTR; rewrite -TSK0 FROMTS.
- }
- {
- apply BEFOREok with (tsk_other := tsk0); try (by done).
- apply leq_trans with (n := t1 + R);
- last by rewrite leq_add2r leq_add2l -JOBtsk; specialize (JOBPARAMS j H_j_arrives); des.
- apply leq_ltn_trans with (n := t); last by done.
- apply leq_trans with (n := job_arrival j0 + task_period tsk0); last by done.
- rewrite -addnA leq_add2l.
- apply leq_trans with (n := task_deadline tsk0); first by apply NOMISS.
- by apply RESTR; rewrite -TSK0; apply FROMTS.
- }
- Qed.
-
- (* 4) Next, we prove that the sum of the interference of each task is equal
- to the total interference multiplied by the number of processors. This
- holds because interference only occurs when all processors are busy.
- With this lemma we can relate per-task interference with the total
- interference incurred by j (backlogged time). *)
- Lemma bertogna_edf_interference_on_all_cpus :
- \sum_(tsk_k <- other_tasks) x tsk_k = X * num_cpus.
- Proof.
- have DIFFTASK := bertogna_edf_interference_by_different_tasks.
- rename H_all_jobs_from_taskset into FROMTS, H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS, H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into CONSTR.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK;
- last by rewrite big1 //; ins; rewrite big1.
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus) 1); last by simpl_sum_const.
- apply eq_bigr; intros cpu _.
- move: (WORK j t H_j_arrives BACK cpu) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- have ARRother: arrives_in arr_seq j_other.
- by apply (FROMSEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- simpl_sum_const; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- apply DIFFTASK with (t := t); [by auto | by done |].
- by apply/existsP; exists cpu; apply/eqP.
- Qed.
-
- (* Before stating the next lemma, let (num_tasks_exceeding delta) be the
- number of interfering tasks whose interference x is larger than delta. *)
- Let num_tasks_exceeding delta := count (fun i => x i >= delta) (other_tasks).
-
- (* 5) Now we prove that, for any delta, if (num_task_exceeding delta > 0), then the
- cumulative interference caused by the complementary set of interfering tasks fills
- the remaining, not-completely-full (num_cpus - num_tasks_exceeding delta)
- processors. *)
- Lemma bertogna_edf_interference_in_non_full_processors :
- forall delta,
- 0 < num_tasks_exceeding delta < num_cpus ->
- \sum_(i <- other_tasks | x i < delta) x i >= delta * (num_cpus - num_tasks_exceeding delta).
- Proof.
- have COMP := bertogna_edf_all_previous_jobs_complete_by_their_period.
- have INV := bertogna_edf_all_cpus_are_busy.
- rename H_all_jobs_from_taskset into FROMTS, H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_tsk_R_in_rt_bounds into INbounds, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_constrained_deadlines into CONSTR, H_sequential_jobs into SEQ.
- unfold sporadic_task_model in *.
- move => delta /andP [HAS LT].
- rewrite -has_count in HAS.
-
- set some_interference_A := fun t =>
- has (fun tsk_k => backlogged job_arrival job_cost job_jitter sched j t &&
- (x tsk_k >= delta) &&
- task_is_scheduled job_task sched tsk_k t) other_tasks.
- set total_interference_B := fun t =>
- backlogged job_arrival job_cost job_jitter sched j t *
- count (fun tsk_k => (x tsk_k < delta) &&
- task_is_scheduled job_task sched tsk_k t) other_tasks.
-
- apply leq_trans with ((\sum_(t1 <= t < t1 + R)
- some_interference_A t) * (num_cpus - num_tasks_exceeding delta)).
- {
- rewrite leq_mul2r; apply/orP; right.
- move: HAS => /hasP HAS; destruct HAS as [tsk_a INa LEa].
- apply leq_trans with (n := x tsk_a); first by apply LEa.
- unfold x, task_interference, some_interference_A.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK;
- last by rewrite (eq_bigr (fun x => 0)); [by simpl_sum_const | by ins].
- destruct ([exists cpu, task_scheduled_on job_task sched tsk_a cpu t]) eqn:SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED; move: SCHED => /forallP ALL.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (ALL cpu); apply negbTE in ALL; rewrite ALL.
- }
- move: SCHED => /existsP [cpu SCHED].
- apply leq_trans with (n := 1); last first.
- {
- rewrite lt0b; apply/hasP; exists tsk_a; first by done.
- by rewrite LEa 2!andTb; apply/existsP; exists cpu.
- }
- rewrite (bigD1 cpu) /= // SCHED.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const; rewrite leq_b1.
- intros cpu' DIFF.
- apply/eqP; rewrite eqb0; apply/negP.
- intros SCHED'.
- move: DIFF => /negP DIFF; apply DIFF; apply/eqP.
- unfold task_scheduled_on in *.
- destruct (sched cpu t) as [j1|] eqn:SCHED1; last by done.
- destruct (sched cpu' t) as [j2|] eqn:SCHED2; last by done.
- move: SCHED SCHED' => /eqP JOB /eqP JOB'.
- subst tsk_a; symmetry in JOB'.
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu'; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost job_jitter sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu; apply/eqP.
- }
- assert (PENDING2: pending job_arrival job_cost job_jitter sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu'; apply/eqP.
- }
- assert (BUG: j1 = j2).
- {
- ( try ( apply platform_at_most_one_pending_job_of_each_task with (task_cost0 := task_cost)
- (job_jitter0 := job_jitter) (task_period0 := task_period) (job_cost0 := job_cost)
- (task_deadline0 := task_deadline) (tsk0 := tsk) (job_task0 := job_task)
- (sched0 := sched) (job_arrival0 := job_arrival) (arr_seq0 := arr_seq)
- (j0 := j) (t0 := t) ) ||
- apply platform_at_most_one_pending_job_of_each_task with (task_cost := task_cost)
- (job_jitter := job_jitter) (task_period := task_period) (job_cost := job_cost)
- (task_deadline := task_deadline) (tsk := tsk) (job_task := job_task)
- (sched := sched) (job_arrival := job_arrival) (arr_seq := arr_seq)
- (j := j) (t := t));
- rewrite ?JOBtsk ?SAMEtsk //; first by apply PARAMS; rewrite -JOBtsk FROMTS.
- by intros j0 tsk0 ARR0 TSK0 LE; apply (COMP t); rewrite ?TSK0.
- }
- by subst j2; apply SEQ with (j := j1) (t := t).
- }
-
- apply leq_trans with (\sum_(t1 <= t < t1 + R) total_interference_B t).
- {
- rewrite big_distrl /=.
- apply leq_sum_nat; move => t LEt _.
- unfold some_interference_A, total_interference_B.
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK;
- [rewrite mul1n /= | by rewrite has_pred0 //].
-
- destruct (has (fun tsk_k : sporadic_task => (delta <= x tsk_k) &&
- task_is_scheduled job_task sched tsk_k t) other_tasks) eqn:HAS';
- last by done.
- rewrite mul1n; move: HAS => /hasP [tsk_k INk LEk].
- unfold num_tasks_exceeding.
- apply leq_trans with (n := num_cpus -
- count (fun i => (x i >= delta) &&
- task_is_scheduled job_task sched i t) other_tasks).
- {
- apply leq_sub2l.
- rewrite -2!sum1_count big_mkcond /=.
- rewrite [\sum_(_ <- _ | _ <= _)_]big_mkcond /=.
- apply leq_sum; intros i _.
- by destruct (task_is_scheduled job_task sched i t);
- [by rewrite andbT | by rewrite andbF].
- }
- rewrite -count_filter -[count _ other_tasks]count_filter.
- eapply leq_trans with (n := count (predC (fun tsk => delta <= x tsk)) _);
- last by apply eq_leq, eq_in_count; red; ins; rewrite ltnNge.
- rewrite leq_subLR count_predC size_filter.
- by apply leq_trans with (n := count (other_scheduled_task t) ts);
- [by rewrite INV | by rewrite count_filter].
- }
- {
- unfold x at 2, total_interference_B.
- rewrite exchange_big /=; apply leq_sum; intros t _.
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK; last by ins.
- rewrite mul1n -sum1_count.
- rewrite big_mkcond [\sum_(i <- other_tasks | _ < _) _]big_mkcond /=.
- apply leq_sum_seq; move => tsk_k IN _.
- destruct (x tsk_k < delta); [rewrite andTb | by rewrite andFb].
- destruct (task_is_scheduled job_task sched tsk_k t) eqn:SCHED; last by done.
- move: SCHED => /existsP [cpu SCHED].
- by rewrite (bigD1 cpu) /= // SCHED.
- }
- Qed.
-
- (* 6) Based on lemma (5), we prove that, for any interval delta, if the sum of per-task
- interference exceeds (delta * num_cpus), the same applies for the
- sum of the minimum of the interference and delta. *)
- Lemma bertogna_edf_minimum_exceeds_interference :
- forall delta,
- \sum_(tsk_k <- other_tasks) x tsk_k >= delta * num_cpus ->
- \sum_(tsk_k <- other_tasks) minn (x tsk_k) delta >=
- delta * num_cpus.
- Proof.
- intros delta SUMLESS.
- set more_interf := fun tsk_k => x tsk_k >= delta.
- rewrite [\sum_(_ <- _) minn _ _](bigID more_interf) /=.
- unfold more_interf, minn.
- rewrite [\sum_(_ <- _ | delta <= _)_](eq_bigr (fun i => delta));
- last by intros i COND; rewrite leqNgt in COND; destruct (delta > x i).
- rewrite [\sum_(_ <- _ | ~~_)_](eq_big (fun i => x i < delta)
- (fun i => x i));
- [| by red; ins; rewrite ltnNge
- | by intros i COND; rewrite -ltnNge in COND; rewrite COND].
-
- (* Case 1: num_tasks_exceeding = 0 *)
- destruct (~~ has (fun i => delta <= x i) other_tasks) eqn:HASa.
- {
- rewrite [\sum_(_ <- _ | _ <= _) _]big_hasC; last by apply HASa.
- rewrite big_seq_cond; move: HASa => /hasPn HASa.
- rewrite add0n (eq_bigl (fun i => (i \in other_tasks) && true));
- last by red; intros tsk_k; destruct (tsk_k \in other_tasks) eqn:INk;
- [by rewrite andTb ltnNge; apply HASa | by rewrite andFb].
- by rewrite -big_seq_cond.
- } apply negbFE in HASa.
-
- (* Case 2: num_tasks_exceeding >= num_cpus *)
- destruct (num_tasks_exceeding delta >= num_cpus) eqn:CARD.
- {
- apply leq_trans with (delta * num_tasks_exceeding delta);
- first by rewrite leq_mul2l; apply/orP; right.
- unfold num_tasks_exceeding; rewrite -sum1_count big_distrr /=.
- rewrite -[\sum_(_ <- _ | _) _]addn0.
- by apply leq_add; [by apply leq_sum; ins; rewrite muln1|by ins].
- } apply negbT in CARD; rewrite -ltnNge in CARD.
-
- (* Case 3: num_tasks_exceeding < num_cpus *)
- rewrite big_const_seq iter_addn addn0; fold num_tasks_exceeding.
- apply leq_trans with (n := delta * num_tasks_exceeding delta +
- delta * (num_cpus - num_tasks_exceeding delta));
- first by rewrite -mulnDr subnKC //; apply ltnW.
- rewrite leq_add2l; apply bertogna_edf_interference_in_non_full_processors.
- by apply/andP; split; first by rewrite -has_count.
- Qed.
-
- (* 7) Next, using lemmas (0), (4) and (6) we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_edf_sum_exceeds_total_interference:
- \sum_((tsk_other, R_other) <- rt_bounds | other_task tsk_other)
- minn (x tsk_other) (R - task_cost tsk + 1) > I tsk R.
- Proof.
- have GE_COST := bertogna_edf_R_other_ge_cost.
- have EXCEEDS := bertogna_edf_minimum_exceeds_interference.
- have ALLBUSY := bertogna_edf_interference_on_all_cpus.
- have TOOMUCH := bertogna_edf_too_much_interference.
- rename H_rt_bounds_contains_all_tasks into UNZIP,
- H_response_time_is_fixed_point into REC.
- apply leq_trans with (n := \sum_(tsk_other <- other_tasks) minn (x tsk_other) (R - task_cost tsk + 1));
- last first.
- {
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- move: UNZIP => UNZIP.
- assert (FILTER: filter other_task (unzip1 rt_bounds) =
- filter other_task ts).
- by f_equal.
- unfold other_tasks; rewrite -FILTER; clear FILTER.
- rewrite -[\sum_(_ <- rt_bounds | _)_]big_filter.
- assert (SUBST: [seq i <- rt_bounds
- | let '(tsk_other, _) := i in other_task tsk_other] =
- [seq i <- rt_bounds | other_task (fst i)]).
- {
- by apply eq_filter; red; intro i; destruct i.
- } rewrite SUBST; clear SUBST.
- have MAP := big_map (fun x => fst x) (fun i => true) (fun i => minn (x i) (R - task_cost tsk + 1)).
- by rewrite -MAP; apply eq_leq; f_equal; rewrite filter_map.
- }
-
- apply ltn_div_trunc with (d := num_cpus); first by apply H_at_least_one_cpu.
- rewrite -(ltn_add2l (task_cost tsk)) -REC; last by done.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by apply GE_COST.
- rewrite leq_divRL; last by apply H_at_least_one_cpu.
- apply EXCEEDS.
- apply leq_trans with (n := X * num_cpus); last by rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 8) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k, I_edf, R - e_i + 1).
- This implies that either x_k > W_k or x_k > I_edf, which is a contradiction,
- since both W_k and I_edf are valid task interference bounds. *)
- Lemma bertogna_edf_exists_task_that_exceeds_bound :
- exists tsk_other R_other,
- (tsk_other, R_other) \in rt_bounds /\
- (minn (x tsk_other) (R - task_cost tsk + 1) > interference_bound tsk_other R_other).
- Proof.
- have SUM := bertogna_edf_sum_exceeds_total_interference.
- have BOUND := bertogna_edf_workload_bounds_interference.
- have EDFBOUND := bertogna_edf_specific_bound_holds.
- rename H_rt_bounds_contains_all_tasks into UNZIP.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_other, R_other) := tup in
- (tsk_other \in ts) && other_task tsk_other &&
- (minn (x tsk_other) (R - task_cost tsk + 1) >
- interference_bound tsk_other R_other))
- rt_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- unfold I, total_interference_bound_edf.
- rewrite big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => tsk_k /andP [INBOUNDSk INTERFk]; destruct tsk_k as [tsk_k R_k].
- specialize (ALL (tsk_k, R_k) INBOUNDSk).
- unfold interference_bound_edf; simpl in *.
- rewrite leq_min; apply/andP; split.
- {
- unfold interference_bound; rewrite leq_min; apply/andP; split;
- last by rewrite geq_minr.
- by apply leq_trans with (n := x tsk_k);
- [by rewrite geq_minl | by apply BOUND].
- }
- {
- apply leq_trans with (n := x tsk_k); first by rewrite geq_minl.
- by apply EDFBOUND.
- }
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MIN].
- move: MIN => /andP [/andP [INts INTERFk] MINk].
- by exists tsk_k, R_k; repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- Section MainProof.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Using the lemmas above, we prove that R bounds the response time of task tsk. *)
- Theorem bertogna_cirinei_response_time_bound_edf :
- response_time_bounded_by tsk (task_jitter tsk + R).
- Proof.
- have EXISTS := bertogna_edf_exists_task_that_exceeds_bound.
- have BASICBOUND := bertogna_edf_workload_bounds_interference.
- have EDFBOUND := bertogna_edf_specific_bound_holds.
- rename H_valid_job_parameters into JOBPARAMS.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- intros j ARRj JOBtsk.
-
- rewrite addnA.
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + task_jitter tsk + R) as ctime.
-
- revert H_tsk_R_in_rt_bounds.
- generalize dependent R; generalize dependent tsk; generalize dependent j.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj tsk' JOBtsk R' EQc INbounds; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0 tsk R0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- (tsk, R0) \in rt_bounds ->
- job_arrival j0 + task_jitter tsk + R0 < job_arrival j + task_jitter tsk' + R' ->
- service sched j0 (job_arrival j0 + task_jitter tsk + R0) >= job_cost j0).
- {
- by ins; apply IH with (tsk := tsk0) (R := R0).
- }
- clear IH.
-
- (* The proof follows by contradiction. Assume that job j does not complete by its
- response-time bound. By the induction hypothesis, all jobs with absolute
- response-time bound t < (job_arrival j + R) have correct response-time bounds. *)
- destruct (completed job_cost sched j (job_arrival j + job_jitter j + R')) eqn:NOTCOMP.
- {
- apply completion_monotonic with (t := job_arrival j + job_jitter j + R'); try (by done).
- rewrite leq_add2r leq_add2l.
- specialize (JOBPARAMS j ARRj); des.
- by rewrite -JOBtsk; apply JOBPARAMS0.
- }
- apply negbT in NOTCOMP; exfalso.
-
- (* Next, we derive a contradiction using the previous lemmas. *)
- exploit (EXISTS tsk' R' INbounds j ARRj JOBtsk NOTCOMP).
- {
- by ins; apply IH with (tsk := tsk_other) (R := R_other).
- }
- intro EX; destruct EX as [tsk_other [R_other [HP LTmin]]].
- unfold interference_bound_edf, interference_bound_generic in LTmin.
- rewrite minnAC in LTmin; apply min_lt_same in LTmin.
- specialize (BASICBOUND tsk' R' j ARRj JOBtsk BEFOREok tsk_other R_other HP).
- specialize (EDFBOUND tsk' R' j ARRj JOBtsk BEFOREok tsk_other R_other HP).
- unfold minn in LTmin; clear -LTmin HP BASICBOUND EDFBOUND tsk; desf.
- {
- by apply (leq_ltn_trans BASICBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- {
- by apply (leq_ltn_trans EDFBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- Qed.
-
- End MainProof.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisEDFJitter.
diff --git a/classic/analysis/global/jitter/bertogna_fp_comp.v b/classic/analysis/global/jitter/bertogna_fp_comp.v
deleted file mode 100644
index 3982a2438da4a15d6922afbdf58f8191bb4d0c3b..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/bertogna_fp_comp.v
+++ /dev/null
@@ -1,731 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.global.jitter.bertogna_fp_theory.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationFP.
-
- Import ResponseTimeAnalysisFP.
-
- (* In this section, we define the algorithm of Bertogna and Cirinei's
- response-time analysis for FP scheduling with release jitter. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- (* During the iterations of the algorithm, we pass around pairs
- of tasks and computed response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Consider a platform with num_cpus processors, ... *)
- Variable num_cpus: nat.
-
- (* ..., and priorities based on an FP policy. *)
- Variable higher_priority: FP_policy sporadic_task.
-
- (* Next we define the fixed-point iteration for computing
- Bertogna's response-time bound of a task set. *)
-
- (* First, given a sequence of pairs R_prev = <..., (tsk_hp, R_hp)> of
- response-time bounds for the higher-priority tasks, we define an
- iteration that computes the response-time bound of the current task:
-
- R_tsk (0) = task_cost tsk
- R_tsk (step + 1) = f (R step),
-
- where f is the response-time recurrence, step is the number of iterations,
- and R_tsk (0) is the initial state. *)
- Definition per_task_rta (tsk: sporadic_task)
- (R_prev: seq task_with_response_time) (step: nat) :=
- iter step
- (fun t => task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period task_jitter tsk R_prev t)
- num_cpus)
- (task_cost tsk).
-
- (* To ensure that the iteration converges, we will apply per_task_rta
- a "sufficient" number of times: task_deadline tsk - task_cost tsk + 1.
- This corresponds to the time complexity of the iteration. *)
- Definition max_steps (tsk: sporadic_task) := task_deadline tsk - task_cost tsk + 1.
-
- (* Next we compute the response-time bounds for the entire task set.
- Since high-priority tasks may not be schedulable, we allow the
- computation to fail.
- Thus, given the response-time bound of previous tasks, we either
- (a) append the computed response-time bound (tsk, R) of the current task
- to the list of pairs, or,
- (b) return None if the response-time analysis failed. *)
- Definition fp_bound_of_task hp_pairs tsk :=
- if hp_pairs is Some rt_bounds then
- let R := per_task_rta tsk rt_bounds (max_steps tsk) in
- if task_jitter tsk + R <= task_deadline tsk then
- Some (rcons rt_bounds (tsk, R))
- else None
- else None.
-
- (* The response-time analysis for a given task set is defined
- as a left-fold (reduce) based on the function above.
- This either returns a list of task and response-time bounds, or None. *)
- Definition fp_claimed_bounds (ts: seq sporadic_task) :=
- foldl fp_bound_of_task (Some [::]) ts.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition fp_schedulable (ts: seq sporadic_task) :=
- fp_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of response-time bounds. The results seem trivial, but must be proven
- nonetheless since the list of response-time bounds is computed with
- a specific algorithm and there are no lemmas in the library for that. *)
- Section SimpleLemmas.
-
- (* First, we show that the first component of the computed list is the set of tasks. *)
- Lemma fp_claimed_bounds_unzip :
- forall ts hp_bounds,
- fp_claimed_bounds ts = Some hp_bounds ->
- unzip1 hp_bounds = ts.
- Proof.
- unfold fp_claimed_bounds in *; intros ts.
- induction ts using last_ind; first by destruct hp_bounds.
- {
- intros hp_bounds SOME.
- destruct (lastP hp_bounds) as [| hp_bounds'].
- {
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- by destruct l.
- }
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- move: H0 => /eqP EQSEQ.
- rewrite eqseq_rcons in EQSEQ.
- move: EQSEQ => /andP [/eqP SUBST /eqP EQSEQ]; subst.
- unfold unzip1; rewrite map_rcons; f_equal.
- by apply IHts.
- }
- Qed.
-
- (* Next, we show that some properties of the analysis are preserved for the
- prefixes of the list: (a) the tasks do not change, (b) R <= deadline,
- (c) R is computed using the response-time equation, ... *)
- Lemma fp_claimed_bounds_rcons :
- forall ts' hp_bounds tsk1 tsk2 R,
- (fp_claimed_bounds (rcons ts' tsk1) = Some (rcons hp_bounds (tsk2, R)) ->
- (fp_claimed_bounds ts' = Some hp_bounds /\
- tsk1 = tsk2 /\
- R = per_task_rta tsk1 hp_bounds (max_steps tsk1) /\
- task_jitter tsk1 + R <= task_deadline tsk1)).
- Proof.
- intros ts hp_bounds tsk tsk' R.
- rewrite -cats1.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /=.
- unfold fp_bound_of_task at 1; simpl; desf.
- intros EQ; inversion EQ; move: EQ H0 => _ /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [/eqP EQ /eqP RESP].
- by inversion RESP; repeat split; subst.
- Qed.
-
- (* ..., which implies that any prefix of the computation is the computation
- of the prefix. *)
- Lemma fp_claimed_bounds_take :
- forall ts hp_bounds i,
- fp_claimed_bounds ts = Some hp_bounds ->
- i <= size hp_bounds ->
- fp_claimed_bounds (take i ts) = Some (take i hp_bounds).
- Proof.
- intros ts hp_bounds i SOME LTi.
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
- rewrite <- UNZIP in *.
- rewrite -[hp_bounds]take_size /unzip1 map_take in SOME.
- fold (unzip1 hp_bounds) in *; clear UNZIP.
- rewrite leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LTi]; first by subst.
- remember (size hp_bounds) as len; apply eq_leq in Heqlen.
- induction len; first by rewrite ltn0 in LTi.
- {
- assert (TAKElen: fp_claimed_bounds (take len (unzip1 (hp_bounds))) =
- Some (take len (hp_bounds))).
- {
- assert (exists p, p \in hp_bounds).
- {
- destruct hp_bounds; first by rewrite ltn0 in Heqlen.
- by exists t; rewrite in_cons eq_refl orTb.
- } destruct H as [[tsk R] _].
- rewrite (take_nth tsk) in SOME; last by rewrite size_map.
- rewrite (take_nth (tsk,R)) in SOME; last by done.
- destruct (nth (tsk, R) hp_bounds len) as [tsk_len R_len].
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- rewrite ltnS leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LESS]; first by subst.
- apply ltnW in Heqlen.
- by specialize (IHlen Heqlen TAKElen LESS).
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadlines... *)
- Lemma fp_claimed_bounds_le_deadline :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- task_jitter tsk + R <= task_deadline tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by apply Heq0.
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* ... and the computed response-time bounds are no smaller
- than the task costs. *)
- Lemma fp_claimed_bounds_ge_cost :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R >= task_cost tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by destruct (max_steps tsk_lst');
- [by apply leqnn | by apply leq_addr].
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* Short lemma about unfolding the iteration one step. *)
- Lemma per_task_rta_fold :
- forall tsk rt_bounds,
- task_cost tsk +
- div_floor (total_interference_bound_fp task_cost task_period task_jitter tsk rt_bounds
- (per_task_rta tsk rt_bounds (max_steps tsk))) num_cpus
- = per_task_rta tsk rt_bounds (max_steps tsk).+1.
- Proof.
- by done.
- Qed.
-
- End SimpleLemmas.
-
- (* In this section, we prove that if the task set is sorted by priority,
- the tasks in fp_claimed_bounds are interfering tasks. *)
- Section HighPriorityTasks.
-
- (* Consider a list of previous tasks and a task tsk to be analyzed. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that the task set is sorted by unique priorities, ... *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
-
- (* ...the priority order is transitive, ...*)
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* ... and that the response-time analysis succeeds. *)
- Variable hp_bounds: seq task_with_response_time.
- Variable R: time.
- Hypothesis H_analysis_succeeds: fp_claimed_bounds ts = Some hp_bounds.
-
- (* Let's refer to tasks by index. *)
- Variable elem: sporadic_task.
- Let TASK := nth elem ts.
-
- (* We prove that higher-priority tasks have smaller index. *)
- Lemma fp_claimed_bounds_hp_tasks_have_smaller_index :
- forall hp_idx idx,
- hp_idx < size ts ->
- idx < size ts ->
- hp_idx != idx ->
- higher_priority (TASK hp_idx) (TASK idx) ->
- hp_idx < idx.
- Proof.
- unfold TASK; clear TASK.
- rename ts into ts'; destruct ts' as [ts UNIQ]; simpl in *.
- intros hp_idx idx LThp LT NEQ HP.
- rewrite ltn_neqAle; apply/andP; split; first by done.
- by apply sorted_rel_implies_le_idx with (leT := higher_priority) (xs := ts) (default := elem).
- Qed.
-
- End HighPriorityTasks.
-
- (* In this section, we show that the fixed-point iteration converges. *)
- Section Convergence.
-
- (* Consider any set of higher-priority tasks. *)
- Variable ts_hp: seq sporadic_task.
-
- (* Assume that the response-time analysis succeeds for the higher-priority tasks. *)
- Variable rt_bounds: seq task_with_response_time.
- Hypothesis H_test_succeeds: fp_claimed_bounds ts_hp = Some rt_bounds.
-
- (* Consider any task tsk to be analyzed, ... *)
- Variable tsk: sporadic_task.
-
- (* ... and assume all tasks have valid parameters. *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline (rcons ts_hp tsk).
-
- (* To simplify, let f denote the fixed-point iteration. *)
- Let f := per_task_rta tsk rt_bounds.
-
- (* Assume that f (max_steps tsk) is no larger than the deadline. *)
- Hypothesis H_no_larger_than_deadline: f (max_steps tsk) <= task_deadline tsk.
-
- (* First, we show that f is monotonically increasing. *)
- Lemma bertogna_fp_comp_f_monotonic :
- forall x1 x2, x1 <= x2 -> f x1 <= f x2.
- Proof.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_test_succeeds into SOME,
- H_valid_task_parameters into VALID.
- intros x1 x2 LEx; unfold f, per_task_rta.
- apply fun_mon_iter_mon; [by ins | by ins; apply leq_addr |].
- clear LEx x1 x2; intros x1 x2 LEx.
- unfold div_floor, total_interference_bound_fp.
- rewrite leq_add2l leq_div2r //.
- rewrite big_seq_cond.
- rewrite [\sum_(_ <- _ | true) _]big_seq_cond.
- apply leq_sum; move => i /andP [IN _].
- destruct i as [i R].
- have GE_COST := fp_claimed_bounds_ge_cost ts_hp rt_bounds i R SOME IN.
- have UNZIP := fp_claimed_bounds_unzip ts_hp rt_bounds SOME.
- unfold interference_bound_generic; simpl.
- rewrite leq_min; apply/andP; split.
- {
- apply leq_trans with (n := W_jitter task_cost task_period task_jitter i R x1); first by apply geq_minl.
- apply W_monotonic; try (by done).
- have INts: i \in ts_hp by rewrite -UNZIP; apply/mapP; exists (i, R).
- by exploit (VALID i);
- [by rewrite mem_rcons in_cons INts orbT | by ins; des].
- }
- {
- apply leq_trans with (n := x1 - task_cost tsk + 1); first by apply geq_minr.
- by rewrite leq_add2r leq_sub2r //.
- }
- Qed.
-
- (* If the iteration converged at an earlier step, then it remains stable. *)
- Lemma bertogna_fp_comp_f_converges_early :
- (exists k, k <= max_steps tsk /\ f k = f k.+1) ->
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- by intros EX; des; apply fixedpoint.iter_fix with (k := k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume instead that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps tsk -> f k != f k.+1.
-
- (* By monotonicity, it follows that the value always increases. *)
- Lemma bertogna_fp_comp_f_increases :
- forall k,
- k <= max_steps tsk ->
- f k < f k.+1.
- Proof.
- intros k LT.
- rewrite ltn_neqAle; apply/andP; split.
- by apply H_keeps_diverging.
- by apply bertogna_fp_comp_f_monotonic, leqnSn.
- Qed.
-
- (* In the end, the response-time bound must exceed the deadline. Contradiction! *)
- Lemma bertogna_fp_comp_rt_grows_too_much :
- forall k,
- k <= max_steps tsk ->
- f k > k + task_cost tsk - 1.
- Proof.
- have INC := bertogna_fp_comp_f_increases.
- rename H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- induction k.
- {
- intros _; rewrite add0n -addn1 addnBAC;
- first by rewrite -addnBA // subnn addn0 /= leqnn.
- by apply PARAMS.
- }
- {
- intros LT.
- specialize (IHk (ltnW LT)).
- apply leq_ltn_trans with (n := f k);
- last by apply INC, ltnW.
- rewrite -addn1 -addnA [1 + _]addnC addnA -addnBA // subnn addn0.
- rewrite -(ltn_add2r 1) in IHk.
- rewrite addnBAC in IHk;
- last by apply leq_trans with (n := task_cost tsk);
- [by apply PARAMS | by apply leq_addl].
- by rewrite -addnBA // subnn addn0 addn1 ltnS in IHk.
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove the convergence of the iteration after max_steps. *)
- Lemma per_task_rta_converges:
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- have TOOMUCH := bertogna_fp_comp_rt_grows_too_much.
- have INC := bertogna_fp_comp_f_increases.
- rename H_no_larger_than_deadline into LE,
- H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_(max_steps tsk).+1, f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- apply bertogna_fp_comp_f_converges_early.
- by exists k; split; [by rewrite -ltnS; apply ltn_ord | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
- rewrite leqNgt in LE; move: LE => /negP LE.
- exfalso; apply LE.
-
- assert (DIFF: forall k : nat, k <= max_steps tsk -> f k != f k.+1).
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | intro DIFF; apply DIFF].
- }
- exploit TOOMUCH; [by apply DIFF | by apply leq_addr |].
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- rewrite addnBAC; last by apply PARAMS2.
- rewrite -addnBA // subnn addn0 subn1 prednK //.
- intros LT; apply (leq_ltn_trans LT).
- by rewrite /max_steps [_ - _ + 1]addn1; apply INC, leq_addr.
- Qed.
-
- End Convergence.
-
- Section MainProof.
-
- (* Consider a task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all tasks have valid parameters, ... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ...and constrained deadlines.*)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Assume that the task set is totally ordered by unique priorities,
- and that the priority order is transitive. *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
- Hypothesis H_priority_is_total:
- FP_is_total_over_task_set higher_priority ts.
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* Next, consider any arrival sequence such that...*)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...they have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job_with_jitter task_cost task_deadline task_jitter job_cost
- job_deadline job_task job_jitter j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any schedule of this arrival sequence such that... *)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after jitter and no longer than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that jobs are sequential (as required by the workload bound). *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assume that the scheduler is work-conserving and respects the FP policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy job_arrival job_cost job_task job_jitter arr_seq sched higher_priority.
-
- Let no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in fp_claimed_bounds is safe. The proof follows by induction on the task set:
-
- Induction hypothesis: all higher-priority tasks have safe response-time bounds.
- Inductive step: We prove that the response-time bound of the current task is safe.
-
- Note that the inductive step is a direct application of the main Theorem from
- bertogna_fp_theory.v. *)
- Theorem fp_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In fp_claimed_bounds ts ->
- response_time_bounded_by tsk (task_jitter tsk + R).
- Proof.
- rename H_valid_job_parameters into JOBPARAMS, H_valid_task_parameters into TASKPARAMS,
- H_constrained_deadlines into RESTR, H_completed_jobs_dont_execute into COMP,
- H_jobs_must_arrive_to_execute into MUSTARRIVE,
- H_all_jobs_from_taskset into ALLJOBS.
- intros tsk R MATCH.
- assert (SOME: exists hp_bounds, fp_claimed_bounds ts = Some hp_bounds /\
- (tsk, R) \in hp_bounds).
- {
- destruct (fp_claimed_bounds ts); last by done.
- by exists l; split.
- } clear MATCH; des; rename SOME0 into IN.
-
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
-
- set elem := (tsk,R).
- move: IN => /(nthP elem) [idx LTidx EQ].
- set NTH := fun k => nth elem hp_bounds k.
- set TASK := fun k => (NTH k).1.
- set RESP := fun k => (NTH k).2.
- cut (response_time_bounded_by (TASK idx) (task_jitter (TASK idx) + RESP idx));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- clear EQ.
-
- assert (PAIR: forall idx, (TASK idx, RESP idx) = NTH idx).
- {
- by intros i; unfold TASK, RESP; destruct (NTH i).
- }
-
- assert (SUBST: forall i, i < size hp_bounds -> TASK i = nth tsk ts i).
- {
- by intros i LTi; rewrite /TASK /NTH -UNZIP (nth_map elem) //.
- }
-
- assert (SIZE: size hp_bounds = size ts).
- {
- by rewrite -UNZIP size_map.
- }
-
- induction idx as [idx IH'] using strong_ind.
-
- assert (IH: forall tsk_hp R_hp, (tsk_hp, R_hp) \in take idx hp_bounds -> response_time_bounded_by tsk_hp (task_jitter tsk_hp + R_hp)).
- {
- intros tsk_hp R_hp INhp.
- move: INhp => /(nthP elem) [k LTk EQ].
- rewrite size_take LTidx in LTk.
- rewrite nth_take in EQ; last by done.
- cut (response_time_bounded_by (TASK k) (task_jitter (TASK k) + RESP k));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- by apply IH'; try (by done); apply (ltn_trans LTk).
- } clear IH'.
-
- unfold response_time_bounded_by in *.
-
- exploit (fp_claimed_bounds_rcons (take idx ts) (take idx hp_bounds) (TASK idx) (TASK idx) (RESP idx)).
- {
- by rewrite PAIR SUBST // -2?take_nth -?SIZE // (fp_claimed_bounds_take _ hp_bounds).
- }
- intros [_ [_ [REC DL]]].
-
- try ( apply bertogna_cirinei_response_time_bound_fp with
- (task_cost0 := task_cost) (task_period0 := task_period)
- (task_deadline0 := task_deadline) (job_deadline0 := job_deadline) (tsk0 := (TASK idx))
- (job_task0 := job_task) (ts0 := ts) (hp_bounds0 := take idx hp_bounds)
- (job_jitter0 := job_jitter) (higher_eq_priority := higher_priority); try (by done) ) ||
- apply bertogna_cirinei_response_time_bound_fp with
- (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (job_deadline := job_deadline) (tsk := (TASK idx))
- (job_task := job_task) (ts := ts) (hp_bounds := take idx hp_bounds)
- (job_jitter := job_jitter) (higher_eq_priority := higher_priority); try (by done).
- {
- cut (NTH idx \in hp_bounds = true);
- [intros IN | by apply mem_nth].
- by rewrite set_mem -UNZIP; apply/mapP; exists (TASK idx, RESP idx); rewrite PAIR.
- }
- {
- intros hp_tsk IN INTERF.
- exists (RESP (index hp_tsk ts)).
- move: (IN) => INDEX; apply nth_index with (x0 := tsk) in INDEX.
- rewrite -{1}[hp_tsk]INDEX -SUBST; last by rewrite SIZE index_mem.
- assert (UNIQ: uniq hp_bounds).
- {
- apply map_uniq with (f := fst); unfold unzip1 in *; rewrite UNZIP.
- by destruct ts.
- }
- rewrite -filter_idx_lt_take //.
- {
- rewrite PAIR mem_filter; apply/andP; split;
- last by apply mem_nth; rewrite SIZE index_mem.
- {
- rewrite /NTH index_uniq; [| by rewrite SIZE index_mem | by done ].
- {
- move: INTERF => /andP [HP NEQ].
- apply fp_claimed_bounds_hp_tasks_have_smaller_index with
- (ts := ts) (elem := tsk) (hp_bounds := hp_bounds);
- try (by done);
- [by rewrite index_mem | by rewrite -SIZE | | by rewrite INDEX -SUBST].
- apply/eqP; intro BUG; subst idx.
- rewrite SUBST -{1}INDEX in NEQ;
- first by rewrite eq_refl in NEQ.
- by rewrite SIZE index_mem INDEX.
- }
- }
- }
- }
- {
- intros hp_tsk R_hp IN; apply mem_take in IN.
- by apply fp_claimed_bounds_ge_cost with (ts' := ts) (rt_bounds := hp_bounds).
- }
- {
- intros hp_tsk R_hp IN; apply mem_take in IN.
- by apply fp_claimed_bounds_le_deadline with (ts' := ts) (rt_bounds := hp_bounds).
- }
- {
- rewrite REC per_task_rta_fold.
- apply per_task_rta_converges with (ts_hp := take idx ts);
- first by apply fp_claimed_bounds_take; try (by apply ltnW).
- {
- rewrite SUBST // -take_nth -?SIZE //.
- by intros i IN; eapply TASKPARAMS, mem_take, IN.
- }
- {
- rewrite -REC.
- by apply leq_trans with (n := task_jitter (TASK idx) + RESP idx); first by apply leq_addl.
- }
- }
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: fp_schedulable ts.
-
- (*..., no task misses its deadline. *)
- Theorem taskset_schedulable_by_fp_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (fp_analysis_yields_response_time_bounds).
- have UNZIP := (fp_claimed_bounds_unzip ts).
- have DL := (fp_claimed_bounds_le_deadline ts).
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- fp_schedulable,
- valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS.
- move => tsk INtsk j ARRj JOBtsk.
- destruct (fp_claimed_bounds ts) as [rt_bounds |]; last by ins.
- feed (UNZIP rt_bounds); first by done.
- assert (EX: exists R, (tsk, R) \in rt_bounds).
- {
- rewrite set_mem -UNZIP in INtsk; move: INtsk => /mapP EX.
- by destruct EX as [p]; destruct p as [tsk' R]; simpl in *; subst tsk'; exists R.
- } des.
- exploit (RLIST tsk R); [by done | by apply ARRj | by done | intro COMPLETED].
- exploit (DL rt_bounds tsk R); [by ins | by ins | clear DL; intro DL].
- apply leq_trans with (n := service sched j (job_arrival j + (task_jitter tsk + R)));
- last first.
- {
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- apply extend_sum; rewrite // leq_add2l.
- by specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS2 JOBtsk.
- }
- by apply COMPLETED.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we also conclude that no job in
- the schedule misses its deadline. *)
- Theorem jobs_schedulable_by_fp_rta :
- forall j,
- arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_fp_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationFP.
diff --git a/classic/analysis/global/jitter/bertogna_fp_theory.v b/classic/analysis/global/jitter/bertogna_fp_theory.v
deleted file mode 100644
index 6326824745d4754c3194e55e8faf9bfc468581ad..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/bertogna_fp_theory.v
+++ /dev/null
@@ -1,852 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.response_time
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.interference
- prosa.classic.model.schedule.global.jitter.schedule prosa.classic.model.schedule.global.jitter.platform
- prosa.classic.model.schedule.global.jitter.constrained_deadlines.
-Require Import prosa.classic.analysis.global.jitter.workload_bound
- prosa.classic.analysis.global.jitter.interference_bound_fp.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisFP.
-
- Export JobWithJitter SporadicTaskset ScheduleOfSporadicTaskWithJitter
- Workload Interference Platform ConstrainedDeadlines Schedulability
- ResponseTime Priority TaskArrival WorkloadBoundJitter
- Interference InterferenceBoundFP.
-
- (* In this section, we prove that any fixed point in Bertogna and
- Cirinei's RTA for FP scheduling modified to account for jitter
- yields a safe response-time bound. This is an extension of the
- analysis found in Chapter 18.2 of Baruah et al.'s book
- Multiprocessor Scheduling for Real-time Systems. *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Assume any job arrival sequence... *)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job_with_jitter task_cost task_deadline task_jitter job_cost
- job_deadline job_task job_jitter j.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j -> job_task j \in ts.
-
- (* Next, consider any schedule of this arrival sequence such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs are sequential, do not execute before the jitter
- has passed and nor longer than their execution costs. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that there exists at least one processor. *)
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Consider a given FP policy, ... *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ...and assume that the schedule is work-conserving and respects this policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_respects_priority:
- respects_FP_policy job_arrival job_cost job_task job_jitter arr_seq sched higher_eq_priority.
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Next, we consider the response-time recurrence.
- Let tsk be a task in ts that is to be analyzed. *)
- Variable tsk: sporadic_task.
- Hypothesis task_in_ts: tsk \in ts.
-
- (* Let is_hp_task denote whether a task is a higher-priority task
- (with respect to tsk). *)
- Let is_hp_task := higher_priority_task higher_eq_priority tsk.
-
- (* Assume a response-time bound is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable hp_bounds: seq task_with_response_time.
- Hypothesis H_response_time_of_interfering_tasks_is_known:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds ->
- response_time_bounded_by hp_tsk (task_jitter hp_tsk + R).
-
- (* ... for every higher-priority task. *)
- Hypothesis H_hp_bounds_has_interfering_tasks:
- forall hp_tsk,
- hp_tsk \in ts ->
- is_hp_task hp_tsk ->
- exists R,
- (hp_tsk, R) \in hp_bounds.
-
- (* Assume that the response-time bounds are larger than task costs. *)
- Hypothesis H_response_time_bounds_ge_cost:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds -> R >= task_cost hp_tsk.
-
- (* Assume that no deadline is missed by any higher-priority task. *)
- Hypothesis H_interfering_tasks_miss_no_deadlines:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds ->
- task_jitter hp_tsk + R <= task_deadline hp_tsk.
-
- (* Let R be the fixed point of Bertogna and Cirinei's recurrence, ...*)
- Variable R: time.
- Hypothesis H_response_time_recurrence_holds :
- R = task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period task_jitter
- tsk hp_bounds R)
- num_cpus.
-
- (* ... and assume that jitter + R is no larger than the deadline of tsk.*)
- Hypothesis H_response_time_no_larger_than_deadline:
- task_jitter tsk + R <= task_deadline tsk.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_job_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Let t1 be the first point in time where j can actually be scheduled. *)
- Let t1 := job_arrival j + job_jitter j.
-
- (* Assume that job j is the first job of tsk not to complete by the response time bound. *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (t1 + R).
- Hypothesis H_previous_jobs_of_tsk_completed :
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + task_jitter tsk + R).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task job_jitter sched j tsk_other t1 (t1 + R).
-
- (* ...and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost job_jitter sched j t1 (t1 + R).
-
- (* Recall Bertogna and Cirinei's workload bound. *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W_jitter task_cost task_period task_jitter tsk_other R_other R.
-
- (* Let hp_tasks denote the set of higher-priority tasks. *)
- Let hp_tasks := [seq tsk_other <- ts | is_hp_task tsk_other].
-
- (* Now we establish results the higher-priority tasks. *)
- Section LemmasAboutHPTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task and
- response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_response_time_of_tsk_other: (tsk_other, R_other) \in hp_bounds.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_fp_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold response_time_bounded_by, is_response_time_bound_of_task,
- completed, completed_jobs_dont_execute, valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS,
- H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into TASK_PARAMS,
- H_constrained_deadlines into RESTR,
- H_response_time_of_interfering_tasks_is_known into RESP,
- H_interfering_tasks_miss_no_deadlines into NOMISS,
- H_response_time_bounds_ge_cost into GE_COST.
- unfold x, workload_bound.
- destruct ([exists t: 'I_(t1 + R),
- task_is_scheduled job_task sched tsk_other t]) eqn: SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED.
- move: SCHED => /forallP SCHED.
- apply leq_trans with (n := 0); last by done.
- apply leq_trans with (n := \sum_(t1 <= t < t1 + R) 0);
- last by rewrite big1.
- apply leq_sum_nat; move => t /andP [_ LTt] _.
- unfold t1 in LTt.
- specialize (SCHED (Ordinal LTt)).
- rewrite negb_exists in SCHED; move: SCHED => /forallP SCHED.
- rewrite big1 //; intros cpu _.
- specialize (SCHED cpu); apply negbTE in SCHED.
- by rewrite SCHED andbF.
- }
- move: SCHED => /existsP [t /existsP [cpu SCHED]].
- unfold task_scheduled_on in SCHED.
- destruct (sched cpu t) as [j0 |] eqn:SCHED0; last by done.
- assert (INts: tsk_other \in ts).
- {
- move: SCHED => /eqP <-. apply FROMTS, (H_jobs_come_from_arrival_sequence j0 t).
- by apply/existsP; exists cpu; apply/eqP.
- }
- apply leq_trans with (n := workload job_task sched tsk_other t1 (t1 + R));
- first by apply task_interference_le_workload.
- try ( apply workload_bounded_by_W with (task_deadline0 := task_deadline)
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq)
- (job_jitter0 := job_jitter) (job_cost0 := job_cost) (job_deadline0 := job_deadline) ) ||
- apply workload_bounded_by_W with (task_deadline := task_deadline)
- (job_arrival := job_arrival) (arr_seq := arr_seq)
- (job_jitter := job_jitter) (job_cost := job_cost) (job_deadline := job_deadline);
- try (by ins); last 2 first;
- [ by apply NOMISS
- | by ins; rewrite -addnA; apply RESP
- | by ins; apply TASK_PARAMS
- | by ins; apply RESTR
- | by ins; apply GE_COST].
- Qed.
-
- End LemmasAboutHPTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X >= R - e_k + 1. *)
- Lemma bertogna_fp_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS,
- H_response_time_recurrence_holds into REC,
- H_job_of_tsk into JOBtsk, H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite [R](REC) // leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
-
- apply leq_ltn_trans with (n := (\sum_(t1 <= t < t1 + R)
- backlogged job_arrival job_cost job_jitter sched j t) +
- service sched j (t1 + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_job_arrives); des; rewrite -JOBtsk.
- }
- unfold service.
- rewrite -> big_cat_nat with (n := t1) (m := 0); rewrite ?leq_addr // /=.
- rewrite (cumulative_service_before_jitter_zero job_arrival job_jitter) // add0n.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(t1 <= i < t1 + R) 1);
- first by simpl_sum_const; rewrite addKn.
- apply leq_sum_nat; move => i /andP [GEi LTi] _.
- destruct (backlogged job_arrival job_cost job_jitter sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* 1) Next, we prove that during the scheduling window of j, any job that is
- scheduled while j is backlogged comes from a different task.
- This follows from the fact that j is the first job not to complete
- by its response-time bound, so previous jobs of j's task must have
- completed by their periods and cannot be pending. *)
- Lemma bertogna_fp_interference_by_different_tasks :
- forall t j_other,
- t1 <= t < t1 + R ->
- arrives_in arr_seq j_other ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- scheduled sched j_other t ->
- job_task j_other != tsk.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_job_parameters into JOBPARAMS, H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK,
- H_constrained_deadlines into CONSTR,
- H_previous_jobs_of_tsk_completed into PREV,
- H_response_time_no_larger_than_deadline into NOMISS.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- move => t j_other /andP [LEt GEt] ARRother BACK SCHED.
- apply/eqP; red; intro SAMEtsk.
- move: SCHED => /existsP [cpu SCHED].
- have SCHED': scheduled sched j_other t by apply/existsP; exists cpu.
- clear SCHED; rename SCHED' into SCHED.
- move: (SCHED) => PENDING.
- try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) (job_jitter0 := job_jitter) in PENDING; try (by done) ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := job_cost) (job_jitter := job_jitter) in PENDING; try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- move: (BEFOREother) => LT; rewrite -(ltn_add2r R) in LT.
- specialize (PREV j_other ARRother SAMEtsk BEFOREother).
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- try ( apply completion_monotonic with (t0 := job_arrival j_other + task_jitter tsk + R) ) ||
- apply completion_monotonic with (t := job_arrival j_other + task_jitter tsk + R);
- try by done.
- apply leq_trans with (n := job_arrival j);
- last by apply leq_trans with (n := t1); [by apply leq_addr | by done].
- apply leq_trans with (n := job_arrival j_other + task_period tsk).
- {
- rewrite -addnA leq_add2l.
- by apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by apply CONSTR; rewrite -JOBtsk FROMTS].
- }
- rewrite -SAMEtsk; apply SPO; [ | by done | by done | by rewrite JOBtsk | by apply ltnW].
- by red; intro EQ; subst j_other; rewrite ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge JOBtsk.
- apply leq_trans with (n := job_arrival j + task_deadline tsk);
- last by rewrite leq_add2l; apply CONSTR; rewrite -JOBtsk FROMTS.
- apply leq_trans with (n := job_arrival j + task_jitter tsk + R);
- last by rewrite -addnA leq_add2l; apply NOMISS.
- apply leq_trans with (n := t1 + R); last first.
- {
- rewrite leq_add2r leq_add2l -JOBtsk.
- by specialize (JOBPARAMS j H_job_arrives); des.
- }
- apply leq_ltn_trans with (n := job_arrival j_other + job_jitter j_other);
- first by apply leq_addr.
- by apply leq_ltn_trans with (n := t).
- }
- by intros EQtsk; subst j_other; rewrite /backlogged SCHED andbF in BACK.
- }
- Qed.
-
- (* Let's define a predicate to identify the other tasks that are scheduled. *)
- Let other_scheduled_task (t: time) (tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- is_hp_task tsk_other.
-
- (* 2) Now we prove that, at all times that j is backlogged, the number
- of tasks other than tsk that are scheduled is exactly the number
- of processors in the system. This is required to prove lemma (3). *)
- Lemma bertogna_fp_all_cpus_are_busy:
- forall t,
- t1 <= t < t1 + R ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- count (other_scheduled_task t) ts = num_cpus.
- Proof.
- rename H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk,
- H_all_jobs_from_taskset into FROMTS,
- H_sporadic_tasks into SPO,
- H_valid_job_parameters into JOBPARAMS,
- H_constrained_deadlines into RESTR,
- H_hp_bounds_has_interfering_tasks into HAS,
- H_interfering_tasks_miss_no_deadlines into NOMISS,
- H_response_time_of_interfering_tasks_is_known into PREV,
- H_previous_jobs_of_tsk_completed into PREVtsk.
- unfold sporadic_task_model, is_response_time_bound_of_task,
- valid_sporadic_job_with_jitter in *.
- move => t /andP [LEt LTt] BACK.
-
- ( try ( apply platform_fp_cpus_busy_with_interfering_tasks with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (job_task0 := job_task)
- (ts0 := ts) (tsk0 := tsk) (higher_eq_priority0 := higher_eq_priority) (arr_seq0 := arr_seq)
- in BACK ) ||
- apply platform_fp_cpus_busy_with_interfering_tasks with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (job_task := job_task)
- (ts := ts) (tsk := tsk) (higher_eq_priority := higher_eq_priority) (arr_seq := arr_seq)
- in BACK); try (by done); first by apply PARAMS; rewrite -JOBtsk FROMTS.
- {
- apply leq_trans with (n := job_arrival j + job_jitter j + R); first by done.
- rewrite -addnA leq_add2l.
- apply leq_trans with (n := task_deadline tsk); last by apply RESTR.
- apply leq_trans with (n := task_jitter tsk + R); last by done.
- by rewrite leq_add2r -JOBtsk; specialize (JOBPARAMS j H_job_arrives); des.
- }
- {
- intros j_other tsk_other ARRother JOBother INTERF.
- feed (HAS tsk_other); first by rewrite -JOBother FROMTS.
- move: (HAS INTERF) => [R' IN].
- try ( apply completion_monotonic with (t0 := job_arrival j_other + task_jitter tsk_other + R') ) ||
- apply completion_monotonic with (t := job_arrival j_other + task_jitter tsk_other + R');
- try (by done); last by rewrite -addnA; apply PREV.
- rewrite -addnA leq_add2l; apply leq_trans with (n := task_deadline tsk_other);
- [by apply NOMISS | by apply RESTR; rewrite -JOBother; apply FROMTS].
- }
- {
- ins; ( try ( apply completion_monotonic with (t0 := job_arrival j0 + task_jitter tsk + R) ) ||
- apply completion_monotonic with (t := job_arrival j0 + task_jitter tsk + R));
- try (by done); last by apply PREVtsk.
- rewrite -addnA leq_add2l.
- by apply leq_trans with (n := task_deadline tsk); [by done | by apply RESTR].
- }
- Qed.
-
- (* 3) Now we prove that, at all times that j is backlogged, the number
- of tasks other than tsk that are scheduled is exactly the number
- of processors in the system. This is required to prove lemma (4). *)
- Lemma bertogna_fp_interference_on_all_cpus:
- \sum_(tsk_k <- hp_tasks) x tsk_k = X * num_cpus.
- Proof.
- have DIFFTASK := bertogna_fp_interference_by_different_tasks.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS, H_jobs_come_from_arrival_sequence into SEQ,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK, H_constrained_deadlines into CONSTR,
- H_previous_jobs_of_tsk_completed into PREV,
- H_respects_priority into FP, H_response_time_no_larger_than_deadline into NOMISS.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /= mul1n.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK;
- last by rewrite big1 //; ins; rewrite big1.
- rewrite big_mkcond /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus) 1); last by simpl_sum_const.
- apply eq_bigr; intros cpu _.
- move: (WORK j t H_job_arrives BACK cpu) => [j_other /eqP SCHED]; unfold scheduled_on in *.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- simpl_sum_const; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- have ARRother: arrives_in arr_seq j_other.
- by apply (SEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- unfold is_hp_task, higher_priority_task; apply/andP; split.
- {
- rewrite -JOBtsk; apply FP with (t := t); try by done.
- by apply/existsP; exists cpu; apply/eqP.
- }
- apply DIFFTASK with (t := t); [by auto | by done | by done |].
- by apply/existsP; exists cpu; apply/eqP.
- Qed.
-
- (* Before stating the next lemma, let (num_tasks_exceeding delta) be the
- number of interfering tasks whose interference x is larger than delta. *)
- Let num_tasks_exceeding delta := count (fun i => x i >= delta) (hp_tasks).
-
- (* 4) Now we prove that, for any delta, if (num_task_exceeding delta > 0), then the
- cumulative interference caused by the complementary set of interfering tasks fills
- the remaining, not-completely-full (num_cpus - num_tasks_exceeding delta)
- processors. *)
- Lemma bertogna_fp_interference_in_non_full_processors :
- forall delta,
- 0 < num_tasks_exceeding delta < num_cpus ->
- \sum_(i <- hp_tasks | x i < delta) x i >= delta * (num_cpus - num_tasks_exceeding delta).
- Proof.
- have INV := bertogna_fp_all_cpus_are_busy.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS, H_valid_job_parameters into JOBPARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_previous_jobs_of_tsk_completed into BEFOREok,
- H_response_time_no_larger_than_deadline into NOMISS,
- H_constrained_deadlines into CONSTR,
- H_sequential_jobs into SEQ, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_respects_priority into FP, H_hp_bounds_has_interfering_tasks into HASHP,
- H_interfering_tasks_miss_no_deadlines into NOMISSHP.
- unfold sporadic_task_model, valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- move => delta /andP [HAS LT].
- rewrite -has_count in HAS.
-
- set some_interference_A := fun t =>
- has (fun tsk_k => backlogged job_arrival job_cost job_jitter sched j t &&
- (x tsk_k >= delta) &&
- task_is_scheduled job_task sched tsk_k t) hp_tasks.
- set total_interference_B := fun t =>
- backlogged job_arrival job_cost job_jitter sched j t *
- count (fun tsk_k => (x tsk_k < delta) &&
- task_is_scheduled job_task sched tsk_k t) hp_tasks.
-
- apply leq_trans with ((\sum_(t1 <= t < t1 + R)
- some_interference_A t) * (num_cpus - num_tasks_exceeding delta)).
- {
- rewrite leq_mul2r; apply/orP; right.
- move: HAS => /hasP HAS; destruct HAS as [tsk_a INa LEa].
- apply leq_trans with (n := x tsk_a); first by apply LEa.
- unfold x, task_interference, some_interference_A.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK;
- last by rewrite (eq_bigr (fun x => 0)); [by simpl_sum_const | by ins].
- destruct ([exists cpu, task_scheduled_on job_task sched tsk_a cpu t]) eqn:SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED; move: SCHED => /forallP ALL.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (ALL cpu); apply negbTE in ALL; rewrite ALL.
- }
- move: SCHED => /existsP [cpu SCHED].
- apply leq_trans with (n := 1); last first.
- {
- rewrite lt0b; apply/hasP; exists tsk_a; first by done.
- by rewrite LEa 2!andTb; apply/existsP; exists cpu.
- }
- rewrite (bigD1 cpu) /= // SCHED.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const; rewrite leq_b1.
- intros cpu' DIFF.
- apply/eqP; rewrite eqb0; apply/negP.
- intros SCHED'.
- move: DIFF => /negP DIFF; apply DIFF; apply/eqP.
- unfold task_scheduled_on in *.
- destruct (sched cpu t) as [j1|] eqn:SCHED1; last by done.
- destruct (sched cpu' t) as [j2|] eqn:SCHED2; last by done.
- move: SCHED SCHED' => /eqP JOB /eqP JOB'.
- subst tsk_a; symmetry in JOB'.
- have ARR1: arrives_in arr_seq j1.
- by apply (FROMSEQ j1 t); apply/existsP; exists cpu; apply/eqP.
- have ARR2: arrives_in arr_seq j2.
- by apply (FROMSEQ j2 t); apply/existsP; exists cpu'; apply/eqP.
- assert (PENDING1: pending job_arrival job_cost job_jitter sched j1 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu; apply/eqP.
- }
- assert (PENDING2: pending job_arrival job_cost job_jitter sched j2 t).
- {
- apply scheduled_implies_pending; try by done.
- by apply/existsP; exists cpu'; apply/eqP.
- }
- assert (BUG: j1 = j2).
- {
- destruct (job_task j1 == tsk) eqn:SAMEtsk.
- {
- move: SAMEtsk => /eqP SAMEtsk.
- move: (PENDING1) => SAMEjob.
- ( try ( apply platform_fp_no_multiple_jobs_of_tsk with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (arr_seq0 := arr_seq)
- (job_task0 := job_task) (tsk0 := tsk) (j0 := j) in SAMEjob) ||
- apply platform_fp_no_multiple_jobs_of_tsk with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (arr_seq := arr_seq)
- (job_task := job_task) (tsk := tsk) (j := j) in SAMEjob); try (by done);
- [ | by apply PARAMS | |]; last 2 first.
- {
- apply (leq_trans LTt); rewrite -addnA leq_add2l.
- apply leq_trans with (n := task_deadline tsk); last by apply CONSTR.
- apply leq_trans with (n := task_jitter tsk + R); last by apply NOMISS.
- by rewrite leq_add2r -JOBtsk; specialize (JOBPARAMS j H_job_arrives); des.
- }
- {
- intros j0 ARR0 JOB0 LT0.
- ( try ( apply completion_monotonic with (t0 := job_arrival j0 + task_jitter tsk + R) ) ||
- apply completion_monotonic with (t := job_arrival j0 + task_jitter tsk + R));
- try (by done); last by apply BEFOREok.
- rewrite -addnA leq_add2l.
- by apply leq_trans with (n := task_deadline tsk); last by apply CONSTR.
- }
- move: BACK => /andP [_ /negP NOTSCHED]; exfalso; apply NOTSCHED.
- by rewrite -SAMEjob; apply/existsP; exists cpu; apply/eqP.
- }
- {
- assert (INTERF: is_hp_task (job_task j1)).
- {
- apply/andP; split; last by rewrite SAMEtsk.
- rewrite -JOBtsk; apply FP with (t := t); try (by done).
- by apply/existsP; exists cpu; apply/eqP.
- }
- ( try ( apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (task_period0 := task_period) (tsk0 := tsk) (job_arrival0 := job_arrival)
- (higher_eq_priority0 := higher_eq_priority) (job_jitter0 := job_jitter)
- (arr_seq0 := arr_seq)
- (job_cost0 := job_cost) (job_task0 := job_task) (sched0 := sched) (t0 := t) ) ||
- apply platform_fp_no_multiple_jobs_of_interfering_tasks with
- (task_period := task_period) (tsk := tsk) (job_arrival := job_arrival)
- (higher_eq_priority := higher_eq_priority) (job_jitter := job_jitter)
- (arr_seq := arr_seq)
- (job_cost := job_cost) (job_task := job_task) (sched := sched) (t := t));
- rewrite ?JOBtsk ?SAMEtsk //.
- {
- intros j0 tsk0 ARR0 JOB0 INTERF0.
- feed (HASHP tsk0); first by rewrite -JOB0 FROMTS.
- move: (HASHP INTERF0) => [R0 IN0].
- ( try ( apply completion_monotonic with (t0 := job_arrival j0 + task_jitter tsk0 + R0) ) ||
- apply completion_monotonic with (t := job_arrival j0 + task_jitter tsk0 + R0));
- try (by done).
- {
- rewrite -addnA leq_add2l.
- by apply leq_trans with (n := task_deadline tsk0);
- [by apply NOMISSHP | by apply CONSTR; rewrite -JOB0 FROMTS].
- }
- rewrite -addnA.
- by eapply H_response_time_of_interfering_tasks_is_known; first by apply IN0.
- }
- }
- }
- by subst j2; apply SEQ with (j := j1) (t := t).
- }
-
- apply leq_trans with (\sum_(t1 <= t < t1 + R)
- total_interference_B t).
- {
- rewrite big_distrl /=.
- apply leq_sum_nat; move => t LEt _.
- unfold some_interference_A, total_interference_B.
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK;
- [rewrite mul1n /= | by rewrite has_pred0 //].
-
- destruct (has (fun tsk_k : sporadic_task => (delta <= x tsk_k) &&
- task_is_scheduled job_task sched tsk_k t) hp_tasks) eqn:HAS';
- last by done.
- rewrite mul1n; move: HAS => /hasP [tsk_k INk LEk].
- unfold num_tasks_exceeding.
- apply leq_trans with (n := num_cpus -
- count (fun i => (x i >= delta) &&
- task_is_scheduled job_task sched i t) hp_tasks).
- {
- apply leq_sub2l.
- rewrite -2!sum1_count big_mkcond /=.
- rewrite [\sum_(_ <- _ | _ <= _)_]big_mkcond /=.
- apply leq_sum; intros i _.
- by destruct (task_is_scheduled job_task sched i t);
- [by rewrite andbT | by rewrite andbF].
- }
- rewrite -count_filter -[count _ hp_tasks]count_filter.
- eapply leq_trans with (n := count (predC (fun tsk => delta <= x tsk)) _);
- last by apply eq_leq, eq_in_count; red; ins; rewrite ltnNge.
- rewrite leq_subLR count_predC size_filter.
- by apply leq_trans with (n := count (other_scheduled_task t) ts);
- [by rewrite INV | by rewrite count_filter].
- }
- {
- unfold x at 2, total_interference_B.
- rewrite exchange_big /=; apply leq_sum; intros t _.
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK; last by ins.
- rewrite mul1n -sum1_count.
- rewrite big_mkcond [\sum_(i <- hp_tasks | _ < _) _]big_mkcond /=.
- apply leq_sum_seq; move => tsk_k IN _.
- destruct (x tsk_k < delta); [rewrite andTb | by rewrite andFb].
- destruct (task_is_scheduled job_task sched tsk_k t) eqn:SCHED; last by done.
- move: SCHED => /existsP [cpu SCHED].
- by rewrite (bigD1 cpu) /= // SCHED.
- }
- Qed.
-
- (* 5) Based on lemma (4), we prove that, for any interval delta, if the sum of per-task
- interference exceeds (delta * num_cpus), the same applies for the
- sum of the minimum of the interference and delta. *)
- Lemma bertogna_fp_minimum_exceeds_interference :
- forall delta,
- \sum_(tsk_k <- hp_tasks) x tsk_k >= delta * num_cpus ->
- \sum_(tsk_k <- hp_tasks) minn (x tsk_k) delta >=
- delta * num_cpus.
- Proof.
- intros delta SUMLESS.
- set more_interf := fun tsk_k => x tsk_k >= delta.
- rewrite [\sum_(_ <- _) minn _ _](bigID more_interf) /=.
- unfold more_interf, minn.
- rewrite [\sum_(_ <- _ | delta <= _)_](eq_bigr (fun i => delta));
- last by intros i COND; rewrite leqNgt in COND; destruct (delta > x i).
- rewrite [\sum_(_ <- _ | ~~_)_](eq_big (fun i => x i < delta)
- (fun i => x i));
- [| by red; ins; rewrite ltnNge
- | by intros i COND; rewrite -ltnNge in COND; rewrite COND].
-
- (* Case 1: num_tasks_exceeding = 0 *)
- destruct (~~ has (fun i => delta <= x i) hp_tasks) eqn:HASa.
- {
- rewrite [\sum_(_ <- _ | _ <= _) _]big_hasC; last by apply HASa.
- rewrite big_seq_cond; move: HASa => /hasPn HASa.
- rewrite add0n (eq_bigl (fun i => (i \in hp_tasks) && true));
- last by red; intros tsk_k; destruct (tsk_k \in hp_tasks) eqn:INk;
- [by rewrite andTb ltnNge; apply HASa | by rewrite andFb].
- by rewrite -big_seq_cond.
- } apply negbFE in HASa.
-
- (* Case 2: num_tasks_exceeding >= num_cpus *)
- destruct (num_tasks_exceeding delta >= num_cpus) eqn:CARD.
- {
- apply leq_trans with (delta * num_tasks_exceeding delta);
- first by rewrite leq_mul2l; apply/orP; right.
- unfold num_tasks_exceeding; rewrite -sum1_count big_distrr /=.
- rewrite -[\sum_(_ <- _ | _) _]addn0.
- by apply leq_add; [by apply leq_sum; ins; rewrite muln1|by ins].
- } apply negbT in CARD; rewrite -ltnNge in CARD.
-
- (* Case 3: num_tasks_exceeding < num_cpus *)
- rewrite big_const_seq iter_addn addn0; fold num_tasks_exceeding.
- apply leq_trans with (n := delta * num_tasks_exceeding delta +
- delta * (num_cpus - num_tasks_exceeding delta));
- first by rewrite -mulnDr subnKC //; apply ltnW.
- rewrite leq_add2l; apply bertogna_fp_interference_in_non_full_processors.
- by apply/andP; split; first by rewrite -has_count.
- Qed.
-
- (* 6) Next, using lemmas (0), (3) and (5) we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_fp_sum_exceeds_total_interference:
- \sum_((tsk_k, R_k) <- hp_bounds)
- minn (x tsk_k) (R - task_cost tsk + 1) >
- total_interference_bound_fp task_cost task_period task_jitter tsk hp_bounds R.
- Proof.
- have EXCEEDS := bertogna_fp_minimum_exceeds_interference.
- have ALLBUSY := bertogna_fp_interference_on_all_cpus.
- have TOOMUCH := bertogna_fp_too_much_interference.
- rename H_hp_bounds_has_interfering_tasks into HAS,
- H_response_time_recurrence_holds into REC.
- apply leq_trans with (n := \sum_(tsk_k <- hp_tasks) minn (x tsk_k) (R - task_cost tsk + 1));
- last first.
- {
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) hp_bounds (fun x => true) (fun y => minn (x y) (R - task_cost tsk + 1)).
- rewrite -MAP.
- apply leq_sum_sub_uniq; first by apply filter_uniq; destruct ts.
- red; move => tsk0 IN0.
- rewrite mem_filter in IN0; move: IN0 => /andP [INTERF0 IN0].
- apply/mapP.
- feed (HAS tsk0); first by done.
- move: (HAS INTERF0) => [R0 IN].
- by exists (tsk0, R0).
- }
- apply ltn_div_trunc with (d := num_cpus);
- first by apply H_at_least_one_cpu.
- unfold div_floor in REC.
- rewrite -(ltn_add2l (task_cost tsk)) -REC.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by rewrite REC; apply leq_addr.
- rewrite leq_divRL; last by apply H_at_least_one_cpu.
- apply EXCEEDS.
- apply leq_trans with (n := X * num_cpus); last by rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 7) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k', R - e_i + 1).
- This implies that x_k > W_k', which is of course a contradiction,
- since W_k is a valid task interference bound. *)
- Lemma bertogna_fp_exists_task_that_exceeds_bound :
- exists tsk_k R_k,
- (tsk_k, R_k) \in hp_bounds /\
- (minn (x tsk_k) (R - task_cost tsk + 1) >
- minn (workload_bound tsk_k R_k) (R - task_cost tsk + 1)).
- Proof.
- have SUM := bertogna_fp_sum_exceeds_total_interference.
- rename H_hp_bounds_has_interfering_tasks into HASHP.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_k, R_k) := tup in
- (minn (x tsk_k) (R - task_cost tsk + 1) >
- minn (workload_bound tsk_k R_k)(R - task_cost tsk + 1)))
- hp_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- rewrite (eq_bigr (fun i => minn (x (fst i)) (R - task_cost tsk + 1)));
- last by ins; destruct i.
- unfold total_interference_bound_fp.
- rewrite big_seq_cond.
- rewrite [\sum_(_ <- _ | true)_]big_seq_cond.
- apply leq_sum.
- intros p; rewrite andbT; intros IN.
- by specialize (ALL p IN); destruct p; rewrite leqNgt.
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MINk]; exists tsk_k, R_k.
- by repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- (* Using the lemmas above, we prove that R' bounds the response time of task tsk. *)
- Theorem bertogna_cirinei_response_time_bound_fp :
- response_time_bounded_by tsk (task_jitter tsk + R).
- Proof.
- have EX := bertogna_fp_exists_task_that_exceeds_bound.
- have WORKLOAD := bertogna_fp_workload_bounds_interference.
- rename H_valid_job_parameters into PARAMS.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + (task_jitter tsk + R)) as ctime.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- generalize dependent j.
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj JOBtsk EQc; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + task_jitter tsk + R)).
- {
- by ins; rewrite -addnA; apply IH; try (by done); first by rewrite ltn_add2r.
- } clear IH.
-
- (* Now we start the proof. Assume by contradiction that job j
- is not complete at time (job_arrival j + job_jitter j + R'). *)
- rewrite addnA.
- apply completion_monotonic with (t := job_arrival j + job_jitter j + R).
- {
- rewrite leq_add2r leq_add2l.
- specialize (PARAMS j ARRj); des.
- by rewrite -JOBtsk; apply PARAMS0.
- }
- destruct (completed job_cost sched j (job_arrival j + job_jitter j + R)) eqn:NOTCOMP;
- first by done.
- apply negbT in NOTCOMP; exfalso.
-
- (* We derive a contradiction using the previous lemmas. *)
- specialize (EX j ARRj JOBtsk NOTCOMP BEFOREok).
- destruct EX as [tsk_k [R_k [HPk LTmin]]].
- unfold minn at 1 in LTmin.
- specialize (WORKLOAD j tsk_k R_k HPk).
- destruct (W_jitter task_cost task_period task_jitter tsk_k R_k R < R - task_cost tsk + 1);
- rewrite leq_min in LTmin;
- last by move: LTmin => /andP [_ BUG]; rewrite ltnn in BUG.
- move: LTmin => /andP [BUG _]; des.
- by apply leq_trans with (p := W_jitter task_cost task_period task_jitter tsk_k R_k R) in BUG;
- first by rewrite ltnn in BUG.
- Qed.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/analysis/global/jitter/interference_bound.v b/classic/analysis/global/jitter/interference_bound.v
deleted file mode 100644
index 513c6da052983bffdc01a5e01c707be5457f0036..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/interference_bound.v
+++ /dev/null
@@ -1,46 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.jitter.schedule prosa.classic.model.schedule.global.jitter.interference.
-Require Import prosa.classic.analysis.global.jitter.workload_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundJitter.
-
- Import ArrivalSequence WorkloadBoundJitter Priority Interference.
-
- Section Definitions.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- Section PerTask.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* Based on the workload bound, Bertogna and Cirinei define the
- following interference bound for a task. *)
- Definition interference_bound_generic :=
- minn (W_jitter task_cost task_period task_jitter tsk_other R_other delta)
- (delta - task_cost tsk + 1).
-
- End PerTask.
-
- End Definitions.
-
-End InterferenceBoundJitter.
\ No newline at end of file
diff --git a/classic/analysis/global/jitter/interference_bound_edf.v b/classic/analysis/global/jitter/interference_bound_edf.v
deleted file mode 100644
index 83a97b34f10be58a3cfcdf0395dbfab7ead768cd..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/interference_bound_edf.v
+++ /dev/null
@@ -1,1336 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.response_time prosa.classic.model.schedule.global.workload
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.platform prosa.classic.model.schedule.global.jitter.interference
- prosa.classic.model.schedule.global.jitter.interference_edf.
-Require Import prosa.classic.analysis.global.jitter.workload_bound prosa.classic.analysis.global.jitter.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module InterferenceBoundEDFJitter.
-
- Import JobWithJitter SporadicTaskset ScheduleWithJitter ScheduleOfSporadicTask Schedulability
- ResponseTime WorkloadBoundJitter Priority TaskArrival Interference InterferenceEDF.
- Export InterferenceBoundJitter.
-
- (* In this section, we define Bertogna and Cirinei's EDF-specific
- interference bound. *)
- Section SpecificBoundDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- (* Consider the interference incurred by tsk in a window of length delta... *)
- Variable delta: time.
-
- (* due to a different task tsk_other, with response-time bound R_other. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
-
- (* Bertogna and Cirinei define the following bound for task interference
- under EDF scheduling. *)
- Definition edf_specific_interference_bound :=
- let d_tsk := task_deadline tsk in
- let e_other := task_cost tsk_other in
- let p_other := task_period tsk_other in
- let d_other := task_deadline tsk_other in
- let j_other := task_jitter tsk_other in
- (div_floor d_tsk p_other) * e_other +
- minn e_other ((d_tsk %% p_other) - (d_other - R_other - j_other)).
-
- End SpecificBoundDef.
-
- (* Next, we define the total interference bound for EDF, which combines the generic
- and the EDF-specific bounds. *)
- Section TotalInterferenceBoundEDF.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- Section RecallInterferenceBounds.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* By combining Bertogna's interference bound for a work-conserving
- scheduler ... *)
- Let basic_interference_bound := interference_bound_generic task_cost task_period task_jitter tsk delta tsk_R.
-
- (* ... with and EDF-specific interference bound, ... *)
- Let edf_specific_bound := edf_specific_interference_bound task_cost task_period task_deadline task_jitter tsk tsk_other R_other.
-
- (* Bertogna and Cirinei define the following interference bound
- under EDF scheduling. *)
- Definition interference_bound_edf :=
- minn basic_interference_bound edf_specific_bound.
-
- End RecallInterferenceBounds.
-
- (* Next we define the computation of the total interference for APA scheduling. *)
- Section TotalInterference.
-
- (* Recall the definition of a different task (with respect to tsk). *)
- Let other_task := different_task tsk.
-
- (* The total interference incurred by tsk is bounded by the sum
- of individual task interferences of the other tasks. *)
- Definition total_interference_bound_edf :=
- \sum_((tsk_other, R_other) <- R_prev | other_task tsk_other)
- interference_bound_edf (tsk_other, R_other).
-
- End TotalInterference.
-
- End TotalInterferenceBoundEDF.
-
- (* In this section, we show that the EDF-specific interference bound is safe. *)
- Section ProofSpecificBound.
-
- Import ScheduleWithJitter Interference Platform SporadicTaskset.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Assume any job arrival sequence... *)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job_with_jitter task_cost task_deadline task_jitter job_cost job_deadline job_task job_jitter j.
-
- (* Consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs do not execute before jitter nor longer than their execution costs. *)
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that jobs are sequential and that there exists
- at least one processor. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines. *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j -> job_task j \in ts.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Assume that we have a work-conserving EDF scheduler. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_edf_policy: respects_JLFP_policy job_arrival job_cost job_jitter arr_seq
- sched (EDF job_arrival job_deadline).
-
- (* Let tsk_i be the task to be analyzed, ...*)
- Variable tsk_i: sporadic_task.
- Hypothesis H_tsk_i_in_task_set: tsk_i \in ts.
-
- (* and j_i one of its jobs. *)
- Variable j_i: Job.
- Hypothesis H_j_i_arrives: arrives_in arr_seq j_i.
- Hypothesis H_job_of_tsk_i: job_task j_i = tsk_i.
-
- (* Let tsk_k denote any interfering task, ... *)
- Variable tsk_k: sporadic_task.
- Hypothesis H_tsk_k_in_task_set: tsk_k \in ts.
-
- (* ...and R_k its response-time bound. *)
- Variable R_k: time.
- Hypothesis H_R_k_le_deadline: task_jitter tsk_k + R_k <= task_deadline tsk_k.
-
- (* Consider a time window of length delta <= D_i, starting with j_i's arrival time. *)
- Variable delta: time.
- Hypothesis H_delta_le_deadline: delta <= task_deadline tsk_i.
-
- (* Assume that the jobs of tsk_k satisfy the response-time bound before the end of the interval *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_k,
- arrives_in arr_seq j_k ->
- job_task j_k = tsk_k ->
- job_arrival j_k + task_jitter tsk_k + R_k < job_arrival j_i + task_jitter tsk_i + delta ->
- completed job_cost sched j_k (job_arrival j_k + task_jitter tsk_k + R_k).
-
- (* In this section, we prove that Bertogna and Cirinei's EDF interference bound
- indeed bounds the interference caused by task tsk_k in the interval [t1, t1 + delta). *)
- Section MainProof.
-
- (* Let t1 be the first point in time where j can actually be scheduled. *)
- Let t1 := job_arrival j_i + job_jitter j_i.
- Let t2 := t1 + delta.
-
- (* Let's call x the task interference incurred by job j due to tsk_k. *)
- Let x :=
- task_interference job_arrival job_cost job_task job_jitter sched j_i tsk_k t1 t2.
-
- (* Also, recall the EDF-specific interference bound for EDF. *)
- Let interference_bound :=
- edf_specific_interference_bound task_cost task_period task_deadline task_jitter tsk_i tsk_k R_k.
-
- (* Let's simplify the names a bit. *)
- Let a_i := job_arrival j_i.
- Let D_i := task_deadline tsk_i.
- Let D_k := task_deadline tsk_k.
- Let p_k := task_period tsk_k.
- Let J_i := task_jitter tsk_i.
- Let J_k := task_jitter tsk_k.
-
- Let n_k := div_floor D_i p_k.
-
- (* Let's give a simpler name to job interference. *)
- Let interference_caused_by := job_interference job_arrival job_cost job_jitter sched j_i.
-
- (* Identify the subset of jobs that actually cause interference *)
- Let interfering_jobs :=
- filter (fun j' =>
- (job_task j' == tsk_k) && (interference_caused_by j' t1 t2 != 0))
- (jobs_scheduled_between sched t1 t2).
-
- (* Now, consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := (sort earlier_arrival interfering_jobs).
-
- (* Now we proceed with the proof.
- The first step consists in simplifying the sum corresponding to the workload. *)
- Section SimplifyJobSequence.
-
- (* Use the alternative definition of task interference, based on
- individual job interference. *)
- Lemma interference_bound_edf_use_another_definition :
- x <= \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2.
- Proof.
- apply interference_le_interference_joblist.
- Qed.
-
- (* Remove the elements that we don't care about from the sum *)
- Lemma interference_bound_edf_simpl_by_filtering_interfering_jobs :
- \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2 =
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2.
- Proof.
- unfold interfering_jobs; rewrite big_filter.
- rewrite big_mkcond; rewrite [\sum_(_ <- _ | _) _]big_mkcond /=.
- apply eq_bigr; intros i _; clear -i.
- destruct (job_task i == tsk_k); rewrite ?andTb ?andFb; last by done.
- destruct (interference_caused_by i t1 t2 != 0) eqn:DIFF; first by done.
- by apply negbT in DIFF; rewrite negbK in DIFF; apply/eqP.
- Qed.
-
- (* Then, we consider the sum over the sorted sequence of jobs. *)
- Lemma interference_bound_edf_simpl_by_sorting_interfering_jobs :
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2 =
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2.
- Proof.
- by rewrite (perm_big sorted_jobs) /=; last by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Note that both sequences have the same set of elements. *)
- Lemma interference_bound_edf_job_in_same_sequence :
- forall j,
- (j \in interfering_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Also recall that all jobs in the sorted sequence is an interfering job of tsk_k, ... *)
- Lemma interference_bound_edf_all_jobs_from_tsk_k :
- forall j,
- j \in sorted_jobs ->
- arrives_in arr_seq j /\
- job_task j = tsk_k /\
- interference_caused_by j t1 t2 != 0 /\
- j \in jobs_scheduled_between sched t1 t2.
- Proof.
- intros j LT.
- rewrite -interference_bound_edf_job_in_same_sequence mem_filter in LT.
- move: LT => /andP [/andP [/eqP JOBi SERVi] INi]; repeat split; try (by done).
- unfold jobs_scheduled_between in *; rewrite mem_undup in INi.
- apply mem_bigcat_nat_exists in INi; des.
- rewrite mem_scheduled_jobs_eq_scheduled in INi.
- by apply (H_jobs_come_from_arrival_sequence j i).
- Qed.
-
- (* ...and consecutive jobs are ordered by arrival. *)
- Lemma interference_bound_edf_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- (* Also, for any job of task tsk_k, the interference is bounded by the task cost. *)
- Lemma interference_bound_edf_interference_le_task_cost :
- forall j,
- j \in interfering_jobs ->
- interference_caused_by j t1 t2 <= task_cost tsk_k.
- Proof.
- rename H_valid_job_parameters into PARAMS.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- intros j IN.
- feed (interference_bound_edf_all_jobs_from_tsk_k j);
- first by rewrite -interference_bound_edf_job_in_same_sequence.
- move => [ARRj [TSKj [_ SCHEDj]]].
- specialize (PARAMS j ARRj); des.
- apply leq_trans with (n := service_during sched j t1 t2);
- first by apply job_interference_le_service.
- try ( by apply cumulative_service_le_task_cost with (job_task0 := job_task)
- (task_deadline0 := task_deadline) (job_cost0 := job_cost)
- (job_deadline0 := job_deadline); try (by done) ) ||
- by apply cumulative_service_le_task_cost with (job_task := job_task)
- (task_deadline := task_deadline) (job_cost := job_cost)
- (job_deadline := job_deadline); try (by done).
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section InterferenceFewJobs.
-
- Hypothesis H_few_jobs: size sorted_jobs <= n_k.
-
- Lemma interference_bound_edf_holds_for_at_most_n_k_jobs :
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2 <=
- interference_bound.
- Proof.
- rewrite -[\sum_(_ <- _ | _) _]addn0 leq_add //.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk_k);
- last by rewrite big_const_seq iter_addn addn0 mulnC leq_mul2r; apply/orP; right.
- {
- rewrite [\sum_(_ <- _) interference_caused_by _ _ _]big_seq_cond.
- rewrite [\sum_(_ <- _) task_cost _]big_seq_cond.
- apply leq_sum; intros i; move/andP => [INi _].
- rewrite -interference_bound_edf_job_in_same_sequence in INi.
- by apply interference_bound_edf_interference_le_task_cost.
- }
- Qed.
-
- End InterferenceFewJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0. *)
- Section InterferenceManyJobs.
-
- Hypothesis H_many_jobs: n_k < size sorted_jobs.
-
- (* This trivially implies that there's at least one job. *)
- Lemma interference_bound_edf_at_least_one_job: size sorted_jobs > 0.
- Proof.
- by apply leq_ltn_trans with (n := n_k).
- Qed.
-
- (* Let j_fst be the first job, and a_fst its arrival time. *)
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let a_fst := job_arrival j_fst.
-
- (* In this section, we prove some basic lemmas about j_fst. *)
- Section FactsAboutFirstJob.
-
- (* The first job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_fst_is_job_of_tsk_k :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk_k /\
- interference_caused_by j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth,
- interference_bound_edf_at_least_one_job.
- Qed.
-
- (* The deadline of j_fst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_fst_deadline :
- job_deadline j_fst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- by specialize (PARAMS j_fst FSTarr); des; rewrite PARAMS2 FSTtask.
- Qed.
-
- (* The deadline of j_i is the deadline of tsk_i. *)
- Lemma interference_bound_edf_j_i_deadline :
- job_deadline j_i = task_deadline tsk_i.
- Proof.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS,
- H_job_of_tsk_i into JOBtsk.
- by specialize (PARAMS j_i H_j_i_arrives); des; rewrite PARAMS2 JOBtsk.
- Qed.
-
- (* If j_fst completes by its response-time bound, then t1 <= a_fst + R_k,
- where t1 is the beginning of the time window (arrival of j_i). *)
- Lemma interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval :
- completed job_cost sched j_fst (a_fst + J_k + R_k) ->
- t1 <= a_fst + J_k + R_k.
- Proof.
- intros RBOUND.
- rewrite leqNgt; apply/negP; unfold not; intro BUG.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [_ [_ [FSTserv _]]].
- move: FSTserv => /negP FSTserv; apply FSTserv.
- rewrite -leqn0; apply leq_trans with (n := service_during sched j_fst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- unfold service_during.
- by ( try ( apply cumulative_service_after_job_rt_zero with
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (R := J_k + R_k) ) ||
- apply cumulative_service_after_job_rt_zero with
- (job_arrival := job_arrival) (job_cost := job_cost) (R := J_k + R_k) );
- try (by done); rewrite addnA; last by apply ltnW.
- Qed.
-
- End FactsAboutFirstJob.
-
- (* Now, let's prove the interference bound for the particular case of a single job.
- This case must be solved separately because the single job can simultaneously
- be carry-in and carry-out job, so its response time is not necessarily
- bounded by R_k (from the hypothesis H_all_previous_jobs_completed_on_time). *)
- Section InterferenceSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_only_one_job: size sorted_jobs = 1.
-
- (* Since there's only one job, we simplify the terms in the interference bound. *)
- Lemma interference_bound_edf_simpl_when_there's_one_job :
- D_i %% p_k - (D_k - R_k - J_k) = D_i - (D_k - R_k - J_k).
- Proof.
- rename H_many_jobs into NUM,
- H_valid_task_parameters into TASK_PARAMS,
- H_tsk_k_in_task_set into INk.
- unfold valid_sporadic_taskset, is_valid_sporadic_task,
- interference_bound, edf_specific_interference_bound in *.
- rewrite H_only_one_job in NUM.
- rewrite ltnS leqn0 in NUM; move: NUM => /eqP EQnk.
- move: EQnk => /eqP EQnk; unfold n_k, div_floor in EQnk.
- rewrite -leqn0 leqNgt divn_gt0 in EQnk;
- last by specialize (TASK_PARAMS tsk_k INk); des.
- by rewrite -ltnNge in EQnk; rewrite modn_small //.
- Qed.
-
-
- (* Next, we show that if j_fst completes by its response-time bound R_k,
- then then interference bound holds. *)
- Section ResponseTimeOfSingleJobBounded.
-
- Hypothesis H_j_fst_completed_by_rt_bound :
- completed job_cost sched j_fst (a_fst + J_k + R_k).
-
- Lemma interference_bound_edf_holds_for_single_job_that_completes_on_time :
- job_interference job_arrival job_cost job_jitter sched j_i j_fst t1 t2
- <= D_i - (D_k - R_k - J_k).
- Proof.
- rename H_j_fst_completed_by_rt_bound into RBOUND.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval RBOUND.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [ARRfst [_ [LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- destruct (D_k - R_k - J_k <= D_i) eqn:LEdk; last first.
- {
- apply negbT in LEdk; rewrite -ltnNge in LEdk.
- apply leq_trans with (n := 0); last by done.
- apply leq_trans with (n := job_interference job_arrival job_cost
- job_jitter sched j_i j_fst (a_fst + J_k + R_k) t2); last first.
- {
- apply leq_trans with (n := service_during sched j_fst (a_fst + J_k + R_k) t2);
- first by apply job_interference_le_service.
- unfold service_during; rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_after_job_rt_zero with
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (R := J_k + R_k);
- try (by done); rewrite addnA // leqnn ) ||
- by apply cumulative_service_after_job_rt_zero with
- (job_arrival := job_arrival) (job_cost := job_cost) (R := J_k + R_k);
- try (by done); rewrite addnA // leqnn.
- }
- {
- apply extend_sum; last by apply leqnn.
- rewrite -(leq_add2r D_i).
- rewrite interference_bound_edf_j_fst_deadline
- interference_bound_edf_j_i_deadline in LEdl.
- apply leq_trans with (n := a_fst + D_k); last first.
- {
- apply leq_trans with (n := job_arrival j_i + D_i); first by done.
- by rewrite leq_add2r leq_addr.
- }
- rewrite -2!addnA leq_add2l.
- rewrite addnA.
- by apply ltnW; rewrite -ltn_subRL addnC subnDA.
- }
- }
- apply leq_trans with (n := job_interference job_arrival job_cost job_jitter sched j_i j_fst a_i t2);
- first by apply extend_sum; [by apply leq_addr | by apply leqnn].
-
- rewrite -(leq_add2r (D_k - R_k - J_k)) addnBAC // -addnBA // subnn addn0.
-
- assert (SUBST: D_k - R_k - J_k = \sum_(a_fst + J_k + R_k <= i < a_fst + D_k) 1).
- {
- rewrite big_const_nat iter_addn mul1n addn0.
- rewrite [_ + D_k]addnC.
- rewrite -subnBA; last by rewrite -addnA leq_addr.
- rewrite [a_fst + _]addnC -addnA [a_fst + R_k]addnC addnA.
- rewrite -addnBA // subnn addn0.
- by rewrite [_ + R_k]addnC subnDA.
- }
-
- apply leq_trans with (n := job_interference job_arrival job_cost job_jitter sched j_i
- j_fst a_i (a_fst + D_k) + (D_k - R_k - J_k)).
- {
- rewrite leq_add2r.
- destruct (t2 <= a_fst + J_k + R_k) eqn:LEt2.
- {
- apply extend_sum; first by apply leqnn.
- apply leq_trans with (n := a_fst + J_k + R_k); first by done.
- rewrite -addnA leq_add2l.
- by apply H_R_k_le_deadline.
- }
- {
- unfold job_interference.
- apply negbT in LEt2; rewrite -ltnNge in LEt2.
- rewrite -> big_cat_nat with (n := a_fst + J_k + R_k);
- [simpl | | by apply ltnW]; last first.
- {
- by apply leq_trans with (n := t1); first by apply leq_addr.
- }
- apply leq_trans with (n := job_interference job_arrival job_cost job_jitter sched j_i j_fst a_i
- (a_fst + J_k + R_k) + service_during sched j_fst (a_fst + J_k + R_k) t2).
- {
- rewrite leq_add2l.
- by apply job_interference_le_service.
- }
- unfold service_during.
- ( try ( rewrite -> cumulative_service_after_job_rt_zero with (job_cost0 := job_cost)
- (job_arrival0 := job_arrival) (R := J_k + R_k) ) ||
- rewrite -> cumulative_service_after_job_rt_zero with (job_cost := job_cost)
- (job_arrival := job_arrival) (R := J_k + R_k));
- rewrite ?addnA //.
- rewrite addn0; apply extend_sum; first by done.
- rewrite -addnA leq_add2l.
- by apply H_R_k_le_deadline.
- }
- }
-
- unfold job_interference.
- rewrite -> big_cat_nat with (n := a_fst + J_k + R_k);
- [simpl | | ]; last first.
- {
- rewrite -addnA leq_add2l.
- by apply H_R_k_le_deadline.
- }
- {
- by apply leq_trans with (n := t1); first by apply leq_addr.
- }
- apply leq_trans with (n := job_interference job_arrival job_cost job_jitter sched j_i j_fst a_i
- (a_fst + J_k + R_k) + service_during sched j_fst (a_fst + J_k + R_k) (a_fst + D_k) + (D_k - R_k - J_k)).
- {
- rewrite leq_add2r leq_add2l.
- by apply job_interference_le_service.
- }
- unfold service_during.
- ( try ( rewrite -> cumulative_service_after_job_rt_zero with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) (R:=J_k + R_k) ) ||
- rewrite -> cumulative_service_after_job_rt_zero with (job_arrival := job_arrival)
- (job_cost := job_cost) (R:=J_k + R_k));
- rewrite ?addnA //.
- rewrite addn0.
- apply leq_trans with (n := (\sum_(a_i <= t < a_fst + J_k + R_k) 1) +
- \sum_(a_fst + J_k + R_k <= t < a_fst + D_k) 1).
- {
- apply leq_add; last by rewrite SUBST.
- simpl_sum_const; rewrite -{1}[_ + R_k](addKn a_i) -addnBA //;
- last by apply leq_trans with (n := t1); first by apply leq_addr.
- by apply job_interference_le_delta.
- }
-
- rewrite -big_cat_nat; simpl; last by rewrite -addnA leq_add2l H_R_k_le_deadline.
- {
- simpl_sum_const; rewrite leq_subLR; unfold D_i, D_k, t1, a_fst.
- by rewrite -interference_bound_edf_j_fst_deadline
- -interference_bound_edf_j_i_deadline.
- }
- by apply leq_trans with (n := t1); first by apply leq_addr.
- Qed.
-
- End ResponseTimeOfSingleJobBounded.
-
- (* Else, if j_fst did not complete by its response-time bound, then
- we need a separate proof. *)
- Section ResponseTimeOfSingleJobNotBounded.
-
- Hypothesis H_j_fst_not_complete_by_rt_bound :
- ~~ completed job_cost sched j_fst (a_fst + J_k + R_k).
-
- (* This trivially implies that a_fst + R_k lies after the end of the interval,
- otherwise j_fst would have completed by its response-time bound. *)
- Lemma interference_bound_edf_response_time_bound_of_j_fst_after_interval :
- job_arrival j_fst + J_k + R_k >= job_arrival j_i + J_i + delta.
- Proof.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- rewrite leqNgt; apply/negP; intro LT.
- move: H_j_fst_not_complete_by_rt_bound => /negP BUG; apply BUG.
- by apply H_all_previous_jobs_completed_on_time.
- Qed.
-
- (* If the slack is too big (D_i < D_k - R_k - J_k), j_fst causes no interference. *)
- Lemma interference_bound_edf_holds_for_single_job_with_big_slack :
- D_i < D_k - R_k - J_k ->
- interference_caused_by j_fst t1 t2 = 0.
- Proof.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- have PARAMS := H_valid_job_parameters j_i H_j_i_arrives; des.
- intro LTdk.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- rewrite 2!ltn_subRL addnA [R_k + _]addnC in LTdk.
- rewrite -(ltn_add2l a_fst) 2!addnA in LTdk.
- apply leq_ltn_trans with (m := t1 + D_i) in LTdk; last first.
- {
- rewrite leq_add2r.
- apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- apply leq_trans with (n := job_arrival j_i + J_i + delta).
- {
- unfold J_i;rewrite leq_add2r leq_add2l.
- rewrite -H_job_of_tsk_i; apply PARAMS0.
- }
- by apply interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- }
- apply/eqP; rewrite -[_ _ _ _ == 0]negbK; apply/negP; red; intro BUG.
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in BUG; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in BUG; try (by done).
- rewrite interference_bound_edf_j_fst_deadline
- interference_bound_edf_j_i_deadline in BUG.
- apply leq_ltn_trans with (m := job_arrival j_i + D_i) in LTdk;
- last by rewrite leq_add2r leq_addr.
- by apply (leq_trans LTdk) in BUG; rewrite ltnn in BUG.
- Qed.
-
- (* Else, if the slack is small, j_fst causes interference for no longer than
- D_i - (D_k - R_k - J_k). *)
- Lemma interference_bound_edf_holds_for_single_job_with_small_slack :
- D_i >= D_k - R_k - J_k ->
- interference_caused_by j_fst t1 t2 <= D_i - (D_k - R_k - J_k).
- Proof.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- have PARAMS := H_valid_job_parameters j_i H_j_i_arrives; des.
- intro LEdk.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTtask [_ [LEdl _]]].
- have LTr := interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- apply leq_subRL_impl; rewrite addnC.
- apply leq_trans with (n := job_interference job_arrival job_cost job_jitter sched j_i
- j_fst t1 (job_arrival j_fst + J_k + R_k) + (D_k - R_k - J_k)).
- {
- rewrite leq_add2r; apply extend_sum; first by apply leqnn.
- apply leq_trans with (n := job_arrival j_i + J_i + delta);
- last by done.
- rewrite leq_add2r leq_add2l.
- by unfold J_i; rewrite -H_job_of_tsk_i; apply PARAMS0.
- }
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + J_k + R_k) 1 +
- \sum_(a_fst + J_k + R_k <= t < a_fst + D_k)1).
- {
- apply leq_add; unfold job_interference.
- {
- simpl_sum_const.
- rewrite -{1}[job_arrival j_fst + J_k + R_k](addKn t1) -addnBA;
- first by apply job_interference_le_delta.
- apply leq_trans with (n := a_i + J_i + delta); last by done.
- apply leq_trans with (n := a_i + J_i); last by apply leq_addr.
- by rewrite leq_add2l /J_i -H_job_of_tsk_i; apply PARAMS0.
- }
- simpl_sum_const; rewrite addnC.
- rewrite -subnBA; last by rewrite -addnA leq_addr.
- rewrite [a_fst + _]addnC -addnA [a_fst + _]addnC addnA.
- rewrite -addnBA // subnn addn0.
- by rewrite addnC subnDA.
- }
- rewrite -big_cat_nat; simpl; last 2 first.
- {
- apply leq_trans with (n := t1 + delta); first by apply leq_addr.
- apply leq_trans with (n := job_arrival j_i + J_i + delta).
- {
- rewrite leq_add2r leq_add2l.
- unfold J_i; rewrite -H_job_of_tsk_i; apply PARAMS0.
- }
- by apply interference_bound_edf_response_time_bound_of_j_fst_after_interval.
- }
- {
- by rewrite -addnA leq_add2l; apply H_R_k_le_deadline.
- }
- rewrite big_const_nat iter_addn mul1n addn0 leq_subLR.
- unfold D_i, D_k, t1, a_fst.
- rewrite -interference_bound_edf_j_fst_deadline
- -interference_bound_edf_j_i_deadline.
- apply leq_trans with (n := a_i + job_deadline j_i);
- last by rewrite leq_add2r leq_addr.
- try ( by apply interference_under_edf_implies_shorter_deadlines with (arr_seq0 := arr_seq)
- (job_arrival0 := job_arrival) (job_deadline0 := job_deadline) in LEdl ) ||
- by apply interference_under_edf_implies_shorter_deadlines with (arr_seq := arr_seq)
- (job_arrival := job_arrival) (job_deadline := job_deadline) in LEdl.
- Qed.
-
- End ResponseTimeOfSingleJobNotBounded.
-
- (* By combining the results above, we prove that the interference caused by the single job
- is bounded by D_i - (D_k - R_k), ... *)
- Lemma interference_bound_edf_interference_of_j_fst_limited_by_slack :
- interference_caused_by j_fst t1 t2 <= D_i - (D_k - R_k - J_k).
- Proof.
- destruct (completed job_cost sched j_fst (a_fst + J_k + R_k)) eqn:COMP;
- first by apply interference_bound_edf_holds_for_single_job_that_completes_on_time.
- apply negbT in COMP.
- destruct (ltnP D_i (D_k - R_k - J_k)) as [LEdk | LTdk].
- by rewrite interference_bound_edf_holds_for_single_job_with_big_slack.
- by apply interference_bound_edf_holds_for_single_job_with_small_slack.
- Qed.
-
- (* ... and thus the interference bound holds. *)
- Lemma interference_bound_edf_holds_for_a_single_job :
- interference_caused_by j_fst t1 t2 <= interference_bound.
- Proof.
- have ONE := interference_bound_edf_simpl_when_there's_one_job.
- have SLACK := interference_bound_edf_interference_of_j_fst_limited_by_slack.
- rename H_many_jobs into NUM, H_only_one_job into SIZE.
- unfold interference_caused_by, interference_bound, edf_specific_interference_bound.
- fold D_i D_k p_k n_k.
- rewrite SIZE ltnS leqn0 in NUM; move: NUM => /eqP EQnk.
- rewrite EQnk mul0n add0n.
- rewrite leq_min; apply/andP; split.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite SIZE.
- }
- by rewrite ONE; apply SLACK.
- Qed.
-
- End InterferenceSingleJob.
-
- (* Next, consider the other case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section InterferenceTwoOrMoreJobs.
-
- (* Assume there are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- (* Let j_lst be the last job of the sequence and a_lst its arrival time. *)
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
- Let a_lst := job_arrival j_lst.
-
- (* In this section, we prove some basic lemmas about the first and last jobs. *)
- Section FactsAboutFirstAndLastJobs.
-
- (* The last job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_lst_is_job_of_tsk_k :
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk_k /\
- interference_caused_by j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The deadline of j_lst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_lst_deadline :
- job_deadline j_lst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [LSTtask _]].
- by specialize (PARAMS j_lst LSTarr); des; rewrite PARAMS2 LSTtask.
- Qed.
-
- (* The first job arrives before the last job. *)
- Lemma interference_bound_edf_j_fst_before_j_lst :
- job_arrival j_fst <= job_arrival j_lst.
- Proof.
- rename H_at_least_two_jobs into SIZE.
- unfold j_fst, j_lst; rewrite -[num_mid_jobs.+1]add0n.
- apply prev_le_next; last by rewrite SIZE leqnn.
- by intros i LT; apply interference_bound_edf_jobs_ordered_by_arrival.
- Qed.
-
- (* The last job arrives before the end of the interval. *)
- Lemma interference_bound_edf_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- feed (interference_bound_edf_all_jobs_from_tsk_k j_lst).
- by apply mem_nth; rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- apply LSTserv; apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := service_during sched j_lst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP; unfold service_during.
- rewrite (cumulative_service_before_job_arrival_zero job_arrival) //.
- try ( by apply arrival_before_jitter with (job_jitter0 := job_jitter) ) ||
- by apply arrival_before_jitter with (job_jitter := job_jitter).
- Qed.
-
- (* Since there are multiple jobs, j_fst is far enough from the end of
- the interval that its response-time bound is valid
- (by the assumption H_all_previous_jobs_completed_on_time). *)
- Lemma interference_bound_edf_j_fst_completed_on_time :
- completed job_cost sched j_fst (a_fst + J_k + R_k).
- Proof.
- have PARAMS := H_valid_job_parameters j_i H_j_i_arrives.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job in *; des.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k; des.
- set j_snd := nth elem sorted_jobs 1.
- exploit interference_bound_edf_all_jobs_from_tsk_k.
- {
- by apply mem_nth; instantiate (1 := 1); rewrite H_at_least_two_jobs.
- }
- instantiate (1 := elem); move => [SNDarr [SNDtsk [/eqP SNDserv _]]].
- apply H_all_previous_jobs_completed_on_time; try (by done).
- apply leq_ltn_trans with (n := job_arrival j_snd); last first.
- {
- apply leq_trans with (n := t2); last first.
- {
- unfold t2, t1; rewrite leq_add2r leq_add2l.
- by rewrite -H_job_of_tsk_i; apply PARAMS0.
- }
- rewrite ltnNge; apply/negP; red; intro BUG; apply SNDserv.
- apply/eqP; rewrite -leqn0; apply leq_trans with (n := service_during
- sched j_snd t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- ( try ( apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival));
- try (by done).
- try ( by apply arrival_before_jitter with (job_jitter0 := job_jitter) ) ||
- by apply arrival_before_jitter with (job_jitter := job_jitter).
- }
- apply leq_trans with (n := a_fst + p_k).
- {
- apply leq_trans with (n := job_arrival j_fst + D_k);
- first by rewrite -addnA leq_add2l.
- by rewrite leq_add2l; apply H_constrained_deadlines.
- }
-
- (* Since jobs are sporadic, we know that the first job arrives
- at least p_k units before the second. *)
- unfold p_k; rewrite -FST0.
- apply H_sporadic_tasks; [| by done | by done | by rewrite SNDtsk | ]; last first.
- {
- apply interference_bound_edf_jobs_ordered_by_arrival.
- by rewrite H_at_least_two_jobs.
- }
- red; move => /eqP BUG.
- by rewrite nth_uniq in BUG; rewrite ?SIZE //;
- [ by apply interference_bound_edf_at_least_one_job
- | by rewrite H_at_least_two_jobs
- | by rewrite sort_uniq; apply filter_uniq, undup_uniq].
- Qed.
-
- End FactsAboutFirstAndLastJobs.
-
- (* Next, we prove that the distance between the first and last jobs is at least
- num_mid_jobs + 1 periods. *)
- Lemma interference_bound_edf_many_periods_in_between :
- a_lst - a_fst >= num_mid_jobs.+1 * p_k.
- Proof.
- clear H_tsk_k_in_task_set.
- clear H_at_least_one_cpu H_tsk_i_in_task_set H_delta_le_deadline.
- unfold a_fst, a_lst, j_fst, j_lst.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- rewrite EQnk telescoping_sum;
- last by ins; apply interference_bound_edf_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk_k]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply interference_bound_edf_jobs_ordered_by_arrival.
-
- (* Show that both cur and next are in the arrival sequence *)
- assert (INnth: cur \in interfering_jobs /\ next \in interfering_jobs).
- {
- rewrite 2!interference_bound_edf_job_in_same_sequence; split.
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs; ins.
- by apply mem_nth; destruct sorted_jobs; ins.
- }
- rewrite 2?mem_filter in INnth; des.
-
- feed (interference_bound_edf_all_jobs_from_tsk_k cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (interference_bound_edf_all_jobs_from_tsk_k next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first by move: EQ => /eqP EQ; lia.
- by apply ltn_trans with (n := (size sorted_jobs).-1); destruct sorted_jobs; ins.
- by destruct sorted_jobs; ins.
- by rewrite sort_uniq -/interfering_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk.
- }
- by rewrite leq_subRL_impl // /p_k -INnth.
- Qed.
-
- (* Using the lemma above, we prove that the ratio n_k is at least the number of
- middle jobs + 1, ... *)
- Lemma interference_bound_edf_n_k_covers_middle_jobs_plus_one :
- n_k >= num_mid_jobs.+1.
- Proof.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- rename H_valid_task_parameters into TASK_PARAMS,
- H_tsk_k_in_task_set into INk.
- unfold valid_sporadic_taskset, is_valid_sporadic_task,
- interference_bound, edf_specific_interference_bound in *.
- have DIST := interference_bound_edf_many_periods_in_between.
- rewrite leqNgt; apply/negP; unfold not; intro LTnk; unfold n_k in LTnk.
- rewrite ltn_divLR in LTnk; last by specialize (TASK_PARAMS tsk_k INk); des.
- apply (leq_trans LTnk) in DIST; rewrite ltn_subRL in DIST.
- rewrite -(ltn_add2r (J_k + R_k)) -addnA [D_i + _]addnC addnA in DIST.
- unfold t1 in *.
- apply leq_ltn_trans with (m := job_arrival j_i + D_i) in DIST; last first.
- {
- rewrite addnA leq_add2r.
- by apply leq_trans with (n := job_arrival j_i + job_jitter j_i);
- first by apply leq_addr.
- }
- apply leq_trans with (p := a_lst + D_k) in DIST;
- last by rewrite leq_add2l.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- unfold D_i, D_k in DIST; rewrite interference_bound_edf_j_lst_deadline
- interference_bound_edf_j_i_deadline in LEdl.
- by apply (leq_trans DIST) in LEdl; rewrite ltnn in LEdl.
- Qed.
-
- (* ... which allows bounding the interference of the middle and last jobs
- using n_k multiplied by the cost. *)
- Lemma interference_bound_edf_holds_for_middle_and_last_jobs :
- interference_caused_by j_lst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- interference_caused_by (nth elem sorted_jobs i.+1) t1 t2
- <= n_k * task_cost tsk_k.
- Proof.
- apply leq_trans with (n := num_mid_jobs.+1 * task_cost tsk_k); last first.
- {
- rewrite leq_mul2r; apply/orP; right.
- by apply interference_bound_edf_n_k_covers_middle_jobs_plus_one.
- }
- rewrite mulSn; apply leq_add.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- {
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs) task_cost tsk_k);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < num_mid_jobs) task_cost _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- apply mem_nth; rewrite H_at_least_two_jobs.
- by rewrite ltnS; apply leq_trans with (n := num_mid_jobs).
- }
- Qed.
-
- (* Now, since n_k < sorted_jobs = num_mid_jobs + 2, it follows that
- n_k = num_mid_jobs + 1. *)
- Lemma interference_bound_edf_n_k_equals_num_mid_jobs_plus_one :
- n_k = num_mid_jobs.+1.
- Proof.
- have NK := interference_bound_edf_n_k_covers_middle_jobs_plus_one.
- rename H_many_jobs into NUM, H_at_least_two_jobs into SIZE.
- move: NK; rewrite leq_eqVlt orbC; move => /orP NK; des;
- first by rewrite SIZE ltnS leqNgt NK in NUM.
- by rewrite NK.
- Qed.
-
- (* After proving the bounds of the middle and last jobs, we do the same for
- the first job. This requires a different proof in order to exploit the slack. *)
- Section InterferenceOfFirstJob.
-
- (* As required by the next lemma, in order to move (D_i %% p_k) to the left of
- the inequality (<=), we must show that it is no smaller than the slack. *)
- Lemma interference_bound_edf_remainder_ge_slack :
- D_k - R_k - J_k <= D_i %% p_k.
- Proof.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- have NK := interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
- have DIST := interference_bound_edf_many_periods_in_between.
- rewrite -NK in DIST.
- rewrite 2!leq_subLR addnA [R_k + _]addnC -subndiv_eq_mod.
- fold (div_floor D_i p_k) n_k.
- rewrite addnBA; last by apply leq_trunc_div.
- apply leq_trans with (n := J_k + R_k + D_i - (a_lst - a_fst)); last by apply leq_sub2l.
- rewrite subnBA; last by apply interference_bound_edf_j_fst_before_j_lst.
- rewrite -(leq_add2r a_lst) addnBAC; last first.
- {
- apply leq_trans with (n := t2);
- [by apply ltnW, interference_bound_edf_last_job_arrives_before_end_of_interval|].
- rewrite addnC addnA.
- apply leq_trans with (n := t1 + D_i).
- unfold t2; rewrite leq_add2l; apply H_delta_le_deadline.
- by rewrite leq_add2r addnA; apply AFTERt1.
- }
- rewrite -addnBA // subnn addn0 [D_k + _]addnC.
- apply leq_trans with (n := job_arrival j_i + D_i); last first.
- {
- rewrite [_ + a_fst]addnC 2!addnA leq_add2r.
- by apply leq_trans with (n := t1); first by apply leq_addr.
- }
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [ LSTserv _]]].
- unfold D_i, D_k, a_lst, t1; rewrite -interference_bound_edf_j_lst_deadline
- -interference_bound_edf_j_i_deadline.
- try ( by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LSTserv ) ||
- by apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LSTserv.
- Qed.
-
- (* To conclude that the interference bound holds, it suffices to show that
- this reordered inequality holds. *)
- Lemma interference_bound_edf_simpl_by_moving_to_left_side :
- interference_caused_by j_fst t1 t2 + (D_k - R_k - J_k) + D_i %/ p_k * p_k <= D_i ->
- interference_caused_by j_fst t1 t2 <= D_i %% p_k - (D_k - R_k - J_k).
- Proof.
- intro LE.
- apply leq_subRL_impl.
- by rewrite addnC -subndiv_eq_mod; apply leq_subRL_impl; rewrite addnC.
- Qed.
-
- (* Next, we prove that interference caused by j_fst is bounded by the length
- of the interval [t1, a_fst + R_k), ... *)
- Lemma interference_bound_edf_interference_of_j_fst_bounded_by_response_time :
- interference_caused_by j_fst t1 t2 <= \sum_(t1 <= t < a_fst + J_k + R_k) 1.
- Proof.
- assert (AFTERt1: t1 <= a_fst + J_k + R_k).
- {
- apply interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval.
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- destruct (leqP t2 (a_fst + J_k + R_k)) as [LEt2 | GTt2].
- {
- apply leq_trans with (n := job_interference job_arrival job_cost job_jitter sched j_i
- j_fst t1 (a_fst + J_k + R_k));
- first by apply extend_sum; rewrite ?leqnn.
- simpl_sum_const; rewrite -{1}[_ + _ + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- {
- unfold interference_caused_by, job_interference.
- rewrite -> big_cat_nat with (n := a_fst + J_k + R_k);
- [simpl | by apply AFTERt1 | by apply ltnW].
- rewrite -[\sum_(_ <= _ < _) 1]addn0; apply leq_add.
- {
- simpl_sum_const; rewrite -{1}[_ + _ + R_k](addKn t1) -addnBA //.
- by apply job_interference_le_delta.
- }
- apply leq_trans with (n := service_during sched j_fst (a_fst + J_k + R_k) t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- ( try ( apply cumulative_service_after_job_rt_zero with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) (R := J_k + R_k) ) ||
- apply cumulative_service_after_job_rt_zero with (job_arrival := job_arrival)
- (job_cost := job_cost) (R := J_k + R_k));
- [ by done | rewrite addnA | by rewrite addnA leqnn].
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- Qed.
-
- (* ..., which leads to the following bounds based on interval lengths. *)
- Lemma interference_bound_edf_bounding_interference_with_interval_lengths :
- interference_caused_by j_fst t1 t2 + (D_k - R_k - J_k) + D_i %/ p_k * p_k <=
- \sum_(t1 <= t < a_fst + J_k + R_k) 1
- + \sum_(a_fst + J_k + R_k <= t < a_fst + D_k) 1
- + \sum_(a_fst + D_k <= t < a_lst + D_k) 1.
- Proof.
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + J_k + R_k) 1 + (D_k - R_k - J_k) +
- D_i %/ p_k * p_k).
- {
- rewrite 2!leq_add2r.
- apply interference_bound_edf_interference_of_j_fst_bounded_by_response_time.
- }
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + J_k + R_k) 1 + (D_k - R_k - J_k) +
- (a_lst - a_fst)).
- {
- rewrite leq_add2l; fold (div_floor D_i p_k) n_k.
- rewrite interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
- by apply interference_bound_edf_many_periods_in_between.
- }
- apply leq_trans with (n := \sum_(t1 <= t < a_fst + J_k + R_k) 1 +
- \sum_(a_fst + J_k + R_k <= t < a_fst + D_k) 1 + \sum_(a_fst + D_k <= t < a_lst + D_k) 1).
- {
- rewrite -3!addnA leq_add2l; apply leq_add;
- rewrite big_const_nat iter_addn mul1n addn0;
- [by rewrite subnDl addnC subnDA | by rewrite subnDr leqnn].
- }
- by apply leqnn.
- Qed.
-
- (* To conclude, we show that the concatenation of these interval lengths equals
- (a_lst + D_k) - 1, ... *)
- Lemma interference_bound_edf_simpl_by_concatenation_of_intervals :
- \sum_(t1 <= t < a_fst + J_k + R_k) 1
- + \sum_(a_fst + J_k + R_k <= t < a_fst + D_k) 1
- + \sum_(a_fst + D_k <= t < a_lst + D_k) 1 = (a_lst + D_k) - t1.
- Proof.
- assert (AFTERt1: t1 <= a_fst + J_k + R_k).
- {
- apply interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval.
- by apply interference_bound_edf_j_fst_completed_on_time.
- }
- rewrite -big_cat_nat;
- [simpl | by apply AFTERt1 | by rewrite -addnA leq_add2l; apply H_R_k_le_deadline].
-
- rewrite -big_cat_nat; simpl; last 2 first.
- {
- by apply (leq_trans AFTERt1); rewrite -addnA leq_add2l.
- }
- {
- rewrite leq_add2r; unfold a_fst, a_lst, j_fst, j_lst.
- rewrite -[num_mid_jobs.+1]add0n; apply prev_le_next;
- last by rewrite add0n H_at_least_two_jobs ltnSn.
- by ins; apply interference_bound_edf_jobs_ordered_by_arrival.
- }
- by rewrite big_const_nat iter_addn mul1n addn0.
- Qed.
-
- (* ... which results in proving that (a_lst + D_k) - t1 <= D_i.
- This holds because high-priority jobs have earlier deadlines. Therefore,
- the interference caused by the first job is bounded by D_i %% p_k - (D_k - R_k). *)
- Lemma interference_bound_edf_interference_of_j_fst_limited_by_remainder_and_slack :
- interference_caused_by j_fst t1 t2 <= D_i %% p_k - (D_k - R_k - J_k).
- Proof.
- apply interference_bound_edf_simpl_by_moving_to_left_side.
- apply (leq_trans interference_bound_edf_bounding_interference_with_interval_lengths).
- rewrite interference_bound_edf_simpl_by_concatenation_of_intervals leq_subLR.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [_ [LSTserv _]]].
- unfold D_i, D_k, a_lst, t1; rewrite -interference_bound_edf_j_lst_deadline
- -interference_bound_edf_j_i_deadline.
- apply leq_trans with (n := a_i + job_deadline j_i);
- last by rewrite -addnA leq_add2l leq_addl.
- try ( by apply interference_under_edf_implies_shorter_deadlines
- with (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LSTserv ) ||
- by apply interference_under_edf_implies_shorter_deadlines
- with (arr_seq := arr_seq) (job_deadline := job_deadline) in LSTserv.
- Qed.
-
- End InterferenceOfFirstJob.
-
- (* Using the lemmas above we show that the interference bound works in the
- case of two or more jobs. *)
- Lemma interference_bound_edf_holds_for_multiple_jobs :
- \sum_(0 <= i < num_mid_jobs.+2)
- interference_caused_by (nth elem sorted_jobs i) t1 t2 <= interference_bound.
- Proof.
- (* Knowing that we have at least two elements, we take first and last out of the sum *)
- rewrite [nth]lock big_nat_recl // big_nat_recr // /= -lock.
- rewrite addnA addnC addnA.
-
- have NK := interference_bound_edf_n_k_equals_num_mid_jobs_plus_one.
-
- (* We use the lemmas we proved to show that the interference bound holds. *)
- unfold interference_bound, edf_specific_interference_bound.
- fold D_i D_k p_k n_k.
- rewrite addnC addnA; apply leq_add;
- first by rewrite addnC interference_bound_edf_holds_for_middle_and_last_jobs.
- rewrite leq_min; apply/andP; split.
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- by apply interference_bound_edf_interference_of_j_fst_limited_by_remainder_and_slack.
- Qed.
-
- End InterferenceTwoOrMoreJobs.
-
- End InterferenceManyJobs.
-
- Theorem interference_bound_edf_bounds_interference :
- x <= interference_bound.
- Proof.
- (* Use the definition of workload based on list of jobs. *)
- apply (leq_trans interference_bound_edf_use_another_definition).
-
- (* We only care about the jobs that cause interference. *)
- rewrite interference_bound_edf_simpl_by_filtering_interfering_jobs.
-
- (* Now we order the list by job arrival time. *)
- rewrite interference_bound_edf_simpl_by_sorting_interfering_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply interference_bound_edf_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs as [| j]; [by rewrite ltn0 in NUM | by exists j].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a single job, or for multiple jobs. *)
- destruct n as [| num_mid_jobs].
- {
- rewrite big_nat_recr // big_geq //.
- rewrite [nth]lock /= -lock add0n.
- by apply interference_bound_edf_holds_for_a_single_job; rewrite SIZE.
- }
- {
- by apply interference_bound_edf_holds_for_multiple_jobs; first by rewrite SIZE.
- }
- Qed.
-
- End MainProof.
-
- End ProofSpecificBound.
-
- (* As required by the proof of convergence of EDF RTA, we show that the
- EDF-specific bound is monotonically increasing with both the size
- of the interval and the value of the previous response-time bounds. *)
- Section MonotonicitySpecificBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Variable tsk tsk_other: sporadic_task.
- Hypothesis H_period_positive: task_period tsk_other > 0.
-
- Variable delta delta' R R': time.
- Hypothesis H_delta_monotonic: delta <= delta'.
- Hypothesis H_response_time_monotonic: R <= R'.
- Hypothesis H_cost_le_rt_bound: task_cost tsk_other <= R.
-
- Lemma interference_bound_edf_monotonic :
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk delta (tsk_other, R) <=
- interference_bound_edf task_cost task_period task_deadline task_jitter tsk delta' (tsk_other, R').
- Proof.
- rename H_response_time_monotonic into LEr, H_delta_monotonic into LEx,
- H_cost_le_rt_bound into LEcost, H_period_positive into GEperiod.
- unfold interference_bound_edf, interference_bound_generic.
- rewrite leq_min; apply/andP; split.
- {
- rewrite leq_min; apply/andP; split.
- apply leq_trans with (n := (minn (W_jitter task_cost task_period task_jitter (fst (tsk_other, R))
- (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1)));
- first by apply geq_minl.
- apply leq_trans with (n := W_jitter task_cost task_period task_jitter (fst (tsk_other, R))
- (snd (tsk_other, R)) delta);
- [by apply geq_minl | by apply W_monotonic].
- apply leq_trans with (n := minn (W_jitter task_cost task_period task_jitter (fst (tsk_other, R)) (snd (tsk_other, R)) delta) (delta - task_cost tsk + 1));
- first by apply geq_minl.
- apply leq_trans with (n := delta - task_cost tsk + 1);
- first by apply geq_minr.
- by rewrite leq_add2r leq_sub2r.
- }
- {
- apply leq_trans with (n := edf_specific_interference_bound task_cost task_period
- task_deadline task_jitter tsk tsk_other R);
- first by apply geq_minr.
- unfold edf_specific_interference_bound; simpl.
- rewrite leq_add2l leq_min; apply/andP; split; first by apply geq_minl.
- apply leq_trans with (n := task_deadline tsk %% task_period tsk_other -
- (task_deadline tsk_other - R - task_jitter tsk_other));
- [by apply geq_minr | by rewrite 2?leq_sub2l 2?leq_sub2r // leq_sub2l].
- }
- Qed.
-
- End MonotonicitySpecificBound.
-
-End InterferenceBoundEDFJitter.
diff --git a/classic/analysis/global/jitter/interference_bound_fp.v b/classic/analysis/global/jitter/interference_bound_fp.v
deleted file mode 100644
index 67e8f525144c9c3dd239920802dc67ebd23202e0..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/interference_bound_fp.v
+++ /dev/null
@@ -1,46 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.jitter.schedule prosa.classic.model.schedule.global.jitter.interference.
-Require Import prosa.classic.analysis.global.jitter.workload_bound prosa.classic.analysis.global.jitter.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundFP.
-
- Import ScheduleWithJitter WorkloadBoundJitter Priority Interference.
- Export InterferenceBoundJitter.
-
- Section Definitions.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- (* Assume an FP policy. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* Recall the interference bound. *)
- Let total_interference_bound := interference_bound_generic task_cost task_period task_jitter tsk delta.
-
- (* The total interference incurred by tsk is bounded by the sum
- of individual task interferences. *)
- Definition total_interference_bound_fp :=
- \sum_((tsk_other, R_other) <- R_prev)
- total_interference_bound (tsk_other, R_other).
-
- End Definitions.
-
-End InterferenceBoundFP.
\ No newline at end of file
diff --git a/classic/analysis/global/jitter/workload_bound.v b/classic/analysis/global/jitter/workload_bound.v
deleted file mode 100644
index f1307a8e647603ff2ae4e63107579944501b4141..0000000000000000000000000000000000000000
--- a/classic/analysis/global/jitter/workload_bound.v
+++ /dev/null
@@ -1,779 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.response_time
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq div fintype bigop path.
-
-Module WorkloadBoundJitter.
-
- Import JobWithJitter SporadicTaskset ScheduleWithJitter ScheduleOfSporadicTask
- TaskArrival ResponseTime Schedulability Workload.
-
- Section WorkloadBoundJitterDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Variable tsk: sporadic_task.
- Variable R_tsk: time. (* Known response-time bound for the task *)
- Variable delta: time. (* Length of the interval *)
-
- (* Bound on the number of jobs that execute completely in the interval *)
- Definition max_jobs_jitter :=
- div_floor (delta + task_jitter tsk + R_tsk - task_cost tsk) (task_period tsk).
-
- (* Bertogna and Cirinei's bound on the workload of a task in an interval of length delta *)
- Definition W_jitter :=
- let e_k := (task_cost tsk) in
- let p_k := (task_period tsk) in
- minn e_k (delta + task_jitter tsk + R_tsk - e_k - max_jobs_jitter * p_k) + max_jobs_jitter * e_k.
-
- End WorkloadBoundJitterDef.
-
- Section BasicLemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- (* Let tsk be any task...*)
- Variable tsk: sporadic_task.
-
- (* ...with period > 0. *)
- Hypothesis H_period_positive: task_period tsk > 0.
-
- (* Let R1 <= R2 be two response-time bounds that
- are larger than the cost of the tsk. *)
- Variable R1 R2: time.
- Hypothesis H_R_lower_bound: R1 >= task_cost tsk.
- Hypothesis H_R1_le_R2: R1 <= R2.
-
- Let workload_bound := W_jitter task_cost task_period task_jitter tsk.
-
- (* Then, Bertogna and Cirinei's workload bound is monotonically increasing. *)
- Lemma W_monotonic :
- forall t1 t2,
- t1 <= t2 ->
- workload_bound R1 t1 <= workload_bound R2 t2.
- Proof.
- intros t1 t2 LEt.
- unfold workload_bound, W_jitter, max_jobs_jitter, div_floor; rewrite 2!subndiv_eq_mod.
- set e := task_cost tsk; set p := task_period tsk; set j := task_jitter tsk.
- set x1 := t1 + j + R1.
- set x2 := t2 + j + R2.
- set delta := x2 - x1.
- rewrite -[x2](addKn x1) -addnBA; fold delta;
- last by rewrite leq_add // leq_add //.
-
- induction delta; first by rewrite addn0 leqnn.
- {
- apply (leq_trans IHdelta).
-
- (* Prove special case for p <= 1. *)
- destruct (leqP p 1) as [LTp | GTp].
- {
- rewrite leq_eqVlt in LTp; move: LTp => /orP LTp; des;
- last by rewrite ltnS in LTp; apply (leq_trans H_period_positive) in LTp.
- {
- rewrite LTp 2!modn1 2!divn1.
- rewrite leq_add2l leq_mul2r; apply/orP; right.
- by rewrite leq_sub2r // leq_add2l.
- }
- }
- (* Harder case: p > 1. *)
- {
- assert (EQ: (x1 + delta.+1 - e) = (x1 + delta - e).+1).
- {
- rewrite -[(x1 + delta - e).+1]addn1.
- rewrite [_+1]addnC addnBA; last first.
- {
- apply (leq_trans H_R_lower_bound).
- by rewrite -addnA addnC -addnA leq_addr.
- }
- by rewrite [1 + _]addnC -addnA addn1.
- } rewrite -> EQ in *; clear EQ.
-
- have DIV := divSn_cases (x1 + delta - e) p GTp; des.
- {
- rewrite DIV leq_add2r leq_min; apply/andP; split;
- first by rewrite geq_minl.
- by apply leq_trans with (n := (x1 + delta - e) %% p);
- [by rewrite geq_minr | by rewrite -DIV0 addn1 leqnSn].
- }
- {
- rewrite -[minn e _]add0n -addnA; apply leq_add; first by ins.
- rewrite -DIV mulnDl mul1n [_ + e]addnC.
- by apply leq_add; [by rewrite geq_minl | by ins].
- }
- }
- }
- Qed.
-
- End BasicLemmas.
-
- Section ProofWorkloadBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_deadline: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...where jobs have valid parameters. *)
- Hypothesis H_jobs_have_valid_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job_with_jitter task_cost task_deadline task_jitter job_cost
- job_deadline job_task job_jitter j.
-
- (* Consider any schedule of this arrival sequence. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Assumption: jobs only execute after the jitter.
- This is used to discard the workload of jobs that arrive after
- the end of the interval t1 + delta. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_execute_after_jitter job_arrival job_jitter sched.
-
- (* Assumption: jobs do not execute after they completed.
- This is used to eliminate jobs that complete before the start of the interval t1. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assumption: Jobs are sequential.
- This is required to use interval lengths as a measure of service. *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* Assumption: sporadic task model.
- This is necessary to conclude that consecutive jobs ordered by arrival times
- are separated by at least 'period' times units. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Before starting the proof, let's give simpler names to the definitions. *)
- Let job_has_completed_by := completed job_cost sched.
-
- Let workload_of (tsk: sporadic_task) (t1 t2: time) :=
- workload job_task sched tsk t1 t2.
-
- (* Now we define the theorem. Let tsk be any task in the taskset. *)
- Variable tsk: sporadic_task.
-
- (* Assumption: the task must have valid parameters:
- a) period > 0 (used in divisions)
- b) deadline of the jobs = deadline of the task
- c) cost <= period
- (used to prove that the distance between the first and last
- jobs is at least (cost + n*period), where n is the number
- of middle jobs. If cost >> period, the claim does not hold
- for every task set. *)
- Hypothesis H_valid_task_parameters:
- is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (* Assumption: the task must have a constrained deadline.
- This is required to prove that n_k (max_jobs) from Bertogna
- and Cirinei's formula accounts for at least the number of
- middle jobs (i.e., number of jobs - 2 in the worst case). *)
- Hypothesis H_constrained_deadline: task_deadline tsk <= task_period tsk.
-
- (* Consider an interval [t1, t1 + delta). *)
- Variable t1 delta: time.
-
- (* Assume that a response-time bound R_tsk for that task in any
- schedule of this processor platform is also given,
- such that R_tsk >= task_cost tsk, and task_jitter tsk + R_tsk <= task_deadline tsk. *)
- Variable R_tsk: time.
-
- Hypothesis H_response_time_ge_cost: R_tsk >= task_cost tsk.
- Hypothesis H_no_deadline_miss: task_jitter tsk + R_tsk <= task_deadline tsk.
-
- Hypothesis H_response_time_bound :
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_arrival j + task_jitter tsk + R_tsk < t1 + delta ->
- job_has_completed_by j (job_arrival j + task_jitter tsk + R_tsk).
-
- Section MainProof.
-
- (* In this section, we prove that the workload of a task in the
- interval [t1, t1 + delta) is bounded by W. *)
-
- (* Let's simplify the names a bit. *)
- Let t2 := t1 + delta.
- Let n_k := max_jobs_jitter task_cost task_period task_jitter tsk R_tsk delta.
- Let workload_bound := W_jitter task_cost task_period task_jitter tsk R_tsk delta.
-
- (* Since we only care about the workload of tsk, we restrict
- our view to the set of jobs of tsk scheduled in [t1, t2). *)
- Let scheduled_jobs :=
- jobs_of_task_scheduled_between job_task sched tsk t1 t2.
-
- (* Now, let's consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := (sort earlier_arrival scheduled_jobs).
-
- (* The first step consists in simplifying the sum corresponding
- to the workload. *)
- Section SimplifyJobSequence.
-
- (* After switching to the definition of workload based on a list
- of jobs, we show that sorting the list preserves the sum. *)
- Lemma workload_bound_simpl_by_sorting_scheduled_jobs :
- workload_joblist job_task sched tsk t1 t2 =
- \sum_(i <- sorted_jobs) service_during sched i t1 t2.
- Proof.
- unfold workload_joblist; fold scheduled_jobs.
- rewrite (perm_big sorted_jobs) /= //.
- by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that both sequences have the same set of elements *)
- Lemma workload_bound_job_in_same_sequence :
- forall j,
- (j \in scheduled_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that all jobs in the sorted sequence is an
- interfering job of task tsk. *)
- Lemma workload_bound_all_jobs_from_tsk :
- forall j_i,
- j_i \in sorted_jobs ->
- arrives_in arr_seq j_i /\
- job_task j_i = tsk /\
- service_during sched j_i t1 t2 != 0 /\
- j_i \in jobs_scheduled_between sched t1 t2.
- Proof.
- rename H_jobs_come_from_arrival_sequence into FROMarr.
- intros j_i LTi.
- rewrite -workload_bound_job_in_same_sequence mem_filter in LTi; des.
- have IN := LTi0.
- unfold jobs_scheduled_between in *; rewrite mem_undup in IN.
- apply mem_bigcat_nat_exists in IN; des.
- rewrite mem_scheduled_jobs_eq_scheduled in IN.
- repeat split; try (by done); first by apply (FROMarr j_i i).
- apply service_implies_cumulative_service with (t := i);
- first by apply/andP; split.
- by rewrite -not_scheduled_no_service negbK.
- Qed.
-
- (* Remember that consecutive jobs are ordered by arrival. *)
- Lemma workload_bound_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section WorkloadNotManyJobs.
-
- Lemma workload_bound_holds_for_at_most_n_k_jobs :
- size sorted_jobs <= n_k ->
- \sum_(i <- sorted_jobs) service_during sched i t1 t2 <=
- workload_bound.
- Proof.
- intros LEnk.
- rewrite -[\sum_(_ <- _ | _) _]add0n leq_add //.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk);
- last by rewrite big_const_seq iter_addn addn0 mulnC leq_mul2r; apply/orP; right.
- rewrite [\sum_(_ <- _) service_during _ _ _ _]big_seq_cond.
- rewrite [\sum_(_ <- _) task_cost _]big_seq_cond.
- apply leq_sum; intros j_i; move/andP => [INi _].
- apply workload_bound_all_jobs_from_tsk in INi; des.
- eapply cumulative_service_le_task_cost;
- [by apply H_completed_jobs_dont_execute | by apply INi0 |].
- by apply H_jobs_have_valid_parameters.
- Qed.
-
- End WorkloadNotManyJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0.
- First, consider the simple case with only one job. *)
- Section WorkloadSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_at_least_one_job: size sorted_jobs > 0.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
-
- (* The first job is an interfering job of task tsk. *)
- Lemma workload_bound_j_fst_is_job_of_tsk :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk /\
- service_during sched j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply workload_bound_all_jobs_from_tsk, mem_nth.
- Qed.
-
- (* The workload bound holds for the single job. *)
- Lemma workload_bound_holds_for_a_single_job :
- \sum_(0 <= i < 1) service_during sched (nth elem sorted_jobs i) t1 t2 <=
- workload_bound.
- Proof.
- unfold workload_bound, W_jitter; fold n_k.
- have INfst := workload_bound_j_fst_is_job_of_tsk; des.
- rewrite big_nat_recr // big_geq // [nth]lock /= -lock add0n.
- destruct n_k; last first.
- {
- rewrite -[service_during _ _ _ _]add0n; rewrite leq_add //.
- rewrite -[service_during _ _ _ _]add0n [_* task_cost tsk]mulSnr.
- apply leq_add; first by done.
- by eapply cumulative_service_le_task_cost;
- [| by apply INfst0 | by apply H_jobs_have_valid_parameters].
- }
- {
- rewrite 2!mul0n addn0 subn0 leq_min; apply/andP; split;
- first by eapply cumulative_service_le_task_cost;
- [| by apply INfst0 | by apply H_jobs_have_valid_parameters].
- rewrite -addnBA // -[service_during _ _ _ _]addn0.
- rewrite -addnA; apply leq_add; last by done.
- by apply cumulative_service_le_delta.
- }
- Qed.
-
- End WorkloadSingleJob.
-
- (* Next, consider the last case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section WorkloadTwoOrMoreJobs.
-
- (* There are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
-
- (* The last job is an interfering job of task tsk. *)
- Lemma workload_bound_j_lst_is_job_of_tsk :
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk /\
- service_during sched j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply workload_bound_all_jobs_from_tsk, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The response time of the first job must fall inside the interval. *)
- Lemma workload_bound_response_time_of_first_job_inside_interval :
- t1 <= job_arrival j_fst + task_jitter tsk + R_tsk.
- Proof.
- rename H_jobs_have_valid_parameters into JOBPARAMS.
- unfold valid_sporadic_job_with_jitter in *.
- rewrite leqNgt; apply /negP; unfold not; intro LTt1.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := 0).
- apply ltn_trans with (n := 1); [by done | by rewrite H_at_least_two_jobs].
- }
- instantiate (1 := elem); move => [FSTARR [FSTtsk [/eqP FSTserv FSTin]]].
- apply FSTserv.
- ( try ( apply cumulative_service_after_job_rt_zero with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) (R := task_jitter tsk + R_tsk) ) ||
- apply cumulative_service_after_job_rt_zero with (job_arrival := job_arrival)
- (job_cost := job_cost) (R := task_jitter tsk + R_tsk));
- [by done | | by rewrite addnA ltnW].
- rewrite addnA; apply H_response_time_bound; try (by done).
- by apply leq_trans with (n := t1); last by apply leq_addr.
- Qed.
-
- (* The arrival of the last job must also fall inside the interval. *)
- Lemma workload_bound_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := num_mid_jobs.+1).
- by rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- }
- instantiate (1 := elem); move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- apply LSTserv.
- apply (cumulative_service_before_job_arrival_zero job_arrival); last by done.
- try ( by apply arrival_before_jitter with (job_jitter0 := job_jitter) ) ||
- by apply arrival_before_jitter with (job_jitter := job_jitter).
- Qed.
-
- (* Next, we upper-bound the service of the first and last jobs using their arrival times. *)
- Lemma workload_bound_service_of_first_and_last_jobs :
- service_during sched j_fst t1 t2 +
- service_during sched j_lst t1 t2 <=
- (job_arrival j_fst + task_jitter tsk + R_tsk - t1) + (t2 - job_arrival j_lst).
- Proof.
- apply leq_add; unfold service_during.
- {
- rewrite -[_ + _ - _]mul1n -[1*_]addn0 -iter_addn -big_const_nat.
- apply leq_trans with (n := \sum_(t1 <= t < job_arrival j_fst + task_jitter tsk + R_tsk)
- service_at sched j_fst t);
- last by apply leq_sum; ins; apply service_at_most_one.
- destruct (job_arrival j_fst + task_jitter tsk + R_tsk < t2) eqn:LEt2; last first.
- {
- unfold t2; apply negbT in LEt2; rewrite -ltnNge in LEt2.
- rewrite -> big_cat_nat with (n := t1 + delta) (p := job_arrival j_fst + task_jitter tsk + R_tsk);
- [by apply leq_addr | by apply leq_addr | by done].
- }
- {
- rewrite -> big_cat_nat with (n := job_arrival j_fst + task_jitter tsk + R_tsk);
- [simpl
- |by apply workload_bound_response_time_of_first_job_inside_interval
- | by apply ltnW].
- rewrite -addnA.
- rewrite [\sum_(_ <= _ < t2)_]
- (cumulative_service_after_job_rt_zero job_arrival job_cost _ _ _
- (task_jitter tsk + R_tsk)); rewrite ?leqnn //; first by rewrite addn0 leqnn.
- rewrite addnA.
- have ALL := workload_bound_all_jobs_from_tsk j_fst.
- feed ALL; first by apply mem_nth; rewrite H_at_least_two_jobs.
- move: ALL => [FSTarr [FSTtsk _]].
- by apply H_response_time_bound.
- }
- }
- {
- rewrite -[_ - _]mul1n -[1 * _]addn0 -iter_addn -big_const_nat.
- destruct (job_arrival j_lst <= t1) eqn:LT.
- {
- apply leq_trans with (n := \sum_(job_arrival j_lst <= t < t2)
- service_at sched j_lst t);
- last by apply leq_sum; ins; apply service_at_most_one.
- rewrite -> big_cat_nat with (m := job_arrival j_lst) (n := t1);
- [by apply leq_addl | by done | by apply leq_addr].
- }
- {
- apply negbT in LT; rewrite -ltnNge in LT.
- rewrite -> big_cat_nat with (n := job_arrival j_lst);
- [| by apply ltnW
- | by apply ltnW, workload_bound_last_job_arrives_before_end_of_interval].
- rewrite /= -[\sum_(_ <= _ < _) 1]add0n; apply leq_add;
- last by apply leq_sum; ins; apply service_at_most_one.
- rewrite (cumulative_service_before_job_arrival_zero job_arrival);
- [by apply leqnn | | by apply leqnn].
- try ( by apply arrival_before_jitter with (job_jitter0 := job_jitter) ) ||
- by apply arrival_before_jitter with (job_jitter := job_jitter).
- }
- }
- Qed.
-
- (* Simplify the expression from the previous lemma. *)
- Lemma workload_bound_simpl_expression_with_first_and_last :
- job_arrival j_fst + task_jitter tsk + R_tsk - t1 + (t2 - job_arrival j_lst) =
- delta + task_jitter tsk + R_tsk - (job_arrival j_lst - job_arrival j_fst).
- Proof.
- have lemma1 := workload_bound_last_job_arrives_before_end_of_interval.
- have lemma2 := workload_bound_response_time_of_first_job_inside_interval.
- rewrite addnBA; last by apply ltnW.
- rewrite addnBAC; last by done.
- rewrite -addnBA; last by apply leq_addr.
-
- rewrite addnC; unfold t2.
- rewrite [t1 + _]addnC -[delta + t1 - _]subnBA // subnn subn0.
- rewrite [_ + R_tsk]addnC addnA.
- rewrite [_ + task_jitter _]addnC.
- rewrite addnA -subnBA; last first.
- {
- unfold j_fst, j_lst; rewrite -[_.+1]add0n.
- apply prev_le_next; last by rewrite add0n H_at_least_two_jobs ltnSn.
- by ins; apply workload_bound_jobs_ordered_by_arrival.
- }
- by rewrite -addnA [R_tsk + _]addnC addnA.
- Qed.
-
- (* Bound the service of the middle jobs. *)
- Lemma workload_bound_service_of_middle_jobs :
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2 <=
- num_mid_jobs * task_cost tsk.
- Proof.
- apply leq_trans with (n := num_mid_jobs * task_cost tsk);
- last by rewrite leq_mul2l; apply/orP; right.
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs) task_cost tsk);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < num_mid_jobs) task_cost _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- exploit workload_bound_all_jobs_from_tsk.
- {
- instantiate (1 := nth elem sorted_jobs i.+1).
- apply mem_nth; rewrite H_at_least_two_jobs.
- by rewrite ltnS; apply leq_trans with (n := num_mid_jobs).
- }
- move => [ARRin [JOBtsk _]].
- by eapply cumulative_service_le_task_cost;
- [by apply H_completed_jobs_dont_execute | | by apply H_jobs_have_valid_parameters].
- Qed.
-
- (* Conclude that the distance between first and last is at least num_mid_jobs + 1 periods. *)
- Lemma workload_bound_many_periods_in_between :
- job_arrival j_lst - job_arrival j_fst >= num_mid_jobs.+1 * (task_period tsk).
- Proof.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- unfold j_fst, j_lst; rewrite EQnk telescoping_sum;
- last by ins; apply workload_bound_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- have ALL := workload_bound_all_jobs_from_tsk.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply workload_bound_jobs_ordered_by_arrival.
-
- feed (workload_bound_all_jobs_from_tsk cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (workload_bound_all_jobs_from_tsk next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first by move: EQ => /eqP EQ; lia.
- by apply ltn_trans with (n := (size sorted_jobs).-1); destruct sorted_jobs; ins.
- by destruct sorted_jobs; ins.
- by rewrite sort_uniq -/scheduled_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk NEXTtsk.
- }
- by rewrite leq_subRL_impl // -CURtsk.
- Qed.
-
- (* Prove that n_k is at least the number of the middle jobs *)
- Lemma workload_bound_n_k_covers_middle_jobs :
- n_k >= num_mid_jobs.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *; des.
- rewrite leqNgt; apply/negP; unfold not; intro LTnk.
- assert (DISTmax: job_arrival j_lst - job_arrival j_fst >= delta + task_period tsk).
- {
- apply leq_trans with (n := n_k.+2 * task_period tsk).
- {
- rewrite -addn1 mulnDl mul1n leq_add2r.
- apply leq_trans with (n := delta + task_jitter tsk + R_tsk - task_cost tsk);
- first by rewrite -addnBA // -addnA leq_addr.
- by apply ltnW, ltn_ceil, PARAMS0.
- }
- apply leq_trans with (num_mid_jobs.+1 * task_period tsk);
- first by rewrite leq_mul2r; apply/orP; right.
- by apply workload_bound_many_periods_in_between.
- }
- rewrite <- leq_add2r with (p := job_arrival j_fst) in DISTmax.
- rewrite addnC addnBAC in DISTmax; last first.
- {
- unfold j_fst, j_lst; rewrite -[_.+1]add0n.
- apply prev_le_next; last by rewrite H_at_least_two_jobs add0n leqnn.
- by ins; apply workload_bound_jobs_ordered_by_arrival.
- }
- rewrite -subnBA // subnn subn0 in DISTmax.
- rewrite [delta + task_period tsk]addnC addnA in DISTmax.
- have BEFOREt2 := workload_bound_last_job_arrives_before_end_of_interval.
- generalize BEFOREt2; move: BEFOREt2; rewrite {1}ltnNge; move => /negP BEFOREt2'.
- intros BEFOREt2; apply BEFOREt2'; clear BEFOREt2'.
- apply leq_trans with (n := job_arrival j_fst + task_deadline tsk + delta);
- last first.
- {
- apply leq_trans with (n := job_arrival j_fst + task_period tsk + delta); last by done.
- by rewrite leq_add2r leq_add2l; apply H_constrained_deadline.
- }
- {
- unfold t2; rewrite leq_add2r.
- apply leq_trans with (n := job_arrival j_fst + task_jitter tsk + R_tsk);
- last by rewrite -addnA leq_add2l.
- by apply workload_bound_response_time_of_first_job_inside_interval.
- }
- Qed.
-
- (* If n_k = num_mid_jobs, then the workload bound holds. *)
- Lemma workload_bound_n_k_equals_num_mid_jobs :
- num_mid_jobs = n_k ->
- service_during sched j_lst t1 t2 +
- service_during sched j_fst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2
- <= workload_bound.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *; des.
- unfold workload_bound, W_jitter; fold n_k.
- move => NK; rewrite -NK.
- apply leq_add;
- last by apply workload_bound_service_of_middle_jobs.
- apply leq_trans with (n := delta + task_jitter tsk + R_tsk -
- (job_arrival j_lst - (job_arrival j_fst))).
- {
- rewrite addnC -workload_bound_simpl_expression_with_first_and_last.
- by apply workload_bound_service_of_first_and_last_jobs.
- }
- rewrite leq_min; apply/andP; split.
- {
- rewrite leq_subLR [_ + task_cost _]addnC -leq_subLR.
- apply leq_trans with (num_mid_jobs.+1 * task_period tsk);
- last by apply workload_bound_many_periods_in_between.
- rewrite NK ltnW // -ltn_divLR; last by apply PARAMS0.
- unfold n_k, max_jobs_jitter, div_floor.
- by unfold n_k, max_jobs_jitter, div_floor.
- }
- {
- rewrite -subnDA; apply leq_sub2l.
- apply leq_trans with (n := num_mid_jobs.+1 * task_period tsk);
- last by apply workload_bound_many_periods_in_between.
- rewrite -addn1 addnC mulnDl mul1n.
- by rewrite leq_add2l; last by apply PARAMS3.
- }
- Qed.
-
- (* If n_k = num_mid_jobs + 1, then the workload bound holds. *)
- Lemma workload_bound_n_k_equals_num_mid_jobs_plus_1 :
- num_mid_jobs.+1 = n_k ->
- service_during sched j_lst t1 t2 +
- service_during sched j_fst t1 t2 +
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2
- <= workload_bound.
- Proof.
- have MID := workload_bound_service_of_middle_jobs.
- rename H_jobs_have_valid_parameters into JOBPARAMS.
- unfold valid_sporadic_job_with_jitter in *; des.
- unfold workload_bound, W_jitter; fold n_k.
- move => NK; rewrite -NK.
- rewrite -{2}addn1 mulnDl mul1n [_* _ + _]addnC addnA addn_minl.
- apply leq_add; last first.
- apply MID.
- rewrite leq_min; apply/andP; split.
- {
- assert (SIZE: 0 < size sorted_jobs).
- by rewrite H_at_least_two_jobs.
- have INfst := workload_bound_j_fst_is_job_of_tsk SIZE elem;
- have INlst := workload_bound_j_lst_is_job_of_tsk; des.
- have PARAMSfst := JOBPARAMS j_fst INfst; des.
- have PARAMSlst := JOBPARAMS j_lst INlst; des.
- try ( by apply leq_add; apply cumulative_service_le_task_cost with
- (task_deadline0 := task_deadline) (job_cost0 := job_cost)
- (job_deadline0 := job_deadline) (job_task0 := job_task) ) ||
- by apply leq_add; apply cumulative_service_le_task_cost with
- (task_deadline := task_deadline) (job_cost := job_cost)
- (job_deadline := job_deadline) (job_task := job_task).
- }
- {
- rewrite subnAC subnK; last first.
- {
- assert (TMP: delta + task_jitter tsk + R_tsk = task_cost tsk + (delta + task_jitter tsk + R_tsk - task_cost tsk));
- first by rewrite subnKC; [by ins | by rewrite -[task_cost _]add0n; apply leq_add].
- rewrite TMP; clear TMP.
- rewrite -{1}[task_cost _]addn0 -addnBA NK; [by apply leq_add | by apply leq_trunc_div].
- }
- apply leq_trans with (n := delta + task_jitter tsk + R_tsk - num_mid_jobs.+1 * task_period tsk);
- last by rewrite leq_sub2r // leq_add2r leq_addr.
- apply leq_trans with (delta + task_jitter tsk +R_tsk - (job_arrival j_lst - job_arrival j_fst)).
- {
- rewrite addnC -workload_bound_simpl_expression_with_first_and_last.
- by apply workload_bound_service_of_first_and_last_jobs.
- }
- {
- by apply leq_sub2l, workload_bound_many_periods_in_between.
- }
- }
- Qed.
-
- End WorkloadTwoOrMoreJobs.
-
- (* Using the lemmas above, we prove the main theorem about the workload bound. *)
- Theorem workload_bounded_by_W :
- workload_of tsk t1 (t1 + delta) <= workload_bound.
- Proof.
- unfold workload_of, workload_bound, W_jitter in *; ins; des.
- fold n_k.
-
- (* Use the definition of workload based on list of jobs. *)
- rewrite workload_eq_workload_joblist.
-
- (* Now we order the list by job arrival time. *)
- rewrite workload_bound_simpl_by_sorting_scheduled_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply workload_bound_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs; [ by rewrite ltn0 in NUM | by exists s].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a singleton set of jobs. *)
- destruct n as [| num_mid_jobs];
- first by apply workload_bound_holds_for_a_single_job; rewrite SIZE.
-
- (* Knowing that we have at least two elements, we take first and last out of the sum *)
- rewrite [nth]lock big_nat_recl // big_nat_recr // /= -lock.
- rewrite addnA addnC addnA.
-
- (* There are two cases to be analyze since n <= n_k < n + 2,
- where n is the number of middle jobs. *)
- have NK := workload_bound_n_k_covers_middle_jobs num_mid_jobs SIZE elem.
- move: NK; rewrite leq_eqVlt orbC leq_eqVlt; move => /orP [NK | /eqP NK].
- move: NK => /orP [/eqP NK | NK]; last by rewrite ltnS leqNgt NK in NUM.
- {
- (* Case 1: n_k = n + 1, where n is the number of middle jobs. *)
- by apply (workload_bound_n_k_equals_num_mid_jobs_plus_1 num_mid_jobs).
- }
- {
- (* Case 2: n_k = n, where n is the number of middle jobs. *)
- by apply (workload_bound_n_k_equals_num_mid_jobs num_mid_jobs).
- }
- Qed.
-
- End MainProof.
-
- End ProofWorkloadBound.
-
-End WorkloadBoundJitter.
diff --git a/classic/analysis/global/parallel/bertogna_edf_comp.v b/classic/analysis/global/parallel/bertogna_edf_comp.v
deleted file mode 100755
index 3006502d987d9e919dab8ffcce85f1165f4f4d69..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/bertogna_edf_comp.v
+++ /dev/null
@@ -1,985 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.global.parallel.bertogna_edf_theory.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationEDF.
-
- Import ResponseTimeAnalysisEDF.
-
- (* In this section, we define the algorithm for Bertogna and Cirinei's
- response-time analysis for EDF scheduling with parallel jobs. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* As input for each iteration of the algorithm, we consider pairs
- of tasks and computed response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider a platform with num_cpus processors. *)
- Variable num_cpus: nat.
-
- (* First, recall the jitter-aware interference bound for EDF, ... *)
- Let I (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline tsk rt_bounds delta.
-
- (* ..., which yields the following response-time bound. *)
- Definition edf_response_time_bound (rt_bounds: seq task_with_response_time)
- (tsk: sporadic_task) (delta: time) :=
- task_cost tsk + div_floor (I rt_bounds tsk delta) num_cpus.
-
- (* Also note that a response-time is only valid if it is no larger
- than the deadline. *)
- Definition R_le_deadline (pair: task_with_response_time) :=
- let (tsk, R) := pair in
- R <= task_deadline tsk.
-
- (* Next we define the fixed-point iteration for computing
- Bertogna's response-time bound of a task set. *)
-
- (* Given a sequence 'rt_bounds' of task and response-time bounds
- from the previous iteration, we compute the response-time
- bound of a single task using the RTA for EDF. *)
- Definition update_bound (rt_bounds: seq task_with_response_time)
- (pair : task_with_response_time) :=
- let (tsk, R) := pair in
- (tsk, edf_response_time_bound rt_bounds tsk R).
-
- (* To compute the response-time bounds of the entire task set,
- We start the iteration with a sequence of tasks and costs:
- <(task1, cost1), (task2, cost2), ...>. *)
- Let initial_state (ts: seq sporadic_task) :=
- map (fun t => (t, task_cost t)) ts.
-
- (* Then, we successively update the the response-time bounds based
- on the slack computed in the previous iteration. *)
- Definition edf_rta_iteration (rt_bounds: seq task_with_response_time) :=
- map (update_bound rt_bounds) rt_bounds.
-
- (* To ensure that the procedure converges, we run the iteration a
- "sufficient" number of times: task_deadline tsk - task_cost tsk + 1.
- This corresponds to the time complexity of the procedure. *)
- Let max_steps (ts: seq sporadic_task) :=
- \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1.
-
- (* This yields the following definition for the RTA. At the end of
- the iteration, we check if all computed response-time bounds
- are less than or equal to the deadline, in which case they are
- valid. *)
- Definition edf_claimed_bounds (ts: seq sporadic_task) :=
- let R_values := iter (max_steps ts) edf_rta_iteration (initial_state ts) in
- if (all R_le_deadline R_values) then
- Some R_values
- else None.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition edf_schedulable (ts: seq sporadic_task) :=
- edf_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of tasks/response-time bounds. *)
- Section SimpleLemmas.
-
- (* Updating a single response-time bound does not modify the task. *)
- Lemma edf_claimed_bounds_unzip1_update_bound :
- forall l rt_bounds,
- unzip1 (map (update_bound rt_bounds) l) = unzip1 l.
- Proof.
- induction l; first by done.
- intros rt_bounds.
- simpl; f_equal; last by done.
- by unfold update_bound; desf.
- Qed.
-
- (* At any point of the iteration, the tasks are the same. *)
- Lemma edf_claimed_bounds_unzip1_iteration :
- forall l k,
- unzip1 (iter k edf_rta_iteration (initial_state l)) = l.
- Proof.
- intros l k; clear -k.
- induction k; simpl.
- {
- unfold initial_state.
- induction l; first by done.
- by simpl; rewrite IHl.
- }
- {
- unfold edf_rta_iteration.
- by rewrite edf_claimed_bounds_unzip1_update_bound.
- }
- Qed.
-
- (* The iteration preserves the size of the list. *)
- Lemma edf_claimed_bounds_size :
- forall l k,
- size (iter k edf_rta_iteration (initial_state l)) = size l.
- Proof.
- intros l k; clear -k.
- induction k; simpl; first by rewrite size_map.
- by rewrite size_map.
- Qed.
-
- (* If the analysis succeeds, the computed response-time bounds are no smaller
- than the task cost. *)
- Lemma edf_claimed_bounds_ge_cost :
- forall l k tsk R,
- (tsk, R) \in (iter k edf_rta_iteration (initial_state l)) ->
- R >= task_cost tsk.
- Proof.
- intros l k tsk R IN.
- destruct k.
- {
- move: IN => /mapP IN; destruct IN as [x IN EQ]; inversion EQ.
- by apply leqnn.
- }
- {
- rewrite iterS in IN.
- move: IN => /mapP IN; destruct IN as [x IN EQ].
- unfold update_bound in EQ; destruct x; inversion EQ.
- by unfold edf_response_time_bound; apply leq_addr.
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadline. *)
- Lemma edf_claimed_bounds_le_deadline :
- forall ts rt_bounds tsk R,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R <= task_deadline tsk.
- Proof.
- intros ts rt_bounds tsk R SOME PAIR; unfold edf_claimed_bounds in SOME.
- destruct (all R_le_deadline (iter (max_steps ts)
- edf_rta_iteration (initial_state ts))) eqn:DEADLINE;
- last by done.
- move: DEADLINE => /allP DEADLINE.
- inversion SOME as [EQ]; rewrite -EQ in PAIR.
- by specialize (DEADLINE (tsk, R) PAIR).
- Qed.
-
- (* The list contains a response-time bound for every task in the task set. *)
- Lemma edf_claimed_bounds_has_R_for_every_task :
- forall ts rt_bounds tsk,
- edf_claimed_bounds ts = Some rt_bounds ->
- tsk \in ts ->
- exists R,
- (tsk, R) \in rt_bounds.
- Proof.
- intros ts rt_bounds tsk SOME IN.
- unfold edf_claimed_bounds in SOME.
- destruct (all R_le_deadline (iter (max_steps ts) edf_rta_iteration (initial_state ts)));
- last by done.
- inversion SOME as [EQ]; clear SOME EQ.
- generalize dependent tsk.
- induction (max_steps ts) as [| step]; simpl in *.
- {
- intros tsk IN; unfold initial_state.
- exists (task_cost tsk).
- by apply/mapP; exists tsk.
- }
- {
- intros tsk IN.
- set prev_state := iter step edf_rta_iteration (initial_state ts).
- fold prev_state in IN, IHstep.
- specialize (IHstep tsk IN); des.
- exists (edf_response_time_bound prev_state tsk R).
- by apply/mapP; exists (tsk, R); [by done | by f_equal].
- }
- Qed.
-
- End SimpleLemmas.
-
- (* In this section, we prove the convergence of the RTA procedure.
- Since we define the RTA procedure as the application of a function
- a fixed number of times, this translates into proving that the value
- of the iteration at (max_steps ts) is equal to the value at (max_steps ts) + 1. *)
- Section Convergence.
-
- (* Consider any sequence of tasks with valid parameters. *)
- Variable ts: seq sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* To simplify, let f denote the RTA procedure. *)
- Let f (k: nat) := iter k edf_rta_iteration (initial_state ts).
-
- (* Since the iteration is applied directly to a list of tasks and response-times,
- we define a corresponding relation "<=" over those lists. *)
-
- (* Let 'all_le' be a binary relation over lists of tasks/response-time bounds.
- It states that every element of list l1 has a response-time bound R that is less
- than or equal to the corresponding response-time bound R' in list l2 (point-wise).
- In addition, the relation states that the tasks of both lists are unchanged. *)
- Let all_le := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- all (fun p => (snd (fst p)) <= (snd (snd p))) (zip l1 l2).
-
- (* Similarly, we define a strict version of 'all_le' called 'one_lt', which states that
- there exists at least one element whose response-time bound increases. *)
- Let one_lt := fun (l1 l2: list task_with_response_time) =>
- (unzip1 l1 == unzip1 l2) &&
- has (fun p => (snd (fst p)) < (snd (snd p))) (zip l1 l2).
-
- (* Next, we prove some basic properties about the relation all_le. *)
- Section RelationProperties.
-
- (* The relation is reflexive, ... *)
- Lemma all_le_reflexive : reflexive all_le.
- Proof.
- intros l; unfold all_le; rewrite eq_refl andTb.
- destruct l; first by done.
- by apply/(zipP t (fun x y => snd x <= snd y)).
- Qed.
-
- (* ... and transitive. *)
- Lemma all_le_transitive: transitive all_le.
- Proof.
- unfold transitive, all_le.
- move => y x z /andP [/eqP ZIPxy LExy] /andP [/eqP ZIPyz LEyz].
- apply/andP; split; first by rewrite ZIPxy -ZIPyz.
- move: LExy => /(zipP _ (fun x y => snd x <= snd y)) LExy.
- move: LEyz => /(zipP _ (fun x y => snd x <= snd y)) LEyz.
- assert (SIZExy: size (unzip1 x) = size (unzip1 y)).
- by rewrite ZIPxy.
- assert (SIZEyz: size (unzip1 y) = size (unzip1 z)).
- by rewrite ZIPyz.
- rewrite 2!size_map in SIZExy; rewrite 2!size_map in SIZEyz.
- destruct y.
- {
- apply size0nil in SIZExy; symmetry in SIZEyz.
- by apply size0nil in SIZEyz; subst.
- }
- apply/(zipP t (fun x y => snd x <= snd y));
- first by rewrite SIZExy -SIZEyz.
- intros i LTi.
- exploit LExy; first by rewrite SIZExy.
- {
- rewrite size_zip -SIZEyz -SIZExy minnn in LTi.
- by rewrite size_zip -SIZExy minnn; apply LTi.
- }
- instantiate (1 := t); intro LE.
- exploit LEyz; first by apply SIZEyz.
- {
- rewrite size_zip SIZExy SIZEyz minnn in LTi.
- by rewrite size_zip SIZEyz minnn; apply LTi.
- }
- by instantiate (1 := t); intro LE'; apply (leq_trans LE).
- Qed.
-
- (* At any step of the iteration, the corresponding list
- is larger than or equal to the initial state. *)
- Lemma bertogna_edf_comp_iteration_preserves_minimum :
- forall step, all_le (initial_state ts) (f step).
- Proof.
- unfold f.
- intros step; destruct step; first by apply all_le_reflexive.
- apply/andP; split.
- {
- assert (UNZIP0 := edf_claimed_bounds_unzip1_iteration ts 0).
- by simpl in UNZIP0; rewrite UNZIP0 edf_claimed_bounds_unzip1_iteration.
- }
- destruct ts as [| tsk0 ts'].
- {
- clear -step; induction step; first by done.
- by rewrite iterSr IHstep.
- }
-
- apply/(zipP (tsk0,0) (fun x y => snd x <= snd y));
- first by rewrite edf_claimed_bounds_size size_map.
-
- intros i LTi; rewrite iterS; unfold edf_rta_iteration at 1.
- have MAP := @nth_map _ (tsk0,0) _ (tsk0,0).
- rewrite size_zip edf_claimed_bounds_size size_map minnn in LTi.
- rewrite MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- destruct (nth (tsk0, 0) (initial_state (tsk0 :: ts')) i) as [tsk_i R_i] eqn:SUBST.
- rewrite SUBST; unfold update_bound.
- unfold initial_state in SUBST.
- have MAP := @nth_map _ tsk0 _ (tsk0, 0).
- rewrite ?MAP // in SUBST; inversion SUBST; clear MAP.
- assert (EQtsk: tsk_i = fst (nth (tsk0, 0) (iter step edf_rta_iteration
- (initial_state (tsk0 :: ts'))) i)).
- {
- have MAP := @nth_map _ (tsk0,0) _ tsk0 (fun x => fst x).
- rewrite -MAP; clear MAP; last by rewrite edf_claimed_bounds_size.
- have UNZIP := edf_claimed_bounds_unzip1_iteration; unfold unzip1 in UNZIP.
- by rewrite UNZIP; symmetry.
- }
- destruct (nth (tsk0, 0) (iter step edf_rta_iteration (initial_state (tsk0 :: ts')))) as [tsk_i' R_i'].
- by simpl in EQtsk; rewrite -EQtsk; subst; apply leq_addr.
- Qed.
-
- (* The application of the function is inductive. *)
- Lemma bertogna_edf_comp_iteration_inductive (P : seq task_with_response_time -> Type) :
- P (initial_state ts) ->
- (forall k, P (f k) -> P (f (k.+1))) ->
- P (f (max_steps ts)).
- Proof.
- by intros P0 Pn; induction (max_steps ts); last by apply Pn.
- Qed.
-
- (* As a last step, we show that edf_rta_iteration preserves order, i.e., for any
- list l1 no smaller than the initial state, and list l2 such that
- l1 <= l2, we have (edf_rta_iteration l1) <= (edf_rta_iteration l2). *)
- Lemma bertogna_edf_comp_iteration_preserves_order :
- forall l1 l2,
- all_le (initial_state ts) l1 ->
- all_le l1 l2 ->
- all_le (edf_rta_iteration l1) (edf_rta_iteration l2).
- Proof.
- rename H_valid_task_parameters into VALID.
- intros x1 x2 LEinit LE.
- move: LE => /andP [/eqP ZIP LE]; unfold all_le.
-
- assert (UNZIP': unzip1 (edf_rta_iteration x1) = unzip1 (edf_rta_iteration x2)).
- {
- by rewrite 2!edf_claimed_bounds_unzip1_update_bound.
- }
-
- apply/andP; split; first by rewrite UNZIP'.
- apply f_equal with (B := nat) (f := fun x => size x) in UNZIP'.
- rename UNZIP' into SIZE.
- rewrite size_map [size (unzip1 _)]size_map in SIZE.
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- destruct x1 as [| p0 x1'], x2 as [| p0' x2']; try (by ins).
- apply/(zipP p0 (fun x y => snd x <= snd y)); first by done.
-
- intros i LTi.
- exploit LE; first by rewrite 2!size_map in SIZE.
- {
- by rewrite size_zip 2!size_map -size_zip in LTi; apply LTi.
- }
- rewrite 2!size_map in SIZE.
- instantiate (1 := p0); intro LEi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map -SIZE minnn in LTi.
- rewrite (nth_map p0);
- last by rewrite size_zip 2!size_map SIZE minnn in LTi.
- unfold update_bound, edf_response_time_bound; desf; simpl.
- rename s into tsk_i, s0 into tsk_i', t into R_i, t0 into R_i', Heq into EQ, Heq0 into EQ'.
- assert (EQtsk: tsk_i = tsk_i').
- {
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0']; simpl in H2; subst.
- have MAP := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0) :: x1').
- have MAP' := @nth_map _ (tsk0',R0) _ tsk0' (fun x => fst x) i ((tsk0', R0') :: x2').
- assert (FSTeq: fst (nth (tsk0', R0)((tsk0', R0) :: x1') i) =
- fst (nth (tsk0',R0) ((tsk0', R0') :: x2') i)).
- {
- rewrite -MAP;
- last by simpl; rewrite size_zip 2!size_map /= -H0 minnn in LTi.
- rewrite -MAP';
- last by simpl; rewrite size_zip 2!size_map /= H0 minnn in LTi.
- by f_equal; simpl; f_equal.
- }
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ.
- apply f_equal with (B := sporadic_task) (f := fun x => fst x) in EQ'.
- by rewrite FSTeq EQ' /= in EQ; rewrite EQ.
- }
- subst tsk_i'; rewrite leq_add2l.
- unfold I, total_interference_bound_edf; apply leq_div2r.
- rewrite 2!big_cons.
- destruct p0 as [tsk0 R0], p0' as [tsk0' R0'].
- simpl in H2; subst tsk0'.
- rename R_i into delta, R_i' into delta'.
- rewrite EQ EQ' in LEi; simpl in LEi.
- rename H0 into SIZE, H1 into UNZIP; clear EQ EQ'.
-
- assert (SUBST: forall l delta,
- \sum_(j <- l | let '(tsk_other, _) := j in
- different_task tsk_i tsk_other)
- (let '(tsk_other, R_other) := j in
- interference_bound_edf task_cost task_period task_deadline tsk_i delta
- (tsk_other, R_other)) =
- \sum_(j <- l | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta j).
- {
- intros l x; clear -l.
- induction l; first by rewrite 2!big_nil.
- by rewrite 2!big_cons; rewrite IHl; desf; rewrite /= Heq in Heq0.
- } rewrite 2!SUBST; clear SUBST.
-
- assert (VALID': valid_sporadic_taskset task_cost task_period task_deadline
- (unzip1 ((tsk0, R0) :: x1'))).
- {
- move: LEinit => /andP [/eqP EQinit _].
- rewrite -EQinit; unfold valid_sporadic_taskset.
- move => tsk /mapP IN. destruct IN as [p INinit EQ]; subst.
- by move: INinit => /mapP INinit; destruct INinit as [tsk INtsk]; subst; apply VALID.
- }
-
- assert (GE_COST: all (fun p => task_cost (fst p) <= snd p) ((tsk0, R0) :: x1')).
- {
- clear LE; move: LEinit => /andP [/eqP UNZIP' LE].
- move: LE => /(zipP _ (fun x y => snd x <= snd y)) LE.
- specialize (LE (tsk0, R0)).
- apply/(all_nthP (tsk0,R0)).
- intros j LTj; generalize UNZIP'; simpl; intro SIZE'.
- have F := @f_equal _ _ size (unzip1 (initial_state ts)).
- apply F in SIZE'; clear F; rewrite /= 3!size_map in SIZE'.
- exploit LE; [by rewrite size_map /= | |].
- {
- rewrite size_zip size_map /= SIZE' minnn.
- by simpl in LTj; apply LTj.
- }
- clear LE; intro LE.
- unfold initial_state in LE.
- have MAP := @nth_map _ tsk0 _ (tsk0,R0).
- rewrite MAP /= in LE;
- [clear MAP | by rewrite SIZE'; simpl in LTj].
- apply leq_trans with (n := task_cost (nth tsk0 ts j));
- [apply eq_leq; f_equal | by done].
- have MAP := @nth_map _ (tsk0, R0) _ tsk0 (fun x => fst x).
- rewrite -MAP; [clear MAP | by done].
- unfold unzip1 in UNZIP'; rewrite -UNZIP'; f_equal.
- clear -ts; induction ts; [by done | by simpl; f_equal].
- }
- move: GE_COST => /allP GE_COST.
-
- assert (LESUM: \sum_(j <- x1' | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta j <= \sum_(j <- x2' | different_task tsk_i (fst j))
- interference_bound_edf task_cost task_period task_deadline tsk_i delta' j).
- {
- set elem := (tsk0, R0); rewrite 2!(big_nth elem).
- rewrite -SIZE.
- rewrite big_mkcond [\sum_(_ <- _ | different_task _ _)_]big_mkcond.
- rewrite big_seq_cond [\sum_(_ <- _ | true) _]big_seq_cond.
- apply leq_sum; intros j; rewrite andbT; intros INj.
- rewrite mem_iota add0n subn0 in INj; move: INj => /andP [_ INj].
- assert (FSTeq: fst (nth elem x1' j) = fst (nth elem x2' j)).
- {
- have MAP := @nth_map _ elem _ tsk0 (fun x => fst x).
- by rewrite -2?MAP -?SIZE //; f_equal.
- } rewrite -FSTeq.
- destruct (different_task tsk_i (fst (nth elem x1' j))) eqn:INTERF;
- last by done.
- {
- exploit (LE elem); [by rewrite /= SIZE | | intro LEj].
- {
- rewrite size_zip 2!size_map /= -SIZE minnn in LTi.
- by rewrite size_zip /= -SIZE minnn; apply (leq_ltn_trans INj).
- }
- simpl in LEj.
- exploit (VALID' (fst (nth elem x1' j))); last intro VALIDj.
- {
- apply/mapP; exists (nth elem x1' j); last by done.
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- exploit (GE_COST (nth elem x1' j)); last intro GE_COSTj.
- {
- by rewrite in_cons; apply/orP; right; rewrite mem_nth.
- }
- unfold is_valid_sporadic_task in *.
- destruct (nth elem x1' j) as [tsk_j R_j] eqn:SUBST1,
- (nth elem x2' j) as [tsk_j' R_j'] eqn:SUBST2.
- rewrite SUBST1 SUBST2 in LEj.
- simpl in FSTeq; rewrite -FSTeq; simpl in LEj; simpl in VALIDj; des.
- by apply interference_bound_edf_monotonic.
- }
- }
- destruct (different_task tsk_i tsk0) eqn:INTERFtsk0; last by done.
- apply leq_add; last by done.
- {
- exploit (LE (tsk0, R0)); [by rewrite /= SIZE | | intro LEj];
- first by instantiate (1 := 0); rewrite size_zip /= -SIZE minnn.
- exploit (VALID' tsk0); first by rewrite in_cons; apply/orP; left.
- exploit (GE_COST (tsk0, R0)); first by rewrite in_cons eq_refl orTb.
- unfold is_valid_sporadic_task; intros GE_COST0 VALID0; des; simpl in LEj.
- by apply interference_bound_edf_monotonic.
- }
- Qed.
-
- (* It follows from the properties above that the iteration is monotonically increasing. *)
- Lemma bertogna_edf_comp_iteration_monotonic: forall k, all_le (f k) (f k.+1).
- Proof.
- unfold f; intros k.
- apply fun_mon_iter_mon_generic with (x1 := k) (x2 := k.+1);
- try (by done);
- [ by apply all_le_reflexive
- | by apply all_le_transitive
- | by apply bertogna_edf_comp_iteration_preserves_order
- | by apply bertogna_edf_comp_iteration_preserves_minimum].
- Qed.
-
- End RelationProperties.
-
- (* Knowing that the iteration is monotonically increasing (with respect to all_le),
- we show that the RTA procedure converges to a fixed point. *)
-
- (* First, note that when there are no tasks, the iteration trivially converges. *)
- Lemma bertogna_edf_comp_f_converges_with_no_tasks :
- size ts = 0 ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- intro SIZE; destruct ts; last by inversion SIZE.
- unfold max_steps; rewrite big_nil /=.
- by unfold edf_rta_iteration.
- Qed.
-
- (* Otherwise, if the iteration reached a fixed point before (max_steps ts), then
- the value at (max_steps ts) is still at a fixed point. *)
- Lemma bertogna_edf_comp_f_converges_early :
- (exists k, k <= max_steps ts /\ f k = f k.+1) ->
- f (max_steps ts) = f (max_steps ts).+1.
- Proof.
- by intros EX; des; apply fixedpoint.iter_fix with (k := k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume that there are tasks. *)
- Hypothesis H_at_least_one_task: size ts > 0.
-
- (* Assume that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps ts -> f k != f k.+1.
-
- (* Since the iteration is monotonically increasing, it must be
- strictly increasing. *)
- Lemma bertogna_edf_comp_f_increases :
- forall k,
- k <= max_steps ts -> one_lt (f k) (f k.+1).
- Proof.
- rename H_at_least_one_task into NONEMPTY.
- intros step LEstep; unfold one_lt; apply/andP; split;
- first by rewrite 2!edf_claimed_bounds_unzip1_iteration.
- rewrite -[has _ _]negbK; apply/negP; unfold not; intro ALL.
- rewrite -all_predC in ALL.
- move: ALL => /allP ALL.
- exploit (H_keeps_diverging step); [by done | intro DIFF].
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- }
- des; clear DUMMY.
- move: DIFF => /eqP DIFF; apply DIFF.
- apply eq_from_nth with (x0 := (tsk, 0));
- first by simpl; rewrite size_map.
- {
- intros i LTi.
- remember (nth (tsk, 0)(f step) i) as p_i;rewrite -Heqp_i.
- remember (nth (tsk, 0)(f step.+1) i) as p_i';rewrite -Heqp_i'.
- rename Heqp_i into EQ, Heqp_i' into EQ'.
- exploit (ALL (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- unfold predC; simpl; rewrite -ltnNge; intro LTp.
-
- have GROWS := bertogna_edf_comp_iteration_monotonic step.
- move: GROWS => /andP [_ /allP GROWS].
- exploit (GROWS (p_i, p_i')).
- {
- rewrite EQ EQ'.
- rewrite -nth_zip; last by unfold f; rewrite iterS size_map.
- apply mem_nth; rewrite size_zip.
- unfold f; rewrite iterS size_map.
- by rewrite minnn.
- }
- simpl; intros LE.
- destruct p_i as [tsk_i R_i], p_i' as [tsk_i' R_i'].
- simpl in *.
- assert (EQtsk: tsk_i = tsk_i').
- {
- unfold edf_rta_iteration in EQ'.
- rewrite (nth_map (tsk, 0)) in EQ'; last by done.
- by unfold update_bound in EQ'; desf.
- }
- rewrite EQtsk; f_equal.
- by apply/eqP; rewrite eqn_leq; apply/andP; split.
- }
- Qed.
-
- (* In the end, each response-time bound is so high that the sum
- of all response-time bounds exceeds the sum of all deadlines.
- Contradiction! *)
- Lemma bertogna_edf_comp_rt_grows_too_much :
- forall k,
- k <= max_steps ts ->
- \sum_((tsk, R) <- f k) (R - task_cost tsk) + 1 > k.
- Proof.
- have LT := bertogna_edf_comp_f_increases.
- have MONO := bertogna_edf_comp_iteration_monotonic.
- rename H_at_least_one_task into NONEMPTY.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_valid_task_parameters into VALID.
- intros step LE.
- assert (DUMMY: exists tsk: sporadic_task, True).
- {
- destruct ts as [|tsk0]; first by rewrite ltnn in NONEMPTY.
- by exists tsk0.
- } destruct DUMMY as [elem _].
-
- induction step; first by rewrite addn1.
- {
- rewrite -addn1 ltn_add2r.
- apply leq_ltn_trans with (n := \sum_(i <- f step) (let '(tsk, R) := i in R - task_cost tsk)).
- {
- rewrite -ltnS; rewrite addn1 in IHstep.
- by apply IHstep, ltnW.
- }
- rewrite (eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- rewrite [\sum_(_ <- f step.+1)_](eq_bigr (fun x => snd x - task_cost (fst x)));
- last by ins; destruct i.
- unfold f at 2; rewrite iterS.
- rewrite big_map; fold (f step).
- rewrite -(ltn_add2r (\sum_(i <- f step) task_cost (fst i))).
- rewrite -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun i => snd i)); last first.
- {
- intro i; rewrite andbT; intro IN;
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts step.
- by destruct i; apply GE_COST.
- }
- rewrite [\sum_(_ <- _ | _)(_ - _ + _)](eq_bigr (fun i => snd (update_bound (f step) i))); last first.
- {
- intro i; rewrite andbT; intro IN.
- unfold update_bound; destruct i; simpl.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- apply (edf_claimed_bounds_ge_cost ts step.+1).
- by rewrite iterS; apply/mapP; exists (s, t).
- }
- rewrite -2!big_seq_cond.
-
- specialize (LT step (ltnW LE)).
- specialize (MONO step).
- move: LT => /andP [_ LT]; move: LT => /hasP LT.
- destruct LT as [[x1 x2] INzip LT]; simpl in *.
- move: MONO => /andP [_ /(zipP _ (fun x y => snd x <= snd y)) MONO].
- rewrite 2!(big_nth (elem, 0)).
- apply mem_zip_exists with (elem := (elem, 0)) (elem' := (elem, 0)) in INzip; des;
- last by rewrite size_map.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite -> big_cat_nat with (m := 0) (n := idx) (p := size (f step));
- [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := idx) (n := idx.+1) (p := size (f step));
- [simpl | by done | by done].
- rewrite big_nat_recr /=; last by done.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite [\sum_(idx <= i < idx) _]big_geq // add0n.
- rewrite -addn1 -addnA; apply leq_add.
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0)); [by rewrite size_map | | intro LEi].
- {
- rewrite size_zip; apply (ltn_trans LT2).
- by apply leq_trans with (n := size (f step));
- [by done | by rewrite size_map minnn].
- }
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi;
- last by apply (ltn_trans LT2).
- }
- rewrite -addnA [_ + 1]addnC addnA; apply leq_add.
- {
- unfold edf_rta_iteration in INzip2; rewrite addn1.
- rewrite -> nth_map with (x1 := (elem, 0)) in INzip2; last by done.
- by rewrite -INzip2 -INzip1.
- }
- {
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [LT1 LT2] _].
- exploit (MONO (elem,0));
- [ by rewrite size_map
- | by rewrite size_zip; apply (leq_trans LT2); rewrite size_map minnn | intro LEi ].
- unfold edf_rta_iteration in LEi.
- by rewrite -> nth_map with (x1 := (elem, 0)) in LEi; last by done.
- }
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove that edf_rta_iteration reaches
- a fixed point after (max_steps ts) step, ... *)
- Lemma edf_claimed_bounds_finds_fixed_point_of_list :
- forall rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- valid_sporadic_taskset task_cost task_period task_deadline ts ->
- f (max_steps ts) = edf_rta_iteration (f (max_steps ts)).
- Proof.
- intros rt_bounds SOME VALID.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- unfold edf_claimed_bounds in SOME; desf.
- rename Heq into LE.
- fold (f (max_steps ts)) in *; fold (f (max_steps ts).+1).
-
- (* Either the task set is empty or not. *)
- destruct (size ts == 0) eqn:EMPTY;
- first by apply bertogna_edf_comp_f_converges_with_no_tasks; apply/eqP.
- apply negbT in EMPTY; rewrite -lt0n in EMPTY.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_((max_steps ts).+1), f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- destruct k as [k LTk]; simpl in ITERk.
- apply bertogna_edf_comp_f_converges_early.
- exists k; split; [by apply LTk | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
-
- assert (SAMESUM: \sum_(tsk <- ts) task_cost tsk = \sum_(p <- f (max_steps ts)) task_cost (fst p)).
- {
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_cost x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- by rewrite UNZIP in MAP; rewrite MAP.
- }
-
- (* Show that the sum is less than the sum of all deadlines. *)
- assert (SUM: \sum_(p <- f (max_steps ts)) (snd p - task_cost (fst p)) + 1 <= max_steps ts).
- {
- unfold max_steps at 2; rewrite leq_add2r.
- rewrite -(leq_add2r (\sum_(tsk <- ts) task_cost tsk)).
- rewrite {1}SAMESUM -2!big_split /=.
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- rewrite (eq_bigr (fun x => snd x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- have GE_COST := edf_claimed_bounds_ge_cost ts (max_steps ts).
- fold (f (max_steps ts)) in GE_COST.
- by destruct i; apply GE_COST.
- }
- rewrite (eq_bigr (fun x => task_deadline x)); last first.
- {
- intro i; rewrite andbT; intro IN.
- rewrite addnBAC; first by rewrite -addnBA // subnn addn0.
- by specialize (VALID i IN); des.
- }
- rewrite -2!big_seq_cond.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) (f (max_steps ts))
- (fun x => true) (fun x => task_deadline x).
- have UNZIP := edf_claimed_bounds_unzip1_iteration ts (max_steps ts).
- fold (f (max_steps ts)) in UNZIP; unfold unzip1 in UNZIP.
- rewrite UNZIP in MAP; rewrite MAP.
- rewrite big_seq_cond [\sum_(_ <- _|true)_]big_seq_cond.
- apply leq_sum; intro i; rewrite andbT; intro IN.
- move: LE => /allP LE; unfold R_le_deadline in LE.
- by specialize (LE i IN); destruct i.
- }
-
- have TOOMUCH :=
- bertogna_edf_comp_rt_grows_too_much EMPTY _ (max_steps ts) (leqnn (max_steps ts)).
- exploit TOOMUCH; [| intro BUG].
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | by ins].
- }
- rewrite (eq_bigr (fun i => snd i - task_cost (fst i))) in BUG;
- last by ins; destruct i.
- by apply (leq_ltn_trans SUM) in BUG; rewrite ltnn in BUG.
- Qed.
-
- (* ...and since there cannot be a vector of response-time bounds with values less than
- the task costs, this solution is also the least fixed point. *)
- Lemma edf_claimed_bounds_finds_least_fixed_point :
- forall v,
- all_le (initial_state ts) v ->
- v = edf_rta_iteration v ->
- all_le (f (max_steps ts)) v.
- Proof.
- intros v GE0 EQ.
- apply bertogna_edf_comp_iteration_inductive; first by done.
- intros k GEk.
- rewrite EQ.
- apply bertogna_edf_comp_iteration_preserves_order; last by done.
- by apply bertogna_edf_comp_iteration_preserves_minimum.
- Qed.
-
- (* Therefore, with regard to the response-time bound recurrence, ...*)
-
- (* ..., the individual response-time bounds (elements of the list) are also fixed points. *)
- Theorem edf_claimed_bounds_finds_fixed_point_for_each_bound :
- forall tsk R rt_bounds,
- edf_claimed_bounds ts = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R = edf_response_time_bound rt_bounds tsk R.
- Proof.
- intros tsk R rt_bounds SOME IN.
- have CONV := edf_claimed_bounds_finds_fixed_point_of_list rt_bounds.
- rewrite -iterS in CONV; fold (f (max_steps ts).+1) in CONV.
- unfold edf_claimed_bounds in *; desf.
- exploit (CONV); [by done | by done | intro ITER; clear CONV].
- unfold f in ITER.
-
- cut (update_bound (iter (max_steps ts)
- edf_rta_iteration (initial_state ts)) (tsk,R) = (tsk, R)).
- {
- intros EQ.
- have F := @f_equal _ _ (fun x => snd x) _ (tsk, R).
- by apply F in EQ; simpl in EQ.
- }
- set s := iter (max_steps ts) edf_rta_iteration (initial_state ts).
- fold s in ITER, IN.
- move: IN => /(nthP (tsk,0)) IN; destruct IN as [i LT EQ].
- generalize EQ; rewrite ITER iterS in EQ; intro EQ'.
- fold s in EQ.
- unfold edf_rta_iteration in EQ.
- have MAP := @nth_map _ (tsk,0) _ _ (update_bound s).
- by rewrite MAP // EQ' in EQ; rewrite EQ.
- Qed.
-
- End Convergence.
-
- Section MainProof.
-
- (* Consider a task set ts where... *)
- Variable ts: taskset_of sporadic_task.
-
- (* ...all tasks have valid parameters ... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ...and constrained deadlines.*)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Next, consider any arrival sequence such that...*)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...they have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any platform with at least one CPU such that...*)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after they arrived and no longer
- than their execution costs,... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume a work-conserving scheduler with EDF policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_edf_policy: respects_JLFP_policy job_arrival job_cost arr_seq sched
- (EDF job_arrival job_deadline).
-
- Definition no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Definition no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in edf_claimed_bounds is safe. The proof follows by direct application of
- the main Theorem from bertogna_edf_theory.v. *)
- Theorem edf_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In edf_claimed_bounds ts ->
- response_time_bounded_by tsk R.
- Proof.
- intros tsk R IN j JOBj.
- destruct (edf_claimed_bounds ts) as [rt_bounds |] eqn:SOME; last by done.
- unfold edf_rta_iteration in *.
- have BOUND := bertogna_cirinei_response_time_bound_edf.
- unfold is_response_time_bound_of_task in *.
- apply BOUND with (task_cost := task_cost) (task_period := task_period)
- (arr_seq := arr_seq) (task_deadline := task_deadline) (job_deadline := job_deadline)
- (job_task := job_task) (ts := ts) (tsk := tsk) (rt_bounds := rt_bounds); try (by ins).
- by unfold edf_claimed_bounds in SOME; desf; rewrite edf_claimed_bounds_unzip1_iteration.
- by ins; apply edf_claimed_bounds_finds_fixed_point_for_each_bound with (ts := ts).
- by ins; rewrite (edf_claimed_bounds_le_deadline ts rt_bounds).
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: edf_schedulable ts.
-
- (*... no task misses its deadline. *)
- Theorem taskset_schedulable_by_edf_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (edf_analysis_yields_response_time_bounds).
- have DL := (edf_claimed_bounds_le_deadline ts).
- have HAS := (edf_claimed_bounds_has_R_for_every_task ts).
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- edf_schedulable,
- valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS,
- H_valid_task_parameters into TASKPARAMS,
- H_constrained_deadlines into RESTR,
- H_completed_jobs_dont_execute into COMP,
- H_jobs_must_arrive_to_execute into MUSTARRIVE,
- H_all_jobs_from_taskset into ALLJOBS,
- H_test_succeeds into TEST.
-
- move => tsk INtsk j ARRj JOBtsk.
- destruct (edf_claimed_bounds ts) as [rt_bounds |] eqn:SOME; last by ins.
- exploit (HAS rt_bounds tsk); [by ins | by ins | clear HAS; intro HAS; des].
- have COMPLETED := RLIST tsk R HAS j ARRj JOBtsk.
- exploit (DL rt_bounds tsk R);
- [by ins | by ins | clear DL; intro DL].
- apply leq_trans with (n := service sched j (job_arrival j + R)); last first.
- {
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- apply extend_sum; rewrite // leq_add2l.
- specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS1.
- by rewrite JOBtsk.
- }
- by done.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we conclude that no job misses
- its deadline. *)
- Theorem jobs_schedulable_by_edf_rta :
- forall j, arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_edf_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationEDF.
diff --git a/classic/analysis/global/parallel/bertogna_edf_theory.v b/classic/analysis/global/parallel/bertogna_edf_theory.v
deleted file mode 100644
index 7d76bb6e48e8d6cc068b8820c171adc8a459b949..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/bertogna_edf_theory.v
+++ /dev/null
@@ -1,500 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.schedulability
- prosa.classic.model.schedule.global.response_time.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.interference
- prosa.classic.model.schedule.global.basic.platform.
-Require Import prosa.classic.analysis.global.parallel.workload_bound
- prosa.classic.analysis.global.parallel.interference_bound_edf.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisEDF.
-
- Export Job SporadicTaskset Schedule ScheduleOfSporadicTask Workload Schedulability ResponseTime
- Priority TaskArrival WorkloadBound InterferenceBoundEDF
- Interference Platform.
-
- (* In this section, we prove that any fixed point in Bertogna and
- Cirinei's RTA for EDF scheduling modified to consider (potentially)
- parallel jobs yields a safe response-time bound. This is an extension
- of the analysis found in Chapter 17.1.2 of Baruah et al.'s book
- Multiprocessor Scheduling for Real-time Systems. *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Next, consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs do not execute before their arrival times nor longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that there exists at least one processor. *)
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Assume that the schedule is a work-conserving EDF schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_edf_policy: respects_JLFP_policy job_arrival job_cost arr_seq sched
- (EDF job_arrival job_deadline).
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Next we consider the response-time recurrence.
- Assume that a response-time bound R is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable rt_bounds: seq task_with_response_time.
-
- (* ...for any task in the task set, ... *)
- Hypothesis H_rt_bounds_contains_all_tasks: unzip1 rt_bounds = ts.
-
- (* ...where R is a fixed-point of the response-time recurrence, ... *)
- Let I (tsk: sporadic_task) (delta: time) :=
- total_interference_bound_edf task_cost task_period task_deadline tsk rt_bounds delta.
- Hypothesis H_response_time_is_fixed_point :
- forall tsk R,
- (tsk, R) \in rt_bounds ->
- R = task_cost tsk + div_floor (I tsk R) num_cpus.
-
- (* ..., and R is no larger than the deadline. *)
- Hypothesis H_tasks_miss_no_deadlines:
- forall tsk_other R,
- (tsk_other, R) \in rt_bounds -> R <= task_deadline tsk_other.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Assume that job j did not complete on time, ... *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (job_arrival j + R).
-
- (* ...and that it is the first job not to satisfy its response-time bound. *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_other tsk_other R_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- (tsk_other, R_other) \in rt_bounds ->
- job_arrival j_other + R_other < job_arrival j + R ->
- completed job_cost sched j_other (job_arrival j_other + R_other).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task sched j
- tsk_other (job_arrival j) (job_arrival j + R).
-
- (* ...and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost sched j (job_arrival j) (job_arrival j + R).
-
- (* Recall Bertogna and Cirinei's workload bound ... *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W task_cost task_period tsk_other R_other R.
-
- (*... and the EDF-specific bound, ... *)
- Let edf_specific_bound (tsk_other: sporadic_task) (R_other: time) :=
- edf_specific_interference_bound task_cost task_period task_deadline tsk tsk_other R_other.
-
- (* ... which combined form the interference bound. *)
- Let interference_bound (tsk_other: sporadic_task) (R_other: time) :=
- interference_bound_edf task_cost task_period task_deadline tsk R (tsk_other, R_other).
-
- (* Based on the definition of a different task, ... *)
- Let other_task := different_task tsk.
-
- (* ...let other_tasks denote the set of tasks that are different from tsk. *)
- Let other_tasks :=
- [seq tsk_other <- ts | other_task tsk_other].
-
- (* Now we establish results the interfering tasks. *)
- Section LemmasAboutInterferingTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task and
- response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_response_time_of_tsk_other: (tsk_other, R_other) \in rt_bounds.
-
- (* Note that tsk_other is in task set ts ...*)
- Lemma bertogna_edf_tsk_other_in_ts: tsk_other \in ts.
- Proof.
- by rewrite set_mem -H_rt_bounds_contains_all_tasks; apply/mapP; exists (tsk_other, R_other).
- Qed.
-
- (* Also, R_other is larger than the cost of tsk_other. *)
- Lemma bertogna_edf_R_other_ge_cost :
- R_other >= task_cost tsk_other.
- Proof.
- by rewrite [R_other](H_response_time_is_fixed_point tsk_other);
- first by apply leq_addr.
- Qed.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_edf_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_all_previous_jobs_completed_on_time into BEFOREok,
- H_valid_job_parameters into PARAMS,
- H_valid_task_parameters into TASK_PARAMS,
- H_constrained_deadlines into RESTR,
- H_tasks_miss_no_deadlines into NOMISS.
- unfold x, task_interference.
- have INts := bertogna_edf_tsk_other_in_ts.
- apply leq_trans with (n := workload job_task sched tsk_other
- (job_arrival j) (job_arrival j + R));
- first apply task_interference_le_workload.
- have BOUND := workload_bounded_by_W task_cost task_period task_deadline
- job_arrival job_cost job_task job_deadline arr_seq _ sched.
- apply BOUND; try (by done); last 2 first.
- - by ins; apply TASK_PARAMS.
- - by ins; apply BEFOREok with (tsk_other := tsk_other).
- Qed.
-
- (* Recall that the edf-specific interference bound also holds. *)
- Lemma bertogna_edf_specific_bound_holds :
- x tsk_other <= edf_specific_bound tsk_other R_other.
- Proof.
- rename H_job_of_tsk into JOBtsk, H_all_jobs_from_taskset into FROMTS.
- ( try ( apply interference_bound_edf_bounds_interference with (job_deadline0 := job_deadline)
- (arr_seq0 := arr_seq) (ts0 := ts); try (by done) ) ||
- apply interference_bound_edf_bounds_interference with (job_deadline := job_deadline)
- (arr_seq := arr_seq) (ts := ts); try (by done));
- [ by rewrite -JOBtsk FROMTS
- | by apply bertogna_edf_tsk_other_in_ts
- | by apply H_tasks_miss_no_deadlines
- | by ins; apply H_all_previous_jobs_completed_on_time with (tsk_other := tsk_other)].
- Qed.
-
- End LemmasAboutInterferingTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X >= R - e_k + 1. *)
- Lemma bertogna_edf_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS,
- H_response_time_is_fixed_point into REC,
- H_job_of_tsk into JOBtsk,
- H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite [R](REC tsk) // leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
- apply leq_ltn_trans with (n := (\sum_(job_arrival j <= t < job_arrival j + R)
- backlogged job_arrival job_cost sched j t) +
- service sched j (job_arrival j + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_j_arrives); des; rewrite -JOBtsk.
- }
- unfold service; rewrite service_before_arrival_eq_service_during //.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(job_arrival j <= i < job_arrival j + R) 1);
- first by rewrite big_const_nat iter_addn mul1n addn0 addKn.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [GEi LTi] _].
- destruct (backlogged job_arrival job_cost sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* 1) Next, we prove that the sum of the interference of each task is equal
- to the total interference multiplied by the number of processors. This
- holds because interference only occurs when all processors are busy.
- With this lemma we can relate per-task interference with the total
- interference incurred by j (backlogged time). *)
- Lemma bertogna_edf_interference_on_all_cpus :
- \sum_(tsk_k <- other_tasks) x tsk_k = X * num_cpus.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS,
- H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_jobs_come_from_arrival_sequence into FROMSEQ,
- H_sporadic_tasks into SPO, H_work_conserving into WORK,
- H_tsk_R_in_rt_bounds into INbounds,
- H_all_previous_jobs_completed_on_time into BEFOREok,
- H_tasks_miss_no_deadlines into NOMISS,
- H_rt_bounds_contains_all_tasks into UNZIP,
- H_constrained_deadlines into RESTR.
- unfold sporadic_task_model in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /=.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last first.
- {
- rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- by intros i _; rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- }
- rewrite big_mkcond mul1n /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus) 1);
- last by rewrite big_const_ord iter_addn mul1n addn0.
- apply eq_bigr; intros cpu _.
- specialize (WORK j t H_j_arrives BACK cpu); des.
- move: WORK => /eqP SCHED.
- have ARRother: arrives_in arr_seq j_other.
- by apply (FROMSEQ j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- rewrite big_const_seq iter_addn mul0n 2!addn0; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- unfold different_task.
- apply/eqP; red; intro SAMEtsk.
- assert (SCHED': scheduled sched j_other t).
- {
- unfold scheduled, scheduled_on.
- by apply/existsP; exists cpu; rewrite SCHED.
- }
- clear SCHED; rename SCHED' into SCHED.
- move: (SCHED) => PENDING.
- try ( apply scheduled_implies_pending with (job_cost0 := job_cost) (job_arrival0 := job_arrival)
- in PENDING; try (by done) ) ||
- apply scheduled_implies_pending with (job_cost := job_cost) (job_arrival := job_arrival)
- in PENDING; try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- move: (BEFOREother) => LT; rewrite -(ltn_add2r R) in LT.
- specialize (BEFOREok j_other tsk R ARRother SAMEtsk INbounds LT).
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- try ( apply completion_monotonic with (t0 := job_arrival j_other + R); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j_other + R); try (by done).
- apply leq_trans with (n := job_arrival j); last by done.
- apply leq_trans with (n := job_arrival j_other + task_deadline tsk);
- first by rewrite leq_add2l; apply NOMISS.
- apply leq_trans with (n := job_arrival j_other + task_period tsk);
- first by rewrite leq_add2l; apply RESTR; rewrite -JOBtsk FROMTS.
- rewrite -SAMEtsk; apply SPO; try (by done); [ | by rewrite JOBtsk | by apply ltnW].
- by red; intro EQ; subst; rewrite ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge.
- apply leq_ltn_trans with (n := t); first by done.
- apply leq_trans with (n := job_arrival j + R); first by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by rewrite JOBtsk RESTR // -JOBtsk FROMTS].
- }
- by red; intros EQtsk; subst; rewrite /backlogged SCHED andbF in BACK.
- }
- Qed.
-
- (* 2) Next, using lemmas (0) and (1) we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_edf_sum_exceeds_total_interference:
- \sum_((tsk_other, R_other) <- rt_bounds | other_task tsk_other)
- x tsk_other > I tsk R.
- Proof.
- have GE_COST := bertogna_edf_R_other_ge_cost.
- have ALLBUSY := bertogna_edf_interference_on_all_cpus.
- have TOOMUCH := bertogna_edf_too_much_interference.
- rename H_rt_bounds_contains_all_tasks into UNZIP,
- H_response_time_is_fixed_point into REC.
- apply leq_trans with (n := \sum_(tsk_other <- other_tasks) x tsk_other);
- last first.
- {
- rewrite (eq_bigr (fun i => x (fst i))); last by ins; destruct i.
- assert (FILTER: filter (different_task tsk) (unzip1 rt_bounds) =
- filter (different_task tsk) ts).
- by f_equal.
- unfold other_tasks; rewrite -FILTER; clear FILTER.
- rewrite -[\sum_(_ <- rt_bounds | _)_]big_filter.
- assert (SUBST: [seq i <- rt_bounds
- | let '(tsk_other, _) := i in other_task tsk_other] =
- [seq i <- rt_bounds| other_task (fst i)]).
- {
- by apply eq_filter; red; intro i; destruct i.
- } rewrite SUBST; clear SUBST.
- have MAP := big_map (fun x => fst x) (fun i => true) (fun i => x i).
- by rewrite -MAP; apply eq_leq; f_equal; rewrite filter_map.
- }
-
- apply ltn_div_trunc with (d := num_cpus); first by apply H_at_least_one_cpu.
- rewrite -(ltn_add2l (task_cost tsk)) -REC; last by done.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by apply GE_COST.
- rewrite leq_divRL; last by apply H_at_least_one_cpu.
- rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 3) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k, I_edf, R - e_i + 1).
- This implies that either x_k > W_k or x_k > I_edf, which is a contradiction,
- since both W_k and I_edf are valid task interference bounds. *)
- Lemma bertogna_edf_exists_task_that_exceeds_bound :
- exists tsk_other R_other,
- (tsk_other, R_other) \in rt_bounds /\
- x tsk_other > interference_bound tsk_other R_other.
- Proof.
- have SUM := bertogna_edf_sum_exceeds_total_interference.
- have BOUND := bertogna_edf_workload_bounds_interference.
- have EDFBOUND := bertogna_edf_specific_bound_holds.
- rename H_rt_bounds_contains_all_tasks into UNZIP.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_other, R_other) := tup in
- (tsk_other \in ts) && other_task tsk_other &&
- (x tsk_other > interference_bound tsk_other R_other))
- rt_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- unfold I, total_interference_bound_edf.
- rewrite big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => tsk_k /andP [INBOUNDSk INTERFk]; destruct tsk_k as [tsk_k R_k].
- specialize (ALL (tsk_k, R_k) INBOUNDSk).
- unfold interference_bound_edf; simpl in *.
- by rewrite leq_min; apply/andP; split;
- [by apply BOUND | by apply EDFBOUND].
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MIN].
- move: MIN => /andP [/andP [INts INTERFk] MINk].
- by exists tsk_k, R_k; repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- Section MainProof.
-
- (* Let (tsk, R) be any task to be analyzed, with its response-time bound R. *)
- Variable tsk: sporadic_task.
- Variable R: time.
- Hypothesis H_tsk_R_in_rt_bounds: (tsk, R) \in rt_bounds.
-
- (* Using the lemmas above, we prove that R bounds the response time of task tsk. *)
- Theorem bertogna_cirinei_response_time_bound_edf :
- response_time_bounded_by tsk R.
- Proof.
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + R) as ctime.
-
- revert H_tsk_R_in_rt_bounds.
- generalize dependent R; generalize dependent tsk; generalize dependent j.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj tsk' JOBtsk R' EQc INbounds; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0 tsk R0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- (tsk, R0) \in rt_bounds ->
- job_arrival j0 + R0 < job_arrival j + R' ->
- service sched j0 (job_arrival j0 + R0) >= job_cost j0).
- {
- by ins; apply IH with (tsk := tsk0) (R := R0).
- }
- clear IH.
-
- (* The proof follows by contradiction. Assume that job j does not complete by its
- response-time bound. By the induction hypothesis, all jobs with absolute
- response-time bound t < (job_arrival j + R) have correct response-time bounds. *)
- destruct (completed job_cost sched j (job_arrival j + R')) eqn:NOTCOMP;
- first by done.
- apply negbT in NOTCOMP; exfalso.
-
- (* Next, we derive a contradiction using the previous lemmas. *)
- exploit (bertogna_edf_exists_task_that_exceeds_bound tsk' R' INbounds j ARRj JOBtsk NOTCOMP).
- {
- by ins; apply IH with (tsk := tsk_other) (R := R_other).
- }
- intro EX; destruct EX as [tsk_other [R_other [HP LTmin]]].
- unfold interference_bound_edf, interference_bound_generic in LTmin.
- have BASICBOUND := bertogna_edf_workload_bounds_interference R' j BEFOREok tsk_other R_other HP.
- have EDFBOUND := bertogna_edf_specific_bound_holds tsk' R' j ARRj JOBtsk
- BEFOREok tsk_other R_other HP.
- unfold minn in LTmin; clear -LTmin HP BASICBOUND EDFBOUND tsk; desf.
- {
- by apply (leq_ltn_trans BASICBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- {
- by apply (leq_ltn_trans EDFBOUND) in LTmin; rewrite ltnn in LTmin.
- }
- Qed.
-
- End MainProof.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisEDF.
diff --git a/classic/analysis/global/parallel/bertogna_fp_comp.v b/classic/analysis/global/parallel/bertogna_fp_comp.v
deleted file mode 100644
index e4394284dc969456176d2f12a7c355520aaa890d..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/bertogna_fp_comp.v
+++ /dev/null
@@ -1,694 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.analysis.global.parallel.bertogna_fp_theory.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeIterationFP.
-
- Import ResponseTimeAnalysisFP.
-
- (* In this section, we define the algorithm of Bertogna and Cirinei's
- response-time analysis for FP scheduling with parallel jobs. *)
- Section Analysis.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* During the iterations of the algorithm, we pass around pairs
- of tasks and computed response-time bounds. *)
- Let task_with_response_time := (sporadic_task * time)%type.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider a platform with num_cpus processors, ... *)
- Variable num_cpus: nat.
-
- (* ..., and priorities based on an FP policy. *)
- Variable higher_priority: FP_policy sporadic_task.
-
- (* Next we define the fixed-point iteration for computing
- Bertogna's response-time bound of a task set. *)
-
- (* First, given a sequence of pairs R_prev = <..., (tsk_hp, R_hp)> of
- response-time bounds for the higher-priority tasks, we define an
- iteration that computes the response-time bound of the current task:
-
- R_tsk (0) = task_cost tsk
- R_tsk (step + 1) = f (R step),
-
- where f is the response-time recurrence, step is the number of iterations,
- and R_tsk (0) is the initial state. *)
- Definition per_task_rta (tsk: sporadic_task)
- (R_prev: seq task_with_response_time) (step: nat) :=
- iter step
- (fun t => task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period R_prev t)
- num_cpus)
- (task_cost tsk).
-
- (* To ensure that the iteration converges, we will apply per_task_rta
- a "sufficient" number of times: task_deadline tsk - task_cost tsk + 1.
- This corresponds to the time complexity of the iteration. *)
- Definition max_steps (tsk: sporadic_task) := task_deadline tsk - task_cost tsk + 1.
-
- (* Next we compute the response-time bounds for the entire task set.
- Since high-priority tasks may not be schedulable, we allow the
- computation to fail.
- Thus, given the response-time bound of previous tasks, we either
- (a) append the computed response-time bound (tsk, R) of the current task
- to the list of pairs, or,
- (b) return None if the response-time analysis failed. *)
- Definition fp_bound_of_task hp_pairs tsk :=
- if hp_pairs is Some rt_bounds then
- let R := per_task_rta tsk rt_bounds (max_steps tsk) in
- if R <= task_deadline tsk then
- Some (rcons rt_bounds (tsk, R))
- else None
- else None.
-
- (* The response-time analysis for a given task set is defined
- as a left-fold (reduce) based on the function above.
- This either returns a list of task and response-time bounds, or None. *)
- Definition fp_claimed_bounds (ts: seq sporadic_task) :=
- foldl fp_bound_of_task (Some [::]) ts.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition fp_schedulable (ts: seq sporadic_task) :=
- fp_claimed_bounds ts != None.
-
- (* In the following section, we prove several helper lemmas about the
- list of response-time bounds. The results seem trivial, but must be proven
- nonetheless since the list of response-time bounds is computed with
- a specific algorithm and there are no lemmas in the library for that. *)
- Section SimpleLemmas.
-
- (* First, we show that the first component of the computed list is the set of tasks. *)
- Lemma fp_claimed_bounds_unzip :
- forall ts hp_bounds,
- fp_claimed_bounds ts = Some hp_bounds ->
- unzip1 hp_bounds = ts.
- Proof.
- unfold fp_claimed_bounds in *; intros ts.
- induction ts using last_ind; first by destruct hp_bounds.
- {
- intros hp_bounds SOME.
- destruct (lastP hp_bounds) as [| hp_bounds'].
- {
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- by destruct l.
- }
- rewrite -cats1 foldl_cat /= in SOME.
- unfold fp_bound_of_task at 1 in SOME; simpl in *; desf.
- move: H0 => /eqP EQSEQ.
- rewrite eqseq_rcons in EQSEQ.
- move: EQSEQ => /andP [/eqP SUBST /eqP EQSEQ]; subst.
- unfold unzip1; rewrite map_rcons; f_equal.
- by apply IHts.
- }
- Qed.
-
- (* Next, we show that some properties of the analysis are preserved for the
- prefixes of the list: (a) the tasks do not change, (b) R <= deadline,
- (c) R is computed using the response-time equation, ... *)
- Lemma fp_claimed_bounds_rcons :
- forall ts' hp_bounds tsk1 tsk2 R,
- (fp_claimed_bounds (rcons ts' tsk1) = Some (rcons hp_bounds (tsk2, R)) ->
- (fp_claimed_bounds ts' = Some hp_bounds /\
- tsk1 = tsk2 /\
- R = per_task_rta tsk1 hp_bounds (max_steps tsk1) /\
- R <= task_deadline tsk1)).
- Proof.
- intros ts hp_bounds tsk tsk' R.
- rewrite -cats1.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /=.
- unfold fp_bound_of_task at 1; simpl; desf.
- intros EQ; inversion EQ; move: EQ H0 => _ /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [/eqP EQ /eqP RESP].
- by inversion RESP; repeat split; subst.
- Qed.
-
- (* ..., which implies that any prefix of the computation is the computation
- of the prefix. *)
- Lemma fp_claimed_bounds_take :
- forall ts hp_bounds i,
- fp_claimed_bounds ts = Some hp_bounds ->
- i <= size hp_bounds ->
- fp_claimed_bounds (take i ts) = Some (take i hp_bounds).
- Proof.
- intros ts hp_bounds i SOME LTi.
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
- rewrite <- UNZIP in *.
- rewrite -[hp_bounds]take_size /unzip1 map_take in SOME.
- fold (unzip1 hp_bounds) in *; clear UNZIP.
- rewrite leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LTi]; first by subst.
- remember (size hp_bounds) as len; apply eq_leq in Heqlen.
- induction len; first by rewrite ltn0 in LTi.
- {
- assert (TAKElen: fp_claimed_bounds (take len (unzip1 (hp_bounds))) =
- Some (take len (hp_bounds))).
- {
- assert (exists p, p \in hp_bounds).
- {
- destruct hp_bounds; first by rewrite ltn0 in Heqlen.
- by exists t; rewrite in_cons eq_refl orTb.
- } destruct H as [[tsk R] _].
- rewrite (take_nth tsk) in SOME; last by rewrite size_map.
- rewrite (take_nth (tsk,R)) in SOME; last by done.
- destruct (nth (tsk, R) hp_bounds len) as [tsk_len R_len].
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- rewrite ltnS leq_eqVlt in LTi.
- move: LTi => /orP [/eqP EQ | LESS]; first by subst.
- apply ltnW in Heqlen.
- by specialize (IHlen Heqlen TAKElen LESS).
- }
- Qed.
-
- (* If the analysis suceeds, the computed response-time bounds are no larger
- than the deadline... *)
- Lemma fp_claimed_bounds_le_deadline :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R <= task_deadline tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by apply Heq0.
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* ... and the computed response-time bounds are no smaller than
- the task costs. *)
- Lemma fp_claimed_bounds_ge_cost :
- forall ts' rt_bounds tsk R,
- fp_claimed_bounds ts' = Some rt_bounds ->
- (tsk, R) \in rt_bounds ->
- R >= task_cost tsk.
- Proof.
- intros ts; induction ts as [| ts' tsk_lst] using last_ind.
- {
- intros rt_bounds tsk R SOME IN.
- by inversion SOME; subst; rewrite in_nil in IN.
- }
- {
- intros rt_bounds tsk_i R SOME IN.
- destruct (lastP rt_bounds) as [|rt_bounds (tsk_lst', R_lst)];
- first by rewrite in_nil in IN.
- rewrite mem_rcons in_cons in IN; move: IN => /orP IN.
- destruct IN as [LAST | FRONT].
- {
- move: LAST => /eqP LAST.
- rewrite -cats1 in SOME.
- unfold fp_claimed_bounds in *.
- rewrite foldl_cat /= in SOME.
- unfold fp_bound_of_task in SOME.
- desf; rename H0 into EQ.
- move: EQ => /eqP EQ.
- rewrite eqseq_rcons in EQ.
- move: EQ => /andP [_ /eqP EQ].
- inversion EQ; subst.
- by destruct (max_steps tsk_lst');
- [by apply leqnn | by apply leq_addr].
- }
- {
- apply IHts with (rt_bounds := rt_bounds); last by ins.
- by apply fp_claimed_bounds_rcons in SOME; des.
- }
- }
- Qed.
-
- (* Short lemma about unfolding the iteration one step. *)
- Lemma per_task_rta_fold :
- forall tsk rt_bounds,
- task_cost tsk +
- div_floor (total_interference_bound_fp task_cost task_period rt_bounds
- (per_task_rta tsk rt_bounds (max_steps tsk))) num_cpus
- = per_task_rta tsk rt_bounds (max_steps tsk).+1.
- Proof.
- by done.
- Qed.
-
- End SimpleLemmas.
-
- (* In this section, we prove that if the task set is sorted by priority,
- the tasks in fp_claimed_bounds are interfering tasks. *)
- Section HighPriorityTasks.
-
- (* Consider a list of previous tasks and a task tsk to be analyzed. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that the task set is sorted by unique priorities, ... *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
-
- (* ...the priority order is transitive, ...*)
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* ... and that the response-time analysis succeeds. *)
- Variable hp_bounds: seq task_with_response_time.
- Variable R: time.
- Hypothesis H_analysis_succeeds: fp_claimed_bounds ts = Some hp_bounds.
-
- (* Let's refer to tasks by index. *)
- Variable elem: sporadic_task.
- Let TASK := nth elem ts.
-
- (* We prove that higher-priority tasks have smaller index. *)
- Lemma fp_claimed_bounds_hp_tasks_have_smaller_index :
- forall hp_idx idx,
- hp_idx < size ts ->
- idx < size ts ->
- hp_idx != idx ->
- higher_priority (TASK hp_idx) (TASK idx) ->
- hp_idx < idx.
- Proof.
- unfold TASK; clear TASK.
- rename ts into ts'; destruct ts' as [ts UNIQ]; simpl in *.
- intros hp_idx idx LThp LT NEQ HP.
- rewrite ltn_neqAle; apply/andP; split; first by done.
- by apply sorted_rel_implies_le_idx with (leT := higher_priority) (xs := ts) (default := elem).
- Qed.
-
- End HighPriorityTasks.
-
- (* In this section, we show that the fixed-point iteration converges. *)
- Section Convergence.
-
- (* Consider any set of higher-priority tasks. *)
- Variable ts_hp: seq sporadic_task.
-
- (* Assume that the response-time analysis succeeds for the higher-priority tasks. *)
- Variable rt_bounds: seq task_with_response_time.
- Hypothesis H_test_succeeds: fp_claimed_bounds ts_hp = Some rt_bounds.
-
- (* Consider any task tsk to be analyzed, ... *)
- Variable tsk: sporadic_task.
-
- (* ... and assume all tasks have valid parameters. *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline (rcons ts_hp tsk).
-
- (* To simplify, let f denote the fixed-point iteration. *)
- Let f := per_task_rta tsk rt_bounds.
-
- (* Assume that f (max_steps tsk) is no larger than the deadline. *)
- Hypothesis H_no_larger_than_deadline: f (max_steps tsk) <= task_deadline tsk.
-
- (* First, we show that f is monotonically increasing. *)
- Lemma bertogna_fp_comp_f_monotonic :
- forall x1 x2, x1 <= x2 -> f x1 <= f x2.
- Proof.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_test_succeeds into SOME,
- H_valid_task_parameters into VALID.
- intros x1 x2 LEx; unfold f, per_task_rta.
- apply fun_mon_iter_mon; [by ins | by ins; apply leq_addr |].
- clear LEx x1 x2; intros x1 x2 LEx.
- rewrite leq_add2l leq_div2r //.
- unfold total_interference_bound_fp.
- rewrite big_seq_cond.
- rewrite [\sum_(_ <- _ | true) _]big_seq_cond.
- apply leq_sum; move => i /andP [IN _].
- destruct i as [i R].
- have GE_COST := fp_claimed_bounds_ge_cost ts_hp rt_bounds i R SOME IN.
- have UNZIP := fp_claimed_bounds_unzip ts_hp rt_bounds SOME.
- unfold interference_bound_generic; simpl.
- apply W_monotonic; try (by done).
- have INts: i \in ts_hp by rewrite -UNZIP; apply/mapP; exists (i, R).
- by exploit (VALID i);
- [by rewrite mem_rcons in_cons INts orbT | by ins; des].
- Qed.
-
- (* If the iteration converged at an earlier step, then it remains stable. *)
- Lemma bertogna_fp_comp_f_converges_early :
- (exists k, k <= max_steps tsk /\ f k = f k.+1) ->
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- by intros EX; des; apply fixedpoint.iter_fix with (k := k).
- Qed.
-
- (* Else, we derive a contradiction. *)
- Section DerivingContradiction.
-
- (* Assume instead that the iteration continued to diverge. *)
- Hypothesis H_keeps_diverging:
- forall k,
- k <= max_steps tsk -> f k != f k.+1.
-
- (* By monotonicity, it follows that the value always increases. *)
- Lemma bertogna_fp_comp_f_increases :
- forall k,
- k <= max_steps tsk ->
- f k < f k.+1.
- Proof.
- intros k LT.
- rewrite ltn_neqAle; apply/andP; split.
- by apply H_keeps_diverging.
- by apply bertogna_fp_comp_f_monotonic, leqnSn.
- Qed.
-
- (* In the end, the response-time bound must exceed the deadline. Contradiction! *)
- Lemma bertogna_fp_comp_rt_grows_too_much :
- forall k,
- k <= max_steps tsk ->
- f k > k + task_cost tsk - 1.
- Proof.
- have INC := bertogna_fp_comp_f_increases.
- rename H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- induction k.
- {
- intros _; rewrite add0n -addn1 addnBAC;
- first by rewrite -addnBA // subnn addn0 /= leqnn.
- by apply PARAMS.
- }
- {
- intros LT.
- specialize (IHk (ltnW LT)).
- apply leq_ltn_trans with (n := f k); last by apply INC, ltnW.
- rewrite -addn1 -addnA [1 + _]addnC addnA -addnBA // subnn addn0.
- rewrite -(ltn_add2r 1) in IHk.
- rewrite addnBAC in IHk;
- last by apply leq_trans with (n := task_cost tsk);
- [by apply PARAMS | by apply leq_addl].
- by rewrite -addnBA // subnn addn0 addn1 ltnS in IHk.
- }
- Qed.
-
- End DerivingContradiction.
-
- (* Using the lemmas above, we prove the convergence of the iteration after max_steps. *)
- Lemma per_task_rta_converges:
- f (max_steps tsk) = f (max_steps tsk).+1.
- Proof.
- have TOOMUCH := bertogna_fp_comp_rt_grows_too_much.
- have INC := bertogna_fp_comp_f_increases.
- rename H_no_larger_than_deadline into LE,
- H_valid_task_parameters into TASK_PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *; des.
-
- (* Either f converges by the deadline or not. *)
- destruct ([exists k in 'I_(max_steps tsk).+1, f k == f k.+1]) eqn:EX.
- {
- move: EX => /exists_inP EX; destruct EX as [k _ ITERk].
- apply bertogna_fp_comp_f_converges_early.
- by exists k; split; [by rewrite -ltnS; apply ltn_ord | by apply/eqP].
- }
-
- (* If not, then we reach a contradiction *)
- apply negbT in EX; rewrite negb_exists_in in EX.
- move: EX => /forall_inP EX.
- rewrite leqNgt in LE; move: LE => /negP LE.
- exfalso; apply LE.
-
- assert (DIFF: forall k : nat, k <= max_steps tsk -> f k != f k.+1).
- {
- intros k LEk; rewrite -ltnS in LEk.
- by exploit (EX (Ordinal LEk)); [by done | intro DIFF; apply DIFF].
- }
- exploit TOOMUCH; [by apply DIFF | by apply leq_addr |].
- exploit (TASK_PARAMS tsk);
- [by rewrite mem_rcons in_cons eq_refl orTb | intro PARAMS; des].
- rewrite addnBAC; last by apply PARAMS2.
- rewrite -addnBA // subnn addn0 subn1 prednK //.
- intros LT; apply (leq_ltn_trans LT).
- by rewrite /max_steps [_ - _ + 1]addn1; apply INC, leq_addr.
- Qed.
-
- End Convergence.
-
- Section MainProof.
-
- (* Consider a task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all tasks have valid parameters, ... *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ...and constrained deadlines.*)
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* Assume that the task set is totally ordered by unique priorities,
- and that the priority order is transitive. *)
- Hypothesis H_task_set_is_sorted: sorted higher_priority ts.
- Hypothesis H_task_set_has_unique_priorities:
- FP_is_antisymmetric_over_task_set higher_priority ts.
- Hypothesis H_priority_is_total:
- FP_is_total_over_task_set higher_priority ts.
- Hypothesis H_priority_transitive: FP_is_transitive higher_priority.
-
- (* Next, consider any arrival sequence such that...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...they have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, consider any schedule of this arrival sequence such that... *)
- Variable sched: schedule Job num_cpus.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs only execute after they arrived and no longer
- than their execution costs,... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the scheduler is work-conserving and respects the FP policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy job_arrival job_cost job_task arr_seq sched higher_priority.
-
- Let no_deadline_missed_by_task (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* In the following theorem, we prove that any response-time bound contained
- in fp_claimed_bounds is safe. The proof follows by induction on the task set:
-
- Induction hypothesis: all higher-priority tasks have safe response-time bounds.
- Inductive step: We prove that the response-time bound of the current task is safe.
-
- Note that the inductive step is a direct application of the main Theorem from
- bertogna_fp_theory.v. *)
- Theorem fp_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In fp_claimed_bounds ts ->
- response_time_bounded_by tsk R.
- Proof.
- rename H_valid_job_parameters into JOBPARAMS, H_valid_task_parameters into TASKPARAMS.
- unfold valid_sporadic_taskset in *.
- intros tsk R MATCH.
- assert (SOME: exists hp_bounds, fp_claimed_bounds ts = Some hp_bounds /\
- (tsk, R) \in hp_bounds).
- {
- destruct (fp_claimed_bounds ts); last by done.
- by exists l; split.
- } clear MATCH; des; rename SOME0 into IN.
-
- have UNZIP := fp_claimed_bounds_unzip ts hp_bounds SOME.
-
- set elem := (tsk,R).
- move: IN => /(nthP elem) [idx LTidx EQ].
- set NTH := fun k => nth elem hp_bounds k.
- set TASK := fun k => (NTH k).1.
- set RESP := fun k => (NTH k).2.
- cut (response_time_bounded_by (TASK idx) (RESP idx));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- clear EQ.
-
- assert (PAIR: forall idx, (TASK idx, RESP idx) = NTH idx).
- by intros i; unfold TASK, RESP; destruct (NTH i).
-
- assert (SUBST: forall i, i < size hp_bounds -> TASK i = nth tsk ts i).
- by intros i LTi; rewrite /TASK /NTH -UNZIP (nth_map elem) //.
-
- assert (SIZE: size hp_bounds = size ts).
- by rewrite -UNZIP size_map.
-
- induction idx as [idx IH'] using strong_ind.
-
- assert (IH: forall tsk_hp R_hp, (tsk_hp, R_hp) \in take idx hp_bounds -> response_time_bounded_by tsk_hp R_hp).
- {
- intros tsk_hp R_hp INhp.
- move: INhp => /(nthP elem) [k LTk EQ].
- rewrite size_take LTidx in LTk.
- rewrite nth_take in EQ; last by done.
- cut (response_time_bounded_by (TASK k) (RESP k));
- first by unfold TASK, RESP, NTH; rewrite EQ.
- by apply IH'; try (by done); apply (ltn_trans LTk).
- } clear IH'.
-
- unfold response_time_bounded_by in *.
-
- exploit (fp_claimed_bounds_rcons (take idx ts) (take idx hp_bounds) (TASK idx) (TASK idx) (RESP idx)).
- {
- by rewrite PAIR SUBST // -2?take_nth -?SIZE // (fp_claimed_bounds_take _ hp_bounds).
- }
- intros [_ [_ [REC DL]]].
-
- try ( apply bertogna_cirinei_response_time_bound_fp with
- (task_cost0 := task_cost) (task_period0 := task_period)
- (task_deadline0 := task_deadline) (job_deadline0 := job_deadline) (tsk0 := (TASK idx))
- (job_task0 := job_task) (ts0 := ts) (hp_bounds0 := take idx hp_bounds)
- (higher_eq_priority := higher_priority); try (by done) ) ||
- apply bertogna_cirinei_response_time_bound_fp with
- (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (job_deadline := job_deadline) (tsk := (TASK idx))
- (job_task := job_task) (ts := ts) (hp_bounds := take idx hp_bounds)
- (higher_eq_priority := higher_priority); try (by done).
- {
- cut (NTH idx \in hp_bounds = true);
- [intros IN | by apply mem_nth].
- by rewrite set_mem -UNZIP; apply/mapP; exists (TASK idx, RESP idx); rewrite PAIR.
- }
- {
- intros hp_tsk IN INTERF.
- exists (RESP (index hp_tsk ts)).
- move: (IN) => INDEX; apply nth_index with (x0 := tsk) in INDEX.
- rewrite -{1}[hp_tsk]INDEX -SUBST; last by rewrite SIZE index_mem.
- assert (UNIQ: uniq hp_bounds).
- {
- apply map_uniq with (f := fst); unfold unzip1 in *; rewrite UNZIP.
- by destruct ts.
- }
- rewrite -filter_idx_lt_take //.
- {
- rewrite PAIR mem_filter; apply/andP; split;
- last by apply mem_nth; rewrite SIZE index_mem.
- {
- rewrite /NTH index_uniq; [| by rewrite SIZE index_mem | by done ].
- {
- move: INTERF => /andP [HP NEQ].
- apply fp_claimed_bounds_hp_tasks_have_smaller_index with
- (ts := ts) (elem := tsk) (hp_bounds := hp_bounds);
- try (by done);
- [by rewrite index_mem | by rewrite -SIZE | | by rewrite INDEX -SUBST].
- apply/eqP; intro BUG; subst idx.
- rewrite SUBST -{1}INDEX in NEQ;
- first by rewrite eq_refl in NEQ.
- by rewrite SIZE index_mem INDEX.
- }
- }
- }
- }
- {
- rewrite REC per_task_rta_fold.
- apply per_task_rta_converges with (ts_hp := take idx ts);
- [by apply fp_claimed_bounds_take; try (by apply ltnW) | | by rewrite -REC ].
- rewrite SUBST // -take_nth -?SIZE //.
- by intros i IN; eapply TASKPARAMS, mem_take, IN.
- }
- Qed.
-
- (* Therefore, if the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: fp_schedulable ts.
-
- (*..., no task misses its deadline. *)
- Theorem taskset_schedulable_by_fp_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RLIST := (fp_analysis_yields_response_time_bounds).
- have UNZIP := (fp_claimed_bounds_unzip ts).
- have DL := (fp_claimed_bounds_le_deadline ts).
- unfold no_deadline_missed_by_task, task_misses_no_deadline,
- job_misses_no_deadline, completed,
- fp_schedulable, valid_sporadic_job in *.
- rename H_valid_job_parameters into JOBPARAMS.
- move => tsk INtsk j ARRj JOBtsk.
-
- destruct (fp_claimed_bounds ts) as [rt_bounds |]; last by ins.
- feed (UNZIP rt_bounds); first by done.
- assert (EX: exists R, (tsk, R) \in rt_bounds).
- {
- rewrite set_mem -UNZIP in INtsk; move: INtsk => /mapP EX.
- by destruct EX as [p]; destruct p as [tsk' R]; simpl in *; subst tsk'; exists R.
- } des.
- exploit (RLIST tsk R); eauto 1; intro COMPLETED.
- exploit (DL rt_bounds tsk R); [by ins | by ins | clear DL; intro DL].
- apply leq_trans with (n := service sched j (job_arrival j + R)); last first.
- {
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- apply extend_sum; rewrite // leq_add2l.
- specialize (JOBPARAMS j ARRj); des; rewrite JOBPARAMS1.
- by rewrite JOBtsk.
- }
- by done.
- Qed.
-
- (* For completeness, since all jobs of the arrival sequence
- are spawned by the task set, we also conclude that no job in
- the schedule misses its deadline. *)
- Theorem jobs_schedulable_by_fp_rta :
- forall j, arrives_in arr_seq j -> no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_fp_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End MainProof.
-
- End Analysis.
-
-End ResponseTimeIterationFP.
diff --git a/classic/analysis/global/parallel/bertogna_fp_theory.v b/classic/analysis/global/parallel/bertogna_fp_theory.v
deleted file mode 100644
index f1f2b7cda7dc6408f770bd58a2bb13a3134b422e..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/bertogna_fp_theory.v
+++ /dev/null
@@ -1,474 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload prosa.classic.model.schedule.global.schedulability
- prosa.classic.model.schedule.global.response_time.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform
- prosa.classic.model.schedule.global.basic.constrained_deadlines prosa.classic.model.schedule.global.basic.interference.
-Require Import prosa.classic.analysis.global.parallel.workload_bound prosa.classic.analysis.global.parallel.interference_bound_fp.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module ResponseTimeAnalysisFP.
-
- Export Job SporadicTaskset ScheduleOfSporadicTask Workload Interference
- InterferenceBoundFP Platform Schedulability ResponseTime
- Priority TaskArrival WorkloadBound ConstrainedDeadlines.
-
- (* In this section, we prove that any fixed point in Bertogna and
- Cirinei's RTA for FP scheduling modified to consider (potentially)
- parallel jobs yields a safe response-time bound. This is an extension
- of the analysis found in Chapter 18.2 of Baruah et al.'s book
- Multiprocessor Scheduling for Real-time Systems. *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines, ... *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- (* ... and that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Next, consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs do not execute before their arrival times nor longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Consider a given FP policy, ... *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ... and assume that the schedule is an APA work-conserving
- schedule that respects this policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy job_arrival job_cost job_task arr_seq sched higher_eq_priority.
-
- (* Assume that there exists at least one processor. *)
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Let's define some local names to avoid passing many parameters. *)
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Next, we consider the response-time recurrence.
- Let tsk be a task in ts that is to be analyzed. *)
- Variable tsk: sporadic_task.
- Hypothesis task_in_ts: tsk \in ts.
-
- (* Let is_hp_task denote whether a task is a higher-priority task
- (with respect to tsk). *)
- Let is_hp_task := higher_priority_task higher_eq_priority tsk.
-
- (* Assume a response-time bound is known... *)
- Let task_with_response_time := (sporadic_task * time)%type.
- Variable hp_bounds: seq task_with_response_time.
- Hypothesis H_response_time_of_interfering_tasks_is_known:
- forall hp_tsk R,
- (hp_tsk, R) \in hp_bounds ->
- response_time_bounded_by hp_tsk R.
-
- (* ... for every higher-priority task. *)
- Hypothesis H_hp_bounds_has_interfering_tasks:
- forall hp_tsk,
- hp_tsk \in ts ->
- is_hp_task hp_tsk ->
- exists R, (hp_tsk, R) \in hp_bounds.
-
- (* Let R be the fixed point of Bertogna and Cirinei's recurrence, ...*)
- Variable R: time.
- Hypothesis H_response_time_recurrence_holds :
- R = task_cost tsk +
- div_floor
- (total_interference_bound_fp task_cost task_period hp_bounds R)
- num_cpus.
-
- (* ... and assume that R is no larger than the deadline of tsk.*)
- Hypothesis H_response_time_no_larger_than_deadline:
- R <= task_deadline tsk.
-
- (* In order to prove that R is a response-time bound, we first provide some lemmas. *)
- Section Lemmas.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Assume that job j is the first job of tsk not to complete by the response time bound. *)
- Hypothesis H_j_not_completed: ~~ completed job_cost sched j (job_arrival j + R).
- Hypothesis H_previous_jobs_of_tsk_completed :
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + R).
-
- (* Let's call x the interference incurred by job j due to tsk_other, ...*)
- Let x (tsk_other: sporadic_task) :=
- task_interference job_arrival job_cost job_task sched j
- tsk_other (job_arrival j) (job_arrival j + R).
-
- (* ...and X the total interference incurred by job j due to any task. *)
- Let X := total_interference job_arrival job_cost sched j (job_arrival j) (job_arrival j + R).
-
- (* Recall Bertogna and Cirinei's workload bound. *)
- Let workload_bound (tsk_other: sporadic_task) (R_other: time) :=
- W task_cost task_period tsk_other R_other R.
-
- (* Let hp_tasks denote the set of higher-priority tasks. *)
- Let hp_tasks := [seq tsk_other <- ts | is_hp_task tsk_other].
-
- (* Now we establish results about the higher-priority tasks. *)
- Section LemmasAboutHPTasks.
-
- (* Let (tsk_other, R_other) be any pair of higher-priority task and
- response-time bound computed in previous iterations. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
- Hypothesis H_response_time_of_tsk_other: (tsk_other, R_other) \in hp_bounds.
-
- (* Since tsk_other cannot interfere more than it executes, we show that
- the interference caused by tsk_other is no larger than workload bound W. *)
- Lemma bertogna_fp_workload_bounds_interference :
- x tsk_other <= workload_bound tsk_other R_other.
- Proof.
- unfold response_time_bounded_by, is_response_time_bound_of_task,
- completed, completed_jobs_dont_execute, valid_sporadic_job in *.
- rename H_valid_task_parameters into TASK_PARAMS,
- H_all_jobs_from_taskset into FROMTS,
- H_response_time_of_interfering_tasks_is_known into RESP.
- unfold x, workload_bound.
- destruct ([exists t: 'I_(job_arrival j + R),
- task_is_scheduled job_task sched tsk_other t]) eqn: SCHED;
- last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED.
- move: SCHED => /forallP SCHED.
- apply leq_trans with (n := 0); last by done.
- apply leq_trans with (n := \sum_(job_arrival j <= t < job_arrival j + R) 0);
- last by rewrite big1.
- apply leq_sum_nat; move => i /andP [_ LTi] _.
- specialize (SCHED (Ordinal LTi)).
- rewrite negb_exists in SCHED; move: SCHED => /forallP SCHED.
- rewrite big1 //; intros cpu _.
- specialize (SCHED cpu); apply negbTE in SCHED.
- by rewrite SCHED andbF.
- }
- move: SCHED => /existsP [t /existsP [cpu SCHED]].
- unfold task_scheduled_on in SCHED.
- destruct (sched cpu t) as [j0 |] eqn:SCHED0; last by done.
- assert (INts: tsk_other \in ts).
- {
- move: SCHED => /eqP <-; apply FROMTS, (H_jobs_come_from_arrival_sequence j0 t).
- by apply/existsP; exists cpu; apply/eqP.
- }
- apply leq_trans with (n := workload job_task sched tsk_other
- (job_arrival j) (job_arrival j + R));
- first by apply task_interference_le_workload.
- by ( try ( apply workload_bounded_by_W with (task_deadline0 := task_deadline) (arr_seq0 := arr_seq)
- (job_arrival0 := job_arrival) (job_cost0 := job_cost) (job_deadline0 := job_deadline) ) ||
- apply workload_bounded_by_W with (task_deadline := task_deadline) (arr_seq := arr_seq)
- (job_arrival := job_arrival) (job_cost := job_cost) (job_deadline := job_deadline));
- try (by ins);
- [ by ins; apply TASK_PARAMS
- | by ins; apply RESP with (hp_tsk := tsk_other)].
- Qed.
-
- End LemmasAboutHPTasks.
-
- (* Next we prove some lemmas that help to derive a contradiction.*)
- Section DerivingContradiction.
-
- (* 0) Since job j did not complete by its response time bound, it follows that
- the total interference X >= R - e_k + 1. *)
- Lemma bertogna_fp_too_much_interference : X >= R - task_cost tsk + 1.
- Proof.
- rename H_completed_jobs_dont_execute into COMP,
- H_valid_job_parameters into PARAMS,
- H_response_time_recurrence_holds into REC,
- H_job_of_tsk into JOBtsk,
- H_j_not_completed into NOTCOMP.
- unfold completed, valid_sporadic_job in *.
- unfold X, total_interference; rewrite addn1.
- rewrite -(ltn_add2r (task_cost tsk)).
- rewrite addnBAC; last by rewrite REC leq_addr.
- rewrite -addnBA // subnn addn0.
- move: (NOTCOMP) => /negP NOTCOMP'.
- rewrite -ltnNge in NOTCOMP.
- apply leq_ltn_trans with (n := (\sum_(job_arrival j <= t < job_arrival j + R)
- backlogged job_arrival job_cost sched j t) +
- service sched j (job_arrival j + R)); last first.
- {
- rewrite -addn1 -addnA leq_add2l addn1.
- apply leq_trans with (n := job_cost j); first by done.
- by specialize (PARAMS j H_j_arrives); des; rewrite -JOBtsk.
- }
- unfold service; rewrite service_before_arrival_eq_service_during //.
- rewrite -big_split /=.
- apply leq_trans with (n := \sum_(job_arrival j <= i < job_arrival j + R) 1);
- first by rewrite big_const_nat iter_addn mul1n addn0 addKn.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => i /andP [/andP [GEi LTi] _].
- destruct (backlogged job_arrival job_cost sched j i) eqn:BACK;
- first by rewrite -addn1 addnC; apply leq_add.
- apply negbT in BACK.
- rewrite add0n lt0n -not_scheduled_no_service negbK.
- rewrite /backlogged negb_and negbK in BACK.
- move: BACK => /orP [/negP NOTPENDING | SCHED]; last by done.
- exfalso; apply NOTPENDING; unfold pending; apply/andP; split; first by done.
- apply/negP; red; intro BUG; apply NOTCOMP'.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- Qed.
-
- (* Let's define a predicate to identify the other tasks that are scheduled. *)
- Let other_scheduled_task (t: time) (tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- is_hp_task tsk_other.
-
- (* 1) Now we prove that, at all times that j is backlogged, the number
- of tasks other than tsk that are scheduled is exactly the number
- of processors in the system. This is required to prove lemma (2). *)
- Lemma bertogna_fp_all_cpus_are_busy:
- \sum_(tsk_k <- hp_tasks) x tsk_k = X * num_cpus.
- Proof.
- rename H_all_jobs_from_taskset into FROMTS, H_valid_task_parameters into PARAMS,
- H_job_of_tsk into JOBtsk, H_sporadic_tasks into SPO,
- H_work_conserving into WORK, H_jobs_come_from_arrival_sequence into FROMarr,
- H_constrained_deadlines into RESTR,
- H_respects_FP_policy into FP,
- H_previous_jobs_of_tsk_completed into BEFOREok,
- H_response_time_no_larger_than_deadline into NOMISS.
- unfold sporadic_task_model, respects_FP_policy,
- respects_JLDP_policy, FP_to_JLDP in *.
- unfold x, X, total_interference, task_interference.
- rewrite -big_mkcond -exchange_big big_distrl /=.
- rewrite [\sum_(_ <= _ < _ | backlogged _ _ _ _ _) _]big_mkcond.
- apply eq_big_nat; move => t /andP [GEt LTt].
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK; last first.
- {
- rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- by intros i _; rewrite (eq_bigr (fun i => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- }
- rewrite big_mkcond mul1n /=.
- rewrite exchange_big /=.
- apply eq_trans with (y := \sum_(cpu < num_cpus) 1);
- last by rewrite big_const_ord iter_addn mul1n addn0.
- apply eq_bigr; intros cpu _.
- specialize (WORK j t H_j_arrives BACK cpu); des.
- move: WORK => /eqP SCHED.
- rewrite (bigD1_seq (job_task j_other)) /=; last by rewrite filter_uniq; destruct ts.
- {
- rewrite (eq_bigr (fun i => 0));
- last by intros i DIFF; rewrite /task_scheduled_on SCHED;apply/eqP;rewrite eqb0 eq_sym.
- rewrite big_const_seq iter_addn mul0n 2!addn0; apply/eqP; rewrite eqb1.
- by unfold task_scheduled_on; rewrite SCHED.
- }
- have ARRother: arrives_in arr_seq j_other.
- by apply (FROMarr j_other t); apply/existsP; exists cpu; apply/eqP.
- rewrite mem_filter; apply/andP; split; last by apply FROMTS.
- apply/andP; split.
- {
- rewrite -JOBtsk; apply FP with (t := t); try (by done).
- by apply/existsP; exists cpu; apply/eqP.
- }
- {
- apply/eqP; intro SAMEtsk.
- assert (SCHED': scheduled sched j_other t).
- {
- unfold scheduled, scheduled_on.
- by apply/existsP; exists cpu; rewrite SCHED.
- } clear SCHED; rename SCHED' into SCHED.
- move: (SCHED) => PENDING.
- try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) in PENDING; try (by done) ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := job_cost) in PENDING; try (by done).
- destruct (ltnP (job_arrival j_other) (job_arrival j)) as [BEFOREother | BEFOREj].
- {
- specialize (BEFOREok j_other ARRother SAMEtsk BEFOREother).
- move: PENDING => /andP [_ /negP NOTCOMP]; apply NOTCOMP.
- try ( apply completion_monotonic with (t0 := job_arrival j_other + R); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j_other + R); try (by done).
- apply leq_trans with (n := job_arrival j); last by done.
- apply leq_trans with (n := job_arrival j_other + task_deadline tsk);
- first by rewrite leq_add2l; apply NOMISS.
- apply leq_trans with (n := job_arrival j_other + task_period tsk);
- first by rewrite leq_add2l; apply RESTR; rewrite -JOBtsk FROMTS.
- rewrite -SAMEtsk; apply SPO; try (by done); [ | by rewrite JOBtsk | by apply ltnW].
- by red; intro EQ; rewrite EQ ltnn in BEFOREother.
- }
- {
- move: PENDING => /andP [ARRIVED _].
- exploit (SPO j j_other); try (by done); [ | by rewrite SAMEtsk | ]; last first.
- {
- apply/negP; rewrite -ltnNge.
- apply leq_ltn_trans with (n := t); first by done.
- apply leq_trans with (n := job_arrival j + R); first by done.
- by rewrite leq_add2l; apply leq_trans with (n := task_deadline tsk);
- [by apply NOMISS | by rewrite JOBtsk RESTR // -JOBtsk FROMTS].
- }
- by red; intros EQjob; rewrite EQjob /backlogged SCHED andbF in BACK.
- }
- }
- Qed.
-
- (* 2) Next, using lemmas (0) and (1) we prove that the reduction-based
- interference bound is not enough to cover the sum of the minima over all tasks
- (artifact of the proof by contradiction). *)
- Lemma bertogna_fp_sum_exceeds_total_interference:
- \sum_((tsk_k, R_k) <- hp_bounds)
- x tsk_k > total_interference_bound_fp task_cost task_period hp_bounds R.
- Proof.
- have TOOMUCH := bertogna_fp_too_much_interference.
- have ALLBUSY := bertogna_fp_all_cpus_are_busy.
- rename H_hp_bounds_has_interfering_tasks into HAS,
- H_response_time_recurrence_holds into REC.
- apply leq_trans with (n := \sum_(tsk_k <- hp_tasks) x tsk_k);
- last first.
- {
- rewrite (eq_bigr (fun i => x (fst i))); last by ins; destruct i.
- have MAP := @big_map _ 0 addn _ _ (fun x => fst x) hp_bounds (fun x => true) (fun y => (x y)).
- rewrite -MAP.
- apply leq_sum_sub_uniq; first by apply filter_uniq; destruct ts.
- red; move => tsk0 IN0.
- rewrite mem_filter in IN0; move: IN0 => /andP [INTERF0 IN0].
- apply/mapP.
- feed (HAS tsk0); first by done.
- move: (HAS INTERF0) => [R0 IN].
- by exists (tsk0, R0).
- }
- apply ltn_div_trunc with (d := num_cpus);
- first by apply H_at_least_one_cpu.
- rewrite -(ltn_add2l (task_cost tsk)) -REC.
- rewrite -addn1 -leq_subLR.
- rewrite -[R + 1 - _]addnBAC; last by rewrite REC; apply leq_addr.
- rewrite leq_divRL; last by apply H_at_least_one_cpu.
- rewrite ALLBUSY.
- by rewrite leq_mul2r; apply/orP; right; apply TOOMUCH.
- Qed.
-
- (* 3) After concluding that the sum of the minima exceeds (R - e_i + 1),
- we prove that there exists a tuple (tsk_k, R_k) that satisfies
- min (x_k, R - e_i + 1) > min (W_k, R - e_i + 1).
- This implies that x_k > W_k, which is of course a contradiction,
- since W_k is a valid task interference bound. *)
- Lemma bertogna_fp_exists_task_that_exceeds_bound :
- exists tsk_k R_k,
- (tsk_k, R_k) \in hp_bounds /\
- x tsk_k > workload_bound tsk_k R_k.
- Proof.
- have SUM := bertogna_fp_sum_exceeds_total_interference.
- rename H_hp_bounds_has_interfering_tasks into HASHP.
- assert (HAS: has (fun tup : task_with_response_time =>
- let (tsk_k, R_k) := tup in
- x tsk_k > workload_bound tsk_k R_k)
- hp_bounds).
- {
- apply/negP; unfold not; intro NOTHAS.
- move: NOTHAS => /negP /hasPn ALL.
- rewrite -[_ < _]negbK in SUM.
- move: SUM => /negP SUM; apply SUM; rewrite -leqNgt.
- rewrite (eq_bigr (fun i => x (fst i))); last by ins; destruct i.
- unfold total_interference_bound_fp.
- rewrite big_seq_cond.
- rewrite [\sum_(_ <- _ | true)_]big_seq_cond.
- apply leq_sum.
- intros p; rewrite andbT; intros IN.
- by specialize (ALL p IN); destruct p; rewrite leqNgt.
- }
- move: HAS => /hasP HAS; destruct HAS as [[tsk_k R_k] HPk MINk]; exists tsk_k, R_k.
- by repeat split.
- Qed.
-
- End DerivingContradiction.
-
- End Lemmas.
-
- (* Using the lemmas above, we prove that R bounds the response time of task tsk. *)
- Theorem bertogna_cirinei_response_time_bound_fp :
- response_time_bounded_by tsk R.
- Proof.
- have EX := bertogna_fp_exists_task_that_exceeds_bound.
- have BOUND := bertogna_fp_workload_bounds_interference.
- rename H_response_time_recurrence_holds into REC,
- H_response_time_of_interfering_tasks_is_known into RESP,
- H_hp_bounds_has_interfering_tasks into HAS,
- H_response_time_no_larger_than_deadline into LEdl.
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + R) as ctime.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- generalize dependent j.
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj JOBtsk EQc; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- assert (BEFOREok: forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- service sched j0 (job_arrival j0 + R) >= job_cost j0).
- {
- by ins; apply IH; try (by done); rewrite ltn_add2r.
- } clear IH.
-
- unfold response_time_bounded_by, is_response_time_bound_of_task,
- completed, completed_jobs_dont_execute, valid_sporadic_job in *.
-
- (* Now we start the proof. Assume by contradiction that job j
- is not complete at time (job_arrival j + R). *)
- destruct (completed job_cost sched j (job_arrival j + R)) eqn:NOTCOMP;
- first by done.
- apply negbT in NOTCOMP; exfalso.
-
- (* We derive a contradiction using the previous lemmas. *)
- specialize (EX j ARRj JOBtsk NOTCOMP BEFOREok).
- destruct EX as [tsk_k [R_k [HPk LTmin]]].
- specialize (BOUND j tsk_k R_k HPk).
- by apply (leq_ltn_trans BOUND) in LTmin; rewrite ltnn in LTmin.
- Qed.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/analysis/global/parallel/interference_bound.v b/classic/analysis/global/parallel/interference_bound.v
deleted file mode 100644
index 72a2366671d7bd83d3c24d8027d8fba67c5024c2..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/interference_bound.v
+++ /dev/null
@@ -1,43 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.analysis.global.parallel.workload_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundGeneric.
-
- Section Definitions.
-
- Import Schedule WorkloadBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- Section PerTask.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* Based on the workload bound, Bertogna and Cirinei define the
- following interference bound for a task. *)
- Definition interference_bound_generic :=
- W task_cost task_period tsk_other R_other delta.
-
- End PerTask.
-
- End Definitions.
-
-End InterferenceBoundGeneric.
\ No newline at end of file
diff --git a/classic/analysis/global/parallel/interference_bound_edf.v b/classic/analysis/global/parallel/interference_bound_edf.v
deleted file mode 100644
index 5ed8a4633a08ea68a1c17ef1f76fba7fd659e69f..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/interference_bound_edf.v
+++ /dev/null
@@ -1,846 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.response_time prosa.classic.model.schedule.global.workload
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform
- prosa.classic.model.schedule.global.basic.interference prosa.classic.model.schedule.global.basic.interference_edf.
-Require Import prosa.classic.analysis.global.parallel.workload_bound
- prosa.classic.analysis.global.parallel.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div path.
-
-Module InterferenceBoundEDF.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask Schedulability
- WorkloadBound ResponseTime Priority
- TaskArrival Interference InterferenceEDF.
- Export InterferenceBoundGeneric.
-
- (* In this section, we define Bertogna and Cirinei's EDF-specific
- interference bound. *)
- Section SpecificBoundDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- (* Consider the interference incurred by tsk in a window of length delta... *)
- Variable delta: time.
-
- (* due to a different task tsk_other, with response-time bound R_other. *)
- Variable tsk_other: sporadic_task.
- Variable R_other: time.
-
- (* Bertogna and Cirinei define the following bound for task interference
- under EDF scheduling. *)
- Definition edf_specific_interference_bound :=
- let d_tsk := task_deadline tsk in
- let e_other := task_cost tsk_other in
- let p_other := task_period tsk_other in
- let d_other := task_deadline tsk_other in
- (div_ceil (d_tsk + R_other - d_other + 1) p_other) * e_other.
-
- End SpecificBoundDef.
-
- (* Next, we define the total interference bound for EDF, which combines the generic
- and the EDF-specific bounds. *)
- Section TotalInterferenceBoundEDF.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- Section RecallInterferenceBounds.
-
- Variable tsk_R: task_with_response_time.
- Let tsk_other := fst tsk_R.
- Let R_other := snd tsk_R.
-
- (* By combining Bertogna's interference bound for a work-conserving
- scheduler ... *)
- Let basic_interference_bound := interference_bound_generic task_cost task_period delta tsk_R.
-
- (* ... with and EDF-specific interference bound, ... *)
- Let edf_specific_bound := edf_specific_interference_bound task_cost task_period task_deadline tsk tsk_other R_other.
-
- (* Bertogna and Cirinei define the following interference bound
- under EDF scheduling. *)
- Definition interference_bound_edf :=
- minn basic_interference_bound edf_specific_bound.
-
- End RecallInterferenceBounds.
-
- (* Next we define the computation of the total interference for APA scheduling. *)
- Section TotalInterference.
-
- (* Let other_task denote tasks different from tsk. *)
- Let other_task := different_task tsk.
-
- (* The total interference incurred by tsk is bounded by the sum
- of individual task interferences of the other tasks. *)
- Definition total_interference_bound_edf :=
- \sum_((tsk_other, R_other) <- R_prev | other_task tsk_other)
- interference_bound_edf (tsk_other, R_other).
-
- End TotalInterference.
-
- End TotalInterferenceBoundEDF.
-
- (* In this section, we show that the EDF-specific interference bound is safe. *)
- Section ProofSpecificBound.
-
- Import Schedule Interference Platform SporadicTaskset.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider any schedule such that...*)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...jobs do not execute before their arrival times nor longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume there exists at least one processor. *)
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Assume that we have a task set where all tasks have valid
- parameters and constrained deadlines. *)
- Variable ts: taskset_of sporadic_task.
- Hypothesis all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Hypothesis H_constrained_deadlines:
- forall tsk, tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- Let no_deadline_is_missed_by_tsk (tsk: sporadic_task) :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
- Let response_time_bounded_by (tsk: sporadic_task) :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Assume that the scheduler is a work-conserving EDF scheduler. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_edf_scheduler:
- respects_JLFP_policy job_arrival job_cost arr_seq sched (EDF job_arrival job_deadline).
-
- (* Let tsk_i be the task to be analyzed, ...*)
- Variable tsk_i: sporadic_task.
- Hypothesis H_tsk_i_in_task_set: tsk_i \in ts.
-
- (* and j_i one of its jobs. *)
- Variable j_i: Job.
- Hypothesis H_j_i_arrives: arrives_in arr_seq j_i.
- Hypothesis H_job_of_tsk_i: job_task j_i = tsk_i.
-
- (* Let tsk_k denote any interfering task, ... *)
- Variable tsk_k: sporadic_task.
- Hypothesis H_tsk_k_in_task_set: tsk_k \in ts.
-
- (* ...and R_k its response-time bound. *)
- Variable R_k: time.
- Hypothesis H_R_k_le_deadline: R_k <= task_deadline tsk_k.
-
- (* Consider a time window of length delta <= D_i, starting with j_i's arrival time. *)
- Variable delta: time.
- Hypothesis H_delta_le_deadline: delta <= task_deadline tsk_i.
-
- (* Assume that the jobs of tsk_k satisfy the response-time bound before the end of the interval *)
- Hypothesis H_all_previous_jobs_completed_on_time :
- forall j_k,
- arrives_in arr_seq j_k ->
- job_task j_k = tsk_k ->
- job_arrival j_k + R_k < job_arrival j_i + delta ->
- completed job_cost sched j_k (job_arrival j_k + R_k).
-
- (* In this section, we prove that Bertogna and Cirinei's EDF interference bound
- indeed bounds the interference caused by task tsk_k in the interval [t1, t1 + delta). *)
- Section MainProof.
-
- (* Let's call x the task interference incurred by job j due to tsk_k. *)
- Let x :=
- task_interference job_arrival job_cost job_task sched j_i
- tsk_k (job_arrival j_i) (job_arrival j_i + delta).
-
- (* Also, recall the EDF-specific interference bound for EDF. *)
- Let interference_bound :=
- edf_specific_interference_bound task_cost task_period task_deadline tsk_i tsk_k R_k.
-
- (* Let's simplify the names a bit. *)
- Let t1 := job_arrival j_i.
- Let t2 := job_arrival j_i + delta.
- Let D_i := task_deadline tsk_i.
- Let D_k := task_deadline tsk_k.
- Let p_k := task_period tsk_k.
-
- Let n_k := div_ceil (D_i + R_k - D_k + 1) p_k.
-
- (* Let's give a simpler name to job interference. *)
- Let interference_caused_by := job_interference job_arrival job_cost sched j_i.
-
- (* Identify the subset of jobs that actually cause interference *)
- Let interfering_jobs :=
- filter (fun j' =>
- (job_task j' == tsk_k) && (interference_caused_by j' t1 t2 != 0))
- (jobs_scheduled_between sched t1 t2).
-
- (* Now, consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := sort earlier_arrival interfering_jobs.
-
- (* Now we proceed with the proof.
- The first step consists in simplifying the sum corresponding to the workload. *)
- Section SimplifyJobSequence.
-
- (* Use the alternative definition of task interference, based on
- individual job interference. *)
- Lemma interference_bound_edf_use_another_definition :
- x <= \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2.
- Proof.
- unfold x, task_interference, interference_caused_by, job_interference.
- rewrite [\sum_(_ <- _ sched _ _ | _) _]exchange_big /=.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum. move => t /andP [LEt _].
- rewrite exchange_big /=.
- apply leq_sum; intros cpu _.
- destruct (backlogged job_arrival job_cost sched j_i t) eqn:BACK;
- last by rewrite andFb (eq_bigr (fun x => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- rewrite andTb.
- destruct (task_scheduled_on job_task sched tsk_k cpu t) eqn:SCHED;
- last by done.
- unfold task_scheduled_on in *.
- destruct (sched cpu t) eqn:SOME; last by done.
- rewrite big_mkcond /= (bigD1_seq s) /=; last by apply undup_uniq.
- {
- rewrite SCHED -addn1 addnC; apply leq_add; last by done.
- apply eq_leq; symmetry; apply/eqP; rewrite eqb1.
- by unfold scheduled_on; apply/eqP.
- }
- {
- unfold jobs_scheduled_between.
- rewrite mem_undup; apply mem_bigcat_nat with (j := t);
- first by done.
- apply mem_bigcat_ord with (j := cpu); first by apply ltn_ord.
- by unfold make_sequence; rewrite SOME mem_seq1 eq_refl.
- }
- Qed.
-
- (* Remove the elements that we don't care about from the sum *)
- Lemma interference_bound_edf_simpl_by_filtering_interfering_jobs :
- \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_k)
- interference_caused_by j t1 t2 =
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2.
- Proof.
- unfold interfering_jobs; rewrite big_filter.
- rewrite big_mkcond; rewrite [\sum_(_ <- _ | _) _]big_mkcond /=.
- apply eq_bigr; intros i _; clear -i.
- destruct (job_task i == tsk_k); rewrite ?andTb ?andFb; last by done.
- destruct (interference_caused_by i t1 t2 != 0) eqn:DIFF; first by done.
- by apply negbT in DIFF; rewrite negbK in DIFF; apply/eqP.
- Qed.
-
- (* Then, we consider the sum over the sorted sequence of jobs. *)
- Lemma interference_bound_edf_simpl_by_sorting_interfering_jobs :
- \sum_(j <- interfering_jobs) interference_caused_by j t1 t2 =
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2.
- Proof.
- by rewrite (perm_big sorted_jobs) /=; last by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Note that both sequences have the same set of elements. *)
- Lemma interference_bound_edf_job_in_same_sequence :
- forall j,
- (j \in interfering_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Also recall that all jobs in the sorted sequence is an interfering job of tsk_k, ... *)
- Lemma interference_bound_edf_all_jobs_from_tsk_k :
- forall j,
- j \in sorted_jobs ->
- arrives_in arr_seq j /\
- job_task j = tsk_k /\
- interference_caused_by j t1 t2 != 0 /\
- j \in jobs_scheduled_between sched t1 t2.
- Proof.
- intros j LT.
- rewrite -interference_bound_edf_job_in_same_sequence mem_filter in LT.
- move: LT => /andP [/andP [/eqP JOBi SERVi] INi].
- repeat split; try (by done).
- unfold jobs_scheduled_between in *; rewrite mem_undup in INi.
- apply mem_bigcat_nat_exists in INi; des.
- rewrite mem_scheduled_jobs_eq_scheduled in INi.
- by apply (H_jobs_come_from_arrival_sequence j i).
- Qed.
-
- (* ...and consecutive jobs are ordered by arrival. *)
- Lemma interference_bound_edf_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- (* Also, for any job of task tsk_k, the interference is bounded by the task cost. *)
- Lemma interference_bound_edf_interference_le_task_cost :
- forall j,
- j \in interfering_jobs ->
- interference_caused_by j t1 t2 <= task_cost tsk_k.
- Proof.
- rename H_valid_job_parameters into PARAMS.
- intros j INj.
- feed (interference_bound_edf_all_jobs_from_tsk_k j);
- first by rewrite -interference_bound_edf_job_in_same_sequence.
- move => [ARRj [TSKj _]].
- specialize (PARAMS j ARRj); des.
- apply leq_trans with (n := service_during sched j t1 t2);
- first by apply job_interference_le_service.
- try ( by apply cumulative_service_le_task_cost with (job_task0 := job_task)
- (task_deadline0 := task_deadline) (job_cost0 := job_cost) (job_deadline0 := job_deadline) ) ||
- by apply cumulative_service_le_task_cost with (job_task := job_task)
- (task_deadline := task_deadline) (job_cost := job_cost) (job_deadline := job_deadline).
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section InterferenceFewJobs.
-
- Hypothesis H_few_jobs: size sorted_jobs <= n_k.
-
- Lemma interference_bound_edf_holds_for_at_most_n_k_jobs :
- \sum_(j <- sorted_jobs) interference_caused_by j t1 t2 <=
- interference_bound.
- Proof.
- unfold interference_bound, edf_specific_interference_bound; fold D_i p_k n_k.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk_k);
- last first.
- {
- rewrite big_const_seq iter_addn addn0 count_predT mulnC.
- by rewrite leq_mul2r; apply/orP; right.
- }
- {
- rewrite big_seq_cond [\sum_(_ <- _ | true)_]big_seq_cond.
- apply leq_sum; move => j /andP [IN _].
- apply interference_bound_edf_interference_le_task_cost.
- by rewrite interference_bound_edf_job_in_same_sequence.
- }
- Qed.
-
- End InterferenceFewJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0. *)
- Section InterferenceManyJobs.
-
- Hypothesis H_many_jobs: n_k < size sorted_jobs.
-
- (* This trivially implies that there's at least one job. *)
- Lemma interference_bound_edf_at_least_one_job: size sorted_jobs > 0.
- Proof.
- by apply leq_ltn_trans with (n := n_k).
- Qed.
-
- (* Let j_fst be the first job, and a_fst its arrival time. *)
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let a_fst := job_arrival j_fst.
-
- (* In this section, we prove some basic lemmas about j_fst. *)
- Section FactsAboutFirstJob.
-
- (* The first job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_fst_is_job_of_tsk_k :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk_k /\
- interference_caused_by j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth,
- interference_bound_edf_at_least_one_job.
- Qed.
-
- (* The deadline of j_fst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_fst_deadline :
- job_deadline j_fst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [FSTarr [FSTtask _]].
- by specialize (PARAMS j_fst FSTarr); des; rewrite PARAMS1 FSTtask.
- Qed.
-
- (* The deadline of j_i is the deadline of tsk_i. *)
- Lemma interference_bound_edf_j_i_deadline :
- job_deadline j_i = task_deadline tsk_i.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS,
- H_job_of_tsk_i into JOBtsk.
- by specialize (PARAMS j_i H_j_i_arrives); des; rewrite PARAMS1 JOBtsk.
- Qed.
-
- (* If j_fst completes by its response-time bound, then t1 <= a_fst + R_k,
- where t1 is the beginning of the time window (arrival of j_i). *)
- Lemma interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval :
- completed job_cost sched j_fst (a_fst + R_k) ->
- t1 <= a_fst + R_k.
- Proof.
- intros RBOUND.
- rewrite leqNgt; apply/negP; unfold not; intro BUG.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [_ [_ [ FSTserv _]]].
- move: FSTserv => /negP FSTserv; apply FSTserv.
- rewrite -leqn0; apply leq_trans with (n := service_during sched j_fst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_after_job_rt_zero with (job_cost0 := job_cost)
- (job_arrival0 := job_arrival) (R := R_k);
- try (by done); apply ltnW ) ||
- by apply cumulative_service_after_job_rt_zero with (job_cost := job_cost)
- (job_arrival := job_arrival) (R := R_k);
- try (by done); apply ltnW.
- Qed.
-
- End FactsAboutFirstJob.
-
- (* Now, let's prove the interference bound for the particular case of a single job.
- This case must be solved separately because the single job can simultaneously
- be carry-in and carry-out job, so its response time is not necessarily
- bounded by R_k (from the hypothesis H_all_previous_jobs_completed_on_time). *)
- Section InterferenceSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_only_one_job: size sorted_jobs = 1.
-
- Lemma interference_bound_edf_holds_for_a_single_job :
- interference_caused_by j_fst t1 t2 <= interference_bound.
- Proof.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_many_jobs into NUM,
- H_valid_task_parameters into PARAMS,
- H_only_one_job into SIZE.
- apply leq_trans with (n := task_cost tsk_k).
- {
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite SIZE.
- }
- {
- unfold interference_bound, edf_specific_interference_bound.
- rewrite -{1}[task_cost tsk_k]mul1n.
- rewrite leq_mul2r; apply/orP; right.
- exploit (PARAMS tsk_i); [by done | intro PARAMSi]; des.
- exploit (PARAMS tsk_k); [by done | intro PARAMSk]; des.
- apply ceil_neq0; last by done.
- rewrite -subnBA; last by done.
- by rewrite addn1 ltnS.
- }
- Qed.
-
- End InterferenceSingleJob.
-
- (* Next, consider the other case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section InterferenceTwoOrMoreJobs.
-
- (* Assume there are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- (* Let j_lst be the last job of the sequence and a_lst its arrival time. *)
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
- Let a_lst := job_arrival j_lst.
-
- (* In this section, we prove some basic lemmas about the first and last jobs. *)
- Section FactsAboutFirstAndLastJobs.
-
- (* The last job is an interfering job of task tsk_k. *)
- Lemma interference_bound_edf_j_lst_is_job_of_tsk_k :
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk_k /\
- interference_caused_by j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply interference_bound_edf_all_jobs_from_tsk_k, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The deadline of j_lst is the deadline of tsk_k. *)
- Lemma interference_bound_edf_j_lst_deadline :
- job_deadline j_lst = task_deadline tsk_k.
- Proof.
- unfold valid_sporadic_job in *.
- rename H_valid_job_parameters into PARAMS.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [LSTarr [LSTtask _]].
- by specialize (PARAMS j_lst LSTarr); des; rewrite PARAMS1 LSTtask.
- Qed.
-
- (* The first job arrives before the last job. *)
- Lemma interference_bound_edf_j_fst_before_j_lst :
- job_arrival j_fst <= job_arrival j_lst.
- Proof.
- rename H_at_least_two_jobs into SIZE.
- unfold j_fst, j_lst; rewrite -[num_mid_jobs.+1]add0n.
- apply prev_le_next; last by rewrite SIZE leqnn.
- by intros i LT; apply interference_bound_edf_jobs_ordered_by_arrival.
- Qed.
-
- (* The last job arrives before the end of the interval. *)
- Lemma interference_bound_edf_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- exploit interference_bound_edf_all_jobs_from_tsk_k.
- {
- apply mem_nth; instantiate (1 := num_mid_jobs.+1).
- by rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- }
- instantiate (1 := elem); move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- apply LSTserv; apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := service_during sched j_lst t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP; unfold service_during.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- Qed.
-
- (* Since there are multiple jobs, j_fst is far enough from the end of
- the interval that its response-time bound is valid
- (by the assumption H_all_previous_jobs_completed_on_time). *)
- Lemma interference_bound_edf_j_fst_completed_on_time :
- completed job_cost sched j_fst (a_fst + R_k).
- Proof.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k; des.
- set j_snd := nth elem sorted_jobs 1.
- exploit interference_bound_edf_all_jobs_from_tsk_k.
- {
- by apply mem_nth; instantiate (1 := 1); rewrite H_at_least_two_jobs.
- }
- instantiate (1 := elem); move => [SNDarr [SNDtsk [/eqP SNDserv _]]].
- apply H_all_previous_jobs_completed_on_time; try (by done).
- apply leq_ltn_trans with (n := job_arrival j_snd); last first.
- {
- rewrite ltnNge; apply/negP; red; intro BUG; apply SNDserv.
- apply/eqP; rewrite -leqn0; apply leq_trans with (n := service_during
- sched j_snd t1 t2);
- first by apply job_interference_le_service.
- rewrite leqn0; apply/eqP.
- try ( by apply cumulative_service_before_job_arrival_zero with (job_arrival0 := job_arrival) ) ||
- by apply cumulative_service_before_job_arrival_zero with (job_arrival := job_arrival).
- }
- apply leq_trans with (n := a_fst + p_k).
- {
- by rewrite leq_add2l; apply leq_trans with (n := D_k);
- [by apply H_R_k_le_deadline | by apply H_constrained_deadlines].
- }
-
- (* Since jobs are sporadic, we know that the first job arrives
- at least p_k units before the second. *)
- unfold p_k; rewrite -FST0.
- apply H_sporadic_tasks; try (by done); [| by rewrite SNDtsk | ]; last first.
- {
- apply interference_bound_edf_jobs_ordered_by_arrival.
- by rewrite H_at_least_two_jobs.
- }
- red; move => /eqP BUG.
- by rewrite nth_uniq in BUG; rewrite ?SIZE //;
- [ by apply interference_bound_edf_at_least_one_job
- | by rewrite H_at_least_two_jobs
- | by rewrite sort_uniq; apply filter_uniq, undup_uniq].
- Qed.
-
- End FactsAboutFirstAndLastJobs.
-
- (* Next, we prove that the distance between the first and last jobs is at least
- num_mid_jobs + 1 periods. *)
- Lemma interference_bound_edf_many_periods_in_between :
- a_lst - a_fst >= num_mid_jobs.+1 * p_k.
- Proof.
- clear H_tsk_k_in_task_set.
- clear H_at_least_one_cpu H_tsk_i_in_task_set H_delta_le_deadline.
- unfold a_fst, a_lst, j_fst, j_lst.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- rewrite EQnk telescoping_sum;
- last by ins; apply interference_bound_edf_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk_k]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply interference_bound_edf_jobs_ordered_by_arrival.
-
- feed (interference_bound_edf_all_jobs_from_tsk_k cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (interference_bound_edf_all_jobs_from_tsk_k next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first by move: EQ => /eqP EQ; lia.
- by apply ltn_trans with (n := (size sorted_jobs).-1); destruct sorted_jobs; ins.
- by destruct sorted_jobs; ins.
- by rewrite sort_uniq -/interfering_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk.
- }
- by rewrite leq_subRL_impl // /p_k -CURtsk.
- Qed.
-
- Lemma interference_bound_edf_slack_le_delta:
- D_k - R_k <= D_i.
- Proof.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- rewrite leq_subLR -(leq_add2r a_fst).
- rewrite -addnA [R_k + _]addnC -addnA.
- apply leq_trans with (n := D_i + t1);
- last by rewrite leq_add2l.
- have FST := interference_bound_edf_j_fst_is_job_of_tsk_k.
- destruct FST as [ARRfst [_ [ LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- rewrite addnC [D_i + _]addnC.
- unfold D_k, D_i.
- by rewrite -interference_bound_edf_j_fst_deadline
- -interference_bound_edf_j_i_deadline.
- Qed.
-
- (* Using the lemma above, we prove that the ratio n_k is at least the number of
- middle jobs + 1, ... *)
- Lemma interference_bound_edf_n_k_covers_all_jobs :
- n_k >= num_mid_jobs.+2.
- Proof.
- have AFTERt1 :=
- interference_bound_edf_j_fst_completion_implies_rt_bound_inside_interval
- interference_bound_edf_j_fst_completed_on_time.
- have SLACK := interference_bound_edf_slack_le_delta.
- rename H_valid_task_parameters into TASK_PARAMS,
- H_tsk_k_in_task_set into INk.
- unfold valid_sporadic_taskset, is_valid_sporadic_task,
- interference_bound, edf_specific_interference_bound in *.
- have DIST := interference_bound_edf_many_periods_in_between.
- rewrite leqNgt; apply/negP; unfold not; rewrite ltnS; intro LTnk.
- assert (BUG: a_lst - a_fst > D_i + R_k - D_k).
- {
- apply leq_trans with (n := num_mid_jobs.+1 * p_k); last by done.
- apply leq_trans with (n := n_k * p_k);
- last by rewrite leq_mul2r; apply/orP; right.
- unfold n_k, div_ceil.
- feed (TASK_PARAMS tsk_k); [by done | des].
- destruct (p_k %| D_i + R_k - D_k + 1) eqn:DIV.
- - by rewrite dvdn_eq in DIV; move: DIV => /eqP DIV; rewrite DIV addn1.
- - by rewrite -addn1; apply ltnW, ltn_ceil.
- }
- rewrite leq_subLR in SLACK.
- rewrite -(leq_add2r a_fst) addnBAC in BUG;
- last by apply interference_bound_edf_j_fst_before_j_lst.
- rewrite -[a_lst + _ - _]subnBA // subnn subn0 in BUG.
- rewrite addnC addnS in BUG.
- rewrite addnBA // in BUG; last by rewrite addnC.
- rewrite -(ltn_add2r D_k) in BUG.
- rewrite addnBAC in BUG; last first.
- {
- rewrite [D_i + R_k]addnC.
- by apply leq_trans with (n := R_k + D_i);
- last by apply leq_addl.
- }
- rewrite -addnBA // subnn addn0 in BUG.
- rewrite [D_i + _]addnC addnA in BUG.
- apply leq_ltn_trans with (m := t1 + D_i) in BUG;
- last by rewrite leq_add2r.
- have LST := interference_bound_edf_j_lst_is_job_of_tsk_k.
- destruct LST as [ARRlst [_ [ LEdl _]]].
- try ( apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq0 := arr_seq) (job_deadline0 := job_deadline) in LEdl; try (by done) ) ||
- apply interference_under_edf_implies_shorter_deadlines with
- (arr_seq := arr_seq) (job_deadline := job_deadline) in LEdl; try (by done).
- unfold D_i, D_k in DIST; rewrite interference_bound_edf_j_lst_deadline
- interference_bound_edf_j_i_deadline in LEdl.
- by rewrite ltnNge LEdl in BUG.
- Qed.
-
- (* ... which allows bounding the interference of the middle and last jobs
- using n_k multiplied by the cost. *)
- Lemma interference_bound_edf_holds_for_multiple_jobs :
- \sum_(0 <= i < num_mid_jobs.+2)
- interference_caused_by (nth elem sorted_jobs i) t1 t2
- <= interference_bound.
- Proof.
- apply leq_trans with (n := num_mid_jobs.+2 * task_cost tsk_k); last first.
- {
- rewrite leq_mul2r; apply/orP; right.
- by apply interference_bound_edf_n_k_covers_all_jobs.
- }
- {
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs.+2) task_cost tsk_k);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < _ | true) _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- apply interference_bound_edf_interference_le_task_cost.
- rewrite interference_bound_edf_job_in_same_sequence.
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- Qed.
-
- End InterferenceTwoOrMoreJobs.
-
- End InterferenceManyJobs.
-
- Theorem interference_bound_edf_bounds_interference :
- x <= interference_bound.
- Proof.
- (* Use the definition of workload based on list of jobs. *)
- apply (leq_trans interference_bound_edf_use_another_definition).
-
- (* We only care about the jobs that cause interference. *)
- rewrite interference_bound_edf_simpl_by_filtering_interfering_jobs.
-
- (* Now we order the list by job arrival time. *)
- rewrite interference_bound_edf_simpl_by_sorting_interfering_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply interference_bound_edf_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs as [| j]; [by rewrite ltn0 in NUM | by exists j].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a single job, or for multiple jobs. *)
- destruct n as [| num_mid_jobs].
- {
- rewrite big_nat_recr // big_geq //.
- rewrite [nth]lock /= -lock add0n.
- by apply interference_bound_edf_holds_for_a_single_job; rewrite SIZE.
- }
- {
- by apply interference_bound_edf_holds_for_multiple_jobs; first by rewrite SIZE.
- }
- Qed.
-
- End MainProof.
-
- End ProofSpecificBound.
-
- (* As required by the proof of convergence of EDF RTA, we show that the
- EDF-specific bound is monotonically increasing with both the size
- of the interval and the value of the previous response-time bounds. *)
- Section MonotonicitySpecificBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Variable tsk tsk_other: sporadic_task.
- Hypothesis H_period_positive: task_period tsk_other > 0.
-
- Variable delta delta' R R': time.
- Hypothesis H_delta_monotonic: delta <= delta'.
- Hypothesis H_response_time_monotonic: R <= R'.
- Hypothesis H_cost_le_rt_bound: task_cost tsk_other <= R.
-
- Lemma interference_bound_edf_monotonic :
- interference_bound_edf task_cost task_period task_deadline tsk delta (tsk_other, R) <=
- interference_bound_edf task_cost task_period task_deadline tsk delta' (tsk_other, R').
- Proof.
- rename H_response_time_monotonic into LEr, H_delta_monotonic into LEx,
- H_cost_le_rt_bound into LEcost, H_period_positive into GEperiod.
- unfold interference_bound_edf, interference_bound_generic.
- rewrite leq_min; apply/andP; split.
- {
- apply leq_trans with (n := W task_cost task_period (fst (tsk_other, R))
- (snd (tsk_other, R)) delta);
- [by apply geq_minl | by apply W_monotonic].
- }
- {
- apply leq_trans with (n := edf_specific_interference_bound task_cost task_period
- task_deadline tsk tsk_other R);
- first by apply geq_minr.
- unfold edf_specific_interference_bound; simpl.
- rewrite leq_mul2r; apply/orP; right.
- apply leq_divceil2r; first by done.
- by rewrite leq_add2r leq_sub2r // leq_add2l.
- }
- Qed.
-
- End MonotonicitySpecificBound.
-
-End InterferenceBoundEDF.
diff --git a/classic/analysis/global/parallel/interference_bound_fp.v b/classic/analysis/global/parallel/interference_bound_fp.v
deleted file mode 100644
index 224c354c1d55a1e2b59d90838b1f048bfbab7f09..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/interference_bound_fp.v
+++ /dev/null
@@ -1,45 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.interference.
-Require Import prosa.classic.analysis.global.parallel.workload_bound prosa.classic.analysis.global.parallel.interference_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module InterferenceBoundFP.
-
- Import Schedule WorkloadBound Priority Interference.
- Export InterferenceBoundGeneric.
-
- Section Definitions.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: sporadic_task.
-
- Let task_with_response_time := (sporadic_task * time)%type.
-
- (* Assume a known response-time bound for each interfering task ... *)
- Variable R_prev: seq task_with_response_time.
-
- (* ... and an interval length delta. *)
- Variable delta: time.
-
- (* Assume an FP policy. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* Recall the interference bound. *)
- Let total_interference_bound := interference_bound_generic task_cost task_period delta.
-
- (* The total interference incurred by tsk is bounded by the sum
- of individual task interferences. *)
- Definition total_interference_bound_fp :=
- \sum_((tsk_other, R_other) <- R_prev)
- total_interference_bound (tsk_other, R_other).
-
- End Definitions.
-
-End InterferenceBoundFP.
\ No newline at end of file
diff --git a/classic/analysis/global/parallel/workload_bound.v b/classic/analysis/global/parallel/workload_bound.v
deleted file mode 100644
index d2c91b8474602d38d29278300725c4e2674b4da8..0000000000000000000000000000000000000000
--- a/classic/analysis/global/parallel/workload_bound.v
+++ /dev/null
@@ -1,529 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.response_time prosa.classic.model.schedule.global.workload
- prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq div fintype bigop path.
-
-Module WorkloadBound.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask TaskArrival ResponseTime Schedulability Workload.
-
- Section WorkloadBoundDef.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
-
- Variable tsk: sporadic_task.
- Variable R_tsk: time. (* Known response-time bound for the task *)
- Variable delta: time. (* Length of the interval *)
-
- (* Bound on the number of jobs that execute on the interval *)
- Definition max_jobs :=
- div_ceil (delta + R_tsk) (task_period tsk).
-
- (* Simplified workload bound for parallel jobs.*)
- Definition W := max_jobs * task_cost tsk.
-
- End WorkloadBoundDef.
-
- Section BasicLemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
-
- (* Let tsk be any task...*)
- Variable tsk: sporadic_task.
-
- (* ...with period > 0. *)
- Hypothesis H_period_positive: task_period tsk > 0.
-
- (* Let R1 <= R2 be two response-time bounds that
- are larger than the cost of the tsk. *)
- Variable R1 R2: time.
- Hypothesis H_R_lower_bound: R1 >= task_cost tsk.
- Hypothesis H_R1_le_R2: R1 <= R2.
-
- Let workload_bound := W task_cost task_period tsk.
-
- (* The workload bound W is monotonically increasing. *)
- Lemma W_monotonic :
- forall t1 t2,
- t1 <= t2 ->
- workload_bound R1 t1 <= workload_bound R2 t2.
- Proof.
- intros t1 t2 LEt.
- unfold workload_bound, W, max_jobs.
- rewrite leq_mul2r; apply/orP; right.
- by apply leq_divceil2r; last by apply leq_add.
- Qed.
-
- End BasicLemmas.
-
- Section ProofWorkloadBound.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_deadline: Job -> time.
-
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume that all jobs have valid parameters *)
- Hypothesis H_jobs_have_valid_parameters :
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider any schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Assumption: jobs only execute if they arrived.
- This is used to eliminate jobs that arrive after end of the interval t1 + delta. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Assumption: jobs do not execute after they completed.
- This is used to eliminate jobs that complete before the start of the interval t1. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assumption: sporadic task model.
- This is necessary to conclude that consecutive jobs ordered by arrival times
- are separated by at least 'period' times units. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Before starting the proof, let's give simpler names to the definitions. *)
- Let job_has_completed_by := completed job_cost sched.
-
- Let workload_of (tsk: sporadic_task) (t1 t2: time) :=
- workload job_task sched tsk t1 t2.
-
- (* Now we define the theorem. Let tsk be any task in the taskset. *)
- Variable tsk: sporadic_task.
-
- (* Assumption: the task must have valid parameters:
- a) period > 0 (used in divisions)
- b) deadline of the jobs = deadline of the task
- c) cost <= period
- (used to prove that the distance between the first and last
- jobs is at least (cost + n*period), where n is the number
- of middle jobs. If cost >> period, the claim does not hold
- for every task set. *)
- Hypothesis H_valid_task_parameters:
- is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (* Consider an interval [t1, t1 + delta). *)
- Variable t1 delta: time.
-
- (* Assume that any job with response-time bound R_tsk before
- t1 + delta indeed completes within the response-time bound. *)
- Variable R_tsk: time.
-
- Hypothesis H_response_time_bound :
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_arrival j + R_tsk < t1 + delta ->
- job_has_completed_by j (job_arrival j + R_tsk).
-
- Section MainProof.
-
- (* In this section, we prove that the workload of a task in the
- interval [t1, t1 + delta) is bounded by W. *)
-
- (* Let's simplify the names a bit. *)
- Let t2 := t1 + delta.
- Let n_k := max_jobs task_period tsk R_tsk delta.
- Let workload_bound := W task_cost task_period tsk R_tsk delta.
-
- (* Since we only care about the workload of tsk, we restrict
- our view to the set of jobs of tsk scheduled in [t1, t2). *)
- Let scheduled_jobs :=
- jobs_of_task_scheduled_between job_task sched tsk t1 t2.
-
- (* Now, let's consider the list of interfering jobs sorted by arrival time. *)
- Let earlier_arrival := fun x y => job_arrival x <= job_arrival y.
- Let sorted_jobs := (sort earlier_arrival scheduled_jobs).
-
- (* The first step consists in simplifying the sum corresponding
- to the workload. *)
- Section SimplifyJobSequence.
-
- (* After switching to the definition of workload based on a list
- of jobs, we show that sorting the list preserves the sum. *)
- Lemma workload_bound_simpl_by_sorting_scheduled_jobs :
- workload_joblist job_task sched tsk t1 t2 =
- \sum_(i <- sorted_jobs) service_during sched i t1 t2.
- Proof.
- unfold workload_joblist; fold scheduled_jobs.
- rewrite (perm_big sorted_jobs) /= //.
- by rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that both sequences have the same set of elements *)
- Lemma workload_bound_job_in_same_sequence :
- forall j,
- (j \in scheduled_jobs) = (j \in sorted_jobs).
- Proof.
- by apply perm_mem; rewrite -(perm_sort earlier_arrival).
- Qed.
-
- (* Remember that all jobs in the sorted sequence is an
- interfering job of task tsk. *)
- Lemma workload_bound_all_jobs_from_tsk :
- forall j_i,
- j_i \in sorted_jobs ->
- arrives_in arr_seq j_i /\
- job_task j_i = tsk /\
- service_during sched j_i t1 t2 != 0 /\
- j_i \in jobs_scheduled_between sched t1 t2.
- Proof.
- rename H_jobs_come_from_arrival_sequence into FROMarr.
- intros j_i LTi.
- rewrite -workload_bound_job_in_same_sequence mem_filter in LTi; des.
- unfold jobs_scheduled_between in *; rewrite mem_undup in LTi0.
- apply mem_bigcat_nat_exists in LTi0; des.
- rewrite mem_scheduled_jobs_eq_scheduled in LTi0.
- repeat split; try (by done); first by apply (FROMarr j_i i).
- {
- apply service_implies_cumulative_service with (t := i);
- first by apply/andP; split.
- by rewrite -not_scheduled_no_service negbK.
- }
- {
- rewrite mem_undup.
- apply mem_bigcat_nat with (j := i); first by auto.
- by rewrite mem_scheduled_jobs_eq_scheduled.
- }
- Qed.
-
- (* Remember that consecutive jobs are ordered by arrival. *)
- Lemma workload_bound_jobs_ordered_by_arrival :
- forall i elem,
- i < (size sorted_jobs).-1 ->
- earlier_arrival (nth elem sorted_jobs i) (nth elem sorted_jobs i.+1).
- Proof.
- intros i elem LT.
- assert (SORT: sorted earlier_arrival sorted_jobs).
- by apply sort_sorted; unfold total, earlier_arrival; ins; apply leq_total.
- by destruct sorted_jobs; simpl in *; [by rewrite ltn0 in LT | by apply/pathP].
- Qed.
-
- End SimplifyJobSequence.
-
- (* Next, we show that if the number of jobs is no larger than n_k,
- the workload bound trivially holds. *)
- Section WorkloadNotManyJobs.
-
- Lemma workload_bound_holds_for_at_most_n_k_jobs :
- size sorted_jobs <= n_k ->
- \sum_(i <- sorted_jobs) service_during sched i t1 t2 <=
- workload_bound.
- Proof.
- unfold workload_bound, W; intros LEnk.
- apply leq_trans with (n := \sum_(x <- sorted_jobs) task_cost tsk);
- last by rewrite big_const_seq iter_addn addn0 mulnC leq_mul2r; apply/orP; right.
- rewrite [\sum_(_ <- _) service_during _ _ _ _]big_seq_cond.
- rewrite [\sum_(_ <- _) task_cost _]big_seq_cond.
- apply leq_sum; intros j_i; move/andP => [INi _].
- apply workload_bound_all_jobs_from_tsk in INi; des.
- eapply cumulative_service_le_task_cost;
- [by apply H_completed_jobs_dont_execute | by apply INi0 |].
- by apply H_jobs_have_valid_parameters.
- Qed.
-
- End WorkloadNotManyJobs.
-
- (* Otherwise, assume that the number of jobs is larger than n_k >= 0.
- First, consider the simple case with only one job. *)
- Section WorkloadSingleJob.
-
- (* Assume that there's at least one job in the sorted list. *)
- Hypothesis H_at_least_one_job: size sorted_jobs > 0.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
-
- (* The first job is an interfering job of task tsk. *)
- Lemma workload_bound_j_fst_is_job_of_tsk :
- arrives_in arr_seq j_fst /\
- job_task j_fst = tsk /\
- service_during sched j_fst t1 t2 != 0 /\
- j_fst \in jobs_scheduled_between sched t1 t2.
- Proof.
- by apply workload_bound_all_jobs_from_tsk, mem_nth.
- Qed.
-
- (* The workload bound holds for the single job. *)
- Lemma workload_bound_holds_for_a_single_job :
- \sum_(0 <= i < 1) service_during sched (nth elem sorted_jobs i) t1 t2 <=
- workload_bound.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *.
- unfold workload_bound, W; fold n_k.
- have INfst := workload_bound_j_fst_is_job_of_tsk; des.
- rewrite big_nat_recr // big_geq // [nth]lock /= -lock add0n.
- apply leq_trans with (n := task_cost tsk).
- {
- eapply cumulative_service_le_task_cost; [by eauto 1 | by apply INfst0 |].
- by apply H_jobs_have_valid_parameters.
- }
- rewrite -{1}[task_cost tsk]mul1n leq_mul2r; apply/orP; right.
- apply ceil_neq0; last by apply PARAMS0.
- {
- apply leq_trans with (n := delta); last by apply leq_addr.
- rewrite lt0n; apply/eqP; intro EQ0.
- move: INfst1 => /eqP BUG; apply BUG.
- unfold t2; rewrite EQ0 addn0.
- by unfold service_during; rewrite big_geq.
- }
- Qed.
-
- End WorkloadSingleJob.
-
- (* Next, consider the last case where there are at least two jobs:
- the first job j_fst, and the last job j_lst. *)
- Section WorkloadTwoOrMoreJobs.
-
- (* There are at least two jobs. *)
- Variable num_mid_jobs: nat.
- Hypothesis H_at_least_two_jobs : size sorted_jobs = num_mid_jobs.+2.
-
- Variable elem: Job.
- Let j_fst := nth elem sorted_jobs 0.
- Let j_lst := nth elem sorted_jobs num_mid_jobs.+1.
-
- (* The last job is an interfering job of task tsk. *)
- Lemma workload_bound_j_lst_is_job_of_tsk :
- arrives_in arr_seq j_lst /\
- job_task j_lst = tsk /\
- service_during sched j_lst t1 t2 != 0 /\
- j_lst \in jobs_scheduled_between sched t1 t2.
- Proof.
- apply workload_bound_all_jobs_from_tsk, mem_nth.
- by rewrite H_at_least_two_jobs.
- Qed.
-
- (* The response time of the first job must fall inside the interval. *)
- Lemma workload_bound_response_time_of_first_job_inside_interval :
- t1 <= job_arrival j_fst + R_tsk.
- Proof.
- rewrite leqNgt; apply /negP; unfold not; intro LTt1.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := 0).
- apply ltn_trans with (n := 1); [by done | by rewrite H_at_least_two_jobs].
- }
- instantiate (1 := elem); move => [FSTarr [FSTtsk [/eqP FSTserv FSTin]]].
- apply FSTserv.
- apply (cumulative_service_after_job_rt_zero job_arrival job_cost) with (R := R_tsk);
- try (by done); last by apply ltnW.
- apply H_response_time_bound; try (by done).
- by apply leq_trans with (n := t1); last by apply leq_addr.
- Qed.
-
- (* The arrival of the last job must also fall inside the interval. *)
- Lemma workload_bound_last_job_arrives_before_end_of_interval :
- job_arrival j_lst < t2.
- Proof.
- rewrite leqNgt; apply/negP; unfold not; intro LT2.
- exploit workload_bound_all_jobs_from_tsk.
- {
- apply mem_nth; instantiate (1 := num_mid_jobs.+1).
- by rewrite -(ltn_add2r 1) addn1 H_at_least_two_jobs addn1.
- }
- instantiate (1 := elem); move => [LSTarr [LSTtsk [/eqP LSTserv LSTin]]].
- unfold service_during; apply LSTserv.
- by eapply cumulative_service_before_job_arrival_zero; eauto 1.
- Qed.
-
- (* Bound the service of the middle jobs. *)
- Lemma workload_bound_service_of_middle_jobs :
- \sum_(0 <= i < num_mid_jobs)
- service_during sched (nth elem sorted_jobs i.+1) t1 t2 <=
- num_mid_jobs * task_cost tsk.
- Proof.
- apply leq_trans with (n := num_mid_jobs * task_cost tsk);
- last by rewrite leq_mul2l; apply/orP; right.
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs) task_cost tsk);
- last by rewrite big_const_nat iter_addn addn0 mulnC subn0.
- rewrite big_nat_cond [\sum_(0 <= i < num_mid_jobs) task_cost _]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
- exploit workload_bound_all_jobs_from_tsk.
- {
- instantiate (1 := nth elem sorted_jobs i.+1).
- apply mem_nth; rewrite H_at_least_two_jobs.
- by rewrite ltnS; apply leq_trans with (n := num_mid_jobs).
- }
- move => [ARR [TSK _]].
- eapply cumulative_service_le_task_cost; eauto 1.
- by apply H_jobs_have_valid_parameters.
- Qed.
-
- (* Conclude that the distance between first and last is at least num_mid_jobs + 1 periods. *)
- Lemma workload_bound_many_periods_in_between :
- job_arrival j_lst - job_arrival j_fst >= num_mid_jobs.+1 * (task_period tsk).
- Proof.
- assert (EQnk: num_mid_jobs.+1=(size sorted_jobs).-1).
- by rewrite H_at_least_two_jobs.
- unfold j_fst, j_lst; rewrite EQnk telescoping_sum;
- last by ins; apply workload_bound_jobs_ordered_by_arrival.
- rewrite -[_ * _ tsk]addn0 mulnC -iter_addn -{1}[_.-1]subn0 -big_const_nat.
- rewrite big_nat_cond [\sum_(0 <= i < _)(_-_)]big_nat_cond.
- apply leq_sum; intros i; rewrite andbT; move => /andP LT; des.
-
- (* To simplify, call the jobs 'cur' and 'next' *)
- set cur := nth elem sorted_jobs i.
- set next := nth elem sorted_jobs i.+1.
-
- (* Show that cur arrives earlier than next *)
- assert (ARRle: job_arrival cur <= job_arrival next).
- by unfold cur, next; apply workload_bound_jobs_ordered_by_arrival.
-
- feed (workload_bound_all_jobs_from_tsk cur).
- by apply mem_nth, (ltn_trans LT0); destruct sorted_jobs.
- intros [CURarr [CURtsk [_ CURin]]].
-
- feed (workload_bound_all_jobs_from_tsk next).
- by apply mem_nth; destruct sorted_jobs.
- intros [NEXTarr [NEXTtsk [_ NEXTin]]].
-
- (* Use the sporadic task model to conclude that cur and next are separated
- by at least (task_period tsk) units. Of course this only holds if cur != next.
- Since we don't know much about the list (except that it's sorted), we must
- also prove that it doesn't contain duplicates. *)
- assert (CUR_LE_NEXT: job_arrival cur + task_period (job_task cur) <= job_arrival next).
- {
- apply H_sporadic_tasks; try (by done).
- unfold cur, next, not; intro EQ; move: EQ => /eqP EQ.
- rewrite nth_uniq in EQ; first by move: EQ => /eqP EQ; lia.
- by apply ltn_trans with (n := (size sorted_jobs).-1); destruct sorted_jobs; ins.
- by destruct sorted_jobs; ins.
- by rewrite sort_uniq -/scheduled_jobs filter_uniq // undup_uniq.
- by rewrite CURtsk.
- }
- by rewrite leq_subRL_impl // -CURtsk.
- Qed.
-
- (* Next, we prove that n_k covers every scheduled job, ... *)
- Lemma workload_bound_n_k_covers_all_jobs :
- n_k >= num_mid_jobs.+2.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold is_valid_sporadic_task in *; des.
- rewrite leqNgt; apply/negP; unfold not; intro LTnk.
- assert (DISTmax: job_arrival j_lst - job_arrival j_fst >= delta + R_tsk).
- {
- apply leq_trans with (n := num_mid_jobs.+1 * task_period tsk);
- last by apply workload_bound_many_periods_in_between.
- apply leq_trans with (n := n_k * task_period tsk);
- last by rewrite leq_mul2r; apply/orP; right.
- unfold n_k, max_jobs, div_ceil.
- destruct (task_period tsk %| delta + R_tsk) eqn:DIV.
- {
- rewrite dvdn_eq in DIV; move: DIV => /eqP DIV.
- by rewrite DIV.
- }
- by apply ltnW, ltn_ceil, PARAMS0.
- }
- rewrite <- leq_add2r with (p := job_arrival j_fst) in DISTmax.
- rewrite addnC addnBAC in DISTmax; last first.
- {
- unfold j_fst, j_lst; rewrite -[_.+1]add0n.
- apply prev_le_next; last by rewrite H_at_least_two_jobs add0n leqnn.
- by ins; apply workload_bound_jobs_ordered_by_arrival.
- }
- rewrite -[job_arrival j_lst + _ - _]subnBA // subnn subn0 in DISTmax.
- rewrite [delta + _]addnC addnA in DISTmax.
- apply leq_trans with (m := t1 + delta) in DISTmax; last first.
- {
- rewrite leq_add2r.
- by apply workload_bound_response_time_of_first_job_inside_interval.
- }
- have LST := workload_bound_last_job_arrives_before_end_of_interval.
- by apply leq_ltn_trans with (m := t2) in LST; first by rewrite ltnn in LST.
- Qed.
-
- (* ... so the workload bound trivially holds. *)
- Lemma workload_bound_holds :
- \sum_(0 <= i < num_mid_jobs.+2)
- service_during sched (nth elem sorted_jobs i) t1 t2
- <= workload_bound.
- Proof.
- unfold workload_bound, W; fold n_k.
- have ALL := workload_bound_n_k_covers_all_jobs.
- apply leq_trans with (n := num_mid_jobs.+2 * task_cost tsk);
- last by rewrite leq_mul2r; apply/orP; right.
- apply leq_trans with (n := \sum_(0 <= i < num_mid_jobs.+2) task_cost tsk);
- last by rewrite big_const_nat iter_addn addn0 subn0 mulnC.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true)_]big_nat_cond.
- apply leq_sum; intro i; move => /andP [/andP [_ LEi] _].
- exploit workload_bound_all_jobs_from_tsk.
- {
- instantiate (1 := nth elem sorted_jobs i).
- by apply mem_nth; rewrite H_at_least_two_jobs.
- }
- move => [ARR [TSK _]].
- eapply cumulative_service_le_task_cost; eauto 1.
- by apply H_jobs_have_valid_parameters.
- Qed.
-
- End WorkloadTwoOrMoreJobs.
-
- (* Using the lemmas above, we prove the main theorem about the workload bound. *)
- Theorem workload_bounded_by_W :
- workload_of tsk t1 (t1 + delta) <= workload_bound.
- Proof.
- unfold workload_of, workload_bound, W in *; ins; des.
- fold n_k.
-
- (* Use the definition of workload based on list of jobs. *)
- rewrite workload_eq_workload_joblist.
-
- (* Now we order the list by job arrival time. *)
- rewrite workload_bound_simpl_by_sorting_scheduled_jobs.
-
- (* Next, we show that the workload bound holds if n_k
- is no larger than the number of interferings jobs. *)
- destruct (size sorted_jobs <= n_k) eqn:NUM;
- first by apply workload_bound_holds_for_at_most_n_k_jobs.
- apply negbT in NUM; rewrite -ltnNge in NUM.
-
- (* Find some dummy element to use in the nth function *)
- assert (EX: exists elem: Job, True).
- destruct sorted_jobs; [ by rewrite ltn0 in NUM | by exists s].
- destruct EX as [elem _].
-
- (* Now we index the sum to access the first and last elements. *)
- rewrite (big_nth elem).
-
- (* First, we show that the bound holds for an empty list of jobs. *)
- destruct (size sorted_jobs) as [| n] eqn:SIZE;
- first by rewrite big_geq.
-
- (* Then, we show the same for a singleton set of jobs. *)
- destruct n as [| num_mid_jobs];
- first by apply workload_bound_holds_for_a_single_job; rewrite SIZE.
- (* Since num_mid_jobs + 2 <= n_k >= num_mid_jobs + 2, the proof follows easily. *)
- by apply workload_bound_holds.
- Qed.
-
- End MainProof.
-
- End ProofWorkloadBound.
-
-End WorkloadBound.
diff --git a/classic/analysis/uni/arrival_curves/workload_bound.v b/classic/analysis/uni/arrival_curves/workload_bound.v
deleted file mode 100644
index 32c5529b5e4623ded3f1070c144abde67be69bb0..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/arrival_curves/workload_bound.v
+++ /dev/null
@@ -1,349 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.arrival.curves.bounds.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-Module MaxArrivalsWorkloadBound.
-
- Import Job ArrivalCurves TaskArrival Priority UniprocessorSchedule Workload Service.
-
- Section Lemmas.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence. *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Consider an FP policy that indicates a higher-or-equal priority relation. *)
- Variable higher_eq_priority: FP_policy Task.
- Let jlfp_higher_eq_priority := FP_to_JLFP job_task higher_eq_priority.
-
- (* For simplicity, let's define some local names. *)
- Let arrivals_between := jobs_arrived_between arr_seq.
-
- (* We define the notion of request bound function. *)
- Section RequestBoundFunction.
-
- (* Let max_arrivals denote any function that takes a task and an interval length
- and returns the associated number of job arrivals of the task. *)
- Variable max_arrivals: Task -> time -> nat.
-
- (* In this section, we define a bound for the workload of a single task
- under uniprocessor FP scheduling. *)
- Section SingleTask.
-
- (* Consider any task tsk that is to be scheduled in an interval of length delta. *)
- Variable tsk: Task.
- Variable delta: time.
-
- (* We define the following workload bound for the task. *)
- Definition task_request_bound_function := task_cost tsk * max_arrivals tsk delta.
-
- End SingleTask.
-
- (* In this section, we define a bound for the workload of multiple tasks. *)
- Section AllTasks.
-
- (* Consider a task set ts... *)
- Variable ts: list Task.
-
- (* ...and let tsk be any task in task set. *)
- Variable tsk: Task.
-
- (* Let delta be the length of the interval of interest. *)
- Variable delta: time.
-
- (* Recall the definition of higher-or-equal-priority task and
- the per-task workload bound for FP scheduling. *)
- Let is_hep_task tsk_other := higher_eq_priority tsk_other tsk.
- Let is_other_hep_task tsk_other := higher_eq_priority tsk_other tsk && (tsk_other != tsk).
-
- (* Using the sum of individual workload bounds, we define the following bound
- for the total workload of tasks in any interval of length delta. *)
- Definition total_request_bound_function :=
- \sum_(tsk <- ts) task_request_bound_function tsk delta.
-
- (* Similarly, we define the following bound for the total workload of tasks of
- higher-or-equal priority (with respect to tsk) in any interval of length delta. *)
- Definition total_hep_request_bound_function_FP :=
- \sum_(tsk_other <- ts | is_hep_task tsk_other)
- task_request_bound_function tsk_other delta.
-
- (* We also define bound for the total workload of higher-or-equal priority
- tasks other than tsk in any interval of length delta. *)
- Definition total_ohep_request_bound_function_FP :=
- \sum_(tsk_other <- ts | is_other_hep_task tsk_other)
- task_request_bound_function tsk_other delta.
-
- End AllTasks.
-
- End RequestBoundFunction.
-
- (* In this section we prove some lemmas about request bound functions. *)
- Section ProofWorkloadBound.
-
- (* Consider a task set ts... *)
- Variable ts: list Task.
-
- (* ...and let tsk be any task in ts. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Assume that a job cost cannot be larger than a task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- forall j,
- arrives_in arr_seq j ->
- job_cost_le_task_cost task_cost job_cost job_task j.
-
- (* Next, we assume that all jobs come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Let max_arrivals be any arrival bound for taskset ts. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_is_arrival_bound:
- is_arrival_bound_for_taskset job_task arr_seq max_arrivals ts.
-
- (* Let's define some local names for clarity. *)
- Let task_rbf := task_request_bound_function max_arrivals tsk.
- Let total_rbf := total_request_bound_function max_arrivals ts.
- Let total_hep_rbf := total_hep_request_bound_function_FP max_arrivals ts tsk.
- Let total_ohep_rbf := total_ohep_request_bound_function_FP max_arrivals ts tsk.
-
- (* Next, we consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* We define whether two jobs j1 and j2 are from the same task. *)
- Let same_task j1 j2 := job_task j1 == job_task j2.
-
- (* Next, we say that two jobs j1 and j2 are in relation other_higher_eq_priority, iff
- j1 has higher or equal priority than j2 and is produced by a different task. *)
- Let other_higher_eq_priority j1 j2 := jlfp_higher_eq_priority j1 j2 && (~~ same_task j1 j2).
-
- (* Next, we recall the notions of total workload of jobs... *)
- Let total_workload t1 t2 :=
- workload_of_jobs job_cost (arrivals_between t1 t2) (fun j => true).
-
- (* ...notions of workload of higher or equal priority jobs... *)
- Let total_hep_workload t1 t2 :=
- workload_of_jobs job_cost (arrivals_between t1 t2)
- (fun j_other => jlfp_higher_eq_priority j_other j).
-
- (* ... workload of other higher or equal priority jobs... *)
- Let total_ohep_workload t1 t2 :=
- workload_of_jobs job_cost (arrivals_between t1 t2)
- (fun j_other => other_higher_eq_priority j_other j).
-
- (* ... and the workload of jobs of the same task as job j. *)
- Let task_workload (t1: time) (t2: time) :=
- workload_of_jobs job_cost (arrivals_between t1 t2)
- (fun j_other => same_task j_other j).
-
- (* In this section we prove that the workload of any jobs is
- no larger than the request bound function. *)
- Section WorkloadIsBoundedByRBF.
-
- (* Consider any time t and any interval of length delta. *)
- Variable t: time.
- Variable delta: time.
-
- (* First, we prove that workload of task is no larger
- than task request bound function. *)
- Lemma task_workload_le_task_rbf:
- task_workload t (t + delta) <= task_rbf delta.
- Proof.
- unfold task_workload.
- unfold task_rbf, task_request_bound_function.
- unfold is_arrival_bound in *.
- unfold arrivals_between.
-
- set l := jobs_arrived_between arr_seq t delta.
- apply leq_trans with (
- task_cost tsk * num_arrivals_of_task job_task arr_seq tsk t (t + delta)).
- {
- rewrite /num_arrivals_of_task -sum1_size big_distrr /= big_filter.
- rewrite -/l /workload_of_jobs.
- rewrite /is_job_of_task /same_task H_job_of_tsk muln1.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- rewrite -EQ.
- apply H_job_cost_le_task_cost.
- by apply in_arrivals_implies_arrived in IN0.
- }
- {
- rewrite leq_mul2l; apply/orP; right.
- rewrite -{2}[delta](addKn t).
- apply H_is_arrival_bound; first by done.
- by rewrite leq_addr.
- }
- Qed.
-
- (* Next, we prove that total workload of tasks is no larger
- than total request bound function. *)
- Lemma total_workload_le_total_rbf:
- total_ohep_workload t (t + delta) <= total_ohep_rbf delta.
- Proof.
- rewrite /total_ohep_rbf /total_ohep_request_bound_function_FP
- /task_request_bound_function.
- rewrite /total_ohep_workload /workload_of_jobs
- /other_higher_eq_priority.
- rewrite /jlfp_higher_eq_priority
- /FP_to_JLFP /same_task H_job_of_tsk.
- rewrite /arrivals_between.
-
- set l := jobs_arrived_between arr_seq t (t + delta).
- set hep := higher_eq_priority.
-
- apply leq_trans with
- (\sum_(tsk' <- ts | hep tsk' tsk && (tsk' != tsk))
- (\sum_(j0 <- l | job_task j0 == tsk') job_cost j0)).
- {
- intros.
- have EXCHANGE :=
- exchange_big_dep
- (fun x => hep (job_task x) tsk && (job_task x != tsk)).
- rewrite EXCHANGE /=; last by move => tsk0 j0 HEP /eqP JOB0; rewrite JOB0.
- rewrite /workload_of_jobs -/l big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => j0 /andP [IN0 HP0].
- rewrite big_mkcond (big_rem (job_task j0)) /=;
- first by rewrite HP0 andTb eq_refl; apply leq_addr.
- by apply in_arrivals_implies_arrived in IN0;
- apply H_all_jobs_from_taskset.
- }
- apply leq_sum_seq; intros tsk0 INtsk0 HP0.
- apply leq_trans with (
- task_cost tsk0 * num_arrivals_of_task job_task arr_seq tsk0 t (t + delta)).
- {
- rewrite /num_arrivals_of_task -sum1_size big_distrr /= big_filter.
- rewrite -/l /workload_of_jobs.
- rewrite /is_job_of_task muln1.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- rewrite -EQ.
- apply H_job_cost_le_task_cost.
- by apply in_arrivals_implies_arrived in IN0.
- }
- {
- rewrite leq_mul2l; apply/orP; right.
- rewrite -{2}[delta](addKn t).
- apply H_is_arrival_bound; first by done.
- by rewrite leq_addr.
- }
- Qed.
-
- Lemma total_workload_le_total_rbf':
- total_hep_workload t (t + delta) <= total_hep_rbf delta.
- Proof.
- intros.
- rewrite /total_hep_rbf /total_hep_request_bound_function_FP
- /task_request_bound_function.
- rewrite /total_hep_workload /workload_of_jobs
- /jlfp_higher_eq_priority /FP_to_JLFP /same_task H_job_of_tsk.
- rewrite /arrivals_between.
-
- set l := jobs_arrived_between arr_seq t (t + delta).
- set hep := higher_eq_priority.
-
- apply leq_trans with
- (n := \sum_(tsk' <- ts | hep tsk' tsk)
- (\sum_(j0 <- l | job_task j0 == tsk') job_cost j0)).
- {
- intros.
- have EXCHANGE := exchange_big_dep (fun x => hep (job_task x) tsk).
- rewrite EXCHANGE /=; last by move => tsk0 j0 HEP /eqP JOB0; rewrite JOB0.
- rewrite /workload_of_jobs -/l big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => j0 /andP [IN0 HP0].
- rewrite big_mkcond (big_rem (job_task j0)) /=;
- first by rewrite HP0 andTb eq_refl; apply leq_addr.
- by apply in_arrivals_implies_arrived in IN0;
- apply H_all_jobs_from_taskset.
- }
- apply leq_sum_seq; intros tsk0 INtsk0 HP0.
- apply leq_trans with (
- task_cost tsk0 * num_arrivals_of_task job_task arr_seq tsk0 t (t + delta)).
- {
- rewrite /num_arrivals_of_task -sum1_size big_distrr /= big_filter.
- rewrite -/l /workload_of_jobs.
- rewrite /is_job_of_task muln1.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- rewrite -EQ.
- apply H_job_cost_le_task_cost.
- by apply in_arrivals_implies_arrived in IN0.
- }
- {
- rewrite leq_mul2l; apply/orP; right.
- rewrite -{2}[delta](addKn t).
- apply H_is_arrival_bound; [by done | by rewrite leq_addr].
- }
- Qed.
-
- Lemma total_workload_le_total_rbf'':
- total_workload t (t + delta) <= total_rbf delta.
- Proof.
- intros.
- rewrite /total_rbf
- /task_request_bound_function.
- rewrite /total_workload /workload_of_jobs.
- rewrite /arrivals_between.
-
- set l := jobs_arrived_between arr_seq t (t + delta).
- rewrite big_mkcond //=.
-
-
- apply leq_trans with
- (n := \sum_(tsk' <- ts)
- (\sum_(j0 <- l | job_task j0 == tsk') job_cost j0)).
- {
- intros.
- have EXCHANGE := exchange_big_dep predT.
- rewrite EXCHANGE /=; last by done.
- rewrite /workload_of_jobs -/l big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => j0 /andP [IN0 HP0].
- rewrite big_mkcond (big_rem (job_task j0)) /=.
- rewrite eq_refl; apply leq_addr.
- by apply in_arrivals_implies_arrived in IN0;
- apply H_all_jobs_from_taskset.
- }
- apply leq_sum_seq; intros tsk0 INtsk0 HP0.
- apply leq_trans with (
- task_cost tsk0 * num_arrivals_of_task job_task arr_seq tsk0 t (t + delta)).
- {
- rewrite /num_arrivals_of_task -sum1_size big_distrr /= big_filter.
- rewrite -/l /workload_of_jobs.
- rewrite /is_job_of_task muln1.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- rewrite -EQ.
- apply H_job_cost_le_task_cost.
- by apply in_arrivals_implies_arrived in IN0.
- }
- {
- rewrite leq_mul2l; apply/orP; right.
- rewrite -{2}[delta](addKn t).
- apply H_is_arrival_bound; [by done | by rewrite leq_addr].
- }
- Qed.
-
- End WorkloadIsBoundedByRBF.
-
- End ProofWorkloadBound.
-
- End Lemmas.
-
-End MaxArrivalsWorkloadBound.
\ No newline at end of file
diff --git a/classic/analysis/uni/basic/fp_rta_comp.v b/classic/analysis/uni/basic/fp_rta_comp.v
deleted file mode 100644
index 58043a5e490bec3a06bcdab032022b03704f9c68..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/basic/fp_rta_comp.v
+++ /dev/null
@@ -1,413 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.priority
- prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.basic.platform.
-Require Import prosa.classic.analysis.uni.basic.workload_bound_fp prosa.classic.analysis.uni.basic.fp_rta_theory.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop path ssrfun.
-
-Module ResponseTimeIterationFP.
-
- Import Job SporadicTaskset UniprocessorSchedule WorkloadBoundFP Priority
- ResponseTime Schedulability Platform TaskArrival ResponseTimeAnalysisFP.
-
- (* In this section, we define the response-time analysis for uniprocessor FP scheduling. *)
- Section Analysis.
-
- Context {SporadicTask: eqType}.
- Variable task_cost: SporadicTask -> time.
- Variable task_period: SporadicTask -> time.
- Variable task_deadline: SporadicTask -> time.
-
- (* In the algorithm, we consider pairs of tasks and computed response-time bounds. *)
- Let task_with_response_time := (SporadicTask * time)%type.
-
- (* Assume a fixed-priority policy. *)
- Variable higher_eq_priority: FP_policy SporadicTask.
-
- (* We begin by defining the fixed-point iteration for computing the
- response-time bound of each task. *)
-
- (* First, to ensure that the algorithm converges, we will run the iteration
- on each task for at most (task_deadline tsk - task_cost tsk + 1) steps,
- i.e., the worst-case time complexity of the procedure. *)
- Definition max_steps (tsk: SporadicTask) :=
- task_deadline tsk - task_cost tsk + 1.
-
- (* Next, based on the workload bound for uniprocessor FP scheduling, ... *)
- Let W := total_workload_bound_fp task_cost task_period higher_eq_priority.
-
- (* ...we compute the response-time bound R of a single task as follows:
-
- R (step) = task_cost tsk if step = 0,
- W (ts, tsk, R (step-1)) otherwise. *)
- Definition per_task_rta ts tsk :=
- iter_fixpoint (W ts tsk) (max_steps tsk) (task_cost tsk).
-
- (* Then, to validate the computed response-time bound, we
- check (a) if the iteration returned some value and
- (b) if the value is no larger than the deadline of the task. *)
- Let is_valid_bound tsk_R :=
- if tsk_R is (tsk, Some R) then
- if R <= task_deadline tsk then
- Some (tsk, R)
- else None
- else None.
-
- (* At the end, the response-time bounds for the entire taskset
- can be computed using the fixed-point iteration on each task.
- If all values are no larger than the deadline, we return the
- pairs of tasks and response-time bounds, else we return None. *)
- Definition fp_claimed_bounds ts: option (seq task_with_response_time) :=
- let possible_bounds := [seq (tsk, per_task_rta ts tsk) | tsk <- ts] in
- if all is_valid_bound possible_bounds then
- Some (pmap is_valid_bound possible_bounds)
- else None.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition fp_schedulable (ts: seq SporadicTask) :=
- fp_claimed_bounds ts != None.
-
- (* In this section, we prove some properties about the computed
- list of response-time bounds. *)
- Section Lemmas.
-
- (* Let ts be any taskset to be analyzed. *)
- Variable ts: seq SporadicTask.
-
- (* Assume that the response-time analysis does not fail.*)
- Variable rt_bounds: seq task_with_response_time.
- Hypothesis H_analysis_succeeds:
- fp_claimed_bounds ts = Some rt_bounds.
-
- (* First, we prove that a response-time bound exists for each task. *)
- Section BoundExists.
-
- (* Let tsk be any task in ts. *)
- Variable tsk: SporadicTask.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Since the analysis succeeded, there must be a corresponding
- response-time bound R for this task. *)
- Lemma fp_claimed_bounds_for_every_task:
- exists R, (tsk, R) \in rt_bounds.
- Proof.
- rename H_analysis_succeeds into SOME.
- move: SOME; rewrite /fp_claimed_bounds.
- case ALL: all; [case => SOME | by done].
- move: ALL => /allP ALL.
- have IN: (tsk, per_task_rta ts tsk) \in
- [seq (tsk, per_task_rta ts tsk) | tsk <- ts];
- first by apply/mapP; exists tsk.
- specialize (ALL _ IN); move: ALL.
- rewrite /is_valid_bound; case RTA: per_task_rta => [R|] //.
- case DL: (R <= _); last by done.
- move => _; exists R; rewrite -SOME.
- rewrite mem_pmap; apply/mapP.
- exists (tsk, Some R); first by rewrite -RTA.
- by rewrite /is_valid_bound DL.
- Qed.
-
- End BoundExists.
-
- (* Next, assuming that a bound exists, we prove some of its properties. *)
- Section PropertiesOfBound.
-
- (* Let tsk and R be any pair of task and response-time bound
- returned by the analysis. *)
- Variable tsk: SporadicTask.
- Variable R: time.
- Hypothesis H_tsk_R_computed: (tsk, R) \in rt_bounds.
-
- (* First, we show that tsk comes from task set ts. *)
- Lemma fp_claimed_bounds_from_taskset:
- tsk \in ts.
- Proof.
- rename H_analysis_succeeds into SOME, H_tsk_R_computed into IN.
- move: SOME; rewrite /fp_claimed_bounds.
- case: all; [case => SOME | by done].
- move: IN; rewrite -SOME mem_pmap.
- move => /mapP [[tsk' someR]].
- rewrite /is_valid_bound; case: someR; last by done.
- move => R'; case: (R' <= _); last by done.
- move => IN; case => EQ1 EQ2; subst tsk' R'.
- by move: IN => /mapP [tsk' IN]; case; move => EQ1; subst tsk'.
- Qed.
-
- (* Next, we prove that R is computed using the per-task
- fixed-point iteration, ... *)
- Lemma fp_claimed_bounds_computes_iteration:
- per_task_rta ts tsk = Some R.
- Proof.
- rename H_analysis_succeeds into SOME, H_tsk_R_computed into IN.
- move: SOME; rewrite /fp_claimed_bounds.
- case: all; [case => SOME | by done].
- move: IN; rewrite -SOME mem_pmap.
- move => /mapP [[tsk' someR]].
- rewrite /is_valid_bound; case: someR; last by done.
- move => R'; case: (R' <= _); last by done.
- move => IN; case => EQ1 EQ2; subst tsk' R'.
- by move: IN => /mapP [tsk' IN]; case; move => EQ1 ->; subst tsk'.
- Qed.
-
- (* ...which implies that R is also a fixed point of the recurrence. *)
- Lemma fp_claimed_bounds_yields_fixed_point :
- R = W ts tsk R.
- Proof.
- rename H_analysis_succeeds into SOME, H_tsk_R_computed into IN.
- move: SOME; rewrite /fp_claimed_bounds.
- case: all; [case => SOME | by done].
- move: IN; rewrite -SOME mem_pmap.
- move => /mapP [[tsk' someR]].
- rewrite /is_valid_bound; case: someR; last by done.
- move => R'; case: (R' <= _); last by done.
- move => IN; case => EQ1 EQ2; subst tsk' R'.
- move: IN => /mapP [tsk' IN]; case; move => EQ1; subst tsk'.
- move => RESP; symmetry in RESP; move: RESP.
- rewrite /per_task_rta.
- set f := W _ _; set s := max_steps _; set x0 := task_cost _.
- case (iter_fixpoint_cases f s x0) => [NONE | [R' [SOME' EQ]]];
- first by rewrite NONE.
- by rewrite SOME'; case => H; subst.
- Qed.
-
- (* Since the analysis validates the computed values, it follows
- that R is no larger than the deadline of tsk. *)
- Lemma fp_claimed_bounds_le_deadline:
- R <= task_deadline tsk.
- Proof.
- rename H_analysis_succeeds into SOME, H_tsk_R_computed into IN.
- move: SOME; rewrite /fp_claimed_bounds.
- case: all; [case => SOME | by done].
- move: IN; rewrite -SOME mem_pmap.
- move => /mapP [[tsk' someR]].
- rewrite /is_valid_bound; case: someR; last by done.
- move => R'; case LE: (R' <= _); last by done.
- by move => IN; case => EQ1 EQ2; subst tsk' R'.
- Qed.
-
- (* Using the monotonicity of the workload bound, we also prove that
- the computed response-time bound is positive. This ensures that
- the busy interval to be analyzed is not empty. *)
- Section BoundPositive.
-
- (* Assume that the priority relation is reflexive. *)
- Hypothesis H_priority_is_reflexive:
- FP_is_reflexive higher_eq_priority.
-
- (* Assume that tasks have positive costs and periods. *)
- Hypothesis H_cost_positive: task_cost tsk > 0.
- Hypothesis H_period_positive:
- forall tsk, tsk \in ts -> task_period tsk > 0.
-
- (* Then, we prove that the fixed-point R is positive. *)
- Lemma fp_claimed_bounds_gt_zero :
- R > 0.
- Proof.
- set f := W ts tsk; set s := max_steps tsk; set x0 := task_cost tsk.
- apply leq_trans with (n := task_cost tsk);
- first by apply H_cost_positive.
- have GE: task_cost tsk <= f (task_cost tsk).
- {
- apply total_workload_bound_fp_ge_cost; try (by done).
- - by apply fp_claimed_bounds_from_taskset.
- - by apply H_period_positive, fp_claimed_bounds_from_taskset.
- }
- have TRANS: transitive leq by rewrite /transitive;apply leq_trans.
- have MON: monotone f leq.
- {
- by intros x1 x2 LE;
- apply total_workload_bound_fp_non_decreasing.
- }
- apply leq_trans with (n := task_cost tsk); first by done.
- try ( apply iter_fixpoint_ge_bottom with (f0 := f) (max_steps := s);
- try (by done) ) ||
- apply iter_fixpoint_ge_bottom with (f := f) (max_steps := s);
- try (by done).
- by apply fp_claimed_bounds_computes_iteration.
- Qed.
-
- End BoundPositive.
-
- End PropertiesOfBound.
-
- End Lemmas.
-
- End Analysis.
-
- (* In this section, we prove the correctness of the RTA. *)
- Section ProvingCorrectness.
-
- Context {SporadicTask: eqType}.
- Variable task_cost: SporadicTask -> time.
- Variable task_period: SporadicTask -> time.
- Variable task_deadline: SporadicTask -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> SporadicTask.
-
- (* Consider a task set ts... *)
- Variable ts: taskset_of SporadicTask.
-
- (* ...where tasks have valid parameters. *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Assume any job arrival sequence with consistent, duplicate-free arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_no_duplicate_arrivals: arrival_sequence_is_a_set arr_seq.
-
- (* ...such that all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...jobs have valid parameters...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and jobs satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Assume any fixed-priority policy... *)
- Variable higher_eq_priority: FP_policy SporadicTask.
-
- (* ...that is reflexive and transitive, i.e., indicating higher-or-equal task priority. *)
- Hypothesis H_priority_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_transitive: FP_is_transitive higher_eq_priority.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...where jobs do not execute before their arrival times nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that the scheduler is work-conserving and respects the FP policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy job_arrival job_cost job_task arr_seq sched higher_eq_priority.
-
- (* For simplicity, let's define some local names. *)
- Let no_deadline_missed_by_task :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- (* Recall the iteration for the response-time analysis and the corresponding
- schedulability test. *)
- Let RTA_claimed_bounds :=
- fp_claimed_bounds task_cost task_period task_deadline higher_eq_priority ts.
- Let claimed_to_be_schedulable :=
- fp_schedulable task_cost task_period task_deadline higher_eq_priority ts.
-
- (* First, we prove that the RTA yields valid response-time bounds. *)
- Theorem fp_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In RTA_claimed_bounds ->
- response_time_bounded_by tsk R.
- Proof.
- rename H_valid_task_parameters into PARAMS,
- H_valid_job_parameters into JOBPARAMS.
- unfold valid_sporadic_job, valid_realtime_job,
- valid_sporadic_taskset, is_valid_sporadic_task in *.
- unfold RTA_claimed_bounds; intros tsk R.
- case SOME: fp_claimed_bounds => [rt_bounds|] IN; last by done.
- try ( apply uniprocessor_response_time_bound_fp with
- (task_cost0 := task_cost) (task_period0 := task_period)
- (ts0 := ts) (task_deadline0 := task_deadline)
- (job_deadline0 := job_deadline)
- (higher_eq_priority0 := higher_eq_priority); try (by done) ) ||
- apply uniprocessor_response_time_bound_fp with
- (task_cost := task_cost) (task_period := task_period)
- (ts := ts) (task_deadline := task_deadline)
- (job_deadline := job_deadline)
- (higher_eq_priority := higher_eq_priority); try (by done).
- {
- ( try ( apply fp_claimed_bounds_gt_zero with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline)
- (higher_eq_priority0 := higher_eq_priority) (ts0 := ts)
- (rt_bounds0 := rt_bounds) (tsk0 := tsk) ) ||
- apply fp_claimed_bounds_gt_zero with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (higher_eq_priority := higher_eq_priority) (ts := ts)
- (rt_bounds := rt_bounds) (tsk := tsk)); try (by done).
- {
- feed (PARAMS tsk) ; last by move: PARAMS => [P1 _].
- try ( by apply fp_claimed_bounds_from_taskset with
- (task_cost0 := task_cost) (task_period0 := task_period)
- (task_deadline0 := task_deadline) (rt_bounds0 := rt_bounds)
- (higher_eq_priority0 := higher_eq_priority) (R0 := R) ) ||
- by apply fp_claimed_bounds_from_taskset with
- (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (rt_bounds := rt_bounds)
- (higher_eq_priority := higher_eq_priority) (R := R).
- }
- by intros tsk0 IN0; specialize (PARAMS tsk0 IN0); des.
- }
- try ( by apply fp_claimed_bounds_yields_fixed_point with
- (task_deadline0 := task_deadline) (rt_bounds0 := rt_bounds) ) ||
- by apply fp_claimed_bounds_yields_fixed_point with
- (task_deadline := task_deadline) (rt_bounds := rt_bounds).
- Qed.
-
- (* Next, we show that the RTA is a sufficient schedulability analysis. *)
- Section AnalysisIsSufficient.
-
- (* If the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: claimed_to_be_schedulable.
-
- (* ...then no task misses its deadline. *)
- Theorem taskset_schedulable_by_fp_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- have RTA := fp_analysis_yields_response_time_bounds.
- rename H_test_succeeds into TEST, H_valid_job_parameters into JOBPARAMS.
- unfold claimed_to_be_schedulable, fp_schedulable in *.
- have RESP := fp_claimed_bounds_for_every_task task_cost task_period task_deadline
- higher_eq_priority ts.
- have DL := fp_claimed_bounds_le_deadline task_cost task_period task_deadline
- higher_eq_priority ts.
- move:TEST; case TEST:(fp_claimed_bounds _ _ _ _ _) => [rt_bounds|] _//.
- intros tsk IN.
- move: (RESP rt_bounds TEST tsk IN) => [R INbounds].
- specialize (DL rt_bounds TEST tsk R INbounds).
- ( try ( apply task_completes_before_deadline with
- (task_deadline0 := task_deadline) (R0 := R) ) ||
- apply task_completes_before_deadline with
- (task_deadline := task_deadline) (R := R)); try (by done);
- first by intros j ARRj; specialize (JOBPARAMS j ARRj); move: JOBPARAMS => [_ [_ EQ]].
- by apply RTA; rewrite /RTA_claimed_bounds TEST.
- Qed.
-
- (* Since all jobs of the arrival sequence are spawned by the task set,
- we also conclude that no job in the schedule misses its deadline. *)
- Theorem jobs_schedulable_by_fp_rta :
- forall j,
- arrives_in arr_seq j ->
- no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_fp_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End AnalysisIsSufficient.
-
- End ProvingCorrectness.
-
-End ResponseTimeIterationFP.
diff --git a/classic/analysis/uni/basic/fp_rta_theory.v b/classic/analysis/uni/basic/fp_rta_theory.v
deleted file mode 100644
index 1e7ad76b22b8639d69c2ddd96e4ad0f4248a00e1..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/basic/fp_rta_theory.v
+++ /dev/null
@@ -1,149 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.arrival.basic.arrival_bounds.
-Require Import prosa.classic.model.schedule.uni.schedule_of_task prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedulability prosa.classic.model.schedule.uni.response_time
- prosa.classic.model.schedule.uni.service.
-Require Import prosa.classic.model.schedule.uni.limited.busy_interval prosa.classic.model.schedule.uni.basic.platform.
-Require Import prosa.classic.analysis.uni.basic.workload_bound_fp.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module ResponseTimeAnalysisFP.
-
- Import Job ScheduleOfTask SporadicTaskset Priority ResponseTime
- TaskArrival ArrivalBounds WorkloadBoundFP Platform Schedulability
- BusyIntervalJLFP Workload Service.
-
- (* In this section, we prove that any fixed point in the RTA for uniprocessor
- FP scheduling is a response-time bound. *)
- Section ResponseTimeBound.
-
- Context {SporadicTask: eqType}.
- Variable task_cost: SporadicTask -> time.
- Variable task_period: SporadicTask -> time.
- Variable task_deadline: SporadicTask -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> SporadicTask.
-
- (* Assume any job arrival sequence with consistent, duplicate-free arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_no_duplicate_arrivals: arrival_sequence_is_a_set arr_seq.
-
- (* ... in which jobs arrive sporadically and have valid parameters. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Consider a task set ts where all tasks have valid parameters... *)
- Variable ts: seq SporadicTask.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* ... and assume that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival times nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Consider an FP policy that indicates a higher-or-equal priority relation,
- and assume that the relation is reflexive and transitive. *)
- Variable higher_eq_priority: FP_policy SporadicTask.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
-
- (* Next, assume that the schedule is a work-conserving FP schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_fp_policy:
- respects_FP_policy job_arrival job_cost job_task arr_seq sched higher_eq_priority.
-
- (* Now we proceed with the analysis.
- Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: SporadicTask.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Recall the definition of response-time bound and the total workload bound W
- for tasks with higher-or-equal priority (with respect to tsk). *)
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let W := total_workload_bound_fp task_cost task_period higher_eq_priority ts tsk.
-
- (* Let R be any positive fixed point of the response-time recurrence. *)
- Variable R: time.
- Hypothesis H_R_positive: R > 0.
- Hypothesis H_response_time_is_fixed_point: R = W R.
-
- (* Since R = W R bounds the workload of higher-or-equal priority
- in any interval of length R, it follows from the busy-interval
- lemmas that R bounds the response-time of job j.
- (For more details, see model/uni/basic/busy_interval.v and
- analysis/uni/basic/workload_bound_fp.v.) *)
- Theorem uniprocessor_response_time_bound_fp:
- response_time_bounded_by tsk R.
- Proof.
- rename H_response_time_is_fixed_point into FIX.
- intros j ARRj JOBtsk.
- move: (posnP (job_cost j)) => [Z|POS].
- { by rewrite /is_response_time_bound_of_job /completed_by Z. }
- set prio := FP_to_JLFP job_task higher_eq_priority.
- try ( apply busy_interval_bounds_response_time with
- (arr_seq0 := arr_seq)
- (higher_eq_priority0 := prio)
- (priority_inversion_bound := 0); try by done ) ||
- apply busy_interval_bounds_response_time with
- (arr_seq := arr_seq)
- (higher_eq_priority := prio)
- (priority_inversion_bound := 0); try by done.
- - by intros x; apply H_priority_is_reflexive.
- { intros t1 t2 BUSY.
- rewrite /cumulative_priority_inversion /is_priority_inversion leqn0.
- rewrite big_nat big1 //; move => t NEQ.
- destruct (sched t) eqn:SCHED; last by done.
- have HP := pending_hp_job_exists
- job_arrival job_cost arr_seq _ sched
- prio _ ARRj _ _ _ _ _ BUSY _ NEQ.
- feed_n 4 HP; try done.
- { by intros x; apply H_priority_is_reflexive. }
- move: HP => [jhp [ARRjhp [PEND PRIO]]].
- apply/eqP; rewrite eqb0 Bool.negb_involutive.
- rewrite /prio /FP_to_JLFP.
- eapply H_priority_is_transitive with (job_task jhp); last by done.
- destruct (s == jhp) eqn:EQ; first by move: EQ => /eqP EQ; subst s.
- apply H_respects_fp_policy with t; try done.
- { apply/andP; split; first by done.
- rewrite /scheduled_at SCHED.
- apply/negP. intros SNEQ; move: SNEQ => /eqP SNEQ.
- move: EQ => /negP EQ; apply EQ.
- by inversion SNEQ.
- }
- { by rewrite /scheduled_at SCHED. }
- }
- try ( apply fp_workload_bound_holds with
- (job_arrival0 := job_arrival) (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline)
- (job_deadline0 := job_deadline) (ts0 := ts); try (by done) ) ||
- apply fp_workload_bound_holds with
- (job_arrival := job_arrival) (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (job_deadline := job_deadline) (ts := ts); try (by done).
- by rewrite JOBtsk.
- Qed.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/analysis/uni/basic/tdma_rta_theory.v b/classic/analysis/uni/basic/tdma_rta_theory.v
deleted file mode 100644
index f931c2203dbe628f68aa3b0b17a82415078f5464..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/basic/tdma_rta_theory.v
+++ /dev/null
@@ -1,269 +0,0 @@
-Require Import Arith.
-Require Import prosa.classic.util.all
- prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.schedule.uni.schedulability
- prosa.classic.model.schedule.uni.schedule_of_task
- prosa.classic.model.schedule.uni.response_time
- prosa.classic.analysis.uni.basic.tdma_wcrt_analysis.
-Require Import prosa.classic.model.schedule.uni.basic.platform_tdma
- prosa.classic.model.schedule.uni.end_time.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div.
-
-Set Bullet Behavior "Strict Subproofs".
-
-Module ResponseTimeAnalysisTDMA.
-
- Import Job TaskArrival ScheduleOfTask ResponseTime Platform_TDMA end_time Schedulability
- WCRT_OneJobTDMA.
-
- (* In this section, we establish that the computed value WCRT of the exact response-time analysis
- yields an upper bound on the response time of a task under TDMA scheduling policy on an uniprocessor,
- assuming that such value is no larger than the task period. *)
-
- Section ResponseTimeBound.
-
- (** System model *)
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* ...and any uniprocessor... *)
- Variable sched: schedule Job.
- (* ... where jobs do not execute before their arrival times nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Consider any TDMA slot assignment... *)
- Variable task_time_slot: TDMA_slot sporadic_task.
- (* ... and any slot order. *)
- Variable slot_order: TDMA_slot_order sporadic_task.
-
- (* Consider any task set ts. *)
- Variable ts: {set sporadic_task}.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Consider any task in task set. *)
- Variable tsk:sporadic_task.
- Hypothesis H_task_in_task_set: tsk \in ts.
-
- (* For simplicity, let us use local names for some definitions and refer them to local variables. *)
- (* Recall definition: whether a job can be scheduled at time t *)
- Let is_scheduled_at j t:=
- scheduled_at sched j t.
- (* Recall definition: whether a task is in its own time slot at time t *)
- Let in_time_slot_at j t:=
- Task_in_time_slot ts slot_order (job_task j) task_time_slot t.
-
- (* Recall the definition of response-time bound. *)
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- (* Let (RT j) denote the computed response-time of job j according to the TDMA analysis.
- Note that this computation assumes that there is only one pending job of each task.
- Still, this assumption doesn't break the generality of the proof. There cannot be
- multiple jobs of the same task because:
- (a) assumption: the computed value WCRT is bounded by its task's period; and
- (b) the lemma: "jobs_finished_before_WCRT" in file tdma_wcrt_analysis.v. *)
- Hypothesis WCRT_le_period:
- WCRT task_cost task_time_slot ts tsk <= task_period tsk.
- Let RT j:= job_response_time_tdma_in_at_most_one_job_is_pending job_arrival job_cost
- task_time_slot slot_order ts tsk j.
-
- (* Next, recall the definition of deadline miss of tasks and jobs. *)
- Let no_deadline_missed_by_task :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
-
- (* Then, we define a valid TDMA bound. *)
- (* Bound is valid bound iff it is less than or equal to task's deadline *)
- Definition is_valid_tdma_bound bound :=
- (bound <= task_deadline tsk).
-
- (* Now, let's assume that the schedule respects TDMA scheduling policy... *)
- Hypothesis TDMA_policy:
- Respects_TDMA_policy job_arrival job_cost job_task arr_seq sched ts task_time_slot slot_order.
-
- (* ..., that task time slot is valid... *)
- Hypothesis H_valid_time_slot:
- is_valid_time_slot tsk task_time_slot.
-
- (* ... and that any job in arrival sequence is a valid job. *)
- Hypothesis H_valid_job_parameters:
- forall j, arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Assume that job cost is less than or equal to its task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- forall j, arrives_in arr_seq j ->
- job_cost_le_task_cost task_cost job_cost job_task j.
-
- (* Let BOUND be the computed WCRT of tsk. *)
- Let BOUND := WCRT task_cost task_time_slot ts tsk.
-
- (** Two basic lemmas *)
- (* Having assumed that the computed BOUND <= task_period tsk, we first prove that
- any job of task tsk must have completed by its period. *)
- Lemma any_job_completed_before_period:
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- completed_by job_cost sched j (job_arrival j + task_period (job_task j) ).
- Proof.
- intros j [t ARR]. generalize dependent j.
- induction t as [ t IHt ] using (well_founded_induction lt_wf).
- case t eqn:GT;intros.
- - have INJ: arrives_in arr_seq j by exists 0.
- (( try ( apply completion_monotonic with (t0:=job_arrival j + WCRT task_cost task_time_slot ts tsk ) ) || apply completion_monotonic with (t:=job_arrival j + WCRT task_cost task_time_slot ts tsk ) )
- ;trivial;try by rewrite leq_add2l H); ( try ( apply job_completed_by_WCRT
- with (task_deadline0:=task_deadline)
- (arr_seq0:=arr_seq)(job_deadline0:=job_deadline)
- (job_task0:=job_task)(slot_order0:=slot_order) ) || apply job_completed_by_WCRT
- with (task_deadline:=task_deadline)
- (arr_seq:=arr_seq)(job_deadline:=job_deadline)
- (job_task:=job_task)(slot_order:=slot_order) );eauto 2.
- intros. apply H_arrival_times_are_consistent in ARR. lia.
- - have INJ: arrives_in arr_seq j by exists n.+1.
- try ( apply completion_monotonic
- with (t0:=job_arrival j + WCRT task_cost task_time_slot ts tsk);auto ) ||
- apply completion_monotonic
- with (t:=job_arrival j + WCRT task_cost task_time_slot ts tsk);auto.
- by rewrite leq_add2l H. try ( apply job_completed_by_WCRT
- with (task_deadline0:=task_deadline)
- (arr_seq0:=arr_seq)(job_deadline0:=job_deadline)
- (job_task0:=job_task)(slot_order0:=slot_order);auto ) ||
- apply job_completed_by_WCRT
- with (task_deadline:=task_deadline)
- (arr_seq:=arr_seq)(job_deadline:=job_deadline)
- (job_task:=job_task)(slot_order:=slot_order);auto.
- intros.
- have PERIOD: job_arrival j_other + task_period (job_task j_other)<= job_arrival j.
- apply H_sporadic_tasks;auto. case (j==j_other)eqn: JJ;move/eqP in JJ;last auto.
- have JO:job_arrival j_other = job_arrival j by f_equal. lia.
- try ( apply completion_monotonic with (t0:= job_arrival j_other +
- task_period (job_task j_other)); auto ) ||
- apply completion_monotonic with (t:= job_arrival j_other +
- task_period (job_task j_other)); auto.
- have ARRJ: job_arrival j = n.+1 by auto.
- apply (IHt (job_arrival j_other));auto. lia.
- destruct H0 as [tj AAJO]. have CONSIST: job_arrival j_other =tj by auto.
- by subst. by subst.
- Qed.
-
- (* Based on the lemma above and the fact that jobs arrive sporadically, we can conclude that
- all the previous jobs of task tsk must have completed before the analyzed job j. *)
- Lemma all_previous_jobs_of_same_task_completed :
- forall j j_other,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- arrives_in arr_seq j_other ->
- job_task j = job_task j_other ->
- job_arrival j_other < job_arrival j ->
- completed_by job_cost sched j_other (job_arrival j).
- Proof.
- intros.
- have PERIOD: job_arrival j_other + task_period (job_task j_other)<= job_arrival j.
- apply H_sporadic_tasks;auto. case (j==j_other)eqn: JJ;move/eqP in JJ;last auto.
- have JO:job_arrival j_other = job_arrival j by f_equal. lia.
- apply completion_monotonic with (t:=job_arrival j_other + task_period (job_task j_other));auto.
- apply any_job_completed_before_period;auto. by subst.
- Qed.
-
- (** Main Theorem *)
- (* Therefore, we proved that the reponse time of task tsk is bouned by the
- BOUND i.e., the computed value WCRT according to TDMA scheduling policy on an uniprocessor.
- ( for more details, see
- response_time_le_WCRT: .
- completed_by_end_time: model/schedule/uni/end_time.v
- completes_at_end_time: model/schedule/uni/end_time.v
- ) *)
- Theorem uniprocessor_response_time_bound_TDMA: response_time_bounded_by tsk BOUND.
- Proof.
- intros j arr_seq_j JobTsk.
- apply completion_monotonic with (t:=job_arrival j + RT j); try done.
- - rewrite leq_add2l /BOUND.
- (try ( apply (response_time_le_WCRT)
- with (task_cost0:=task_cost) (task_deadline0:=task_deadline)(sched0:=sched)
- (job_arrival0:=job_arrival)(job_cost0:=job_cost)(job_deadline0:=job_deadline)
- (job_task0:=job_task)(ts0:=ts)(arr_seq0:=arr_seq)
- (slot_order0:=slot_order)(Job0:=Job)(tsk0:=tsk) ) ||
- apply (response_time_le_WCRT)
- with (task_cost:=task_cost) (task_deadline:=task_deadline)(sched:=sched)
- (job_arrival:=job_arrival)(job_cost:=job_cost)(job_deadline:=job_deadline)
- (job_task:=job_task)(ts:=ts)(arr_seq:=arr_seq)
- (slot_order:=slot_order)(Job:=Job)(tsk:=tsk)); try done;auto;try (intros;
- by apply all_previous_jobs_of_same_task_completed).
- - ( try ( apply completed_by_end_time
- with (sched0:=sched)(job_arrival0:=job_arrival)
- (job_cost0:=job_cost) ) ||
- apply completed_by_end_time
- with (sched:=sched)(job_arrival:=job_arrival)
- (job_cost:=job_cost)); first exact.
- ( try ( apply completes_at_end_time
- with
- (job_arrival0:=job_arrival)(task_cost0:=task_cost)(arr_seq0:=arr_seq)
- (job_task0:=job_task)(job_deadline0:=job_deadline)(task_deadline0:=task_deadline)
- (sched0:=sched)(ts0:=ts)(slot_order0:=slot_order)
- (tsk0:=tsk) (j0:=j) ) ||
- apply completes_at_end_time
- with
- (job_arrival:=job_arrival)(task_cost:=task_cost)(arr_seq:=arr_seq)
- (job_task:=job_task)(job_deadline:=job_deadline)(task_deadline:=task_deadline)
- (sched:=sched)(ts:=ts)(slot_order:=slot_order)
- (tsk:=tsk) (j:=j)); try auto;try (intros;
- by apply all_previous_jobs_of_same_task_completed).
- Qed.
-
- (** Sufficient Analysis *)
- (* Finally, we show that the RTA is a sufficient schedulability analysis. *)
- Section AnalysisIsSufficient.
-
- (* Assume that BOUND is a valid tdma bound *)
- Hypothesis H_is_valid_bound:
- is_valid_tdma_bound BOUND.
-
- (* We can prove the theorem: there is no deadline miss of task tsk *)
- Theorem taskset_schedulable_by_tdma : no_deadline_missed_by_task tsk.
- Proof.
- ( try ( apply task_completes_before_deadline with (task_deadline0:=task_deadline) (R:=BOUND) ) ||
- apply task_completes_before_deadline with (task_deadline:=task_deadline) (R:=BOUND) )
- ;try done.
- move => j arr_seqJ.
- - by apply H_valid_job_parameters.
- - apply uniprocessor_response_time_bound_TDMA.
- Qed.
-
- (* Based on the theorem above, we can prove that
- any job of the arrival sequence are spawned by task tsk won't miss its deadline. *)
- Theorem jobs_schedulable_by_tdma_rta :
- forall j,
- arrives_in arr_seq j /\ job_task j =tsk ->
- no_deadline_missed_by_job j.
- Proof.
- intros j [arr_seqJ Jtsk].
- by apply taskset_schedulable_by_tdma.
- Qed.
-
- End AnalysisIsSufficient.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisTDMA.
diff --git a/classic/analysis/uni/basic/tdma_wcrt_analysis.v b/classic/analysis/uni/basic/tdma_wcrt_analysis.v
deleted file mode 100644
index de796455cb4a0b11913378f5bdc48fb9363c2832..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/basic/tdma_wcrt_analysis.v
+++ /dev/null
@@ -1,839 +0,0 @@
-Require Import Arith Nat.
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.schedule.uni.schedulability
- prosa.classic.model.schedule.uni.schedule_of_task
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.basic.platform_tdma
- prosa.classic.model.schedule.uni.end_time.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div.
-
-Set Bullet Behavior "Strict Subproofs".
-
-Module WCRT_OneJobTDMA.
-
-Import Job TaskArrival ScheduleOfTask ResponseTime Platform_TDMA end_time Schedulability.
-
- (* In this section, we prove that any job j of task tsk will be completed by
- the computed value WCRT of the exact response-time analysis under TDMA scheduling policy
- on an uniprocessor, assuming that all its previous jobs have been completed by its arrival time. *)
- Section WCRT_analysis.
-
- (** System model *)
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* ..., any uniprocessor... *)
- Variable sched: schedule Job.
- (* ... where jobs do not execute before their arrival times nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Consider any TDMA slot assignment... *)
- Variable task_time_slot: TDMA_slot sporadic_task.
- (* ... and any slot order. *)
- Variable slot_order: TDMA_slot_order sporadic_task.
-
- (* ... and any sporadic task set. *)
- Variable ts: {set sporadic_task}.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Consider any task in task set... *)
- Variable tsk:sporadic_task.
- Hypothesis H_task_in_task_set: tsk \in ts.
-
- (* ... and any job belongs to it. *)
- Variable j:Job.
- Hypothesis H_job_task: job_task j =tsk.
- Hypothesis job_in_arr_seq: arrives_in arr_seq j.
- Hypothesis H_valid_job:
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* For simplicity, let us use local names for some definitions and refer them to local variables. *)
- Let time_slot:= task_time_slot tsk.
- Let slot_offset:= Task_slot_offset ts slot_order tsk task_time_slot.
- Let tdma_cycle:= TDMA_cycle ts task_time_slot.
- Let is_scheduled_at t:=
- scheduled_at sched j t.
- Let in_time_slot_at t:=
- Task_in_time_slot ts slot_order tsk task_time_slot t.
- Let pending_at:=
- pending job_arrival job_cost sched j.
-
- (* Recall definitions of end time predicate... *)
- Let job_end_time_predicate:= end_time_predicate sched j.
- (* ... and completes_at *)
- Let job_completes_at:=
- completes_at job_arrival job_cost sched j.
-
- (* Then, let's give some local definition for clarity. *)
- (* We define a formula that allows to calculate the distance
- between time t and the previous start of tsk's time slot *)
- Let from_start_of_slot t:=
- ( t + tdma_cycle- slot_offset %% tdma_cycle) %% tdma_cycle.
-
- (* ... and a formula that allows to calculate the distance
- between time t and the next start of its time slot *)
- Let to_next_slot t:=
- tdma_cycle - from_start_of_slot t.
-
- (* and a formula that allows to calculate the duration to finish
- a job if it is right at the start of its time slot and has
- an execution cost c *)
- Let duration_to_finish_from_start_of_slot_with c:duration :=
- (div_ceil c time_slot -1) * (tdma_cycle - time_slot) + c.
-
- (* a formula that allows to calculate the duration between time t and the end of slot
- in case of time t in time slot *)
- Let to_end_of_slot t:=
- time_slot - from_start_of_slot t.
-
- (* Given the arrival time arr and job cost c, we define a formula for calculating the response time.
- This formula will be shown to be correct w.r.t. end_time_predicate *)
- Definition formula_rt (arr:instant) (c:duration):=
- if c ==0 then 0 else
- if in_time_slot_at arr then
- if c <= to_end_of_slot arr then
- c
- else to_next_slot arr +
- duration_to_finish_from_start_of_slot_with (c - to_end_of_slot arr)
- else
- to_next_slot arr + duration_to_finish_from_start_of_slot_with c.
-
- (* and the response time formula for job *)
- Definition job_response_time_tdma_in_at_most_one_job_is_pending:=
- formula_rt (job_arrival j) (job_cost j).
-
- (* Now, let's assume that task time slot is valid, and... *)
- Hypothesis H_valid_time_slot: is_valid_time_slot tsk task_time_slot.
-
- (* ... the schedule respects TDMA scheduling policy. *)
- Hypothesis TDMA_policy:
- Respects_TDMA_policy job_arrival job_cost job_task arr_seq sched ts task_time_slot slot_order.
-
-
- (* Assume that all previous jobs of same task have completed
- before the arrive of this job of this task *)
- Hypothesis all_previous_jobs_of_same_task_completed :
- forall j_other,
- arrives_in arr_seq j_other ->
- job_task j = job_task j_other ->
- job_arrival j_other < job_arrival j ->
- completed_by job_cost sched j_other (job_arrival j).
-
- (** First, we prove some basic lemmas about pending. *)
- Section BasicLemmas.
- (* We can prove that there is at most one job of a task is pending at
- any instant t *)
- Lemma at_most_one_job_is_pending:
- forall j_other (t : time),
- arrives_in arr_seq j_other ->
- job_arrival j_other < job_arrival j ->
- pending job_arrival job_cost sched j t ->
- pending job_arrival job_cost sched j_other t ->
- job_task j = job_task j_other -> j = j_other.
- Proof.
- move=> j_other t ARRJO ARRBF /andP [ARREDJ /negP NCOMJ] /andP [ARREDJO /negP NCOMJO] EQTSK.
- apply all_previous_jobs_of_same_task_completed in ARRBF;auto;
- apply completion_monotonic with (t':=t) in ARRBF;auto;try contradiction;
- apply scheduler_completed_jobs_dont_execute,job_arrival_times_are_consistent.
- Qed.
-
- (*Lemma: it respects TDMA policy for a particular case (job must be
- finished before the next job's arrival), that is, the job can be always
- scheduled at time t iff it is in its time slot at time t *)
- Lemma TDMA_policy_case_RT_le_Period:
- forall t,
- pending_at t ->
- reflect (in_time_slot_at t) (is_scheduled_at t).
- Proof.
- intros* PEN.
- apply/introP.
- - rewrite /is_scheduled_at /in_time_slot_at -H_job_task.
- by apply TDMA_policy.
- - intro NSCHED. have BACKLOG:backlogged job_arrival job_cost sched j t by apply/andP.
- apply TDMA_policy in BACKLOG;auto.
- destruct BACKLOG as [NINSLOT | SCHED].
- + by rewrite H_job_task in NINSLOT.
- + destruct SCHED as [j_other [ARRJO [ARRBF [SAME SCHEDJO]]]].
- apply (at_most_one_job_is_pending _ t) in ARRJO;trivial.
- * by rewrite -ARRJO in SCHEDJO;move/negP in NSCHED.
- * by apply scheduled_implies_pending.
- Qed.
-
- (* Job is pending at its arrival *)
- Lemma pendingArrival: pending_at (job_arrival j).
- Proof.
- rewrite /pending_at /pending.
- apply /andP. split.
- - rewrite /has_arrived. auto.
- - rewrite /completed_by /service /service_during.
- try ( rewrite ->cumulative_service_before_job_arrival_zero
- with (job_arrival0:=job_arrival)) ||
- rewrite ->cumulative_service_before_job_arrival_zero
- with (job_arrival:=job_arrival). rewrite -ltnNge.
- apply H_valid_job. apply H_jobs_must_arrive_to_execute. auto.
- Qed.
-
- (* Job is pending at t.+1 if
- it is pending but isn't scheduled at t *)
- Lemma pendingSt:
- forall t,
- pending_at t ->
- is_scheduled_at t = false ->
- pending_at t.+1.
- Proof.
- rewrite /pending_at /pending.
- move=> t /andP [ARR NCOMP] NSCHED.
- apply /andP. split.
- - rewrite /has_arrived. auto.
- - rewrite /completed_by /service /service_during big_nat_recr /service_at /=.
- rewrite /is_scheduled_at in NSCHED. rewrite NSCHED /= addn0. auto. auto.
- Qed.
-
- (* Job is pending at t.+1 if
- it is both pending and scheduled at instant t
- but there are 2 cost left at instant t *)
- Lemma pendingSt_Sched:
- forall t c,
- pending_at t ->
- service sched j t + c.+2 =job_cost j ->
- is_scheduled_at t = true ->
- pending_at t.+1.
- Proof.
- rewrite /pending_at /pending.
- move=> t c /andP [ARR NCOMP] COST SCHED.
- apply /andP. split.
- - rewrite /has_arrived; auto.
- - rewrite /completed_by /service /service_during big_nat_recr /service_at /=;
- rewrite /is_scheduled_at in SCHED. rewrite SCHED /= -COST; apply/eqP;
- rewrite /service /service_during /service_at; lia. trivial.
- Qed.
-
- End BasicLemmas.
-
- (** Next, we prove some generic lemmas about the response time formula and the end time predicate. *)
- Section formula_predicate_eq.
-
- (* Lemma: duration to next start of time slot is always positive *)
- Lemma to_next_slot_pos:
- forall t, to_next_slot t>0.
- Proof.
- intros t.
- rewrite /to_next_slot /from_start_of_slot ltn_subRL addn0.
- apply ltn_pmod. by apply (TDMA_cycle_positive ts tsk).
- Qed.
-
- (* Lemma: if the duration to next start of slot is a+1 at instant t
- imply the duration to next start of slot is a at instant t+1 *)
- Lemma lt_to_next_slot_1LR:
- forall a t,
- a.+1 < to_next_slot t ->
- a < to_next_slot t.+1.
- Proof.
- intros*.
- rewrite /to_next_slot /from_start_of_slot.
- set cycle_sub:=tdma_cycle - slot_offset %% tdma_cycle.
- assert (H_tdma_cycle_p: tdma_cycle>0) by (apply (TDMA_cycle_positive ts tsk); done).
- repeat (rewrite -addnBA;last (apply ltnW; by apply ltn_pmod)).
- fold cycle_sub. repeat rewrite ltn_subRL.
- rewrite addSn addnS.
- case (modulo_cases (t + cycle_sub) tdma_cycle.-1); intros h1 h2.
- - rewrite prednK // in h1. lia.
- - destruct h1 as [h1 _]. rewrite prednK // in h1. lia.
- Qed.
-
- (* Lemma: if the duration to next start of slot is a+b at instant t
- imply the duration to next start of slot is a at instant t+b *)
- Lemma lt_to_next_slot_LR:
- forall b a t,
- a+b < to_next_slot t ->
- a < to_next_slot (t+b).
- Proof.
- intro b.
- induction b as [| b' IHb']; intros* h1.
- - rewrite addn0 in h1. rewrite addn0 //.
- - rewrite addnS.
- apply lt_to_next_slot_1LR, IHb'.
- by rewrite addSn -addnS.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and the duration to
- next start is at least 1, thus the job cannot be scheduled at instant
- t+1 *)
- Lemma S_t_not_sched:
- forall t, pending_at t ->
- is_scheduled_at t = false ->
- 1 < to_next_slot t ->
- is_scheduled_at t.+1 = false.
- Proof.
- intros* PEN NSCHED.
- assert (H_tdma_cycle_p: tdma_cycle>0). by apply (TDMA_cycle_positive ts tsk).
- have PEN2:pending_at t by trivial.
- apply TDMA_policy_case_RT_le_Period in PEN. move:NSCHED => h1 h2. have NSCHED :is_scheduled_at t = false by auto.
- move:h1=>/PEN /negP h1.
- apply/(TDMA_policy_case_RT_le_Period t.+1). by apply pendingSt.
- apply/negP.
- revert h1. rewrite /in_time_slot_at /Task_in_time_slot.
- fold tdma_cycle slot_offset time_slot.
- repeat rewrite -leqNgt.
- set cycle_sub:=tdma_cycle - slot_offset %% tdma_cycle.
- repeat (rewrite -addnBA;last (by apply ltnW, ltn_pmod)).
- fold cycle_sub.
- rewrite /to_next_slot /from_start_of_slot -addnBA in h2.
- - fold cycle_sub in h2. rewrite ltn_subRL in h2.
- case (modulo_cases (t + cycle_sub) tdma_cycle.-1).
- + intros h3 h4. rewrite prednK // in h3. rewrite h3. lia.
- + intros [h31 h32] h4. rewrite prednK // in h32. lia.
- - by apply ltnW, ltn_pmod.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and the duration to
- next start is at least d, thus the job cannot be scheduled at instant
- t+d and is pending at t+d *)
- Lemma duration_not_sched:
- forall t,
- pending_at t ->
- is_scheduled_at t = false ->
- forall d, d < to_next_slot t ->
- is_scheduled_at (t+d) = false /\ pending_at (t+d).
- Proof.
- intros t PEN h1 d h2. generalize dependent t.
- induction d as [| d' IHd'];intros t PEN.
- - by rewrite addn0.
- - rewrite addnS -addSn. intros NSCHED SD. apply IHd'. by apply pendingSt.
- apply S_t_not_sched;auto. lia. by apply lt_to_next_slot_1LR.
- Qed.
-
- (* Lemma: if the job is pending but cannot be scheduled at instant t
- thus that the job is pending at t+ to_next_slot t *)
- Lemma pending_Nsched_sched:
- forall t,
- pending_at t ->
- is_scheduled_at t = false ->
- pending_at (t+ to_next_slot t).
- Proof.
- intros* PEN NSCHED.
- have NEXT: to_next_slot t > 0 by apply to_next_slot_pos.
- apply duration_not_sched with (d:= (to_next_slot t).-1)in PEN.
- replace (to_next_slot t) with ((to_next_slot t).-1 .+1).
- rewrite addnS. apply pendingSt. apply PEN. apply PEN.
- lia. auto. lia.
- Qed.
-
- (* Lemma: It must be schedulable at next start of its time slot *)
- Lemma at_next_start_of_slot_schedulabe:
- forall t,
- pending_at t ->
- is_scheduled_at t = false ->
- is_scheduled_at (t+to_next_slot t) = true.
- Proof.
- assert (H_tdma_cycle_p: tdma_cycle>0) by (apply (TDMA_cycle_positive ts tsk); done).
- intros* PEN NSCHED_t.
- apply/TDMA_policy_case_RT_le_Period. by apply pending_Nsched_sched.
- rewrite /in_time_slot_at /Task_in_time_slot /to_next_slot /from_start_of_slot.
- repeat rewrite -addnBA.
- - set haha:= t + (tdma_cycle - slot_offset %% tdma_cycle).
- rewrite addnAC -modnDml subnKC.
- + by rewrite modnn.
- + by apply ltnW, ltn_pmod.
- - by apply ltnW, ltn_pmod.
- - by apply ltnW, ltn_pmod.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and its residue cost is not
- 0, so it has the same residue cost at instant t+1.
- the end time of this job is fixed whenever we calculate it *)
- Lemma formula_not_sched_St: forall t c, pending_at t ->
- is_scheduled_at t = false ->
- t + formula_rt t c.+1 = t.+1 + formula_rt t.+1 c.+1.
- Proof.
- intros* PEN h1.
- have PENS: pending_at t.+1 by apply pendingSt.
- assert (H_tdma_cycle_p: tdma_cycle>0). by apply (TDMA_cycle_positive ts tsk).
- assert (H_tdma_cycle_le_slot: tdma_cycle>= time_slot).
- by apply (TDMA_cycle_ge_each_time_slot ts tsk) with(task_time_slot:= task_time_slot).
- assert (Hoffset: slot_offset %% tdma_cycle <= tdma_cycle). by apply ltnW, ltn_pmod.
- have NSLOT: in_time_slot_at t = false. apply /negP /TDMA_policy_case_RT_le_Period;auto.
- by rewrite h1.
- rewrite /formula_rt /to_end_of_slot NSLOT gtn_eqF //. move:NSLOT. move /negP.
- rewrite /in_time_slot_at /Task_in_time_slot.
- move/negP. rewrite -ltnNge -/time_slot -/tdma_cycle -/slot_offset. intro NSLOT.
- case_eq (in_time_slot_at t.+1);
- rewrite /in_time_slot_at /Task_in_time_slot -/time_slot -/tdma_cycle -/slot_offset;
- intro Hcases.
- - rewrite -addnBA // in NSLOT. rewrite -addnBA // in Hcases.
- case (modulo_cases (t + (tdma_cycle - slot_offset %% tdma_cycle)) tdma_cycle.-1); intro mod_case;
- repeat (rewrite prednK // in mod_case).
- + rewrite addSn mod_case in Hcases. lia.
- + destruct mod_case as [case1 case2].
- rewrite /to_next_slot /from_start_of_slot. repeat (rewrite -addnBA //).
- rewrite case2 Hcases. repeat rewrite addSn case1 -subn1 subKn //.
- repeat rewrite subn0.
- case Hc_slot:(c < time_slot); rewrite /duration_to_finish_from_start_of_slot_with.
- * by rewrite ceil_eq1 //; lia.
- * rewrite ceil_suba //; [|lia].
- rewrite subn1 mulnBl mul1n addnA -addSn addn1.
- apply/eqP. rewrite eqn_add2l subnBA // addnA. repeat rewrite addnBA; [| |lia].
- -- by rewrite addKn addnAC addnK.
- -- apply leq_trans with (n:=tdma_cycle - time_slot + time_slot).
- ++ lia.
- ++ apply leq_add; [|lia].
- apply leq_pmull, ceil_neq0; lia.
- - rewrite Hcases. repeat rewrite addnA. apply/eqP. repeat rewrite eqn_add2r.
- rewrite -addn1 -addnA eqn_add2l /to_next_slot /from_start_of_slot.
- move:Hcases. repeat rewrite -addnBA //. intro Hcases.
- case (modulo_cases (t + (tdma_cycle - slot_offset %% tdma_cycle)) tdma_cycle.-1);
- intro mod_case; rewrite prednK // in mod_case.
- + rewrite add1n addn1 addSn mod_case.
- do 2 rewrite -addn1.
- set nb:=t + (tdma_cycle - slot_offset %% tdma_cycle) .
- by rewrite subnDA subn1 addn1 prednK // ltn_subRL addn0 ltn_mod.
- + destruct mod_case as [case1 case2].
- rewrite addSn case1 in Hcases.
- assert (H_slot_pos: time_slot > 0) by assumption. lia.
- Qed.
-
- (* Lemma: if the job can be scheduled at instant t and its residue cost is not
- 0 (c+1), so its residue cost will be consume 1 unit and remain c at
- instant t+1.
- the end time of this job is fixed whenever we calculate it *)
-
- Lemma formula_sched_St:
- forall t c,
- is_scheduled_at t = true ->
- t + formula_rt t c.+1 = t.+1 + formula_rt t.+1 c.
- Proof.
- assert (H_tdma_cycle_p: tdma_cycle>0). by apply (TDMA_cycle_positive ts tsk).
- assert (H_tdma_cycle_ge_slot: tdma_cycle>= time_slot). by apply (TDMA_cycle_ge_each_time_slot ts tsk).
- assert (Hoffset: slot_offset %% tdma_cycle <= tdma_cycle). by apply ltnW, ltn_pmod.
- intros* h1. have PEN:pending_at t by apply scheduled_implies_pending.
- have NSLOT: in_time_slot_at t = true. apply /TDMA_policy_case_RT_le_Period;auto.
- rewrite /formula_rt /to_end_of_slot NSLOT gtn_eqF //. move:NSLOT.
- rewrite /in_time_slot_at /Task_in_time_slot.
- rewrite -/time_slot -/tdma_cycle -/slot_offset. intro NSLOT.
- case (in_time_slot_at t.+1) eqn:Hcases; revert Hcases;
- rewrite /in_time_slot_at /Task_in_time_slot;
- fold time_slot tdma_cycle slot_offset; (rewrite -addnBA;last exact); intro Hcases;rewrite Hcases.
- rewrite /from_start_of_slot.
- case (c < time_slot - (t + tdma_cycle - slot_offset %% tdma_cycle) %% tdma_cycle) eqn: Hc.
- - destruct c; simpl.
- + lia.
- + case (modulo_cases (t + (tdma_cycle - slot_offset %% tdma_cycle)) tdma_cycle.-1); intro mod_case.
- * repeat rewrite -addnBA //. rewrite prednK // in mod_case. repeat rewrite addSn mod_case.
- case (c < time_slot - ((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+1) eqn:Hc1; try lia.
- rewrite ltn_subRL addSn in Hc1. rewrite ltn_subRL addnS -addnBA // in Hc.
- lia.
- * repeat rewrite -addnBA //.
- case (c < time_slot - ((t.+1 + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle)) eqn:Hc1; [lia|].
- rewrite prednK // in mod_case. destruct mod_case.
- rewrite addSn in Hc1.
- lia.
- - destruct c; repeat rewrite -addnBA // in Hc;rewrite -addnBA // in NSLOT;simpl.
- + lia.
- + repeat rewrite -addnBA // addSn.
- case (modulo_cases (t + (tdma_cycle - slot_offset %% tdma_cycle)) tdma_cycle.-1);
- intro mod_case; rewrite prednK // in mod_case.
- * case (c < time_slot - ((t + (tdma_cycle - slot_offset %% tdma_cycle)).+1 %% tdma_cycle)) eqn:Hc1; try lia.
- rewrite /to_next_slot /from_start_of_slot. repeat rewrite -addnBA //. rewrite addSn.
- rewrite mod_case -addSn addnA addnA.
- replace (t.+1 +(tdma_cycle - ((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+1)) with
- (t + (tdma_cycle - (t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle)).
- -- apply/eqP. rewrite eqn_add2l.
- replace (c.+2 - (time_slot - (t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle)) with
- (c.+1 - (time_slot - ((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+1)); trivial.
- symmetry.
- replace ((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+1 with
- (((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle)+1) by lia.
- rewrite subnDA. by repeat (rewrite subnBA;try lia).
- -- rewrite -addn1. apply/eqP. rewrite -addnA eqn_add2l.
- replace ((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+1 with
- (((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle)+1) by lia.
- rewrite subnDA addnC addnBA.
- ++ rewrite add1n subn1 //.
- ++ rewrite ltn_subRL addn0. by apply ltn_pmod.
- * case (c < time_slot - ((t + (tdma_cycle - slot_offset %% tdma_cycle)).+1 %% tdma_cycle)) eqn:Hc1;
- destruct mod_case as [case1 case2].
- -- rewrite leq_eqVlt in H_tdma_cycle_ge_slot. revert H_tdma_cycle_ge_slot.
- move/orP. intros [Hts | Hts]; try lia.
- move/eqP in Hts. rewrite case2.
- rewrite /duration_to_finish_from_start_of_slot_with Hts.
- replace (tdma_cycle - tdma_cycle) with 0 by lia.
- rewrite muln0 /to_next_slot /from_start_of_slot -addnBA // case2.
- replace (tdma_cycle - tdma_cycle.-1) with 1 by lia. lia.
- -- rewrite case1 case2. rewrite leq_eqVlt in H_tdma_cycle_ge_slot.
- revert H_tdma_cycle_ge_slot. move/orP.
- intros [Hts | Hts]; try lia. move/eqP in Hts. apply /eqP.
- rewrite -addnS eqn_add2l /duration_to_finish_from_start_of_slot_with /to_next_slot /from_start_of_slot.
- repeat rewrite Hts.
- replace (tdma_cycle - tdma_cycle) with 0 by lia.
- repeat rewrite muln0 -addnBA //.
- rewrite addSn case1 case2 add0n subn0 add0n.
- replace (tdma_cycle - tdma_cycle.-1) with 1 by lia.
- rewrite add1n subn1 //= addnBA; try lia.
- - move/negP /negP in Hcases. rewrite -ltnNge in Hcases. rewrite -addnBA in NSLOT.
- rewrite /from_start_of_slot.
- case (c < time_slot - (t + tdma_cycle - slot_offset %% tdma_cycle) %% tdma_cycle)eqn:Hc.
- + destruct c; simpl; try lia.
- rewrite /to_next_slot /from_start_of_slot.
- case (modulo_cases (t + (tdma_cycle - slot_offset %% tdma_cycle)) tdma_cycle.-1); intro mod_case;
- rewrite prednK // in mod_case. rewrite addSn mod_case leq_eqVlt in Hcases.
- move: Hcases => /orP [Hcase | Hcase]; try lia.
- * rewrite -addn1 in Hcase.
- replace ((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+2 with
- (((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+1 +1) in Hcase; try lia.
- rewrite eqn_add2r in Hcase. move/eqP in Hcase.
- rewrite Hcase -addnBA // subSnn in Hc. lia.
- * destruct mod_case as [case1 case2].
- rewrite addSn case1 in Hcases. lia.
- + destruct c; simpl.
- * rewrite ltn_subRL addn0 -addnBA // in Hc. lia.
- * rewrite /to_next_slot /from_start_of_slot.
- case (modulo_cases (t + (tdma_cycle - slot_offset %% tdma_cycle)) tdma_cycle.-1) ;intro mod_case;
- rewrite prednK // in mod_case.
- -- rewrite addSn mod_case leq_eqVlt in Hcases.
- move:Hcases =>/orP [Hcase|Hcase]; try lia.
- rewrite -addn1 in Hcase.
- replace ((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+2 with
- (((t + (tdma_cycle - slot_offset %% tdma_cycle)) %% tdma_cycle).+1 +1) in Hcase; try lia.
- rewrite eqn_add2r in Hcase.
- move/eqP in Hcase.
- repeat rewrite -addnBA //.
- rewrite addSn addSn mod_case Hcase subSnn subn1 /= subnS -addnS -addSn prednK // ltn_subRL addn0.
- by apply ltn_pmod.
- -- destruct mod_case as [case1 _]. rewrite addSn case1 in Hcases. lia.
- + trivial.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and its cost is not
- null, it will have the same cost at instant t+d, where
- d < the duration to the start of the next slot from t *)
- Lemma formula_not_sched_interval:
- forall t c,
- pending_at t ->
- is_scheduled_at t = false ->
- forall d, d < to_next_slot t ->
- t + formula_rt t c.+1 = t + d + formula_rt (t + d) c.+1.
- Proof.
- intros* h1.
- induction d as [| d' IHd']; intro h2.
- - by repeat rewrite addn0.
- - rewrite addnS -formula_not_sched_St.
- + auto.
- + apply duration_not_sched; auto.
- + apply duration_not_sched; auto.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and its cost is not
- null, then its cost will be the same at the start of the next slot *)
- Lemma formula_not_sched_to_next_slot:
- forall t c, pending_at t ->
- is_scheduled_at t = false ->
- t + formula_rt t c.+1 = t + to_next_slot t + formula_rt (t + to_next_slot t) c.+1.
- Proof.
- intros* PEN h1.
- assert (H2ns:to_next_slot t>0) by apply to_next_slot_pos.
- rewrite (formula_not_sched_interval _ _ _ _ (to_next_slot t).-1) //.
- - rewrite formula_not_sched_St.
- + replace (t + (to_next_slot t).-1).+1 with (t + to_next_slot t).
- * reflexivity.
- * rewrite -addnS. lia.
- + apply duration_not_sched;auto. lia.
- + apply duration_not_sched;auto. lia.
- - lia.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and its residue cost is not
- null, and it will remain the same at the next start of slot + 1 *)
- Lemma job_not_sched_to_cunsume_1unit:
- forall t c, pending_at t ->
- is_scheduled_at t = false ->
- t + formula_rt t c.+1 = (t + to_next_slot t).+1 + formula_rt (t + to_next_slot t).+1 c.
- Proof.
- intros* PEN h1.
- assert (Hsched:is_scheduled_at (t+to_next_slot t) = true)
- . apply at_next_start_of_slot_schedulabe;auto.
- apply formula_sched_St with (c:=c) in Hsched.
- rewrite -Hsched formula_not_sched_to_next_slot //.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and its cost is not
- null, it will have the same cost at instant t+d, where
- d < the duration to the start of the next slot from t.
- lemma on end time predicate with forward direction *)
- Lemma end_time_predicate_not_sched_eq:
- forall d c t e ,
- pending_at t ->
- is_scheduled_at t = false ->
- job_end_time_predicate t c.+1 e ->
- d < to_next_slot t ->
- job_end_time_predicate (t+d) c.+1 e.
- Proof.
- intro d.
- induction d as [| d' IHd'];intros c t e PEN h1 h2 h3.
- - by rewrite addn0.
- - rewrite addnS. apply end_time_predicate_not_sched.
- + apply duration_not_sched with (d:=d')in h1.
- * rewrite /is_scheduled_at in h1. destruct h1 as [h11 h12]. by rewrite h11.
- * auto.
- * auto.
- + apply IHd'; auto.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and its cost is not
- null, it will have the same cost at instant t+d, where
- d < the duration to the start of the next slot from t.
- lemma on end time predicate with reverse direction *)
- Lemma end_time_predicate_not_sched_eq_rev:
- forall d c t e ,
- pending_at t ->
- is_scheduled_at t = false ->
- job_end_time_predicate (t+d) (S c) e ->
- d < to_next_slot t ->
- job_end_time_predicate t (S c) e.
- Proof.
- intro d.
- induction d as [| d' IHd'];intros c t e PEN h1 h2 h3.
- - by rewrite addn0 in h2.
- - rewrite addnS in h2. apply S_C_not_sched in h2.
- + apply IHd'; auto.
- + apply duration_not_sched with (d:=d') in h1; auto.
- rewrite /is_scheduled_at in h1. destruct h1 as [h11 h12].
- by rewrite h11.
- Qed.
-
- (* Lemma: if the job cannot be scheduled at instant t and its cost is not
- null, it will have the same cost at instant t+d, where
- d < the duration to the start of the next slot from t.
- lemma on end time predicate *)
- Lemma end_time_predicate_eq:
- forall t c e,
- pending_at t ->
- is_scheduled_at t = false ->
- job_end_time_predicate t c.+1 e <->
- job_end_time_predicate ((t+to_next_slot t).+1) c e.
- Proof.
- intros t c e PEN h1.
- assert (H1:is_scheduled_at t = false) by assumption.
- assert (H2ns:to_next_slot t>0) by apply to_next_slot_pos.
- assert (Hfact: (to_next_slot t).-1 < to_next_slot t). by rewrite prednK.
- split; intro h2.
- - apply (end_time_predicate_sched j sched (t + to_next_slot t) c e).
- by apply at_next_start_of_slot_schedulabe.
- apply duration_not_sched with (d:=(to_next_slot t).-1) in h1; try done.
- replace (t + to_next_slot t) with (t + (to_next_slot t).-1.+1) by (rewrite prednK; done).
- rewrite addnS.
- apply end_time_predicate_not_sched.
- + rewrite /is_scheduled_at in h1. destruct h1 as [h11 h12]. by rewrite h11.
- + by apply end_time_predicate_not_sched_eq.
- - apply S_C_sched in h2.
- + replace (t + to_next_slot t) with (t + (to_next_slot t).-1.+1) in h2 by (rewrite prednK; done).
- rewrite addnS in h2. apply S_C_not_sched in h2.
- * by apply end_time_predicate_not_sched_eq_rev with (d:=(to_next_slot t).-1) in h2.
- * apply duration_not_sched with (d:=(to_next_slot t).-1) in h1; try done.
- rewrite /is_scheduled_at in h1. destruct h1 as [h11 h12]. by rewrite h11.
- + by apply at_next_start_of_slot_schedulabe.
- Qed.
-
- (* Lemma: service received dont change if the job isn't scheduled *)
- Lemma service_is_zero_in_Nsched_duration:
- forall d t,
- pending_at t ->
- scheduled_at sched j t = false ->
- d <= to_next_slot t ->
- service sched j ( t + d) = service sched j t.
- Proof.
- intro d.
- induction d as [| d GD];intros* PEN NSCHED D.
- - by rewrite addn0.
- - have NSTD: scheduled_at sched j (t+d) = false by apply duration_not_sched.
- rewrite addnS /service /service_during big_nat_recr /service_at;trivial. rewrite NSTD /= addn0.
- apply GD;auto.
- Qed.
-
- (* Lemma: job completes at end time
- this lemma allows to valide the response time formula defined above *)
- Lemma completes_at_end_time_pre:
- forall c t , pending_at t -> service sched j t + c = job_cost j ->
- end_time_predicate sched j t c (t + formula_rt t c).
- Proof.
- intro c.
- induction c as [| c IHc];intros ARR PEN SC.
- - rewrite /formula_rt /= addn0; apply (C0_ sched j).
- - case l:(is_scheduled_at ARR).
- + destruct c as [|c];apply (S_C_sched sched j);rewrite // formula_sched_St //.
- * rewrite /formula_rt /= addn0;apply C0_.
- * apply IHc.
- -- by apply pendingSt_Sched with (c:=c).
- -- rewrite /is_scheduled_at in l;
- rewrite -SC /service /service_during /service_at big_nat_recr //.
- rewrite l /=;lia.
- + apply end_time_predicate_eq;try exact l.
- * exact PEN.
- * destruct c as [|c];rewrite job_not_sched_to_cunsume_1unit //.
- -- rewrite /formula_rt /= addn0; apply C0_.
- -- have SCHED: scheduled_at sched j (ARR + to_next_slot ARR) = true
- by apply at_next_start_of_slot_schedulabe. apply IHc.
- ++ have PENX: pending_at (ARR+to_next_slot ARR) by apply pending_Nsched_sched.
- apply pendingSt_Sched with (c:=c);try trivial.
- by rewrite service_is_zero_in_Nsched_duration.
- ++ rewrite <-service_is_zero_in_Nsched_duration with (d:=to_next_slot ARR) in SC;auto.
- rewrite -SC /service /service_during /service_at big_nat_recr;auto. rewrite SCHED /=.
- lia.
- Qed.
-
- End formula_predicate_eq.
-
- (** Then we prove that job j completes at instant (arrival + response time) by
- (1) assuming that all its previous jobs have been completed by its arrival time and
- (2) basing on the basic and generic lemmas above. *)
- Lemma completes_at_end_time:
- job_completes_at (job_arrival j + job_response_time_tdma_in_at_most_one_job_is_pending).
- Proof.
- apply completes_at_end_time_pre.
- by apply pendingArrival.
- rewrite /service /service_during.
- try ( by rewrite ->cumulative_service_before_job_arrival_zero with (job_arrival0:=job_arrival) ) ||
- by rewrite ->cumulative_service_before_job_arrival_zero with (job_arrival:=job_arrival).
- Qed.
-
- (** Finally, we prove that job can be finished within the formula WCRT. *)
- Section ValidWCRT.
-
- (* Recall the definition of task_cost is exactly WCET, which is the worst-case execution time
- with respect to a job *)
- Let WCET := task_cost tsk.
-
- (* We define a formula for calculating the worst-case response time, which means
- job arrives at the end of its time slot with WCET *)
- Definition WCRT_formula cycle s wcet:=
- (div_ceil wcet s)*(cycle - s) + wcet.
- Definition WCRT:=
- WCRT_formula tdma_cycle time_slot WCET.
-
- (* Assume that job cost is always less than or equal to its task cost *)
- Hypothesis H_job_cost_le_task_cost: job_cost_le_task_cost task_cost job_cost job_task j.
-
- (* We prove that response time is always less than or equal to WCRT *)
- Lemma response_time_le_WCRT:
- job_response_time_tdma_in_at_most_one_job_is_pending <= WCRT.
- Proof.
- rewrite /job_response_time_tdma_in_at_most_one_job_is_pending /WCRT /formula_rt /to_end_of_slot.
- unfold Task_in_time_slot in in_time_slot_at.
- fold tdma_cycle in in_time_slot_at. fold time_slot in in_time_slot_at. fold slot_offset in in_time_slot_at.
- have cost_pos: job_cost j > 0 by apply H_valid_job.
- case test_in_slot:(in_time_slot_at (job_arrival j)).
- - case test_cost:(job_cost j <= time_slot - from_start_of_slot (job_arrival j)).
- + set other := div_ceil (job_cost j) time_slot * (tdma_cycle - time_slot).
- apply leq_trans with (n:=div_ceil WCET time_slot * (tdma_cycle - time_slot) + job_cost j).
- * rewrite gtn_eqF //. apply leq_addl.
- * rewrite leq_add2l /WCET -H_job_task //.
- + assert (Hmod:(job_arrival j + tdma_cycle - slot_offset %% tdma_cycle)%% tdma_cycle < tdma_cycle)
- by (apply ltn_pmod; apply TDMA_cycle_positive with (task:=tsk); done).
- assert (hcm:tdma_cycle - time_slot <=div_ceil (job_cost j - (time_slot -
- from_start_of_slot (job_arrival j))) time_slot * (tdma_cycle - time_slot)).
- * apply leq_pmull, ceil_neq0; try apply H_valid_time_slot.
- apply negbT in test_cost; rewrite<-ltnNge in test_cost; by rewrite subn_gt0.
- * unfold duration_to_finish_from_start_of_slot_with.
- rewrite addnA mulnBl mul1n.
- set cost_sub_end:=job_cost j - (time_slot - from_start_of_slot (job_arrival j)).
- rewrite addnBA; try apply hcm.
- rewrite addnC;rewrite addnBA.
- -- rewrite addnA.
- assert (h1:cost_sub_end + to_next_slot (job_arrival j) = job_cost j + (tdma_cycle - time_slot)).
- ++ rewrite /cost_sub_end /to_next_slot addnC subnBA.
- ** rewrite addnBA.
- --- rewrite addnC -addnA subnKC; try auto.
- rewrite addnBA //.
- by apply TDMA_cycle_ge_each_time_slot with (task:=tsk).
- --- apply negbT in test_cost. rewrite -ltnNge in test_cost.
- rewrite addnC -leq_subLR. auto.
- ** destruct (TDMA_policy_case_RT_le_Period (job_arrival j)) as [hj |hj]. apply pendingArrival.
- unfold in_time_slot_at in hj; auto. unfold in_time_slot_at in hj; auto.
- ++ rewrite h1 -addnBA ; try apply hcm.
- rewrite -addnA subnKC; try apply hcm.
- rewrite addnC gtn_eqF //.
- apply leq_add.
- ** rewrite leq_mul2r. apply /orP. right. apply leq_divceil2r; auto.
- apply leq_trans with (n:=job_cost j); try apply leq_subr.
- rewrite /WCET -H_job_task //.
- ** rewrite /WCET -H_job_task //.
- -- rewrite <-add0n. apply leq_add; auto.
- - unfold duration_to_finish_from_start_of_slot_with.
- rewrite addnA gtn_eqF //.
- apply leq_add; try (rewrite /WCET -H_job_task //).
- rewrite mulnBl mul1n addnBA.
- + rewrite leq_subLR. apply leq_add.
- * unfold to_next_slot. apply leq_sub2l. move/negP in test_in_slot.
- apply /leP. apply not_gt. apply /ltP. by apply/negP.
- * rewrite leq_mul2r. apply /orP. right. apply leq_divceil2r; try done.
- + apply leq_pmull, ceil_neq0.
- * apply H_valid_job.
- * apply H_valid_time_slot.
- Qed.
-
- (* We show that this analysis is exact: job j's response time is equal to WCRT when
- (1) the job cost is equal to WCER; and
- (2) the job arrives right at the end of its time slot. *)
- Lemma exists_WCRT:
- job_cost j = WCET /\ from_start_of_slot (job_arrival j)=time_slot ->
- job_response_time_tdma_in_at_most_one_job_is_pending = WCRT.
- Proof.
- intros [COST_WCET EXISTS].
- rewrite /job_response_time_tdma_in_at_most_one_job_is_pending /WCRT /formula_rt.
- unfold Task_in_time_slot in in_time_slot_at.
- have cost_pos: job_cost j>0 by apply H_valid_job.
- fold tdma_cycle in in_time_slot_at. fold time_slot in in_time_slot_at.
- fold slot_offset in in_time_slot_at. fold from_start_of_slot in in_time_slot_at.
- assert (gt_ref: reflect (time_slot> from_start_of_slot (job_arrival j))%coq_nat
- (time_slot >from_start_of_slot (job_arrival j))) by apply ltP.
- case hgt:(time_slot > from_start_of_slot (job_arrival j)).
- - apply decPcases in gt_ref. rewrite EXISTS ltnn in hgt. done.
- - apply decPcases in gt_ref.
- destruct (TDMA_policy_case_RT_le_Period (job_arrival j)) as [hj |hj]. apply pendingArrival.
- unfold in_time_slot_at in hj.
- + rewrite /from_start_of_slot in gt_ref. rewrite /from_start_of_slot in EXISTS. case (_ < _) in gt_ref;try lia.
- + have F:in_time_slot_at (job_arrival j) = false by auto. rewrite F.
- rewrite /to_next_slot EXISTS /duration_to_finish_from_start_of_slot_with.
- rewrite mulnBl mul1n addnA {1}gtn_eqF // -COST_WCET.
- apply /eqP. rewrite eqn_add2r addnC addnBAC.
- * by rewrite addnK.
- * by apply leq_pmull, ceil_neq0.
- Qed.
-
- (** Main Theorem *)
- (* We prove that any job j of task tsk will be completed by the computed value WCRT,
- assuming that all its previous jobs have been completed by its arrival time. *)
- Theorem job_completed_by_WCRT:
- completed_by job_cost sched j (job_arrival j + WCRT).
- Proof.
- apply completion_monotonic with (t:= job_arrival j + job_response_time_tdma_in_at_most_one_job_is_pending);auto.
- rewrite leq_add2l.
- apply response_time_le_WCRT.
- try ( apply completed_by_end_time with (job_arrival0:=job_arrival);auto ) ||
- apply completed_by_end_time with (job_arrival:=job_arrival);auto.
- apply completes_at_end_time.
- Qed.
-
- End ValidWCRT.
-
- End WCRT_analysis.
-
-End WCRT_OneJobTDMA.
diff --git a/classic/analysis/uni/basic/workload_bound_fp.v b/classic/analysis/uni/basic/workload_bound_fp.v
deleted file mode 100644
index 34daae8d56c1727d699851e00212ebbc69932cb3..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/basic/workload_bound_fp.v
+++ /dev/null
@@ -1,247 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority
- prosa.classic.model.arrival.basic.task_arrival prosa.classic.model.arrival.basic.arrival_bounds.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.workload.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div.
-
-Module WorkloadBoundFP.
-
- Import Job SporadicTaskset UniprocessorSchedule Priority Workload
- TaskArrival ArrivalBounds.
-
- (* In this section, we define a bound for the workload of a single task
- under uniprocessor FP scheduling. *)
- Section SingleTask.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
-
- (* Consider any task tsk that is to be scheduled in an interval of length delta. *)
- Variable tsk: Task.
- Variable delta: time.
-
- (* Based on the maximum number of jobs of tsk that can execute in the interval, ... *)
- Definition max_jobs := div_ceil delta (task_period tsk).
-
- (* ... we define the following workload bound for the task. *)
- Definition task_workload_bound_FP := max_jobs * task_cost tsk.
-
- End SingleTask.
-
- (* In this section, we define a bound for the workload of multiple tasks. *)
- Section AllTasks.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
-
- (* Assume any FP policy. *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* Consider a task set ts... *)
- Variable ts: list Task.
-
- (* ...and let tsk be the task to be analyzed. *)
- Variable tsk: Task.
-
- (* Let delta be the length of the interval of interest. *)
- Variable delta: time.
-
- (* Recall the definition of higher-or-equal-priority task and
- the per-task workload bound for FP scheduling. *)
- Let is_hep_task tsk_other := higher_eq_priority tsk_other tsk.
- Let W tsk_other :=
- task_workload_bound_FP task_cost task_period tsk_other delta.
-
- (* Using the sum of individual workload bounds, we define the following bound
- for the total workload of tasks of higher-or-equal priority (with respect
- to tsk) in any interval of length delta. *)
- Definition total_workload_bound_fp :=
- \sum_(tsk_other <- ts | is_hep_task tsk_other) W tsk_other.
-
- End AllTasks.
-
- (* In this section, we prove some basic lemmas about the workload bound. *)
- Section BasicLemmas.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
-
- (* Assume any FP policy. *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* Consider a task set ts... *)
- Variable ts: list Task.
-
- (* ...and let tsk be any task in ts. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Recall the workload bound for uniprocessor FP scheduling. *)
- Let workload_bound :=
- total_workload_bound_fp task_cost task_period higher_eq_priority ts tsk.
-
- (* In this section we prove that the workload bound in a time window of
- length (task_cost tsk) is as large as (task_cost tsk) time units.
- (This is an important initial condition for the response-time analysis.) *)
- Section NoSmallerThanCost.
-
- (* Assume that the priority order is reflexive. *)
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
-
- (* Assume that cost and period of the task are positive. *)
- Hypothesis H_cost_positive: task_cost tsk > 0.
- Hypothesis H_period_positive: task_period tsk > 0.
-
- (* We prove that the workload bound of an interval of size (task_cost tsk)
- cannot be smaller than (task_cost tsk). *)
- Lemma total_workload_bound_fp_ge_cost:
- workload_bound (task_cost tsk) >= task_cost tsk.
- Proof.
- rename H_priority_is_reflexive into REFL.
- unfold workload_bound, total_workload_bound_fp.
- rewrite big_mkcond (big_rem tsk) /=; last by done.
- rewrite REFL /task_workload_bound_FP.
- apply leq_trans with (n := max_jobs task_period tsk (task_cost tsk) * task_cost tsk);
- last by apply leq_addr.
- rewrite -{1}[task_cost tsk]mul1n leq_mul2r; apply/orP; right.
- by apply ceil_neq0.
- Qed.
-
- End NoSmallerThanCost.
-
- (* In this section, we prove that the workload bound is monotonically non-decreasing. *)
- Section NonDecreasing.
-
- (* Assume that the period of every task in the task set is positive. *)
- Hypothesis H_period_positive:
- forall tsk,
- tsk \in ts ->
- task_period tsk > 0.
-
- (* Then, the workload bound is a monotonically non-decreasing function.
- (This property is important for the fixed-point iteration.) *)
- Lemma total_workload_bound_fp_non_decreasing:
- forall delta1 delta2,
- delta1 <= delta2 ->
- workload_bound delta1 <= workload_bound delta2.
- Proof.
- unfold workload_bound, total_workload_bound_fp; intros d1 d2 LE.
- apply leq_sum_seq; intros tsk' IN HP.
- rewrite leq_mul2r; apply/orP; right.
- apply leq_divceil2r; last by done.
- by apply H_period_positive.
- Qed.
-
- End NonDecreasing.
-
- End BasicLemmas.
-
- (* In this section, we prove that any fixed point R = workload_bound R
- is indeed a workload bound for an interval of length R. *)
- Section ProofWorkloadBound.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Let ts be any task set with valid task parameters. *)
- Variable ts: seq Task.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Consider any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Assume that all jobs come from the task set ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...and have valid parameters. *)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Assume that jobs arrived sporadically. *)
- Hypothesis H_sporadic_arrivals:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Let tsk be any task in ts. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Assume any fixed-priority policy. *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* First, let's define some local names for clarity. *)
- Let arrivals_between := jobs_arrived_between arr_seq.
- Let hp_workload t1 t2:=
- workload_of_higher_or_equal_priority_tasks job_cost job_task (arrivals_between t1 t2)
- higher_eq_priority tsk.
- Let workload_bound :=
- total_workload_bound_fp task_cost task_period higher_eq_priority ts tsk.
-
- (* Consider any R that is a fixed point of the following equation,
- i.e., the claimed workload bound is equal to the interval length. *)
- Variable R: time.
- Hypothesis H_fixed_point: R = workload_bound R.
-
- (* Then, we prove that R is indeed a workload bound. *)
- Lemma fp_workload_bound_holds:
- forall t,
- hp_workload t (t + R) <= R.
- Proof.
- have BOUND := sporadic_task_arrival_bound task_period job_arrival job_task arr_seq.
- feed_n 3 BOUND; try (by done).
- rename H_fixed_point into FIX, H_all_jobs_from_taskset into FROMTS,
- H_valid_job_parameters into JOBPARAMS,
- H_valid_task_parameters into PARAMS.
- unfold hp_workload, workload_of_higher_or_equal_priority_tasks,
- valid_sporadic_job, valid_realtime_job,
- valid_sporadic_taskset, is_valid_sporadic_task in *.
- intro t.
- rewrite {2}FIX /workload_bound /total_workload_bound_fp.
- set l := jobs_arrived_between arr_seq t (t + R).
- set hep := higher_eq_priority.
- apply leq_trans with (n := \sum_(tsk' <- ts | hep tsk' tsk)
- (\sum_(j0 <- l | job_task j0 == tsk') job_cost j0)).
- {
- have EXCHANGE := exchange_big_dep (fun x => hep (job_task x) tsk).
- rewrite EXCHANGE /=; last by move => tsk0 j0 HEP /eqP JOB0; rewrite JOB0.
- rewrite /workload_of_jobs -/l big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => j0 /andP [IN0 HP0].
- rewrite big_mkcond (big_rem (job_task j0)) /=;
- first by rewrite HP0 andTb eq_refl; apply leq_addr.
- by apply in_arrivals_implies_arrived in IN0; apply FROMTS.
- }
- apply leq_sum_seq; intros tsk0 INtsk0 HP0.
- apply leq_trans with (n := num_arrivals_of_task job_task arr_seq
- tsk0 t (t + R) * task_cost tsk0).
- {
- rewrite /num_arrivals_of_task -sum1_size big_distrl /= big_filter.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- rewrite -EQ mul1n.
- feed (JOBPARAMS j0); first by eapply in_arrivals_implies_arrived; eauto 1.
- by move: JOBPARAMS => [_ [LE _]].
- }
- rewrite /task_workload_bound_FP leq_mul2r; apply/orP; right.
- feed (BOUND t (t + R) tsk0); first by feed (PARAMS tsk0); last by des.
- by rewrite addKn in BOUND.
- Qed.
-
- End ProofWorkloadBound.
-
-End WorkloadBoundFP.
\ No newline at end of file
diff --git a/classic/analysis/uni/jitter/fp_rta_comp.v b/classic/analysis/uni/jitter/fp_rta_comp.v
deleted file mode 100644
index 4317091000217dbe704d42076611acd0e7cb3020..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/jitter/fp_rta_comp.v
+++ /dev/null
@@ -1,419 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.arrival.jitter.job prosa.classic.model.arrival.jitter.arrival_sequence
- prosa.classic.model.arrival.jitter.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedulability
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule prosa.classic.model.schedule.uni.jitter.platform.
-Require Import prosa.classic.analysis.uni.jitter.workload_bound_fp prosa.classic.analysis.uni.jitter.fp_rta_theory.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop path ssrfun.
-
-Module ResponseTimeIterationFP.
-
- Import JobWithJitter UniprocessorScheduleWithJitter TaskArrivalWithJitter
- SporadicTaskset WorkloadBoundFP Priority ResponseTime
- ResponseTime Schedulability Platform ResponseTimeAnalysisFP.
-
- (* In this section, we define the response-time analysis for
- jitter-aware uniprocessor FP scheduling. *)
- Section Analysis.
-
- Context {SporadicTask: eqType}.
- Variable task_cost: SporadicTask -> time.
- Variable task_period: SporadicTask -> time.
- Variable task_deadline: SporadicTask -> time.
- Variable task_jitter: SporadicTask -> time.
-
- (* In the algorithm, we consider pairs of tasks and computed response-time bounds. *)
- Let task_with_response_time := (SporadicTask * time)%type.
-
- (* Assume a fixed-priority policy. *)
- Variable higher_eq_priority: FP_policy SporadicTask.
-
- (* We begin by defining the fixed-point iteration for computing the
- response-time bound of each task. *)
-
- (* First, to ensure that the algorithm converges, we will run the iteration
- on each task for at most (task_deadline tsk - task_cost tsk + 1) steps,
- i.e., the worst-case time complexity of the procedure. *)
- Definition max_steps (tsk: SporadicTask) :=
- task_deadline tsk - task_cost tsk + 1.
-
- (* Next, based on the jitter-aware workload bound for uniprocessor FP scheduling, ... *)
- Let workload_bound :=
- total_workload_bound_fp task_cost task_period task_jitter higher_eq_priority.
-
- (* ...we compute the response-time bound R of a single task as follows:
-
- R (step) = task_cost tsk if step = 0,
- workload_bound (ts, tsk, R (step-1)) otherwise. *)
- Definition per_task_rta ts tsk :=
- iter_fixpoint (workload_bound ts tsk) (max_steps tsk) (task_cost tsk).
-
- (* Next, we validate the computed response-time bound by checking
- (a) if the iteration returned some value and
- (b) if the corresponding response-time bound plus the jitter of the task is no
- larger than its deadline.
- If the validation succeeds, we return the pair (tsk, R), without the task jitter. *)
- Let is_valid_bound tsk_R :=
- if tsk_R is (tsk, Some R) then
- if task_jitter tsk + R <= task_deadline tsk then
- Some (tsk, R)
- else None
- else None.
-
- (* At the end, the response-time bounds for the entire taskset is computed
- using the fixed-point iteration on each task.
- If each response-time bound is no larger than the corresponding deadline,
- we return the pairs of tasks and response-time bounds, else we return None. *)
- Definition fp_claimed_bounds ts: option (seq task_with_response_time) :=
- let possible_bounds := [seq (tsk, per_task_rta ts tsk) | tsk <- ts] in
- if all is_valid_bound possible_bounds then
- Some (pmap is_valid_bound possible_bounds)
- else None.
-
- (* The schedulability test simply checks if we got a list of
- response-time bounds (i.e., if the computation did not fail). *)
- Definition fp_schedulable (ts: seq SporadicTask) :=
- fp_claimed_bounds ts != None.
-
- (* In this section, we prove some properties about the computed
- list of response-time bounds. *)
- Section Lemmas.
-
- (* Let ts be any taskset to be analyzed. *)
- Variable ts: seq SporadicTask.
-
- (* Assume that the response-time analysis does not fail.*)
- Variable rt_bounds: seq task_with_response_time.
- Hypothesis H_analysis_succeeds:
- fp_claimed_bounds ts = Some rt_bounds.
-
- (* First, we prove that a response-time bound exists for each task. *)
- Section BoundExists.
-
- (* Let tsk be any task in ts. *)
- Variable tsk: SporadicTask.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Since the analysis succeeded, there must be a corresponding
- response-time bound R for this task. *)
- Lemma fp_claimed_bounds_for_every_task:
- exists R, (tsk, R) \in rt_bounds.
- Proof.
- rename H_analysis_succeeds into SOME.
- move: SOME; rewrite /fp_claimed_bounds.
- case ALL: all; [case => SOME | by done].
- move: ALL => /allP ALL.
- have IN: (tsk, per_task_rta ts tsk) \in
- [seq (tsk, per_task_rta ts tsk) | tsk <- ts];
- first by apply/mapP; exists tsk.
- specialize (ALL _ IN); move: ALL.
- rewrite /is_valid_bound; case RTA: per_task_rta => [R|] //.
- case DL: (_ <= _); last by done.
- move => _; exists R; rewrite -SOME.
- rewrite mem_pmap; apply/mapP.
- exists (tsk, Some R); first by rewrite -RTA.
- by rewrite /is_valid_bound DL.
- Qed.
-
- End BoundExists.
-
- (* Next, assuming that a bound exists, we prove some of its properties. *)
- Section PropertiesOfBound.
-
- (* Let tsk and R be any pair of task and response-time bound
- returned by the analysis. *)
- Variable tsk: SporadicTask.
- Variable R: time.
- Hypothesis H_tsk_R_computed: (tsk, R) \in rt_bounds.
-
- (* First, we show that tsk comes from task set ts. *)
- Lemma fp_claimed_bounds_from_taskset:
- tsk \in ts.
- Proof.
- rename H_analysis_succeeds into SOME, H_tsk_R_computed into IN.
- move: SOME; rewrite /fp_claimed_bounds.
- case: all; [case => SOME | by done].
- move: IN; rewrite -SOME mem_pmap.
- move => /mapP [[tsk' someR]].
- rewrite /is_valid_bound; case: someR; last by done.
- move => R'; case: (_ <= _); last by done.
- move => IN; case => EQ1 EQ2; subst.
- move: IN => /mapP [tsk'' IN].
- by case; move => EQ1; subst tsk'.
- Qed.
-
- (* Then, we prove that R is computed using the per-task fixed-point iteration, ... *)
- Lemma fp_claimed_bounds_computes_iteration:
- per_task_rta ts tsk = Some R.
- Proof.
- rename H_analysis_succeeds into SOME, H_tsk_R_computed into IN.
- move: SOME; rewrite /fp_claimed_bounds.
- case: all; [case => SOME | by done].
- move: IN; rewrite -SOME mem_pmap.
- move => /mapP [[tsk' someR]].
- rewrite /is_valid_bound; case: someR; last by done.
- move => R'; case: (_ <= _); last by done.
- move => IN; case => EQ1 EQ2; subst.
- move: IN => /mapP [tsk'' IN]; case => EQ1; subst; move => <-.
- by f_equal; rewrite addKn.
- Qed.
-
- (* ...which implies that the computed bound is a fixed point
- of the response-time recurrence. *)
- Lemma fp_claimed_bounds_yields_fixed_point :
- R = workload_bound ts tsk R.
- Proof.
- have ITER := fp_claimed_bounds_computes_iteration.
- rewrite /per_task_rta in ITER.
- set f := workload_bound _ _ in ITER.
- set s := max_steps _ in ITER.
- set x0 := _ tsk in ITER.
- destruct (iter_fixpoint_cases f s x0) as [NONE | [R' [SOME EQ]]];
- first by rewrite NONE in ITER.
- by rewrite SOME in ITER; case: ITER => SAME; subst.
- Qed.
-
- (* Since the analysis validates the computed values, it follows that
- the jitter of the task plus R is no larger than its deadline. *)
- Lemma fp_claimed_bounds_le_deadline:
- task_jitter tsk + R <= task_deadline tsk.
- Proof.
- rename H_analysis_succeeds into SOME, H_tsk_R_computed into IN.
- move: SOME; rewrite /fp_claimed_bounds.
- case: all; [case => SOME | by done].
- move: IN; rewrite -SOME mem_pmap.
- move => /mapP [[tsk' someR]].
- rewrite /is_valid_bound; case: someR; last by done.
- move => R'; case LE: (_ <= _); last by done.
- by move => IN; case => EQ1 EQ2; subst.
- Qed.
-
- (* Using the monotonicity of the workload bound, we prove some properties
- of the results of the iteration. *)
- Section FixedPoint.
-
- (* Assume that the priority relation is reflexive. *)
- Hypothesis H_priority_is_reflexive:
- FP_is_reflexive higher_eq_priority.
-
- (* Assume that tasks have positive costs and periods. *)
- Hypothesis H_cost_positive: task_cost tsk > 0.
- Hypothesis H_period_positive:
- forall tsk, tsk \in ts -> task_period tsk > 0.
-
- (* Then, we can show that the computed response-time bound is as large
- as the cost of the task, ... *)
- Lemma fp_claimed_bounds_ge_cost:
- R >= task_cost tsk.
- Proof.
- have ITER := fp_claimed_bounds_computes_iteration.
- rewrite /per_task_rta in ITER.
- set f := workload_bound _ _ in ITER.
- set s := max_steps _ in ITER.
- set x0 := _ tsk in ITER.
- have REFL: reflexive leq by rewrite /reflexive; apply leqnn.
- have TRANS: transitive leq by rewrite /transitive;apply leq_trans.
- have MON: monotone f leq.
- by intros x1 x2 LE; apply total_workload_bound_fp_non_decreasing.
- have GE: task_cost tsk <= f (task_cost tsk).
- {
- apply total_workload_bound_fp_ge_cost; try (by done).
- - by apply fp_claimed_bounds_from_taskset.
- - by apply H_period_positive, fp_claimed_bounds_from_taskset.
- }
- by apply (iter_fixpoint_ge_bottom f leq REFL TRANS MON s x0 _ ITER GE).
- Qed.
-
- (* ...which implies that the response-time bound is positive. *)
- Corollary fp_claimed_bounds_gt_zero: R > 0.
- Proof.
- apply leq_trans with (n := task_cost tsk); first by done.
- by apply fp_claimed_bounds_ge_cost.
- Qed.
-
- End FixedPoint.
-
- End PropertiesOfBound.
-
- End Lemmas.
-
- End Analysis.
-
- (* In this section, using the main theorem from fp_rta_theory.v, we prove
- the correctness of the jitter-aware response-time analysis. *)
- Section ProvingCorrectness.
-
- Context {SporadicTask: eqType}.
- Variable task_cost: SporadicTask -> time.
- Variable task_period: SporadicTask -> time.
- Variable task_deadline: SporadicTask -> time.
- Variable task_jitter: SporadicTask -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> SporadicTask.
-
- (* Consider a task set ts... *)
- Variable ts: seq SporadicTask.
-
- (* ...with positive task costs and periods. *)
- Hypothesis H_positive_costs: forall tsk, tsk \in ts -> task_cost tsk > 0.
- Hypothesis H_positive_periods: forall tsk, tsk \in ts -> task_period tsk > 0.
-
- (* Next, consider any job arrival sequence with consistent, duplicate-free arrivals, ... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ...where all jobs come from task set ts, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
-
- (* ... and satisfy the sporadic task model.*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Assume that the cost of each job is bounded by the cost of its task,... *)
- Hypothesis H_job_cost_le_task_cost:
- forall j,
- arrives_in arr_seq j ->
- job_cost j <= task_cost (job_task j).
-
- (* ...the jitter of each job is bounded by the jitter of its task,... *)
- Hypothesis H_job_jitter_le_task_jitter:
- forall j,
- arrives_in arr_seq j ->
- job_jitter j <= task_jitter (job_task j).
-
- (* ...and that job deadlines equal task deadlines. *)
- Hypothesis H_job_deadline_eq_task_deadline:
- forall j,
- arrives_in arr_seq j ->
- job_deadline j = task_deadline (job_task j).
-
- (* Assume any fixed-priority policy... *)
- Variable higher_eq_priority: FP_policy SporadicTask.
-
- (* ...that is reflexive and transitive, i.e., indicating higher-or-equal priority. *)
- Hypothesis H_priority_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_transitive: FP_is_transitive higher_eq_priority.
-
- (* Next, consider any jitter-aware uniprocessor schedule of these jobs... *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...where jobs do not execute before the jitter has passed nor after completion. *)
- Hypothesis H_jobs_execute_after_jitter: jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that the scheduler is jitter-aware work-conserving and respects the FP policy. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_respects_FP_policy:
- respects_FP_policy job_arrival job_cost job_jitter job_task arr_seq sched higher_eq_priority.
-
- (* For simplicity, let's define some local names. *)
- Let no_deadline_missed_by_task :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
- Let no_deadline_missed_by_job :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched.
- Let response_time_bounded_by:=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- (* Recall the response-time analysis and the corresponding schedulability test. *)
- Let RTA_claimed_bounds :=
- fp_claimed_bounds task_cost task_period task_deadline task_jitter higher_eq_priority ts.
- Let claimed_to_be_schedulable :=
- fp_schedulable task_cost task_period task_deadline task_jitter higher_eq_priority ts.
-
- (* First, we prove that the RTA yields valid response-time bounds. *)
- Theorem fp_analysis_yields_response_time_bounds :
- forall tsk R,
- (tsk, R) \In RTA_claimed_bounds ->
- response_time_bounded_by tsk (task_jitter tsk + R).
- Proof.
- unfold valid_sporadic_job, valid_realtime_job,
- valid_sporadic_taskset, is_valid_sporadic_task in *.
- unfold RTA_claimed_bounds; intros tsk R.
- case SOME: fp_claimed_bounds => [rt_bounds|] IN; last by done.
- try ( apply uniprocessor_response_time_bound_fp with
- (task_cost0 := task_cost) (task_period0 := task_period)
- (ts0 := ts) (job_jitter0 := job_jitter)
- (higher_eq_priority0 := higher_eq_priority); try (by done) ) ||
- apply uniprocessor_response_time_bound_fp with
- (task_cost := task_cost) (task_period := task_period)
- (ts := ts) (job_jitter := job_jitter)
- (higher_eq_priority := higher_eq_priority); try (by done).
- {
- try ( apply fp_claimed_bounds_gt_zero with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_deadline0 := task_deadline)
- (higher_eq_priority0 := higher_eq_priority) (ts0 := ts) (task_jitter0 := task_jitter)
- (rt_bounds0 := rt_bounds) (tsk0 := tsk); try (by done) ) ||
- apply fp_claimed_bounds_gt_zero with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (higher_eq_priority := higher_eq_priority) (ts := ts) (task_jitter := task_jitter)
- (rt_bounds := rt_bounds) (tsk := tsk); try (by done).
- apply H_positive_costs.
- by eapply fp_claimed_bounds_from_taskset; eauto 1.
- }
- try ( by apply fp_claimed_bounds_yields_fixed_point with
- (task_deadline0 := task_deadline) (rt_bounds0 := rt_bounds) ) ||
- by apply fp_claimed_bounds_yields_fixed_point with
- (task_deadline := task_deadline) (rt_bounds := rt_bounds).
- Qed.
-
- (* Next, we show that the RTA is a sufficient schedulability analysis. *)
- Section AnalysisIsSufficient.
-
- (* If the schedulability test suceeds, ...*)
- Hypothesis H_test_succeeds: claimed_to_be_schedulable.
-
- (* ...then no task misses its deadline. *)
- Theorem taskset_schedulable_by_fp_rta :
- forall tsk, tsk \in ts -> no_deadline_missed_by_task tsk.
- Proof.
- unfold claimed_to_be_schedulable, fp_schedulable in *.
- have RESP := fp_claimed_bounds_for_every_task task_cost task_period task_deadline
- task_jitter higher_eq_priority ts.
- have DL := fp_claimed_bounds_le_deadline task_cost task_period task_deadline
- task_jitter higher_eq_priority ts.
- have BOUND := fp_analysis_yields_response_time_bounds.
- rename H_test_succeeds into TEST.
- move:TEST; case TEST:(fp_claimed_bounds _ _ _ _ _) => [rt_bounds|] _//.
- intros tsk IN.
- move: (RESP rt_bounds TEST tsk IN) => [R INbounds].
- specialize (DL rt_bounds TEST tsk R INbounds).
- try ( apply task_completes_before_deadline with
- (task_deadline0 := task_deadline) (R0 := task_jitter tsk + R); try (by done) ) ||
- apply task_completes_before_deadline with
- (task_deadline := task_deadline) (R := task_jitter tsk + R); try (by done).
- by apply BOUND; rewrite /RTA_claimed_bounds TEST.
- Qed.
-
- (* Since all jobs of the arrival sequence are spawned by the task set,
- we also conclude that no job in the schedule misses its deadline. *)
- Theorem jobs_schedulable_by_fp_rta :
- forall j,
- arrives_in arr_seq j ->
- no_deadline_missed_by_job j.
- Proof.
- intros j ARRj.
- have SCHED := taskset_schedulable_by_fp_rta.
- unfold no_deadline_missed_by_task, task_misses_no_deadline in *.
- apply SCHED with (tsk := job_task j); try (by done).
- by apply H_all_jobs_from_taskset.
- Qed.
-
- End AnalysisIsSufficient.
-
- End ProvingCorrectness.
-
-End ResponseTimeIterationFP.
diff --git a/classic/analysis/uni/jitter/fp_rta_theory.v b/classic/analysis/uni/jitter/fp_rta_theory.v
deleted file mode 100644
index 3296e94cee72233b9862670e3775c577f77469dd..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/jitter/fp_rta_theory.v
+++ /dev/null
@@ -1,138 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.arrival.jitter.job prosa.classic.model.arrival.jitter.task_arrival
- prosa.classic.model.arrival.jitter.arrival_sequence prosa.classic.model.arrival.jitter.arrival_bounds.
-Require Import prosa.classic.model.schedule.uni.schedule_of_task prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.schedulability prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule
- prosa.classic.model.schedule.uni.jitter.busy_interval
- prosa.classic.model.schedule.uni.jitter.platform.
-Require Import prosa.classic.analysis.uni.jitter.workload_bound_fp.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module ResponseTimeAnalysisFP.
-
- Import ArrivalSequenceWithJitter JobWithJitter TaskArrivalWithJitter ArrivalBounds
- UniprocessorScheduleWithJitter ScheduleOfTask SporadicTaskset Priority
- ResponseTime WorkloadBoundFP Platform Schedulability BusyInterval.
-
- (* In this section, we prove that any fixed point in the RTA for jitter-aware
- uniprocessor FP scheduling is a response-time bound. *)
- Section ResponseTimeBound.
-
- Context {SporadicTask: eqType}.
- Variable task_cost: SporadicTask -> time.
- Variable task_period: SporadicTask -> time.
- Variable task_deadline: SporadicTask -> time.
- Variable task_jitter: SporadicTask -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> SporadicTask.
-
- (* Consider any task set ts... *)
- Variable ts: seq SporadicTask.
-
- (* ...with positive task periods. *)
- Hypothesis H_positive_periods: forall tsk, tsk \in ts -> task_period tsk > 0.
-
- (* Consider any job arrival sequence with consistent, duplicate-free arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ... in which jobs arrive sporadically,... *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* ...the cost of each job is bounded by the cost of its task, ... *)
- Hypothesis H_job_cost_le_task_cost:
- forall j,
- arrives_in arr_seq j ->
- job_cost j <= task_cost (job_task j).
-
- (* ...and the jitter of each job is bounded by the jitter of its task. *)
- Hypothesis H_job_jitter_le_task_jitter:
- forall j,
- arrives_in arr_seq j ->
- job_jitter j <= task_jitter (job_task j).
-
- (* Assume that all jobs in the arrival sequence come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence... *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...such that jobs do not execute before the jitter has passed nor after completion. *)
- Hypothesis H_jobs_execute_after_jitter: jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Consider any FP policy that indicates a higher-or-equal priority relation,
- where the relation is reflexive and transitive. *)
- Variable higher_eq_priority: FP_policy SporadicTask.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
-
- (* Next, assume that the schedule is a jitter-aware, work-conserving FP schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_respects_fp_policy:
- respects_FP_policy job_arrival job_cost job_jitter job_task arr_seq sched higher_eq_priority.
-
- (* Now we proceed with the analysis.
- Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: SporadicTask.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Recall the definition of response-time bound and the total workload bound W
- for higher-or-equal-priority tasks (with respect to tsk). *)
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let W := total_workload_bound_fp task_cost task_period task_jitter higher_eq_priority ts tsk.
-
- (* Let R be any positive fixed point of the response-time recurrence. *)
- Variable R: time.
- Hypothesis H_R_positive: R > 0.
- Hypothesis H_response_time_is_fixed_point: R = W R.
-
- (* Since R = W R bounds the workload of higher-or-equal priority and actual arrival
- time in any interval of length R, it follows from the busy-interval lemmas that
- R bounds the response-time of job j.
- (For more details, see model/uni/jitter/busy_interval.v and
- analysis/uni/jitter/workload_bound_fp.v.) *)
- Theorem uniprocessor_response_time_bound_fp:
- response_time_bounded_by tsk (task_jitter tsk + R).
- Proof.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job,
- valid_sporadic_taskset, is_valid_sporadic_task in *.
- rename H_response_time_is_fixed_point into FIX.
- intros j IN JOBtsk.
- set arr := actual_arrival job_arrival job_jitter.
- apply completion_monotonic with (t := arr j + R); try (by done).
- {
- rewrite -addnA leq_add2l leq_add2r.
- by rewrite -JOBtsk; apply H_job_jitter_le_task_jitter.
- }
- set prio := FP_to_JLFP job_task higher_eq_priority.
- try ( apply busy_interval_bounds_response_time with (arr_seq0 := arr_seq)
- (higher_eq_priority0 := prio); try (by done) ) ||
- apply busy_interval_bounds_response_time with (arr_seq := arr_seq)
- (higher_eq_priority := prio); try (by done).
- - by intros x; apply H_priority_is_reflexive.
- - by intros x z y; apply H_priority_is_transitive.
- intros t.
- try ( apply fp_workload_bound_holds with (task_cost0 := task_cost)
- (task_period0 := task_period) (task_jitter0 := task_jitter) (ts0 := ts); try (by done) ) ||
- apply fp_workload_bound_holds with (task_cost := task_cost)
- (task_period := task_period) (task_jitter := task_jitter) (ts := ts); try (by done).
- by rewrite JOBtsk.
- Qed.
-
- End ResponseTimeBound.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/analysis/uni/jitter/workload_bound_fp.v b/classic/analysis/uni/jitter/workload_bound_fp.v
deleted file mode 100644
index 2ce2e97cadbc9306512ee23756e9031b88d95c73..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/jitter/workload_bound_fp.v
+++ /dev/null
@@ -1,267 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.jitter.job
- prosa.classic.model.arrival.jitter.task_arrival
- prosa.classic.model.arrival.jitter.arrival_bounds.
-Require Import prosa.classic.model.schedule.uni.workload.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div.
-
-(* In this file, we define the workload bound for jitter-aware FP scheduling. *)
-Module WorkloadBoundFP.
-
- Import JobWithJitter SporadicTaskset UniprocessorScheduleWithJitter Priority Workload
- TaskArrivalWithJitter ArrivalBounds.
-
- (* First, we define a bound for the workload of a single task. *)
- Section SingleTask.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_jitter: Task -> time.
-
- (* Consider any task tsk to be scheduled in a given interval of length delta. *)
- Variable tsk: Task.
- Variable delta: time.
-
- (* Based on the maximum number of jobs of tsk that can execute in the interval, ... *)
- Definition max_jobs := div_ceil (delta + task_jitter tsk) (task_period tsk).
-
- (* ... we define the following workload bound for the task. *)
- Definition task_workload_bound_FP := max_jobs * task_cost tsk.
-
- End SingleTask.
-
- (* In this section, we define a bound for the workload all tasks with
- higher or equal priority. *)
- Section AllTasks.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_jitter: Task -> time.
-
- (* Assume any FP policy. *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* Consider a task set ts... *)
- Variable ts: list Task.
-
- (* ...and let tsk be the task to be analyzed. *)
- Variable tsk: Task.
-
- (* Let delta be the length of the interval of interest. *)
- Variable delta: time.
-
- (* Recall the definition of higher-or-equal-priority task and
- the per-task workload bound for FP scheduling (defined above). *)
- Let is_hep_task tsk_other := higher_eq_priority tsk_other tsk.
- Let W tsk_other :=
- task_workload_bound_FP task_cost task_period task_jitter tsk_other delta.
-
- (* Using the sum of individual workload bounds, we define the following bound
- for the total workload of tasks of higher-or-equal priority (with respect
- to tsk) in any interval of length delta. *)
- Definition total_workload_bound_fp :=
- \sum_(tsk_other <- ts | is_hep_task tsk_other) W tsk_other.
-
- End AllTasks.
-
- (* In this section, we prove some basic lemmas about the workload bound. *)
- Section BasicLemmas.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
- Variable task_jitter: Task -> time.
-
- (* Assume any FP policy. *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* Consider a task set ts... *)
- Variable ts: list Task.
-
- (* ...and let tsk be any task in ts. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Recall the workload bound for uniprocessor FP scheduling. *)
- Let workload_bound :=
- total_workload_bound_fp task_cost task_period task_jitter higher_eq_priority ts tsk.
-
- (* In this section we prove that the workload bound in a time window of
- length (task_cost tsk) is as large as (task_cost tsk) time units.
- (This is an important initial condition for the fixed-point iteration.) *)
- Section NoSmallerThanCost.
-
- (* Assume that the priority order is reflexive... *)
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
-
- (* ...and that the cost and period of task tsk are positive. *)
- Hypothesis H_cost_positive: task_cost tsk > 0.
- Hypothesis H_period_positive: task_period tsk > 0.
-
- (* Then, we prove that the workload bound in an interval of length (task_cost tsk)
- cannot be smaller than (task_cost tsk). *)
- Lemma total_workload_bound_fp_ge_cost:
- workload_bound (task_cost tsk) >= task_cost tsk.
- Proof.
- rename H_priority_is_reflexive into REFL.
- unfold workload_bound, total_workload_bound_fp.
- rewrite big_mkcond (big_rem tsk) /=; last by done.
- rewrite REFL /task_workload_bound_FP.
- apply leq_trans with (n := max_jobs task_period task_jitter
- tsk (task_cost tsk) * task_cost tsk);
- last by apply leq_addr.
- rewrite -{1}[task_cost tsk]mul1n leq_mul2r; apply/orP; right.
- apply ceil_neq0; last by done.
- by apply leq_trans with (n := task_cost tsk); last by apply leq_addr.
- Qed.
-
- End NoSmallerThanCost.
-
- (* In this section, we prove that the workload bound is monotonically non-decreasing. *)
- Section NonDecreasing.
-
- (* Assume that the period of every task in the task set is positive. *)
- Hypothesis H_period_positive:
- forall tsk,
- tsk \in ts ->
- task_period tsk > 0.
-
- (* Then, the workload bound is a monotonically non-decreasing function.
- (This is an important property for the fixed-point iteration.) *)
- Lemma total_workload_bound_fp_non_decreasing:
- forall delta1 delta2,
- delta1 <= delta2 ->
- workload_bound delta1 <= workload_bound delta2.
- Proof.
- unfold workload_bound, total_workload_bound_fp; intros d1 d2 LE.
- apply leq_sum_seq; intros tsk' IN HP.
- rewrite leq_mul2r; apply/orP; right.
- by apply leq_divceil2r; [by apply H_period_positive | by rewrite leq_add2r].
- Qed.
-
- End NonDecreasing.
-
- End BasicLemmas.
-
- (* In this section, we prove that any fixed point R = workload_bound R
- is indeed a workload bound for any interval of length R. *)
- Section ProofWorkloadBound.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_jitter: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Let ts be any task set... *)
- Variable ts: seq Task.
-
- (* ...with positive task periods. *)
- Hypothesis H_positive_periods:
- forall tsk, tsk \in ts -> task_period tsk > 0.
-
- (* Consider any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* First, let's define some local names for clarity. *)
- Let actual_arrivals := actual_arrivals_between job_arrival job_jitter arr_seq.
-
- (* Next, assume that all jobs come from the task set, ...*)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...the cost of each job is bounded by the cost of its task, ... *)
- Hypothesis H_job_cost_le_task_cost:
- forall j,
- arrives_in arr_seq j ->
- job_cost j <= task_cost (job_task j).
-
- (* ...and the jitter of each job is bounded by the jitter of its task. *)
- Hypothesis H_job_jitter_le_task_jitter:
- forall j,
- arrives_in arr_seq j ->
- job_jitter j <= task_jitter (job_task j).
-
- (* Assume that jobs arrived sporadically. *)
- Hypothesis H_sporadic_arrivals:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Then, let tsk be any task in ts. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* For a given fixed-priority policy, ... *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* ...we recall the definitions of higher-or-equal-priority workload and the workload bound. *)
- Let actual_hp_workload t1 t2 :=
- workload_of_higher_or_equal_priority_tasks job_cost job_task (actual_arrivals t1 t2)
- higher_eq_priority tsk.
- Let workload_bound :=
- total_workload_bound_fp task_cost task_period task_jitter higher_eq_priority ts tsk.
-
- (* Next, consider any R that is a fixed point of the following equation,
- i.e., the claimed workload bound is equal to the interval length. *)
- Variable R: time.
- Hypothesis H_fixed_point: R = workload_bound R.
-
- (* Then, we prove that R bounds the workload of jobs of higher-or-equal-priority tasks
- with actual arrival time (including jitter) in [t, t + R). *)
- Lemma fp_workload_bound_holds:
- forall t,
- actual_hp_workload t (t + R) <= R.
- Proof.
- rename H_fixed_point into FIX, H_all_jobs_from_taskset into FROMTS,
- H_arrival_times_are_consistent into CONS, H_arrival_sequence_is_a_set into SET.
- unfold actual_hp_workload, workload_of_higher_or_equal_priority_tasks,
- valid_sporadic_job_with_jitter, valid_sporadic_job, valid_realtime_job,
- valid_sporadic_taskset, is_valid_sporadic_task in *.
- have BOUND := sporadic_task_with_jitter_arrival_bound task_period task_jitter job_arrival
- job_jitter job_task arr_seq CONS SET.
- feed_n 2 BOUND; (try by done).
- intro t.
- rewrite {2}FIX /workload_bound /total_workload_bound_fp.
- set l := actual_arrivals_between job_arrival job_jitter arr_seq t (t + R).
- set hep := higher_eq_priority.
- apply leq_trans with (n := \sum_(tsk' <- ts | hep tsk' tsk)
- (\sum_(j0 <- l | job_task j0 == tsk') job_cost j0)).
- {
- have EXCHANGE := exchange_big_dep (fun x => hep (job_task x) tsk).
- rewrite EXCHANGE /=; last by move => tsk0 j0 HEP /eqP JOB0; rewrite JOB0.
- rewrite /workload_of_jobs -/l big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => j0 /andP [IN0 HP0].
- rewrite big_mkcond (big_rem (job_task j0)) /=;
- first by rewrite HP0 andTb eq_refl; apply leq_addr.
- rewrite mem_filter in IN0; move: IN0 => /andP [_ ARR0].
- by apply in_arrivals_implies_arrived in ARR0; apply FROMTS.
- }
- apply leq_sum_seq; intros tsk0 IN0 HP0.
- apply leq_trans with (n := num_actual_arrivals_of_task job_arrival job_jitter job_task arr_seq
- tsk0 t (t + R) * task_cost tsk0).
- {
- rewrite /num_actual_arrivals_of_task -sum1_size big_distrl /= big_filter.
- apply leq_sum_seq; move => j1 IN1 /eqP EQ.
- rewrite -EQ mul1n; apply H_job_cost_le_task_cost.
- rewrite mem_filter in IN1; move: IN1 => /andP [_ ARR1].
- by apply in_arrivals_implies_arrived in ARR1.
- }
- rewrite /task_workload_bound_FP leq_mul2r; apply/orP; right.
- feed (BOUND t (t + R) tsk0); first by apply H_positive_periods.
- by rewrite -addnA addKn in BOUND.
- Qed.
-
- End ProofWorkloadBound.
-
-End WorkloadBoundFP.
\ No newline at end of file
diff --git a/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule.v b/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule.v
deleted file mode 100644
index 6b68c9830a06cfa89f23ef3551c1b4173771470c..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule.v
+++ /dev/null
@@ -1,162 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq.
-
-(* In this file, we formalize a reduction from a suspension-aware schedule
- to a jitter-aware schedule. *)
-Module JitterScheduleConstruction.
-
- Import UniprocessorScheduleWithJitter Suspension Priority ScheduleConstruction.
-
- Section ConstructingJitterSchedule.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (** Basic Setup & Setting*)
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume any FP policy and the corresponding job-level priority relation. *)
- Variable higher_eq_priority: FP_policy Task.
- Let job_higher_eq_priority := FP_to_JLFP job_task higher_eq_priority.
-
- (* Consider the original job and task costs from the suspension-aware schedule... *)
- Variable job_cost: Job -> time.
- Variable task_cost: Task -> time.
-
- (* ...and assume that jobs have associated suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (* Next, consider any suspension-aware schedule of the arrival sequence. *)
- Variable sched_susp: schedule Job.
-
- (** Definition of the Reduction *)
-
- (* Now we proceed with the reduction. Let j be the job to be analyzed. *)
- Variable j: Job.
-
- (* For simplicity, we give some local names for the parameters of this job... *)
- Let arr_j := job_arrival j.
- Let task_of_j := job_task j.
-
- (* ...and recall the definition of other higher-or-equal-priority tasks. *)
- Let other_hep_task tsk_other :=
- higher_eq_priority tsk_other task_of_j && (tsk_other != task_of_j).
-
- (* Moreover, assume that jobs from higher-priority tasks are associated a response-time bound R. *)
- Variable R: Job -> time.
-
- (* Now we are going to redefine the job parameters for the new schedule. *)
- Section DefiningJobParameters.
-
- (* First, we inflate job costs with suspension time. *)
- Section CostInflation.
-
- (* Recall the total suspension time of a job in the original schedule. *)
- Let job_total_suspension :=
- total_suspension job_cost job_suspension_duration.
-
- (* We inflate job costs as follows.
- (a) The cost of job j is inflated with its total suspension time.
- (b) The cost of all other jobs remains unchanged. *)
- Definition inflated_job_cost (any_j: Job) :=
- if any_j == j then
- job_cost any_j + job_total_suspension any_j
- else
- job_cost any_j.
-
- End CostInflation.
-
- (* Next, we show how to set the job jitter in the new schedule
- to compensate for the suspension times. *)
- Section ConvertingSuspensionToJitter.
-
- (* Let any_j be any job in the new schedule. *)
- Variable any_j: Job.
-
- (* First, recall the distance between any_j and job j that is to be analyzed.
- Note that since we use natural numbers, this distance saturates to 0 if
- any_j arrives later than j. *)
- Let distance_to_j := job_arrival j - job_arrival any_j.
-
- (* Then, we define the actual job jitter in the new schedule as follows.
- a) For every job of higher-priority tasks (with respect to job j), the jitter is set to
- the minimum between the distance to j and the term (R any_j - job_cost any_j).
- b) The remaining jobs have no jitter.
-
- The intuition behind this formula is that any_j is to be released as close to job j as
- possible, while not "trespassing" the response-time bound (R any_j) from sched_susp,
- which is only assumed to be valid for higher-priority tasks. *)
- Definition job_jitter :=
- if other_hep_task (job_task any_j) then
- minn distance_to_j (R any_j - job_cost any_j)
- else 0.
-
- End ConvertingSuspensionToJitter.
-
- End DefiningJobParameters.
-
- (** Schedule Construction *)
-
- (* Next we generate a jitter-aware schedule using the job parameters above.
- For that, we always pick the highest-priority pending job (after jitter) in
- the new schedule. However, if there are multiple highest-priority jobs, we
- try not to schedule job j in order to maximize interference. *)
- Section ScheduleConstruction.
-
- (* First, we define the schedule construction function. *)
- Section ConstructionStep.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job.
- Variable t: time.
-
- (* For simplicity, let's define some local names. *)
- Let job_is_pending := pending job_arrival inflated_job_cost job_jitter sched_prefix.
- Let actual_job_arrivals_up_to := actual_arrivals_up_to job_arrival job_jitter arr_seq.
- Let lower_priority j1 j2 := ~~ job_higher_eq_priority j1 j2.
-
- (* Next, consider the list of pending jobs at time t that are different from j
- and whose jitter has passed, in the new schedule. *)
- Definition pending_jobs_other_than_j :=
- [seq j_other <- actual_job_arrivals_up_to t | job_is_pending j_other t & j_other != j].
-
- (* From the list of pending jobs, we can return one of the (possibly many)
- highest-priority jobs, or None, in case there are no pending jobs. *)
- Definition highest_priority_job_other_than_j :=
- seq_min job_higher_eq_priority pending_jobs_other_than_j.
-
- (* Then, we construct the new schedule at time t as follows.
- a) If job j is pending and the highest-priority job (other than j) has
- lower priority than j, we have to schedule j.
- b) Else, if job j is not pending, we pick one of the highest priority pending jobs. *)
- Definition build_schedule : option Job :=
- if job_is_pending j t then
- if highest_priority_job_other_than_j is Some j_hp then
- if lower_priority j_hp j then
- Some j
- else Some j_hp
- else Some j
- else highest_priority_job_other_than_j.
-
- End ConstructionStep.
-
- (* Finally, starting from the empty schedule, ...*)
- Let empty_schedule : schedule Job := fun t => None.
-
- (* ...we use the recursive definition above to construct the jitter-aware schedule. *)
- Definition sched_jitter := build_schedule_from_prefixes build_schedule empty_schedule.
-
- End ScheduleConstruction.
-
- End ConstructingJitterSchedule.
-
-End JitterScheduleConstruction.
\ No newline at end of file
diff --git a/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_properties.v b/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_properties.v
deleted file mode 100644
index c57c49b76615fa61bab06b2f0c28ec9711ef7d5d..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_properties.v
+++ /dev/null
@@ -1,458 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task
- prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.arrival.jitter.job.
-Require Import prosa.classic.model.schedule.uni.schedulability prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule
- prosa.classic.model.schedule.uni.jitter.valid_schedule
- prosa.classic.model.schedule.uni.jitter.platform.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.valid_schedule
- prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop path.
-
-(* In this file, we prove several properties about the constructed jitter-aware schedule. *)
-Module JitterScheduleProperties.
-
- Import Job SporadicTaskset Suspension Priority SuspensionIntervals Workload Service
- UniprocessorScheduleWithJitter Schedulability ResponseTime
- ScheduleConstruction ValidSuspensionAwareSchedule ValidJitterAwareSchedule.
-
- Module basic := schedule.UniprocessorSchedule.
- Module susp := ScheduleWithSuspensions.
- Module jitter_aware := Platform.
- Module susp_aware := PlatformWithSuspensions.
- Module job_jitter := JobWithJitter.
- Module reduction := JitterScheduleConstruction.
-
- Section ProvingScheduleProperties.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (** Basic Setup & Setting *)
-
- (* Let ts be any task set to be analyzed. *)
- Variable ts: seq Task.
-
- (* Next, consider any consistent job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
-
- (* ...whose jobs come from task set ts. *)
- Hypothesis H_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Consider any FP policy that is reflexive, transitive and total. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: FP_is_total_over_task_set higher_eq_priority ts.
- Let job_higher_eq_priority := FP_to_JLDP job_task higher_eq_priority.
-
- (* Consider the original job and task costs from the suspension-aware schedule. *)
- Variable job_cost: Job -> time.
- Variable task_cost: Task -> time.
-
- (* Assume that jobs have associated suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (* Next, consider any valid suspension-aware schedule of this arrival sequence.
- (Note: see prosa.classic.model.schedule.uni.susp.valid_schedule.v for details) *)
- Variable sched_susp: schedule Job.
- Hypothesis H_valid_schedule:
- valid_suspension_aware_schedule job_arrival arr_seq job_higher_eq_priority
- job_suspension_duration job_cost sched_susp.
-
- (* Finally, recall the definition of a job response-time bound in sched_susp. *)
- Let job_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_job job_arrival job_cost sched_susp.
-
- (** Analysis Setup *)
-
- (* Now we proceed with the reduction. Let j be the job to be analyzed. *)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
-
- (* For simplicity, let's give some local names for the parameters of this job... *)
- Let arr_j := job_arrival j.
- Let task_of_j := job_task j.
-
- (* ...and recall the definition of other higher-or-equal-priority tasks. *)
- Let other_hep_task tsk_other :=
- higher_eq_priority tsk_other task_of_j && (tsk_other != task_of_j).
-
- (* Moreover, assume that each job is associated a response-time bound R. *)
- Variable R: Job -> time.
-
- (** Instantiation of the Reduction *)
-
- (* Next, recall the jitter-aware schedule from the reduction. *)
- Let sched_jitter := reduction.sched_jitter job_arrival job_task arr_seq higher_eq_priority
- job_cost job_suspension_duration j R.
- Let inflated_job_cost := reduction.inflated_job_cost job_cost job_suspension_duration j.
- Let job_jitter := reduction.job_jitter job_arrival job_task higher_eq_priority job_cost j R.
-
- (** Schedule Construction *)
-
- (* In this section, we prove that the jitter-aware schedule uses its construction function. *)
- Section PropertiesOfScheduleConstruction.
-
- Let build_schedule := reduction.build_schedule job_arrival job_task arr_seq higher_eq_priority
- job_cost job_suspension_duration j R.
-
- (* Then, by showing that the construction function depends only on the previous service, ... *)
- Lemma sched_jitter_depends_only_on_service:
- forall sched1 sched2 t,
- (forall j, service sched1 j t = service sched2 j t) ->
- build_schedule sched1 t = build_schedule sched2 t.
- Proof.
- intros sched1 sched2 t ALL.
- rewrite /build_schedule /reduction.build_schedule /reduction.highest_priority_job_other_than_j.
- set pend1 := pending _ _ _ sched1.
- set pend2 := pending _ _ _ sched2.
- have SAME': forall j, pend1 j t = pend2 j t.
- {
- intros j0; rewrite /pend1 /pend2 /pending.
- case: jitter_has_passed => //=.
- by rewrite /completed_by ALL.
- }
- set pendjobs := reduction.pending_jobs_other_than_j _ _ _ _ _ _ _ _.
- have SAME: pendjobs sched1 t = pendjobs sched2 t.
- {
- apply eq_in_filter; intros j0 IN.
- rewrite /pending; case: jitter_has_passed => //=.
- by rewrite /completed_by ALL.
- }
- rewrite SAME SAME'; by done.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary sched_jitter_uses_construction_function:
- forall t,
- sched_jitter t = build_schedule sched_jitter t.
- Proof.
- by ins; apply service_dependent_schedule_construction, sched_jitter_depends_only_on_service.
- Qed.
-
- End PropertiesOfScheduleConstruction.
-
- (** Valid Schedule Properties *)
-
- (* In this section, we prove that sched_jitter is a valid jitter-aware schedule. *)
- Section ScheduleIsValid.
-
- (* For simplicity, let's recall some definitions from the schedule construction. *)
- Let pending_jobs_other_than_j :=
- reduction.pending_jobs_other_than_j job_arrival job_task arr_seq higher_eq_priority
- job_cost job_suspension_duration j R sched_jitter.
- Let hp_job_other_than_j :=
- reduction.highest_priority_job_other_than_j job_arrival job_task arr_seq higher_eq_priority
- job_cost job_suspension_duration j R sched_jitter.
-
- (* Also recall the definition of a valid jitter-aware schedule. *)
- Let is_valid_jitter_aware_schedule :=
- valid_jitter_aware_schedule job_arrival arr_seq job_higher_eq_priority
- inflated_job_cost job_jitter.
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma sched_jitter_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched_jitter arr_seq.
- Proof.
- move: H_valid_schedule => [FROM _].
- move => j0 t /eqP SCHED.
- rewrite sched_jitter_uses_construction_function /reduction.build_schedule
- -/hp_job_other_than_j in SCHED.
- set pending_in_jitter := pending _ _ _ _ in SCHED.
- destruct (hp_job_other_than_j t) as [j_hp|] eqn:HP; last first.
- {
- case PENDj: (pending_in_jitter j t); rewrite PENDj in SCHED; last by done.
- by case: SCHED => SAME; subst j0.
- }
- {
- have IN: arrives_in arr_seq j_hp.
- {
- have IN: j_hp \in pending_jobs_other_than_j t.
- {
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in HP.
- by apply seq_min_in_seq in HP.
- }
- rewrite mem_filter in IN; move: IN => /andP [/andP _ IN].
- rewrite /actual_arrivals_up_to in IN.
- by apply in_actual_arrivals_between_implies_arrived in IN.
- }
- case PENDj: (pending_in_jitter j t); rewrite PENDj in SCHED;
- first by move: SCHED; case: (~~ _); case => SAME; subst.
- by case: SCHED => SAME; subst j0.
- }
- Qed.
-
- (* Next, we show that jobs do not execute before their arrival times... *)
- Lemma sched_jitter_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched_jitter.
- Proof.
- move => j0 t /eqP SCHED.
- rewrite sched_jitter_uses_construction_function /reduction.build_schedule
- -/hp_job_other_than_j in SCHED.
- set pending_in_jitter := pending _ _ _ _ in SCHED.
- destruct (hp_job_other_than_j t) as [j_hp|] eqn:HP; last first.
- {
- case PENDj: (pending_in_jitter j t); rewrite PENDj in SCHED; last by done.
- by case: SCHED => SAME; subst j0; move: PENDj => /andP [ARR _].
- }
- {
- have ARR: jitter_has_passed job_arrival job_jitter j_hp t.
- {
- have IN: j_hp \in pending_jobs_other_than_j t.
- {
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in HP.
- by apply seq_min_in_seq in HP.
- }
- by rewrite mem_filter in IN; move: IN => /andP [/andP [/andP [ARR _] _] _].
- }
- case PENDj: (pending_in_jitter j t); rewrite PENDj in SCHED;
- last by case: SCHED => SAME; subst j0.
- move: SCHED; case: (~~ _); case => SAME; subst; last by done.
- by move: PENDj => /andP [ARRj _].
- }
- Qed.
-
- (* ...nor longer than their execution costs. *)
- Lemma sched_jitter_completed_jobs_dont_execute:
- completed_jobs_dont_execute inflated_job_cost sched_jitter.
- Proof.
- intros j0 t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[inflated_job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite sched_jitter_uses_construction_function /reduction.build_schedule
- -/hp_job_other_than_j.
- destruct (hp_job_other_than_j t) as [j_hp|] eqn:HP; last first.
- { case PENDj: pending; last by done.
- apply/eqP; case => SAME; subst j0; move: PENDj => /andP [_ NOTCOMPj].
- by rewrite /completed_by EQ leqnn in NOTCOMPj.
- }
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in HP.
- apply seq_min_in_seq in HP; rewrite mem_filter /pending /completed_by in HP.
- move: HP => /andP [/andP [/andP [_ NOTCOMPhp] _] _].
- case PENDj: pending.
- {
- move: PENDj => /andP [_ NOTCOMPj].
- case: (~~ higher_eq_priority _ _); apply/eqP; case => SAME; subst j0;
- first by rewrite /completed_by EQ leqnn in NOTCOMPj.
- by rewrite EQ leqnn in NOTCOMPhp.
- }
- {
- apply/eqP; case => SAME; subst j0.
- by rewrite EQ leqnn in NOTCOMPhp.
- }
- Qed.
-
- (* In addition, we prove that the schedule is (jitter-aware) work-conserving... *)
- Lemma sched_jitter_work_conserving:
- jitter_aware.work_conserving job_arrival inflated_job_cost job_jitter arr_seq sched_jitter.
- Proof.
- intros j0 t IN BACK.
- move: BACK => /andP [PEND NOTSCHED].
- rewrite /scheduled_at sched_jitter_uses_construction_function
- /reduction.build_schedule -/hp_job_other_than_j in NOTSCHED *.
- destruct (hp_job_other_than_j t) as [j_hp|] eqn:HP.
- {
- case PENDj: pending; rewrite PENDj in NOTSCHED; last by exists j_hp.
- by case: (~~ _); [by exists j | by exists j_hp].
- }
- {
- case PENDj: pending; rewrite PENDj in NOTSCHED; first by exists j.
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in HP.
- case: (boolP (j0 == j)) => [EQ | NEQ];
- first by move: EQ => /eqP EQ; subst j0; rewrite PEND in PENDj.
- have IN0: j0 \in pending_jobs_other_than_j t.
- {
- rewrite mem_filter PEND NEQ /=.
- apply arrived_between_implies_in_actual_arrivals; try (by done).
- by move: PEND => /andP [ARR _].
- }
- move: HP => /eqP HP; rewrite -[_ == _]negbK in HP.
- exfalso; move: HP => /negP BUG; apply: BUG.
- by apply seq_min_exists with (x := j0).
- }
- Qed.
-
- (* ...and respects task priorities. *)
- Lemma sched_jitter_respects_policy:
- jitter_aware.respects_FP_policy job_arrival inflated_job_cost job_jitter
- job_task arr_seq sched_jitter higher_eq_priority.
- Proof.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL,
- H_priority_is_reflexive into REFL, H_jobs_from_taskset into FROMTS.
- move => j1 j2 t IN BACK /eqP SCHED.
- move: BACK => /andP [PEND NOTSCHED].
- rewrite /scheduled_at sched_jitter_uses_construction_function /reduction.build_schedule
- -/hp_job_other_than_j in SCHED NOTSCHED *.
- set pend := pending _ _ _ _ in SCHED NOTSCHED.
- have ALL: forall j_hi j_lo, hp_job_other_than_j t = Some j_hi ->
- j_lo \in pending_jobs_other_than_j t ->
- higher_eq_priority (job_task j_hi) (job_task j_lo).
- {
- intros j_hi j_lo SOME INlo; move: SCHED => MIN.
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in SOME.
- apply seq_min_computes_min with (y := j_lo) in SOME; try (by done);
- first by intros x y z; apply TRANS.
- intros x y; rewrite mem_filter [y \in _]mem_filter /actual_arrivals_up_to.
- move => /andP [_ INx] /andP [_ INy].
- rewrite /FP_is_total_over_task_set /total_over_list in TOTAL.
- by apply/orP; apply TOTAL; apply FROMTS;
- eapply in_actual_arrivals_between_implies_arrived; eauto 1.
- }
- case PENDj: (pend j t); rewrite PENDj in SCHED NOTSCHED.
- {
- destruct (hp_job_other_than_j t) as [j_hp|] eqn:HP.
- {
- rewrite /FP_to_JLFP /= in SCHED NOTSCHED.
- case LP: (~~ higher_eq_priority (job_task j_hp) (job_task j));
- rewrite LP in SCHED NOTSCHED.
- {
- case: SCHED => SAME; subst j2.
- case: (boolP (j1 == j)) => [EQ | NEQ]; first by move: EQ => /eqP EQ; subst j1.
- apply (TRANS (job_task j_hp)).
- {
- have INhp: arrives_in arr_seq j_hp.
- {
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in HP.
- apply seq_min_in_seq in HP.
- rewrite mem_filter in HP; move: HP => /andP [_ INhp].
- rewrite /actual_arrivals_up_to in INhp.
- by apply in_actual_arrivals_before_implies_arrived in INhp.
- }
- by exploit (TOTAL (job_task j) (job_task j_hp)); try (by apply FROMTS);
- move => [HPj | HPhp]; last by rewrite HPhp in LP.
- }
- apply ALL; try (by done).
- move: PEND => /andP [ARR NOTCOMP].
- rewrite mem_filter /pending ARR NOTCOMP 2!andTb.
- by apply/andP; split; last by apply arrived_between_implies_in_actual_arrivals.
- }
- {
- case: SCHED => SAME; subst j2.
- case: (boolP (j1 == j)) => [EQ | NEQ];
- first by move: EQ => /eqP EQ; subst j1; apply negbT in LP; rewrite negbK in LP.
- apply ALL; try (by done).
- move: PEND => /andP [ARR NOTCOMP].
- rewrite mem_filter /pending ARR NOTCOMP 2!andTb.
- by apply/andP; split; last by apply arrived_between_implies_in_actual_arrivals.
- }
- }
- {
- case: SCHED => SAME; subst j2.
- case: (boolP (j1 == j)) => [EQ | NEQ]; first by move: EQ => /eqP EQ; subst j1.
- suff NOTNONE: hp_job_other_than_j t != None by rewrite HP in NOTNONE.
- apply seq_min_exists with (x := j1).
- move: PEND => /andP [ARR NOTCOMP].
- rewrite mem_filter /pending ARR NOTCOMP 2!andTb.
- by apply/andP; split; last by apply arrived_between_implies_in_actual_arrivals.
- }
- }
- {
- case: (boolP (j1 == j)) => [EQ | NEQ];
- first by move: EQ => /eqP EQ; subst j1; rewrite -/pend PENDj in PEND.
- apply ALL; first by done.
- move: PEND => /andP [ARR NOTCOMP].
- rewrite mem_filter /pending ARR NOTCOMP 2!andTb.
- by apply/andP; split; last by apply arrived_between_implies_in_actual_arrivals.
- }
- Qed.
-
- (* From the properties above, we conclude that the generated schedule is valid. *)
- Corollary sched_jitter_is_valid: is_valid_jitter_aware_schedule sched_jitter.
- Proof.
- repeat split.
- - by apply sched_jitter_jobs_come_from_arrival_sequence.
- - by apply sched_jitter_jobs_execute_after_jitter.
- - by apply sched_jitter_completed_jobs_dont_execute.
- - by apply sched_jitter_work_conserving.
- - by apply sched_jitter_respects_policy.
- Qed.
-
- (* Finally, we show that the generated schedule does not pick job j if
- there are other pending higher-or-equal-priority jobs. *)
- Lemma sched_jitter_does_not_pick_j:
- forall j_hp t,
- arrives_in arr_seq j_hp ->
- j_hp != j ->
- pending job_arrival inflated_job_cost job_jitter sched_jitter j_hp t ->
- higher_eq_priority (job_task j_hp) (job_task j) ->
- ~~ scheduled_at sched_jitter j t.
- Proof.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL,
- H_jobs_from_taskset into FROMTS.
- move => j_hp t ARRinhp NEQ PENDhp HP; apply/negP; move => /eqP SCHEDj.
- rewrite sched_jitter_uses_construction_function /reduction.build_schedule
- -/hp_job_other_than_j in SCHEDj.
- set pend := pending _ _ _ _ in SCHEDj.
- have INhp: j_hp \in pending_jobs_other_than_j t.
- {
- rewrite mem_filter PENDhp NEQ /=.
- apply arrived_between_implies_in_actual_arrivals; try (by done).
- rewrite /actual_arrival_between /=.
- by move: PENDhp => /andP [ARRhp _].
- }
- case PENDj: (pend j t); rewrite PENDj in SCHEDj.
- {
- destruct (hp_job_other_than_j t) as [j_hp'|] eqn:HP'.
- {
- have ALL: forall j_lo, j_lo \in pending_jobs_other_than_j t ->
- higher_eq_priority (job_task j_hp') (job_task j_lo).
- {
- intros j_lo INlo; move: HP' => MIN.
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in MIN.
- apply seq_min_computes_min with (y := j_lo) in MIN; try (by done);
- first by intros x y z; apply TRANS.
- intros x y; rewrite mem_filter [y \in _]mem_filter /actual_arrivals_up_to.
- move => /andP [_ INx] /andP [_ INy].
- by apply/orP; apply TOTAL; apply FROMTS;
- eapply in_actual_arrivals_between_implies_arrived; eauto 1.
- }
- case LP: (~~ higher_eq_priority (job_task j_hp') (job_task j)); rewrite LP in SCHEDj.
- {
- move: LP => /negP LP; apply: LP.
- by apply (TRANS (job_task j_hp)); first by apply ALL.
- }
- {
- case: SCHEDj => SAME; subst j_hp'.
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in HP'.
- by apply seq_min_in_seq in HP'; rewrite mem_filter eq_refl andbF /= in HP'.
- }
- }
- {
- suff NOTNONE: hp_job_other_than_j t != None by rewrite HP' in NOTNONE.
- by apply seq_min_exists with (x := j_hp).
- }
- }
- {
- rewrite /hp_job_other_than_j /reduction.highest_priority_job_other_than_j in SCHEDj.
- apply seq_min_in_seq in SCHEDj.
- by rewrite mem_filter eq_refl andbF in SCHEDj.
- }
- Qed.
-
- End ScheduleIsValid.
-
- End ProvingScheduleProperties.
-
-End JitterScheduleProperties.
\ No newline at end of file
diff --git a/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_service.v b/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_service.v
deleted file mode 100644
index cc0f616cc9de6eda745c75e5f2485343ae637084..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_service.v
+++ /dev/null
@@ -1,1269 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.arrival.jitter.job.
-Require Import prosa.classic.model.schedule.uni.schedulability prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule
- prosa.classic.model.schedule.uni.jitter.platform.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.platform
- prosa.classic.model.schedule.uni.susp.valid_schedule.
-Require Import prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule
- prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule_properties.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop path.
-
-(* In this file, we compare the service received by the analyzed job j after
- reducing the suspension-aware schedule to a jitter-aware schedule. *)
-Module JitterScheduleService.
-
- Import Job SporadicTaskset Suspension Priority SuspensionIntervals Workload Service
- UniprocessorScheduleWithJitter Schedulability ResponseTime TaskArrival
- ScheduleConstruction ValidSuspensionAwareSchedule.
-
- Module basic := schedule.UniprocessorSchedule.
- Module susp := ScheduleWithSuspensions.
- Module jitter_aware := Platform.
- Module susp_aware := PlatformWithSuspensions.
- Module job_jitter := JobWithJitter.
- Module reduction := JitterScheduleConstruction.
- Module reduction_prop := JitterScheduleProperties.
-
- (* We begin by providing the initial setup and definitions in Sections 1 to 5.
- The main results are proven later in Sections 6-(A) to 6-(C). *)
- Section ProvingScheduleProperties.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> Task.
-
- (** 1) Basic Setup & Setting *)
-
- (* Let ts be any task set. *)
- Variable ts: seq Task.
-
- (* Next, consider any consistent, duplicate-free job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ...where all jobs come from task set ts. *)
- Hypothesis H_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Since we consider real-time tasks, assume that job deadlines are equal to task deadlines. *)
- Hypothesis H_job_deadlines_equal_task_deadlines:
- forall j, arrives_in arr_seq j -> job_deadline j = task_deadline (job_task j).
-
- (* Also assume that tasks have constrained deadlines and that jobs arrive sporadically.
- (Note: this is required to bound the interference of previous jobs of the analyzed task.) *)
- Hypothesis H_constrained_deadlines:
- constrained_deadline_model task_period task_deadline ts.
- Hypothesis H_sporadic_arrivals:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider any FP policy that is reflexive, transitive and total. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: FP_is_total_over_task_set higher_eq_priority ts.
- Let job_higher_eq_priority := FP_to_JLDP job_task higher_eq_priority.
-
- (* Assume that jobs have associated suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (* Next, consider any valid suspension-aware schedule of this arrival sequence.
- (Note: see definition in prosa.classic.model.schedule.uni.susp.valid_schedule.v) *)
- Variable sched_susp: schedule Job.
- Hypothesis H_valid_schedule:
- valid_suspension_aware_schedule job_arrival arr_seq job_higher_eq_priority
- job_suspension_duration job_cost sched_susp.
-
- (* Finally, recall the notion of job response-time bound and deadline miss in sched_susp. *)
- Let job_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_job job_arrival job_cost sched_susp.
- Let job_misses_no_deadline_in_sched_susp :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched_susp.
-
- (** 2) Analysis Setup *)
-
- (* Recall that we are going to analyze the response time of some job after
- applying the reduction to the jitter-aware schedule as defined in
- prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule. *)
-
- (* Let j be the job to be analyzed. *)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
- Let arr_j := job_arrival j.
-
- (* Let R_j be any value that we want to prove to be a response-time bound for job j in sched_susp.
- Note that in the context of this proof, R_j also delimits the length of the schedules
- that we are going to analyze, i.e., we only care about the interval [0, arr_j + R_j). *)
- Variable R_j: time.
-
- (* Next, recall the definition of higher-or-equal-priority tasks (other than j's task). *)
- Let other_hep_task tsk_other :=
- higher_eq_priority tsk_other (job_task j) && (tsk_other != job_task j).
-
- (* Assume that each job of a higher-or-equal-priority task (other than j's task) is
- associated a response-time bound R_hp.
- (Note: this follows from analyzing the higher-priority tasks in a previous step.) *)
- Variable R_hp: Job -> time.
- Hypothesis H_bounded_response_time_of_hp_jobs:
- forall j_hp,
- arrives_in arr_seq j_hp ->
- other_hep_task (job_task j_hp) ->
- job_response_time_in_sched_susp_bounded_by j_hp (R_hp j_hp).
-
- (* Also assume that all the previous jobs of same task as j do not miss any
- deadlines in sched_susp.
- (Note: this is an induction hypothesis that is easily obtained when analyzing the
- sequence of jobs of the same task.) *)
- Hypothesis H_no_deadline_misses_for_previous_jobs:
- forall j0,
- arrives_in arr_seq j0 ->
- job_arrival j0 < job_arrival j ->
- job_task j0 = job_task j ->
- job_misses_no_deadline_in_sched_susp j0.
-
- (** 3) Instantiation of the Reduction *)
-
- (* Having stated all the properties of the suspension-aware schedule, now we recall
- the construction of the jitter-aware schedule and the corresponding job parameters. *)
- Let sched_jitter := reduction.sched_jitter job_arrival job_task arr_seq higher_eq_priority
- job_cost job_suspension_duration j R_hp.
- Let inflated_job_cost := reduction.inflated_job_cost job_cost job_suspension_duration j.
- Let job_jitter := reduction.job_jitter job_arrival job_task higher_eq_priority job_cost j R_hp.
-
- (* By the end of this file, we are going to show that if job j completes by time (arr_j + R_j)
- in sched_jitter, then it also completes by time (arr_j + R_j) in sched_susp.
- The argument is based on the fact that the service of higher-or-equal-priority jobs is moved
- from the interval [0, arr_j) to the interval [arr_j, arr_j + R_j), when we introduce jitter.
-
- The proofs are structured in the three final sections. In Section 6-A, we prove that
- sched_jitter provides provides less service for higher-or-equal-priority jobs during [0, arr_j).
- In Section B, we prove that sched_jitter provides more service for higher-or-equal-priority
- jobs during [arr_j, arr_j + R). In Section 6-C, we conclude with the main theorem that compares
- the response time of job j in both schedules. *)
-
- (** 4) Setup for Next Sections *)
-
- (* For simplicity, let's define some local names... *)
- Let actual_job_arrival := actual_arrival job_arrival job_jitter.
- Let job_arrived_before := arrived_before job_arrival.
- Let job_has_arrived := has_arrived job_arrival.
- Let job_has_actually_arrived := jitter_has_passed job_arrival job_jitter.
- Let job_completed_in_sched_jitter := completed_by inflated_job_cost sched_jitter.
-
- (* ...and also recall definitions related to the suspension-aware schedule. *)
- Let job_suspended_at :=
- suspended_at job_arrival job_cost job_suspension_duration sched_susp.
- Let job_cumulative_suspension :=
- cumulative_suspension_during job_arrival job_cost job_suspension_duration sched_susp.
- Let job_completed_in_sched_susp := completed_by job_cost sched_susp.
- Let backlogged_in_sched_susp := susp.backlogged job_arrival job_cost
- job_suspension_duration sched_susp.
-
- (* Since we'll have to reason about sets of arriving jobs with and without jitter,
- let's use simpler names for those as well. *)
- Let arrivals := jobs_arrived_between arr_seq.
- Let actual_arrivals := actual_arrivals_between job_arrival job_jitter arr_seq.
-
- (* Because we are dealing with a bounded scheduling window, we also identify all
- job arrivals (with and without jitter) in the interval [0, arr_j + R_j). *)
- Let arrivals_before_end_of_interval := arrivals 0 (arr_j + R_j).
- Let actual_arrivals_before_end_of_interval := actual_arrivals 0 (arr_j + R_j).
-
- (* Next, by checking jobs priorities, ... *)
- Let other_higher_eq_priority_job j_hp :=
- higher_eq_priority (job_task j_hp) (job_task j) && (j_hp != j).
-
- (* ...we identify the workload of higher-or-equal-priority jobs (other than j)
- that arrive in any interval [t1, t2), in the original schedule,... *)
- Definition workload_of_other_hep_jobs_in_sched_susp t1 t2 :=
- workload_of_jobs job_cost (arrivals t1 t2) other_higher_eq_priority_job.
-
- (* ... and also the workload of higher-or-equal priority jobs (other than j)
- with actual arrival time in the interval [t1, t2), in the jitter-aware schedule. *)
- Definition workload_of_other_hep_jobs_in_sched_jitter t1 t2 :=
- workload_of_jobs inflated_job_cost (actual_arrivals t1 t2) other_higher_eq_priority_job.
-
- (* Next, we recall the cumulative service of all higher-or-equal-priority
- jobs (other than j) that arrived in the interval [0, arr_j + R_j),
- received in a given interval [t1, t2) in the original schedule. *)
- Definition service_of_other_hep_jobs_in_sched_susp t1 t2 :=
- service_of_jobs sched_susp arrivals_before_end_of_interval other_higher_eq_priority_job t1 t2.
-
- (* Similarly, we recall the cumulative service of all higher-or-equal-priority
- jobs (other than j) with actual arrival time in the interval [0, arr_j + R_j),
- received in a given interval [t1, t2) in the jitter-aware schedule. *)
- Definition service_of_other_hep_jobs_in_sched_jitter t1 t2 :=
- service_of_jobs sched_jitter actual_arrivals_before_end_of_interval
- other_higher_eq_priority_job t1 t2.
-
- (** 5) Auxiliary Lemmas *)
-
- (* Before moving to the main results, let's prove some auxiliary lemmas about service/workload. *)
- Section AuxiliaryLemmas.
-
- (* First, we prove that if all higher-or-equal-priority jobs have completed by
- some time t in the jitter-aware schedule, then the service received
- by those jobs up to time t amounts to the requested workload. *)
- Section ServiceEqualsWorkload.
-
- (* Let t be any time no later than (arr_j + R_j)... *)
- Variable t: time.
- Hypothesis H_before_end_of_interval: t <= arr_j + R_j.
-
- (* ...in which all higher-or-equal-priority jobs (other than j) have completed. *)
- Hypothesis H_workload_has_finished:
- forall j_hp,
- arrives_in arr_seq j_hp ->
- actual_arrival_before job_arrival job_jitter j_hp t ->
- other_higher_eq_priority_job j_hp ->
- job_completed_in_sched_jitter j_hp t.
-
- (* Then, the service received by all those jobs in the interval [0, t) amounts to
- the workload requested by them in the interval [0, t). *)
- Lemma jitter_reduction_service_equals_workload_in_jitter:
- service_of_other_hep_jobs_in_sched_jitter 0 t >=
- workload_of_other_hep_jobs_in_sched_jitter 0 t.
- Proof.
- rename H_workload_has_finished into WORK.
- rewrite /workload_of_other_hep_jobs_in_sched_jitter
- /workload_of_jobs /service_of_other_hep_jobs_in_sched_jitter
- /actual_arrivals_before_end_of_interval /actual_arrivals_before.
- set act := actual_arrivals.
- set t1 := arr_j; set t2 := arr_j + R_j.
- set hep := other_higher_eq_priority_job.
- set Sj := service_during sched_jitter.
- apply leq_trans with (n := \sum_(j0 <- act 0 t | hep j0) Sj j0 0 t); last first.
- {
- rewrite big_mkcond [X in _ <= X]big_mkcond.
- apply leq_sum_sub_uniq; first by apply actual_arrivals_uniq.
- intros j0 IN0.
- try ( by apply actual_arrivals_between_sub with (t3 := 0) (t4 := t) ) ||
- by apply actual_arrivals_between_sub with (t1 := 0) (t2 := t).
- }
- apply leq_sum_seq; rewrite /act /actual_arrivals; intros j0 IN0 HP0.
- apply WORK; try done.
- - by apply in_actual_arrivals_between_implies_arrived in IN0.
- - by apply in_actual_arrivals_implies_arrived_before in IN0.
- Qed.
-
- End ServiceEqualsWorkload.
-
- (* Next, we prove a lemma showing that service in the suspension-aware schedule
- is bounded by the workload. *)
- Section ServiceBoundedByWorkload.
-
- (* Consider any time t <= arr_j + R_j. *)
- Variable t: time.
- Hypothesis H_before_end_of_interval: t <= arr_j + R_j.
-
- (* Then, the service of all jobs with higher-or-equal-priority that arrive in
- the interval [0, arr_j + R_j), received in the interval [0, t), is no
- larger than the workload of all jobs with higher-or-equal-priority that
- are released in the interval [0, t), in the suspension-aware schedule. *)
- Lemma jitter_reduction_service_in_sched_susp_le_workload:
- service_of_other_hep_jobs_in_sched_susp 0 t <=
- workload_of_other_hep_jobs_in_sched_susp 0 t.
- Proof.
- move: (H_valid_schedule) => [FROMarr [MUSTARRs [COMPs _]]].
- rename H_before_end_of_interval into LTt.
- rewrite /workload_of_other_hep_jobs_in_sched_susp /workload_of_jobs
- /service_of_other_hep_jobs_in_sched_susp /service_of_jobs
- /arrivals_before_end_of_interval /jobs_arrived_before.
- set all := arrivals.
- set t1 := arr_j; set t2 := arr_j + R_j.
- set hep := other_higher_eq_priority_job.
- set Ss := service_during sched_susp.
- apply leq_trans with (n := \sum_(j0 <- all 0 t | hep j0) Ss j0 0 t);
- last by apply leq_sum; intros j0 _; apply cumulative_service_le_job_cost.
- rewrite exchange_big [X in _ <= X]exchange_big /=.
- apply leq_sum_nat; move => t' /= LT' _.
- apply leq_trans with (n := \sum_(j0 <- all 0 t2 | hep j0 &&
- (scheduled_at sched_susp j0 t')) 1).
- {
- rewrite big_mkcond [X in _ <= X]big_mkcond.
- rewrite /service_at; apply leq_sum; intros j0 _.
- by case: hep; case SCHED': scheduled_at.
- }
- apply leq_trans with (n := \sum_(j0 <- all 0 t | hep j0 &&
- (scheduled_at sched_susp j0 t')) 1); last first.
- {
- rewrite big_mkcond [X in _ <= X]big_mkcond.
- rewrite /service_at; apply leq_sum; intros j0 _.
- by case: hep; case SCHED': scheduled_at.
- }
- rewrite -big_filter -[X in _ <= X]big_filter.
- apply leq_sum_sub_uniq; first by rewrite filter_uniq //; eapply arrivals_uniq; eauto 1.
- intros j0; rewrite 2!mem_filter; move => /andP [/andP [HP0 SCHED0] IN0].
- rewrite HP0 SCHED0 /=.
- have ARRin0: arrives_in arr_seq j0 by apply FROMarr in SCHED0.
- have ARR0: job_arrival j0 <= t' by apply MUSTARRs.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival);
- try (by done) ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival);
- try (by done).
- by apply: (leq_ltn_trans _ LT').
- Qed.
-
- End ServiceBoundedByWorkload.
-
- End AuxiliaryLemmas.
-
- (** ** 6-(A) Less High-Priority Service Before the Arrival of Job j in sched_jitter *)
-
- (* In this section we prove that before the arrival of job j, the cumulative service
- received by other higher-or-equal-priority is no larger in the jitter-aware schedule
- than in the suspension-aware schedule. *)
- Section LessServiceBeforeArrival.
-
- (* In fact, we can prove that the service is not larger for each higher-or-equal-priority
- job in isolation. *)
- Section LessServiceForEachJob.
-
- (* Let j_hp be any higher-or-equal-priority job (different from j). *)
- Variable j_hp: Job.
- Hypothesis H_arrives: arrives_in arr_seq j_hp.
- Hypothesis H_higher_or_equal_priority: other_higher_eq_priority_job j_hp.
-
- (* For simplicity, let's define some local names. *)
- Let arr_hp := job_arrival j_hp.
- Let cost_hp := job_cost j_hp.
- Let Rhp := R_hp j_hp.
-
- (* Using a series of case analyses, we are going to prove that
- service sched_jitter j_hp t <= service sched_susp j_hp t. *)
- Section Case1.
-
- (* Case 1. Assume that j_hp is a job from the same task as j. *)
- Hypothesis H_same_task: job_task j_hp = job_task j.
-
- (* Due to constrained deadlines, we can infer that previous jobs of the same task
- complete in sched_susp before j arrives. Because these jobs do not have inflated
- costs, they cannot receive more service in sched_jitter before the arrival of j. *)
- Lemma jitter_reduction_less_job_service_before_interval_case1:
- service sched_jitter j_hp arr_j <= service sched_susp j_hp arr_j.
- Proof.
- move: (H_valid_schedule) => [_ [MUSTARRs [COMPs _]]].
- rename H_no_deadline_misses_for_previous_jobs into NOMISS,
- H_constrained_deadlines into DL, H_jobs_from_taskset into FROM,
- H_sporadic_arrivals into SPO.
- move: H_higher_or_equal_priority => /andP [HP NEQ].
- case (ltnP arr_hp arr_j) => [BEFORE | AFTER]; last first.
- {
- rewrite /service /service_during.
- rewrite (cumulative_service_before_jitter_is_zero job_arrival job_jitter) //;
- first by eapply reduction_prop.sched_jitter_jobs_execute_after_jitter; eauto 1.
- move: H_same_task => /eqP SAMEtsk; apply negbF in SAMEtsk.
- by rewrite /actual_arrival /job_jitter /reduction.job_jitter HP SAMEtsk /= addn0.
- }
- apply leq_trans with (n := inflated_job_cost j_hp).
- {
- apply cumulative_service_le_job_cost.
- by apply reduction_prop.sched_jitter_completed_jobs_dont_execute.
- }
- rewrite /inflated_job_cost /reduction.inflated_job_cost.
- apply negbTE in NEQ; rewrite NEQ.
- apply completion_monotonic with (t := arr_hp + job_deadline j_hp); last by apply NOMISS.
- rewrite H_job_deadlines_equal_task_deadlines //.
- apply leq_trans with (n := arr_hp + task_period (job_task j_hp));
- first by rewrite leq_add2l DL // FROM.
- apply SPO; try (by done); last by apply ltnW.
- by intros SAME; subst; rewrite eq_refl in NEQ.
- Qed.
-
- End Case1.
-
- Section Case2.
-
- (* Case 2. Assume that j_hp is a job from another task,... *)
- Hypothesis H_different_task: job_task j_hp != job_task j.
-
- (* ...that is released (with jitter) no earlier than the arrival of j. *)
- Hypothesis H_released_no_earlier: arr_j <= actual_job_arrival j_hp.
-
- (* Since j_hp cannot execute in sched_jitter, the claim trivially holds. *)
- Lemma jitter_reduction_less_job_service_before_interval_case2:
- service sched_jitter j_hp arr_j <= service sched_susp j_hp arr_j.
- Proof.
- rename H_different_task into DIFFtask.
- move: H_higher_or_equal_priority => /andP [HP NEQ].
- rewrite /service /service_during.
- by rewrite (cumulative_service_before_jitter_is_zero job_arrival job_jitter) //;
- first by eapply reduction_prop.sched_jitter_jobs_execute_after_jitter; eauto 1.
- Qed.
-
- End Case2.
-
- Section Case3.
-
- (* Case 3. Assume that j_hp is a job from another task,... *)
- Hypothesis H_different_task: job_task j_hp != job_task j.
-
- (* ...and that (arr_j - arr_hp < arr_j - cost_hp). *)
- Hypothesis H_distance_is_smaller:
- arr_j - arr_hp < Rhp - cost_hp.
-
- (* By definition, the jitter of j_hp is set so that it arrives after j.
- Since j_hp cannot execute in sched_jitter, the claim follows trivially. *)
- Lemma jitter_reduction_less_job_service_before_interval_case3:
- service sched_jitter j_hp arr_j <= service sched_susp j_hp arr_j.
- Proof.
- rename H_higher_or_equal_priority into HEP, H_distance_is_smaller into MIN.
- move: (HEP) => /andP [HP NEQ].
- rewrite /service /service_during.
- rewrite (cumulative_service_before_jitter_is_zero job_arrival job_jitter) //;
- first by eapply reduction_prop.sched_jitter_jobs_execute_after_jitter; eauto 1.
- rewrite /actual_arrival /job_jitter /reduction.job_jitter HP H_different_task /=.
- rewrite /minn MIN.
- case (leqP (job_arrival j) (job_arrival j_hp)) => [AFTER | BEFORE];
- first by apply: (leq_trans AFTER); apply leq_addr.
- by rewrite subnKC; last by apply ltnW.
- Qed.
-
- End Case3.
-
- Section Case4.
-
- (* Case 4. Assume that j_hp is a job from another task... *)
- Hypothesis H_different_task: job_task j_hp != job_task j.
-
- (* ...and that j_hp completes in sched_susp before j arrives. *)
- Hypothesis H_completes_before_j_arrives: arr_hp + Rhp <= arr_j.
-
- (* Since j_hp completes early in sched_susp and receives maximum service, it cannot
- receive more service in sched_jitter before j arrives, thus the claim holds. *)
- Lemma jitter_reduction_less_job_service_before_interval_case4:
- service sched_jitter j_hp arr_j <= service sched_susp j_hp arr_j.
- Proof.
- rename H_higher_or_equal_priority into HEP,
- H_bounded_response_time_of_hp_jobs into RESPhp.
- move: (HEP) => /andP [HP NEQ].
- apply leq_trans with (n := service sched_susp j_hp (arr_hp + Rhp));
- last by apply extend_sum.
- apply leq_trans with (n := cost_hp);
- last by apply RESPhp; last by apply/andP; split.
- apply leq_trans with (n := inflated_job_cost j_hp);
- last by rewrite /inflated_job_cost /reduction.inflated_job_cost -[_==_]negbK NEQ.
- apply cumulative_service_le_job_cost.
- by apply reduction_prop.sched_jitter_completed_jobs_dont_execute.
- Qed.
-
- End Case4.
-
- Section Case5.
-
- (* Case 5. Assume that j_hp is a job from another task,... *)
- Hypothesis H_different_task: job_task j_hp != job_task j.
-
- (* ...that is released (with jitter) before the arrival of j. *)
- Hypothesis H_released_before: actual_job_arrival j_hp < arr_j.
-
- (* Also assume that (arr_j < arr_hp + Rhp) and (Rhp - costhp <= arr_j - arr_hp). *)
- Hypothesis H_j_hp_completes_after_j_arrives: arr_j < arr_hp + Rhp.
- Hypothesis H_distance_is_not_smaller: Rhp - cost_hp <= arr_j - arr_hp.
-
- (* Note that in this case the jitter of job j_hp is set to (Rhp - cost_hp). *)
- Remark jitter_reduction_jitter_equals_R_minus_cost:
- job_jitter j_hp = Rhp - cost_hp.
- Proof.
- rename H_higher_or_equal_priority into HEP, H_different_task into DIFFtask.
- move: (HEP) => /andP [HP NEQ].
- rewrite /job_jitter /reduction.job_jitter HP DIFFtask /= /minn.
- by rewrite ltnNge H_distance_is_not_smaller /=.
- Qed.
-
- (* Since j_hp is released late in sched_jitter with "slack" (Rhp - cost_hp), even
- if it executes at full speed, it cannot beat sched_susp in terms of service.
- Therefore, the claim also holds. *)
- Lemma jitter_reduction_less_job_service_before_interval_case5:
- service sched_jitter j_hp arr_j <= service sched_susp j_hp arr_j.
- Proof.
- move: (H_valid_schedule) => [_ [MUSTARRs [COMPs _]]].
- have JITdef := jitter_reduction_jitter_equals_R_minus_cost.
- rename H_higher_or_equal_priority into HEP,
- H_bounded_response_time_of_hp_jobs into RESPhp.
- move: (HEP) => /andP [HP NEQ].
- set arr_hp' := actual_job_arrival j_hp.
- set cost_hp' := inflated_job_cost j_hp.
- have JIT: job_jitter j_hp = Rhp - cost_hp by apply JITdef.
- apply leq_trans with (n := cost_hp - (arr_hp + Rhp - arr_j)); last first.
- {
- rewrite /cost_hp leq_subLR.
- apply leq_trans with (n := service sched_susp j_hp (arr_hp + Rhp));
- first by apply RESPhp; last by apply/andP; split.
- rewrite /service /service_during.
- apply leq_trans with (n := \sum_(arr_j <= t' < arr_hp+Rhp)
- 1 + service sched_susp j_hp arr_j);
- last by apply leq_add; first by simpl_sum_const.
- rewrite -> big_cat_nat with (n := arr_j); [simpl | by done | by apply ltnW].
- by rewrite addnC; apply leq_add; first by apply leq_sum; intros t0 _; apply leq_b1.
- }
- {
- have AFTERj := reduction_prop.sched_jitter_jobs_execute_after_jitter job_arrival
- job_task arr_seq higher_eq_priority job_cost job_suspension_duration.
- rewrite /service /service_during.
- rewrite (ignore_service_before_jitter job_arrival job_jitter) //;
- [| by eapply AFTERj; eauto 1 | by apply ltnW].
- apply leq_trans with (n := \sum_(arr_hp' <= t0 < arr_j) 1);
- first by apply leq_sum; intros t0 _; apply leq_b1.
- simpl_sum_const; rewrite /arr_hp' /actual_job_arrival /actual_arrival JIT.
- have LEcost: cost_hp <= Rhp.
- {
- apply leq_trans with (n := service sched_susp j_hp (arr_hp + Rhp));
- first by apply RESPhp; last by apply/andP;split.
- apply leq_trans with (n := \sum_(arr_hp <= t' < arr_hp + Rhp) 1);
- last by simpl_sum_const; rewrite addKn.
- rewrite /service /service_during.
- rewrite (ignore_service_before_arrival job_arrival) //; last by apply leq_addr.
- by apply leq_sum; intros t0 _; apply leq_b1.
- }
- rewrite addnBA; last by done.
- rewrite subnBA; last by apply: (leq_trans LEcost); apply leq_addl.
- rewrite subnBA; last by apply ltnW.
- by apply leq_sub2r; rewrite addnC.
- }
- Qed.
-
- End Case5.
-
- (** **** Main Claim of Section (A) *)
-
- (* Using the case analysis above, we conclude that before the arrival of job j,
- any higher-or-equal-priority job receives no more service in the jitter-aware
- schedule than in the suspension-aware schedule. *)
- Lemma jitter_reduction_less_job_service_before_interval:
- service sched_jitter j_hp arr_j <= service sched_susp j_hp arr_j.
- Proof.
- have CASE1 := jitter_reduction_less_job_service_before_interval_case1.
- have CASE2 := jitter_reduction_less_job_service_before_interval_case2.
- have CASE3 := jitter_reduction_less_job_service_before_interval_case3.
- have CASE4 := jitter_reduction_less_job_service_before_interval_case4.
- have CASE5 := jitter_reduction_less_job_service_before_interval_case5.
- have AFTERj := reduction_prop.sched_jitter_jobs_execute_after_jitter job_arrival job_task
- arr_seq higher_eq_priority job_cost job_suspension_duration j _ R_hp.
- feed AFTERj; try (by done).
- case (boolP (job_task j_hp == job_task j)) => [/eqP SAME | DIFFtsk]; first by apply CASE1.
- case (leqP arr_j (actual_job_arrival j_hp)) => [LEarr | GTarr]; first by apply CASE2.
- case (ltnP (arr_j - arr_hp) (Rhp - cost_hp)) => [LTdiff | GEdiff]; first by apply CASE3.
- case (leqP (arr_hp + Rhp) arr_j) => [LEarrj | GTarrj]; first by apply CASE4.
- by apply CASE5.
- Qed.
-
- End LessServiceForEachJob.
-
- (* Since the result about service applies to each individual job, we can prove that
- it also holds for the cumulative service of all higher-or-equal-priority jobs. *)
- Corollary jitter_reduction_less_service_before_the_interval:
- service_of_other_hep_jobs_in_sched_jitter 0 arr_j <=
- service_of_other_hep_jobs_in_sched_susp 0 arr_j.
- Proof.
- rewrite /service_of_other_hep_jobs_in_sched_jitter
- /service_of_other_hep_jobs_in_sched_susp
- /actual_arrivals_before_end_of_interval /arrivals_before_end_of_interval
- /actual_arrivals_before /jobs_arrived_before.
- set hep := other_higher_eq_priority_job.
- set Ss := service_during sched_susp.
- set t2 := arr_j + R_j.
- apply leq_trans with (n := \sum_(j_hp <- actual_arrivals 0 t2 | hep j_hp) Ss j_hp 0 arr_j).
- {
- apply leq_sum_seq; rewrite /actual_arrivals; intros j0 IN0 HEP0.
- apply jitter_reduction_less_job_service_before_interval; try (by done).
- by apply in_actual_arrivals_between_implies_arrived in IN0.
- }
- {
- rewrite big_mkcond [X in _ <= X]big_mkcond /actual_arrivals /=.
- apply leq_sum_sub_uniq; first by apply actual_arrivals_uniq.
- by intros j0; rewrite !mem_filter /=; move => /andP [_ IN0].
- }
- Qed.
-
- End LessServiceBeforeArrival.
-
- (** ** 6-(B) More High-Priority Service After the Arrival of Job j in sched_jitter *)
-
- (* So far, we have shown that the higher-or-equal-priority jobs receives less service
- in the jitter-aware schedule during [0, arr_j). Recall that our final goal is to show
- that all this service is actually moved into the interval [arr_j, arr_j + R_j) and
- converted into interference for the job j being analyzed.
- In this section, we reason about what happens to high-priority jobs after job j arrives. *)
- Section MoreServiceAfterArrival.
-
- (* First, we show that the workload is conserved at every point in the interval
- [arr_j, arr_j + R_j). *)
- Section Conservation.
-
- (* Consider any time t >= arr_j (no earlier than the arrival of j). *)
- Variable t: time.
- Hypothesis H_no_earlier_than_j: t >= arr_j.
-
- (* Then, we prove that every job that arrives up to time t is also released
- in the jitter-aware schedule up to time t. *)
- Lemma jitter_reduction_actual_arrival_before_end_of_interval:
- forall j_hp,
- other_higher_eq_priority_job j_hp ->
- job_arrival j_hp <= t ->
- actual_job_arrival j_hp <= t.
- Proof.
- move => j_hp /andP [HP NEQ] ARRhp.
- set arr_hp := job_arrival j_hp.
- set cost_hp := job_cost j_hp.
- rewrite /actual_job_arrival /actual_arrival /job_jitter /reduction.job_jitter HP /=.
- case: ifP => [NEQtsk | /eqP SAMEtsk]; last by rewrite addn0.
- case (ltnP (arr_j - arr_hp) (R_hp j_hp - cost_hp)) => [MINl | MINr].
- {
- rewrite /minn MINl.
- case (leqP arr_hp arr_j) => [BEFORE | AFTER]; first by rewrite subnKC //.
- by apply leq_trans with (n := arr_hp + (arr_hp - arr_hp));
- [by rewrite leq_add2l leq_sub2r // ltnW | by rewrite subnn addn0].
- }
- {
- rewrite /minn ltnNge MINr /=.
- apply leq_trans with (n := arr_hp + (arr_j - arr_hp)); first by rewrite leq_add2l.
- case (leqP arr_hp arr_j) => [BEFORE | AFTER]; first by rewrite subnKC //.
- by apply leq_trans with (n := arr_hp + (arr_hp - arr_hp));
- [by rewrite leq_add2l leq_sub2r // ltnW | by rewrite subnn addn0].
- }
- Qed.
-
- (* This implies that the workload is conserved up to time t (inclusive). That is,
- in the jitter-aware schedule, there's always as much (high-priority) work to be
- executed as in the original schedule. *)
- Lemma jitter_reduction_workload_conservation_inside_interval:
- workload_of_other_hep_jobs_in_sched_susp 0 t.+1 <=
- workload_of_other_hep_jobs_in_sched_jitter 0 t.+1.
- Proof.
- rewrite /workload_of_other_hep_jobs_in_sched_susp
- /workload_of_other_hep_jobs_in_sched_jitter /workload_of_jobs.
- set all := arrivals; set act := actual_arrivals.
- set hep := other_higher_eq_priority_job.
- apply leq_trans with (n := \sum_(j0 <- all 0 t.+1 | hep j0) inflated_job_cost j0).
- {
- apply leq_sum_seq; rewrite /all /arrivals; move => j0 IN0 /andP [_ NEQ].
- by apply negbTE in NEQ; rewrite /inflated_job_cost /reduction.inflated_job_cost NEQ //.
- }
- apply leq_trans with (n := \sum_(j0 <- all 0 t.+1 | hep j0 &&
- (actual_job_arrival j0 < t.+1)) inflated_job_cost j0); last first.
- {
- rewrite -big_filter -[X in _ <= X]big_filter.
- apply leq_sum_sub_uniq;
- first by rewrite filter_uniq //; eapply arrivals_uniq; eauto 1.
- intros j0; rewrite !mem_filter /=.
- by move => /andP [/andP [HP LT] IN]; rewrite HP LT IN.
- }
- rewrite big_mkcond [X in _ <= X]big_mkcond /=.
- apply leq_sum_seq; intros j0 IN0 _.
- case HP: hep; simpl; last by done.
- case: (leqP _ _); last by done.
- intros BUG; exfalso; rewrite leqNgt in BUG; move: BUG => /negP BUG; apply: BUG.
- apply jitter_reduction_actual_arrival_before_end_of_interval; try (by done).
- by eapply in_arrivals_implies_arrived_before in IN0; eauto 1.
- Qed.
-
- End Conservation.
-
- (* Since the higher-or-equal-priority jobs receive no more service in the jitter-aware
- schedule during [0, arr_j), and because the workload is conserved, we prove next
- that those jobs receive no less service in the jitter-aware schedule in the interval
- [arr_j, arr_j + R_j). *)
- Section MoreServiceInsideTheInterval.
-
- (* The claim we need to show is presented next. The proof follows by induction on
- the interval length d:
- forall d,
- d <= R_j ->
- service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + d) <=
- service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + d). *)
-
- (* Since the base case of the induction is trivial, we focus on the inductive step. *)
- Section InductiveStep.
-
- (* By strong induction, assume that for a given interval length d < R_j, ... *)
- Variable d: time.
- Hypothesis H_d_lt_R: d < R_j.
-
- (* ...the higher-or-equal-priority jobs (other than j) received as much service in
- the jitter-aware schedule during [arr_j, arr_j + d) as in the suspension-aware
- schedule. *)
- Hypothesis H_induction_hypothesis:
- service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + d) <=
- service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + d).
-
- (* Now we must prove that the claim continues to hold for interval [arr_j, arr_j + d + 1):
-
- service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + d + 1) <=
- service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + d + 1). *)
-
- (* The proof begins with a case analysis on whether there are pending
- higher-or-equal-priority jobs at time (arr_j + d) in the jitter-aware schedule. *)
- Section NoPendingJobs.
-
- (* Case 1. Assume that all higher-or-equal-priority jobs (other than j) whose jitter
- has passed by time (arr_j + d) are already complete at time (arr_j + d)
- in the jitter-aware schedule. *)
- Hypothesis H_all_jobs_completed_in_sched_jitter:
- forall j_hp,
- arrives_in arr_seq j_hp ->
- other_higher_eq_priority_job j_hp ->
- job_has_actually_arrived j_hp (arr_j + d) ->
- job_completed_in_sched_jitter j_hp (arr_j + d).
-
- (* First, we show that the service received in the suspension-aware schedule
- during [arr_j, arr_j + d + 1) is bounded by the difference between the
- requested workload and the service received prior to the arrival of job j. *)
- Lemma jitter_reduction_convert_service_to_workload:
- service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + d + 1) <=
- workload_of_other_hep_jobs_in_sched_susp 0 (arr_j + d + 1)
- - service_of_other_hep_jobs_in_sched_susp 0 arr_j.
- Proof.
- have LEWORKs := jitter_reduction_service_in_sched_susp_le_workload.
- rewrite /service_of_other_hep_jobs_in_sched_jitter
- /actual_arrivals_before_end_of_interval /actual_arrivals_before.
- rewrite /service_of_other_hep_jobs_in_sched_susp /service_of_jobs
- /arrivals_before_end_of_interval /jobs_arrived_before.
- set all := arrivals; set act := actual_arrivals.
- set hep := other_higher_eq_priority_job.
- set Ss := service_during sched_susp.
- set Sj := service_during sched_jitter.
- set SCHs := scheduled_at sched_susp.
- set SCHj := scheduled_at sched_jitter.
- set SUSP := job_cumulative_suspension.
- set Wj := workload_of_other_hep_jobs_in_sched_jitter.
- set Ws := workload_of_other_hep_jobs_in_sched_susp.
- set t1 := arr_j.
- set t2 := arr_j + R_j.
- rewrite exchange_big [X in _ <= _ - X]exchange_big /= /service_at.
- rewrite -/SCHs -/SCHj addnS addn0.
- set TSs := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- all 0 t2 | hep j_hp) SCHs j_hp t0.
- set TSj := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- act 0 t2 | hep j_hp) SCHj j_hp t0.
- rewrite -/(TSs t1 (t1 + d).+1) -/(TSs 0 t1).
- rewrite leq_subRL_impl //.
- rewrite -big_cat_nat //=;
- last by apply leq_trans with (n := t1 + d); first by apply leq_addr.
- by rewrite exchange_big; apply LEWORKs; rewrite ltn_add2l.
- Qed.
-
- (* Because of workload conservation, we show that the workload in the suspension-aware
- schedule is bounded by the workload in the jitter-aware schedule. *)
- Lemma jitter_reduction_compare_workload:
- workload_of_other_hep_jobs_in_sched_susp 0 (arr_j + d + 1)
- - service_of_other_hep_jobs_in_sched_susp 0 arr_j
- <= workload_of_other_hep_jobs_in_sched_jitter 0 (arr_j + d + 1)
- - service_of_other_hep_jobs_in_sched_susp 0 arr_j.
- Proof.
- have CONS := jitter_reduction_workload_conservation_inside_interval.
- rewrite /service_of_other_hep_jobs_in_sched_jitter
- /actual_arrivals_before_end_of_interval /actual_arrivals_before.
- rewrite /service_of_other_hep_jobs_in_sched_susp /service_of_jobs
- /arrivals_before_end_of_interval /jobs_arrived_before.
- set all := arrivals; set act := actual_arrivals.
- set hep := other_higher_eq_priority_job.
- set Ss := service_during sched_susp.
- set Sj := service_during sched_jitter.
- set SCHs := scheduled_at sched_susp.
- set SCHj := scheduled_at sched_jitter.
- set SUSP := job_cumulative_suspension.
- set Wj := workload_of_other_hep_jobs_in_sched_jitter.
- set Ws := workload_of_other_hep_jobs_in_sched_susp.
- set t1 := arr_j.
- set t2 := arr_j + R_j.
- rewrite exchange_big /= /service_at.
- rewrite -/SCHs -/SCHj addnS addn0.
- set TSs := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- all 0 t2 | hep j_hp) SCHs j_hp t0.
- set TSj := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- act 0 t2 | hep j_hp) SCHj j_hp t0.
- rewrite -/(TSs t1 (t1 + d).+1) -/(TSs 0 t1).
- apply leq_trans with (n := Ws 0 (t1 + d).+1 - TSs 0 t1); first by done.
- by rewrite leq_sub2r //; apply CONS, leq_addr.
- Qed.
-
- (* Since the higher-or-equal-priority jobs received less service in the
- jitter-aware schedule in the interval [0, arr_j), we can compare the
- service in the two schedules. *)
- Lemma jitter_reduction_compare_service:
- workload_of_other_hep_jobs_in_sched_jitter 0 (arr_j + d + 1)
- - service_of_other_hep_jobs_in_sched_susp 0 arr_j
- <= workload_of_other_hep_jobs_in_sched_jitter 0 (arr_j + d + 1)
- - service_of_other_hep_jobs_in_sched_jitter 0 arr_j.
- Proof.
- have LEserv := jitter_reduction_less_service_before_the_interval.
- rewrite /service_of_other_hep_jobs_in_sched_jitter
- /actual_arrivals_before_end_of_interval /actual_arrivals_before.
- rewrite /service_of_other_hep_jobs_in_sched_susp /service_of_jobs
- /arrivals_before_end_of_interval /jobs_arrived_before.
- set all := arrivals; set act := actual_arrivals.
- set hep := other_higher_eq_priority_job.
- set Ss := service_during sched_susp.
- set Sj := service_during sched_jitter.
- set SCHs := scheduled_at sched_susp.
- set SCHj := scheduled_at sched_jitter.
- set SUSP := job_cumulative_suspension.
- set Wj := workload_of_other_hep_jobs_in_sched_jitter.
- set Ws := workload_of_other_hep_jobs_in_sched_susp.
- set t1 := arr_j.
- set t2 := arr_j + R_j.
- rewrite exchange_big [X in _ <= _ - X]exchange_big /= /service_at.
- rewrite -/SCHs -/SCHj addnS addn0.
- set TSs := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- all 0 t2 | hep j_hp) SCHs j_hp t0.
- set TSj := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- act 0 t2 | hep j_hp) SCHj j_hp t0.
- rewrite -/(TSs t1 (t1 + d).+1) -/(TSs 0 t1).
- rewrite leq_sub2l //.
- rewrite /TSj /TSs exchange_big [X in _ <= X]exchange_big /=.
- by apply LEserv.
- Qed.
-
- (* Having inferred that the difference between the workload and service is that
- large in the jitter-aware schedule, we can convert this difference back to
- service received in the interval [arr_j, arr_j + d + 1] in sched_jitter. *)
- Lemma jitter_reduction_convert_workload_to_service:
- workload_of_other_hep_jobs_in_sched_jitter 0 (arr_j + d + 1) -
- service_of_other_hep_jobs_in_sched_jitter 0 arr_j <=
- service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + d + 1).
- Proof.
- have EQWORKj := jitter_reduction_service_equals_workload_in_jitter.
- rename H_all_jobs_completed_in_sched_jitter into ALL.
- rewrite /service_of_other_hep_jobs_in_sched_jitter
- /actual_arrivals_before_end_of_interval /actual_arrivals_before.
- rewrite /service_of_other_hep_jobs_in_sched_susp /service_of_jobs
- /arrivals_before_end_of_interval /jobs_arrived_before.
- set all := arrivals; set act := actual_arrivals.
- set hep := other_higher_eq_priority_job.
- set Ss := service_during sched_susp.
- set Sj := service_during sched_jitter.
- set SCHs := scheduled_at sched_susp.
- set SCHj := scheduled_at sched_jitter.
- set SUSP := job_cumulative_suspension.
- set Wj := workload_of_other_hep_jobs_in_sched_jitter.
- set Ws := workload_of_other_hep_jobs_in_sched_susp.
- set t1 := arr_j.
- set t2 := arr_j + R_j.
- rewrite exchange_big [X in _ <= X]exchange_big /= /service_at.
- rewrite -/SCHs -/SCHj addnS addn0.
- set TSs := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- all 0 t2 | hep j_hp) SCHs j_hp t0.
- set TSj := fun a b => \sum_(a <= t0 < b)
- \sum_(j_hp <- act 0 t2 | hep j_hp) SCHj j_hp t0.
- rewrite -/(TSj t1 (t1 + d).+1) -/(TSj 0 t1).
- rewrite leq_subLR -big_cat_nat //=;
- last by apply leq_trans with (n := t1 + d); first by apply leq_addr.
- rewrite exchange_big /=.
- feed (EQWORKj (t1 + d).+1); first by rewrite ltn_add2l.
- apply EQWORKj.
- intros j0 ARRin0 ARR0 HEP0; specialize (ALL j0 ARRin0 HEP0 ARR0).
- by apply completion_monotonic with (t := t1 + d).
- Qed.
-
- (* By combining each inequality above in sequence, we complete the induction
- step for Case 1. *)
- Lemma jitter_reduction_inductive_step_case1:
- service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + d + 1) <=
- service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + d + 1).
- Proof.
- apply: (leq_trans jitter_reduction_convert_service_to_workload).
- apply: (leq_trans jitter_reduction_compare_workload).
- apply: (leq_trans jitter_reduction_compare_service).
- by apply: (leq_trans jitter_reduction_convert_workload_to_service).
- Qed.
-
- End NoPendingJobs.
-
- Section ThereArePendingJobs.
-
- (* Case 2. Assume that there are higher-or-equal-priority jobs (other than j) whose
- jitter has passed by time (arr_j + d) that are still pending at time
- (arr_j + d) in the jitter-aware schedule. *)
- Hypothesis H_there_are_pending_jobs_in_sched_jitter:
- exists j_hp,
- arrives_in arr_seq j_hp /\
- other_higher_eq_priority_job j_hp /\
- job_has_actually_arrived j_hp (arr_j + d) /\
- ~~ job_completed_in_sched_jitter j_hp (arr_j + d).
-
- (* By the induction hypothesis, the higher-or-equal-priority jobs received
- as much service in the jitter-aware schedule as in the suspension-aware
- schedule in the interval [arr_j, arr_j + d). Therefore, it only remains
- to show that:
-
- service_of_other_hep_jobs_in_sched_susp (arr_j + d) (arr_j + d + 1) <=
- service_of_other_hep_jobs_in_sched_jitter (arr_j + d) (arr_j + d + 1). *)
-
- (* Because the LHS in the inequality above cannot be larger than 1 (single point),
- it suffices to show that there is a higher-or-equal-priority job (different from j)
- scheduled at time (arr_j + d) in the jitter-aware schedule. That follows
- from two facts:
- (a) The jitter-aware schedule is work-conserving and enforces priorities.
- Therefore, even if the job j_hp in the hypothesis above is not scheduled,
- there will always be a job with higher-or-equal-priority being scheduled.
- (b) If there is at least one higher-or-equal-priority pending job, by the
- additional property we embedded in the schedule construction, we avoid
- scheduling job j (see lemma sched_jitter_does_not_pick_j). *)
- Lemma jitter_reduction_inductive_step_case2:
- service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + d + 1) <=
- service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + d + 1).
- Proof.
- have RESPj := reduction_prop.sched_jitter_respects_policy job_arrival job_task ts
- arr_seq _ _ higher_eq_priority _ _ _ job_cost job_suspension_duration j _ R_hp.
- feed_n 6 RESPj; try (by done).
- unfold reduction_prop.jitter_aware.respects_FP_policy in RESPj.
- have NOTj := reduction_prop.sched_jitter_does_not_pick_j job_arrival job_task ts arr_seq
- _ _ higher_eq_priority _ _ job_cost job_suspension_duration j R_hp.
- feed_n 4 NOTj; try (by done).
- have WORKj := reduction_prop.sched_jitter_work_conserving job_arrival job_task arr_seq _
- higher_eq_priority job_cost job_suspension_duration j R_hp.
- feed WORKj; first by done.
- have AFTERj := reduction_prop.sched_jitter_jobs_execute_after_jitter job_arrival job_task
- arr_seq higher_eq_priority job_cost job_suspension_duration j _ R_hp.
- feed AFTERj; try (by done).
- set sched_j := reduction_prop.reduction.sched_jitter _ _ _ _ _ _ _ _ in AFTERj NOTj
- WORKj RESPj.
- set inf_cost := reduction_prop.reduction.inflated_job_cost _ _ _ in NOTj WORKj
- AFTERj RESPj.
- set job_jit := reduction_prop.reduction.job_jitter _ _ _ _ _ _ in AFTERj NOTj
- WORKj RESPj.
- rename H_priority_is_transitive into TRANS, H_induction_hypothesis into IH,
- H_there_are_pending_jobs_in_sched_jitter into HASj.
- rewrite /service_of_other_hep_jobs_in_sched_jitter
- /actual_arrivals_before_end_of_interval /actual_arrivals_before.
- rewrite /service_of_other_hep_jobs_in_sched_susp /service_of_jobs
- /arrivals_before_end_of_interval /jobs_arrived_before.
- set all := arrivals; set act := actual_arrivals.
- set hep := other_higher_eq_priority_job.
- set Ss := service_during sched_susp.
- set Sj := service_during sched_jitter.
- set SCHs := scheduled_at sched_susp.
- set SCHj := scheduled_at sched_jitter.
- set SUSP := job_cumulative_suspension.
- set Wj := workload_of_other_hep_jobs_in_sched_jitter.
- set Ws := workload_of_other_hep_jobs_in_sched_susp.
- set t1 := arr_j.
- set t2 := arr_j + R_j.
- rewrite exchange_big [X in _ <= X]exchange_big /=.
- rewrite addnS /service_at addn0.
- rewrite big_nat_recr ?leq_addr // big_nat_recr ?leq_addr //=.
- apply leq_add;
- first by rewrite exchange_big [X in _ <= X]exchange_big; apply IH.
- case (boolP (has (fun j0 => hep j0 && scheduled_at sched_susp j0 (t1 + d))
- (all 0 t2))) => [HASs | ALLs]; last first.
- {
- rewrite -all_predC in ALLs; move: ALLs => /allP ALLs.
- rewrite big_seq_cond big1 //.
- move => j0 /andP [IN0 HP0]; apply/eqP; rewrite eqb0.
- by specialize (ALLs j0 IN0); rewrite /= HP0 /= in ALLs.
- }
- move: HASs => /hasP [j0 IN0 /andP [HP0 SCHED0]].
- rewrite big_mkcond (bigD1_seq j0) /=; [| by done | by eapply arrivals_uniq; eauto 1].
- rewrite HP0 SCHED0 big1 //; last first.
- {
- intros j1 NEQ; case: (hep j1); last by done.
- apply/eqP; rewrite eqb0; apply/negP; intro SCHED1.
- apply (only_one_job_scheduled _ j1) in SCHED0; last by done.
- by rewrite SCHED0 eq_refl in NEQ.
- }
- rewrite addn0.
- move: HASj => [j1 [ARRin1 [HEP1 [IN1 NOTCOMP1]]]].
- move: (HEP1) => /andP [HP1 NEQ1].
- rewrite /act /actual_arrivals in IN1.
- case (boolP (scheduled_at sched_jitter j1 (t1+d))) => [SCHED1 | NOTSCHED1].
- {
- rewrite (big_rem j1) /=; first by rewrite /hep HEP1 SCHED1.
- apply arrived_between_implies_in_actual_arrivals; try (by done).
- rewrite /actual_arrival_between /=.
- by apply leq_ltn_trans with (n := arr_j + d); last by rewrite ltn_add2l.
- }
- have BACK1: backlogged job_arrival inflated_job_cost job_jitter sched_jitter j1 (t1+d).
- by repeat (apply/andP; split); try (by done).
- move: (BACK1) (BACK1) => SCHED2 PRIO2.
- apply WORKj in SCHED2; try (by done).
- move: SCHED2 => [j2 SCHED2].
- apply RESPj with (j_hp := j2) in PRIO2; try (by done).
- have ARRin2: arrives_in arr_seq j2.
- {
- rewrite /sched_j in SCHED2.
- try ( by apply reduction_prop.sched_jitter_jobs_come_from_arrival_sequence with
- (sched_susp0 := sched_susp) in SCHED2 ) ||
- by apply reduction_prop.sched_jitter_jobs_come_from_arrival_sequence with
- (sched_susp := sched_susp) in SCHED2.
- }
- have HP2: hep j2.
- {
- apply/andP; split; first by apply (TRANS (job_task j1)).
- apply/eqP; intro SAME; subst j2.
- move: BACK1 => /andP [PEND1 _].
- by specialize (NOTj j1 (t1+d) ARRin1 NEQ1 PEND1 HP1); rewrite SCHED2 in NOTj.
- }
- have IN2: j2 \in act 0 t2.
- {
- apply arrived_between_implies_in_actual_arrivals; try (by done).
- rewrite /actual_arrival_between /=.
- apply leq_ltn_trans with (n := t1+d); last by rewrite ltn_add2l.
- by apply AFTERj.
- }
- by rewrite (big_rem j2) //= HP2 SCHED2.
- Qed.
-
- End ThereArePendingJobs.
-
- End InductiveStep.
-
- (** **** Main Claim of Section (B) *)
-
- (* Using the proof by induction above, we conclude that, for any interval length
- d <= R_j, the service received by higher-or-equal-priority jobs (other than j)
- in the interval [arr_j, arr_j + d) in the jitter-aware schedule is as large as
- the corresponding service in the suspension-aware schedule. *)
- Lemma jitter_reduction_more_service_inside_the_interval:
- forall d,
- d <= R_j ->
- service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + d) <=
- service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + d).
- Proof.
- have CASE1 := jitter_reduction_inductive_step_case1.
- have CASE2 := jitter_reduction_inductive_step_case2.
- set all := arrivals; set act := actual_arrivals.
- set hep := other_higher_eq_priority_job.
- rename H_priority_is_transitive into TRANS.
- induction d.
- {
- rewrite /service_of_other_hep_jobs_in_sched_susp /service_of_jobs.
- by intros _; rewrite exchange_big /= addn0 big_geq.
- }
- intros LTR; feed (IHd); first by apply ltnW.
- rewrite -addn1 addnA.
- case (boolP (has (fun j0 => hep j0 && job_has_actually_arrived j0 (arr_j + d)
- && ~~ completed_by inflated_job_cost sched_jitter j0 (arr_j + d))
- (act 0 (arr_j + R_j)))) => [HASj | ALLj]; last first.
- {
- apply CASE1; try (by done).
- rewrite -all_predC in ALLj; move: ALLj => /allP ALLj.
- intros j0 ARRin0 HEP0 ARR0.
- feed (ALLj j0).
- {
- apply arrived_between_implies_in_actual_arrivals; try (by done).
- rewrite /actual_arrival_between /=.
- by apply leq_ltn_trans with (n := arr_j + d); last by rewrite ltn_add2l.
- }
- by rewrite /= /hep HEP0 ARR0 /= negbK in ALLj.
- }
- {
- apply (CASE2 _ LTR IHd).
- move: HASj => /hasP [j0 IN0 /andP [/andP [HP0 ARR0] NOTCOMP0]].
- exists j0; repeat (split); try (by done).
- rewrite /act /actual_arrivals in IN0.
- by apply in_actual_arrivals_between_implies_arrived in IN0.
- }
- Qed.
-
- End MoreServiceInsideTheInterval.
-
- End MoreServiceAfterArrival.
-
- (** ** 6-(C) Conclusion: Comparing Response Times of Job j *)
-
- (* In this section, we prove that the generated schedule is "worse" for job j.
- More precisely, job j receives no more service in the jitter-aware schedule
- than the cumulative service and suspension time in the original schedule. *)
- Section JitterAwareScheduleIsWorse.
-
- (* Recall the definition of job response-time bound in sched_jitter. *)
- Let job_response_time_in_sched_jitter_bounded_by :=
- is_response_time_bound_of_job job_arrival inflated_job_cost sched_jitter.
-
- (* From this point, we are going to analyze both schedules up to time (arr_j + R_j) and
- compare the service received by job j. At the end, we are going to prove that R_j is
- also a response-time bound for job j in the suspension-aware schedule sched_susp. *)
-
- (* First, we show that the service received by job j in the interval [arr_j, arr_j + R_j)
- is always bounded by the difference between the interval length R_j and the service
- received by the other higher-or-equal-priority jobs in the same interval. *)
- Lemma jitter_reduction_service_jitter:
- service_during sched_jitter j arr_j (arr_j + R_j) <=
- R_j - service_of_other_hep_jobs_in_sched_jitter arr_j (arr_j + R_j).
- Proof.
- have ARRj := reduction_prop.sched_jitter_jobs_come_from_arrival_sequence job_arrival job_task
- arr_seq higher_eq_priority job_cost job_suspension_duration sched_susp _ j _ R_hp.
- feed_n 2 ARRj; try done.
- have AFTERj := reduction_prop.sched_jitter_jobs_execute_after_jitter job_arrival job_task
- arr_seq higher_eq_priority job_cost job_suspension_duration j _ R_hp.
- feed AFTERj; try done.
- set Sj := service_during sched_jitter j arr_j.
- set Shp := service_of_other_hep_jobs_in_sched_jitter arr_j.
- rewrite leq_subRL_impl // addnC.
- apply leq_trans with (n := \sum_(arr_j <= t < arr_j + R_j) 1);
- last by simpl_sum_const; rewrite addKn.
- rewrite /Sj /Shp /service_of_other_hep_jobs_in_sched_jitter /service_of_jobs
- /service_during.
- rewrite exchange_big -big_split /=.
- apply leq_sum_nat; move => i /andP [GEi LTi] _.
- destruct (sched_jitter i) as [j'|] eqn:SCHED;
- last by rewrite /service_at /scheduled_at SCHED /= add0n; simpl_sum_const.
- case (boolP ((j' == j) || ~~ higher_eq_priority (job_task j') (job_task j))).
- {
- intros OR; rewrite big1; first by rewrite addn0 leq_b1.
- intros j_hp HP; rewrite /other_higher_eq_priority_job in HP.
- apply/eqP; rewrite eqb0; apply contraT; rewrite negbK; move => /eqP SCHED'.
- rewrite SCHED in SCHED'; case: SCHED' => SAME; subst j_hp.
- move: OR => /orP [/eqP EQ | NOTHP]; subst; first by rewrite eq_refl andbF in HP.
- by apply negbTE in NOTHP; rewrite NOTHP /= in HP.
- }
- {
- rewrite negb_or negbK; move => /andP [NEQ HP].
- rewrite -[1]add0n; apply leq_add.
- {
- rewrite leqn0 eqb0; apply/negP; intro SCHED'.
- apply only_one_job_scheduled with (j1 := j') in SCHED'; [subst | by apply/eqP].
- by rewrite eq_refl in NEQ.
- }
- {
- move: SCHED => /eqP SCHED.
- have IN: arrives_in arr_seq j' by apply ARRj in SCHED.
- have ARR: actual_arrival_before job_arrival job_jitter j' (arr_j + R_j).
- by apply AFTERj in SCHED; apply: (leq_ltn_trans _ LTi).
- rewrite big_mkcond (bigD1_seq j') /=; first last.
- - by eapply actual_arrivals_uniq; eauto 1.
- - by eapply arrived_between_implies_in_actual_arrivals.
- rewrite /other_higher_eq_priority_job HP NEQ /=.
- move: SCHED => /eqP SCHED.
- rewrite /service_at /scheduled_at SCHED eq_refl.
- rewrite big1 //; intros j_other NEQother.
- case: ifP => HPother; last by done.
- apply/eqP; rewrite eqb0; apply/eqP; case => SAME; subst j_other.
- by rewrite eq_refl in NEQother.
- }
- }
- Qed.
-
- (* Next, since we want to infer that job j is schedulable in the suspension-aware
- schedule if it is schedulable in the jitter-aware schedule, we can assume by
- contrapositive that job j has not completed by time (arr_j + R_j) in
- the suspension-aware schedule. *)
- Section JobNotCompleted.
-
- (* Assume that j has not completed by (arr_j + R_j) in the suspension-aware schedule. *)
- Hypothesis H_j_not_completed:
- ~~ job_completed_in_sched_susp j (arr_j + R_j).
-
- (* Then, we can prove that the difference between the interval length and
- the service received by the other higher-or-equal-priority jobs during
- [arr_j, arr_j + R_j) in the suspension-aware schedule is bounded by
- the cumulative service and suspension time of job j. *)
- Lemma jitter_reduction_service_susp:
- R_j - service_of_other_hep_jobs_in_sched_susp arr_j (arr_j + R_j) <=
- service_during sched_susp j arr_j (arr_j + R_j) +
- job_cumulative_suspension j arr_j (arr_j + R_j).
- Proof.
- move: (H_valid_schedule) => [FROM [ARRIVE [COMPs [WORK [PRIO _]]]]].
- rename H_j_not_completed into NOTCOMP.
- rewrite leq_subLR -big_split /=.
- rewrite /service_of_other_hep_jobs_in_sched_susp /service_of_jobs.
- rewrite exchange_big -big_split /=.
- apply leq_trans with (n := \sum_(arr_j <= t < arr_j + R_j) 1);
- first by simpl_sum_const; rewrite addKn.
- apply leq_sum_nat; move => i /andP [GEi LTi] _.
- rewrite -/job_suspended_at /service_at.
- case: (boolP (job_suspended_at _ _)) => [SUSP | NOTSUSP];
- [by rewrite addnA leq_addl | rewrite addn0].
- case: (boolP (scheduled_at _ _ _)) => [SCHED | NOTSCHED];
- [by rewrite leq_addl | rewrite addn0].
- have BACK: susp.backlogged job_arrival job_cost job_suspension_duration sched_susp j i.
- {
- repeat (apply/andP; split); try (by done).
- apply/negP; intro COMP.
- move: NOTCOMP => /negP NOTCOMP; apply: NOTCOMP.
- by apply completion_monotonic with (t := i); try (by done); apply ltnW.
- }
- move: (BACK) => SCHED; apply WORK in SCHED; last by done.
- move: SCHED => [j_hp SCHEDhp].
- have NEQ: j_hp != j by apply/eqP => SAME; subst; rewrite SCHEDhp in NOTSCHED.
- have HP: higher_eq_priority (job_task j_hp) (job_task j) by apply PRIO with (t := i).
- rewrite (big_rem j_hp) /other_higher_eq_priority_job /=; last first.
- {
- have IN: arrives_in arr_seq j_hp by apply FROM in SCHEDhp.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival);
- try (by done) ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival);
- try (by done).
- by apply: (leq_trans _ LTi); apply ARRIVE.
- }
- by rewrite HP NEQ SCHEDhp /=.
- Qed.
-
- (* Since the higher-or-equal-priority jobs receive more service during
- [arr_j, arr_j + R_j) in the jitter-aware schedule and produce more
- interference, it follows that job j cannot receive as much service
- in the jitter-aware schedule as in the suspension-aware schedule. *)
- Lemma jitter_reduction_less_service_for_job_j:
- service_during sched_jitter j arr_j (arr_j + R_j) <=
- service_during sched_susp j arr_j (arr_j + R_j)
- + job_cumulative_suspension j arr_j (arr_j + R_j).
- Proof.
- apply: (leq_trans jitter_reduction_service_jitter).
- apply: (leq_trans _ jitter_reduction_service_susp).
- by apply leq_sub2l, jitter_reduction_more_service_inside_the_interval.
- Qed.
-
- End JobNotCompleted.
-
- (** **** Main Claim of Section (C) *)
-
- (* Suppose that the response time of job j is bounded by R_j in sched_jitter. *)
- Hypothesis H_response_time_of_j_in_sched_jitter:
- job_response_time_in_sched_jitter_bounded_by j R_j.
-
- (* Then, using the lemmas above, we conclude that the response time of job j in sched_susp
- is also bounded by R_j. *)
- Corollary jitter_reduction_job_j_completes_no_later:
- job_response_time_in_sched_susp_bounded_by j R_j.
- Proof.
- move: (H_valid_schedule) => [_ [MUSTARRs [COMPs [WORK [PRIO SELF]]]]].
- rename H_response_time_of_j_in_sched_jitter into COMPj.
- apply contraT; intro NOTCOMPs.
- suff NOTCOMPj: ~~ job_response_time_in_sched_jitter_bounded_by j R_j;
- [by rewrite COMPj in NOTCOMPj | clear COMPj].
- have LESS := jitter_reduction_less_service_for_job_j NOTCOMPs.
- rewrite -ltnNge.
- rewrite /inflated_job_cost /reduction.inflated_job_cost eq_refl.
- apply leq_ltn_trans with (n := service_during sched_jitter j arr_j (arr_j + R_j)).
- { rewrite /service /service_during.
- rewrite (ignore_service_before_arrival job_arrival) ?leq_addr //.
- try ( apply jobs_with_jitter_must_arrive_to_execute with (job_jitter0 := job_jitter) ) ||
- apply jobs_with_jitter_must_arrive_to_execute with (job_jitter := job_jitter).
- by apply reduction_prop.sched_jitter_jobs_execute_after_jitter.
- }
- apply: (leq_ltn_trans LESS).
- rewrite -addn1 -addnA [_ + 1]addnC addnA; apply leq_add.
- { rewrite addn1; apply contraT; rewrite -leqNgt; intro LE.
- exfalso; move: NOTCOMPs => /negP NOTCOMPs; apply: NOTCOMPs.
- rewrite /job_response_time_in_sched_susp_bounded_by /is_response_time_bound_of_job.
- rewrite /completed_by.
- apply: (leq_trans LE).
- rewrite /service /service_during.
- by rewrite [X in _ <= X](ignore_service_before_arrival job_arrival) ?leq_addr.
- }
- by apply cumulative_suspension_le_total_suspension.
- Qed.
-
- End JitterAwareScheduleIsWorse.
-
- End ProvingScheduleProperties.
-
-End JitterScheduleService.
diff --git a/classic/analysis/uni/susp/dynamic/jitter/jitter_taskset_generation.v b/classic/analysis/uni/susp/dynamic/jitter/jitter_taskset_generation.v
deleted file mode 100644
index 07727da109ae73dffab2131954c4bb3151a51ce1..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/jitter/jitter_taskset_generation.v
+++ /dev/null
@@ -1,61 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule.
-Require Import prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq.
-
-(* In this file we construct a jitter-aware task set that contains the
- jitter-aware schedule generated in the reduction. *)
-Module JitterTaskSetGeneration.
-
- Import UniprocessorScheduleWithJitter Suspension Priority
- JitterScheduleConstruction.
-
- Section GeneratingTaskset.
-
- Context {Task: eqType}.
-
- (** Analysis Setup *)
-
- (* Let ts be the original, suspension-aware task set. *)
- Variable ts: seq Task.
-
- (* Assume that tasks have cost and suspension bound. *)
- Variable original_task_cost: Task -> time.
- Variable task_suspension_bound: Task -> time.
-
- (* Consider any FP policy that is reflexive, transitive and total, i.e., that
- indicates "higher-or-equal priority". *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* Let tsk_i be any task to be analyzed... *)
- Variable tsk_i: Task.
-
- (* ...and recall the definition of higher-or-equal-priority tasks (other than tsk_i). *)
- Let other_hep_task tsk_other := higher_eq_priority tsk_other tsk_i && (tsk_other != tsk_i).
-
- (** Definition of Jitter-Aware Task Parameters *)
-
- (* We are going to define next a jitter-aware task set that models the jitter-aware
- schedule that we constructed in the reduction. *)
-
- (* First, using the task suspension bounds, we inflate the cost of the analyzed task
- in a suspension-oblivious manner. *)
- Definition inflated_task_cost (tsk: Task) :=
- if tsk == tsk_i then
- original_task_cost tsk + task_suspension_bound tsk
- else original_task_cost tsk.
-
- (* Next, assuming that higher-priority tasks have a valid response-time bound R,... *)
- Variable R: Task -> time.
-
- (* ...we define the task jitter as follows. *)
- Definition task_jitter (tsk: Task) :=
- if other_hep_task tsk then
- R tsk - original_task_cost tsk
- else 0.
-
- End GeneratingTaskset.
-
-End JitterTaskSetGeneration.
\ No newline at end of file
diff --git a/classic/analysis/uni/susp/dynamic/jitter/rta_by_reduction.v b/classic/analysis/uni/susp/dynamic/jitter/rta_by_reduction.v
deleted file mode 100644
index 65fc824fa14f78073006b6da04551d88bf06ff75..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/jitter/rta_by_reduction.v
+++ /dev/null
@@ -1,206 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task
- prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.arrival.jitter.job.
-Require Import prosa.classic.model.schedule.uni.schedulability prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule
- prosa.classic.model.schedule.uni.jitter.platform.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.valid_schedule
- prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule
- prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule_properties
- prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule_service
- prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_taskset_generation.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(* In this file, we determine task response-time bounds in suspension-aware
- schedules using a reduction to jitter-aware schedules. *)
-Module RTAByReduction.
-
- Import TaskArrival SporadicTaskset Suspension Priority Workload Service Schedulability
- UniprocessorScheduleWithJitter ResponseTime SuspensionIntervals ValidSuspensionAwareSchedule.
-
- Module susp_aware := PlatformWithSuspensions.
- Module reduction := JitterScheduleConstruction.
- Module reduction_prop := JitterScheduleProperties.
- Module reduction_serv := JitterScheduleService.
- Module ts_gen := JitterTaskSetGeneration.
-
- Section ComparingResponseTimeBounds.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> Task.
-
- (** Basic Setup & Setting *)
-
- (* Let ts be any task set with constrained deadlines. *)
- Variable ts: seq Task.
- Hypothesis H_constrained_deadlines:
- constrained_deadline_model task_period task_deadline ts.
-
- (* Consider any consistent, duplicate-free job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ...with sporadic arrivals... *)
- Hypothesis H_sporadic_arrivals:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* ...and in which all jobs come from task set ts. *)
- Hypothesis H_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Since we consider real-time tasks, assume that job deadlines are equal to task deadlines. *)
- Hypothesis H_job_deadlines_equal_task_deadlines:
- forall j, arrives_in arr_seq j -> job_deadline j = task_deadline (job_task j).
-
- (* Consider any FP policy that is reflexive, transitive and total.
- Note that the policy does not depend on the schedule. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: FP_is_total_over_task_set higher_eq_priority ts.
- Let job_higher_eq_priority := FP_to_JLDP job_task higher_eq_priority.
-
- (* Assume that jobs and tasks have associated costs... *)
- Variable job_cost: Job -> time.
- Variable task_cost: Task -> time.
-
- (* ...and suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
- Variable task_suspension_bound: Task -> time.
-
- (* Assume that jobs have positive cost. *)
- Hypothesis H_positive_costs:
- forall j, arrives_in arr_seq j -> job_cost j > 0.
-
- (* Next, consider any valid suspension-aware schedule of this arrival sequence.
- (Note: see prosa.classic.model.schedule.uni.susp.valid_schedule.v for details) *)
- Variable sched_susp: schedule Job.
- Hypothesis H_valid_schedule:
- valid_suspension_aware_schedule job_arrival arr_seq job_higher_eq_priority
- job_suspension_duration job_cost sched_susp.
-
- (** Analysis Setup *)
-
- (* Now we proceed with the proof. Let tsk be the task to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* For simplicity, let's define some local names. *)
- Let other_hep_task tsk_other :=
- higher_eq_priority tsk_other tsk && (tsk_other != tsk).
- Let task_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched_susp.
- Let job_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_job job_arrival job_cost sched_susp.
- Let completed_in_sched_susp_by := completed_by job_cost sched_susp.
- Let job_misses_no_deadline_in_sched_susp :=
- job_misses_no_deadline job_arrival job_cost job_deadline sched_susp.
-
- (* Assume that each task is associated a value R... *)
- Variable R: Task -> time.
-
- (* ...that bounds the response-time of all tasks with higher-or-equal priority
- (other than tsk) in the suspension-aware schedule sched_susp. *)
- Hypothesis H_valid_response_time_bound_of_hp_tasks:
- forall tsk_hp,
- tsk_hp \in ts ->
- other_hep_task tsk_hp ->
- task_response_time_in_sched_susp_bounded_by tsk_hp (R tsk_hp).
-
- (* The existence of those response-time bounds implies that we can compute the actual
- response times of the higher-priority jobs in sched_susp. *)
- Definition actual_response_time (j_hp: Job) : time :=
- [pick-min r <= R (job_task j_hp) |
- job_response_time_in_sched_susp_bounded_by j_hp r].
-
- (* Next, let j be any job of tsk... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* ...and assume that all the previous jobs of same task do not miss any
- deadlines in sched_susp. *)
- Hypothesis H_no_deadline_misses_for_previous_jobs:
- forall j0,
- arrives_in arr_seq j0 ->
- job_arrival j0 < job_arrival j ->
- job_task j0 = job_task j ->
- job_misses_no_deadline_in_sched_susp j0.
-
- (** Instantiation of the Reduction *)
-
- (* First, recall the parameters of the jitter-aware task set. *)
- Let inflated_task_cost := ts_gen.inflated_task_cost task_cost task_suspension_bound tsk.
- Let task_jitter := ts_gen.task_jitter task_cost higher_eq_priority tsk.
-
- (* Then, using the actual response times of higher-priority jobs as parameters, we construct
- the jitter-aware schedule from sched_susp. *)
- Let sched_jitter := reduction.sched_jitter job_arrival job_task arr_seq higher_eq_priority
- job_cost job_suspension_duration j actual_response_time.
-
- (* Next, recall the corresponding job parameters... *)
- Let inflated_job_cost := reduction.inflated_job_cost job_cost job_suspension_duration j.
- Let job_jitter := reduction.job_jitter job_arrival job_task higher_eq_priority job_cost j
- actual_response_time.
-
- (* ...and the definition of job response-time bound in sched_jitter. *)
- Let job_response_time_in_sched_jitter_bounded_by :=
- is_response_time_bound_of_job job_arrival inflated_job_cost sched_jitter.
-
- (** Central Hypothesis *)
-
- (* Assume that using some jitter-aware RTA, we determine that
- (R tsk) is a response-time bound for tsk in sched_jitter. *)
- Hypothesis H_valid_response_time_bound_in_sched_jitter:
- job_response_time_in_sched_jitter_bounded_by j (R tsk).
-
- (** **** Main Claim *)
-
- (* Then, we use the properties of the reduction to prove that (R tsk) is also a
- response-time bound for tsk in the original schedule sched_susp. *)
- Theorem valid_response_time_bound_in_sched_susp:
- job_response_time_in_sched_susp_bounded_by j (R tsk).
- Proof.
- rename H_priority_is_reflexive into REFL, H_priority_is_transitive into TRANS,
- H_priority_is_total into TOT, H_jobs_from_taskset into FROM,
- H_valid_response_time_bound_of_hp_tasks into RESPhp,
- H_valid_response_time_bound_in_sched_jitter into RESPj.
- rewrite -H_job_of_tsk /job_response_time_in_sched_susp_bounded_by.
- try ( apply reduction_serv.jitter_reduction_job_j_completes_no_later with (job_task0 := job_task)
- (ts0 := ts) (arr_seq0 := arr_seq) (higher_eq_priority0 := higher_eq_priority)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (job_deadline0 := job_deadline)
- (job_suspension_duration0 := job_suspension_duration) (R_hp := actual_response_time) ) ||
- apply reduction_serv.jitter_reduction_job_j_completes_no_later with (job_task := job_task)
- (ts := ts) (arr_seq := arr_seq) (higher_eq_priority := higher_eq_priority)
- (task_period := task_period) (task_deadline := task_deadline) (job_deadline := job_deadline)
- (job_suspension_duration := job_suspension_duration) (R_hp := actual_response_time);
- try (by done).
- {
- intros j_hp ARRhp OTHERhp.
- rewrite /actual_response_time.
- apply pick_min_holds; last by intros r _ RESP _.
- exists (R (job_task j_hp)); split; first by done.
- by apply RESPhp; try (by done); [by apply FROM | rewrite /other_hep_task -H_job_of_tsk].
- }
- {
- by rewrite /is_response_time_bound_of_job H_job_of_tsk; apply RESPj.
- }
- Qed.
-
- End ComparingResponseTimeBounds.
-
-End RTAByReduction.
diff --git a/classic/analysis/uni/susp/dynamic/jitter/taskset_membership.v b/classic/analysis/uni/susp/dynamic/jitter/taskset_membership.v
deleted file mode 100644
index 353f00aa08a6a51bcaa35a8df7048744751832de..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/jitter/taskset_membership.v
+++ /dev/null
@@ -1,354 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.arrival.jitter.job.
-Require Import prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.platform
- prosa.classic.model.schedule.uni.susp.valid_schedule.
-Require Import prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_schedule
- prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_taskset_generation.
-Require Import prosa.classic.analysis.uni.susp.sustainability.singlecost.reduction
- prosa.classic.analysis.uni.susp.sustainability.singlecost.reduction_properties.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file we prove that the jitter-aware schedule sched_jitter used in the
- reduction is an instance of the jitter-aware task set that we analyze. *)
-Module TaskSetMembership.
-
- Import SporadicTaskset Suspension Priority ValidSuspensionAwareSchedule
- ScheduleWithSuspensions ResponseTime PlatformWithSuspensions.
-
- Module reduction := JitterScheduleConstruction.
- Module ts_gen := JitterTaskSetGeneration.
- Module sust := SustainabilitySingleCost.
- Module sust_prop := SustainabilitySingleCostProperties.
- Module valid_sched := ValidSuspensionAwareSchedule.
- Module job_susp := Job.
- Module job_jitter := JobWithJitter.
-
- Section ProvingMembership.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> Task.
-
- (** Basic Setup & Setting*)
-
- (* Let ts be any suspension-aware task set. *)
- Variable ts: seq Task.
-
- (* Consider any job arrival sequence with consistent, duplicate-free arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ...where jobs come from the task set. *)
- Hypothesis H_jobs_come_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...and the associated job and task costs. *)
- Variable job_cost: Job -> time.
- Variable task_cost: Task -> time.
-
- (* Assume that jobs and tasks have associated suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
- Variable task_suspension_bound: Task -> time.
-
- (* Assume any FP policy that is reflexive, transitive and total... *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: FP_is_total_over_task_set higher_eq_priority ts.
- Let job_higher_eq_priority := FP_to_JLDP job_task higher_eq_priority.
-
- (* Recall the definition of a valid suspension-aware schedule. *)
- Let is_valid_suspension_aware_schedule :=
- valid_suspension_aware_schedule job_arrival arr_seq job_higher_eq_priority
- job_suspension_duration.
-
- (* Next, consider any valid suspension-aware schedule of this arrival sequence.
- (Note: see prosa.classic.model.schedule.uni.susp.valid_schedule.v for details) *)
- Variable sched_susp: schedule Job.
- Hypothesis H_valid_schedule:
- valid_suspension_aware_schedule job_arrival arr_seq job_higher_eq_priority
- job_suspension_duration job_cost sched_susp.
-
- (* Recall the definition of response-time bounds in sched_susp. *)
- Let task_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched_susp.
- Let job_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_job job_arrival job_cost sched_susp.
-
- (** Analysis Setup *)
-
- (* Let tsk_i be any task to be analyzed... *)
- Variable tsk_i: Task.
- Hypothesis H_tsk_in_ts: tsk_i \in ts.
-
- (* ...and let j be any job of this task. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk_i: job_task j = tsk_i.
-
- (* Also recall the definition of task response-time bound with any job cost and schedule... *)
- Let is_task_response_time_bound_with job_cost sched :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- (* ...and the definition of higher-or-equal-priority tasks (other than tsk_i). *)
- Let other_hep_task tsk_other := higher_eq_priority tsk_other tsk_i && (tsk_other != tsk_i).
-
- (* Next, assume that for each of those higher-or-equal-priority tasks (other than tsk_i),
- we know a response-time bound R that is valid across all suspension-aware schedules of ts. *)
- Variable R: Task -> time.
- Hypothesis H_valid_response_time_bound_of_hp_tasks_in_all_schedules:
- forall job_cost sched,
- is_valid_suspension_aware_schedule job_cost sched ->
- forall tsk_hp,
- tsk_hp \in ts ->
- other_hep_task tsk_hp ->
- is_task_response_time_bound_with job_cost sched tsk_hp (R tsk_hp).
-
- (* The existence of response-time bounds across all schedules implies that we can find
- actual response times of the higher-priority jobs in sched_susp... *)
- Definition actual_response_time (j_hp: Job) : time :=
- [pick-min r <= R (job_task j_hp) |
- job_response_time_in_sched_susp_bounded_by j_hp r].
-
- (* ...and show that they are valid... *)
- Corollary actual_response_time_is_valid:
- forall j_hp,
- arrives_in arr_seq j_hp ->
- other_hep_task (job_task j_hp) ->
- job_response_time_in_sched_susp_bounded_by j_hp (actual_response_time j_hp).
- Proof.
- rename H_valid_response_time_bound_of_hp_tasks_in_all_schedules into RESPhp,
- H_jobs_come_from_taskset into FROM.
- intros j_hp ARRhp HP.
- rewrite /actual_response_time.
- apply pick_min_holds; last by done.
- exists (R (job_task j_hp)); split; first by done.
- by apply RESPhp; try (by done); first by apply FROM.
- Qed.
-
- (* ...and tight. *)
- Corollary actual_response_time_is_minimum:
- forall j_hp r_hp,
- arrives_in arr_seq j_hp ->
- other_hep_task (job_task j_hp) ->
- job_response_time_in_sched_susp_bounded_by j_hp r_hp ->
- actual_response_time j_hp <= r_hp.
- Proof.
- rename H_valid_response_time_bound_of_hp_tasks_in_all_schedules into RESPhp,
- H_jobs_come_from_taskset into FROM.
- intros j_hp r_hp ARRhp HP RESP.
- case (leqP r_hp (R (job_task j_hp))) => [LT | GE].
- {
- rewrite /actual_response_time.
- apply pick_min_holds;
- last by intros x RESPx _ MINx; rewrite -ltnS in LT; apply (MINx (Ordinal LT)).
- exists (R (job_task j_hp)); split; first by done.
- by apply RESPhp; try (by done); first by apply FROM.
- }
- {
- apply leq_trans with (n := (R (job_task j_hp))); last by apply ltnW.
- rewrite -ltnS /actual_response_time.
- apply pick_min_ltn.
- exists (R (job_task j_hp)); split; first by done.
- by apply RESPhp; try (by done); first by apply FROM.
- }
- Qed.
-
- (** Instantiation of the Reduction *)
-
- (* Using the actual response time of higher-priority jobs as a parameter, we construct
- the jitter-aware schedule from sched_susp. *)
- Let inflated_job_cost := reduction.inflated_job_cost job_cost job_suspension_duration j.
- Let job_jitter := reduction.job_jitter job_arrival job_task higher_eq_priority job_cost j
- actual_response_time.
-
- (* We also recall the parameters of the generated jitter-aware task set. *)
- Let inflated_task_cost := ts_gen.inflated_task_cost task_cost task_suspension_bound tsk_i.
- Let task_jitter := ts_gen.task_jitter task_cost higher_eq_priority tsk_i R.
-
- (** Proof of Task Set Membership *)
-
- (* Now we proceed with the main claim. We are going to show that the job parameters in the
- jitter-aware schedule sched_susp are an instance of the task set parameters. *)
-
- (* Assume that the original costs are positive... *)
- Hypothesis H_positive_costs:
- forall j, arrives_in arr_seq j -> job_cost j > 0.
-
- (* ...and no larger than the task costs. *)
- Hypothesis H_job_cost_le_task_cost:
- forall j,
- arrives_in arr_seq j ->
- job_cost j <= task_cost (job_task j).
-
- (* Also assume that job suspension times are bounded by the task suspension bounds. *)
- Hypothesis H_dynamic_suspensions:
- dynamic_suspension_model job_cost job_task job_suspension_duration task_suspension_bound.
-
- (* We begin by showing that the inflated job costs remain positive... *)
- Section JobCostPositive.
-
- Lemma ts_membership_inflated_job_cost_positive:
- forall j, arrives_in arr_seq j -> inflated_job_cost j > 0.
- Proof.
- intros j0 ARR0.
- apply leq_trans with (n := job_cost j0); first by apply H_positive_costs.
- rewrite /inflated_job_cost /reduction.inflated_job_cost.
- by case: ifP => _; first by apply leq_addr.
- Qed.
-
- End JobCostPositive.
-
- (* ...and no larger than the inflated task costs. *)
- Section JobCostBoundedByTaskCost.
-
- Lemma ts_membership_inflated_job_cost_le_inflated_task_cost:
- forall j,
- arrives_in arr_seq j ->
- inflated_job_cost j <= inflated_task_cost (job_task j).
- Proof.
- intros j' ARR'.
- rewrite /inflated_job_cost /inflated_task_cost /reduction.inflated_job_cost
- /ts_gen.inflated_task_cost.
- case: ifP => [/eqP SAME | NEQ]; subst.
- {
- rewrite eq_refl; apply leq_add; last by apply H_dynamic_suspensions.
- by apply H_job_cost_le_task_cost.
- }
- case: ifP => [SAMEtsk | DIFFtsk]; last by apply H_job_cost_le_task_cost.
- apply leq_trans with (n := task_cost (job_task j')); last by apply leq_addr.
- by apply H_job_cost_le_task_cost.
- Qed.
-
- End JobCostBoundedByTaskCost.
-
- (* Finally, we show that the job jitter in sched_susp is upper-bounded by the task jitter.
- This only concerns higher-priority jobs, which are assigned non-zero jitter to
- compensate suspension times. *)
- Section JobJitterBoundedByTaskJitter.
-
- (* Let any_j be any job from the arrival sequence. *)
- Variable any_j: Job.
- Hypothesis H_any_j_arrives: arrives_in arr_seq any_j.
-
- (* Since most parts of the proof are trivial, we focus on the more complicated case
- of higher-priority jobs. *)
- Section JitterOfHigherPriorityJobs.
-
- (* Suppose that any_j is a higher-or-equal-priority job from some task other than tsk_i. *)
- Hypothesis H_higher_priority: higher_eq_priority (job_task any_j) tsk_i.
- Hypothesis H_different_task: job_task any_j != tsk_i.
-
- (* Recall that we want to prove that job_jitter any_j <= task_jitter (job_task any_j).
- By definition, this amounts to showing that:
- actual_response_time any_j - job_cost any_j <=
- R (job_task any_j) - task_cost (job_task any_j). *)
-
- (* The proof follows by a sustainability argument based on the following reduction. *)
-
- (* By inflating the cost of any_j to its worst-case execution time...*)
- Let higher_cost_wcet j' :=
- if j' == any_j then task_cost (job_task any_j) else job_cost j'.
-
- (* ...we construct a new suspension-aware schedule sched_susp_highercost where the response
- time of any_j is as large as in the original schedule sched_susp.
- (For more details, see analysis/uni/susp/sustainability/cost. ) *)
- Let sched_susp_highercost :=
- sust.sched_susp_highercost job_arrival arr_seq job_higher_eq_priority
- sched_susp job_suspension_duration higher_cost_wcet.
-
- (* Next, recall the definition of task response-time bounds in sched_susp_highercost. *)
- Let task_response_time_in_sched_susp_highercost_bounded_by :=
- is_response_time_bound_of_task job_arrival higher_cost_wcet job_task arr_seq
- sched_susp_highercost.
-
- (* Since the response-time bounds R are valid across all suspension-aware schedules
- of task set ts, they are also valid in sched_susp_higher_cost. *)
- Remark response_time_bound_in_sched_susp_highercost:
- forall tsk_hp,
- tsk_hp \in ts ->
- other_hep_task tsk_hp ->
- task_response_time_in_sched_susp_highercost_bounded_by tsk_hp (R tsk_hp).
- Proof.
- rename H_valid_response_time_bound_of_hp_tasks_in_all_schedules into RESPhp,
- H_jobs_come_from_taskset into FROM, H_valid_schedule into VALID.
- split_conj VALID.
- feed (RESPhp higher_cost_wcet sched_susp_highercost).
- {
- repeat split.
- - by apply sust_prop.sched_susp_highercost_jobs_come_from_arrival_sequence.
- - by apply sust_prop.sched_susp_highercost_jobs_must_arrive_to_execute.
- - by apply sust_prop.sched_susp_highercost_completed_jobs_dont_execute.
- - by apply sust_prop.sched_susp_highercost_work_conserving.
- - apply sust_prop.sched_susp_highercost_respects_policy; try (by done).
- -- by intros t j1 j2 j3; apply H_priority_is_transitive.
- -- by intros j1 j2 t ARR1 ARR2; apply/orP; apply H_priority_is_total; apply FROM.
- - by apply sust_prop.sched_susp_highercost_respects_self_suspensions.
- }
- by intros tsk_hp IN Ohp; by apply RESPhp.
- Qed.
-
- (* Finally, by comparing the two schedules, we prove that the difference between the
- actual response time and job cost is bounded by the difference between the
- response-time bound and the task cost. *)
- Lemma ts_membership_difference_in_response_times:
- actual_response_time any_j - job_cost any_j <=
- R (job_task any_j) - task_cost (job_task any_j).
- Proof.
- have VALIDr := actual_response_time_is_valid.
- have MINr := actual_response_time_is_minimum.
- have RESPhp := response_time_bound_in_sched_susp_highercost.
- rename H_jobs_come_from_taskset into FROM, H_valid_schedule into VALIDSCHED.
- split_conj VALIDSCHED.
- apply leq_trans with (n := R (job_task any_j) - higher_cost_wcet any_j);
- last by apply leq_sub2l; rewrite /higher_cost_wcet eq_refl.
- try ( apply sust_prop.sched_susp_highercost_incurs_more_interference with
- (job_arrival0 := job_arrival) (arr_seq0 := arr_seq) (sched_susp0 := sched_susp)
- (higher_eq_priority0:=job_higher_eq_priority)
- (job_suspension_duration0 := job_suspension_duration); try (by done) ) ||
- apply sust_prop.sched_susp_highercost_incurs_more_interference with
- (job_arrival := job_arrival) (arr_seq := arr_seq) (sched_susp := sched_susp)
- (higher_eq_priority:=job_higher_eq_priority)
- (job_suspension_duration := job_suspension_duration); try (by done).
- - by intros t j1; apply H_priority_is_reflexive.
- - by rewrite /higher_cost_wcet eq_refl; apply H_job_cost_le_task_cost.
- - by move => j' NEQ; apply negbTE in NEQ; rewrite /higher_cost_wcet NEQ.
- - by apply H_positive_costs.
- - by apply VALIDr; try (by done); apply/andP; split.
- - by intros r' RESP; apply MINr; try (by done); first by apply/andP; split.
- - by apply RESPhp; try (by done); [apply FROM | apply/andP; split].
- Qed.
-
- End JitterOfHigherPriorityJobs.
-
- (* Using the lemmas above, we conclude that the job jitter parameter is
- upper-bounded by the task jitter for any job in the arrival sequence. *)
- Lemma ts_membership_job_jitter_le_task_jitter:
- job_jitter any_j <= task_jitter (job_task any_j).
- Proof.
- have DIFF := ts_membership_difference_in_response_times.
- rewrite /job_jitter /task_jitter /reduction.job_jitter /ts_gen.task_jitter H_job_of_tsk_i.
- case: ifP => // /andP [HP' NEQ].
- rewrite /minn; case: ifP => [LTdist | GEdist]; last by apply DIFF.
- case (leqP (job_arrival j) (job_arrival any_j)) => [AFTER | BEFORE];
- first by apply leq_trans with (n := 0); first rewrite leqn0 subn_eq0.
- apply leq_trans with (n := actual_response_time any_j - job_cost any_j); first by apply ltnW.
- by apply DIFF.
- Qed.
-
- End JobJitterBoundedByTaskJitter.
-
- End ProvingMembership.
-
-End TaskSetMembership.
diff --git a/classic/analysis/uni/susp/dynamic/jitter/taskset_rta.v b/classic/analysis/uni/susp/dynamic/jitter/taskset_rta.v
deleted file mode 100644
index 3dcf1a9a8498d5c9e2e2d4a042122a96c3b1a6de..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/jitter/taskset_rta.v
+++ /dev/null
@@ -1,238 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.arrival.jitter.job.
-Require Import prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.susp.schedule prosa.classic.model.schedule.uni.susp.platform
- prosa.classic.model.schedule.uni.susp.valid_schedule.
-Require Import prosa.classic.model.schedule.uni.jitter.valid_schedule.
-Require Import prosa.classic.analysis.uni.susp.dynamic.jitter.rta_by_reduction
- prosa.classic.analysis.uni.susp.dynamic.jitter.jitter_taskset_generation
- prosa.classic.analysis.uni.susp.dynamic.jitter.taskset_membership.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file we use the reduction to jitter-aware schedule to analyze
- individual tasks using RTA. *)
-Module TaskSetRTA.
-
- Import SporadicTaskset Suspension Priority ValidSuspensionAwareSchedule
- ScheduleWithSuspensions ResponseTime PlatformWithSuspensions
- TaskArrival ValidJitterAwareSchedule RTAByReduction TaskSetMembership.
-
- Module ts_gen := JitterTaskSetGeneration.
- Module job_susp := Job.
- Module job_jitter := JobWithJitter.
-
- (* In this section, we are going to assume we have obtained response-time
- bounds for high-priority tasks and then use the reduction to infer a
- response-time bound for a particular task. *)
- Section PerTaskAnalysis.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> Task.
-
- (** Basic Setup & Setting*)
-
- (* Let ts be any task set with constrained deadlines. *)
- Variable ts: seq Task.
- Hypothesis H_constrained_deadlines:
- constrained_deadline_model task_period task_deadline ts.
-
- (* Consider any consistent, duplicate-free job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ...with sporadic arrivals... *)
- Hypothesis H_sporadic_arrivals:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* ...and in which all jobs come from the task set. *)
- Hypothesis H_jobs_come_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Assume that job deadlines equal task deadlines. *)
- Hypothesis H_job_deadline_eq_task_deadline:
- forall j, arrives_in arr_seq j -> job_deadline j = task_deadline (job_task j).
-
- (* Consider any job suspension times and task suspension bound. *)
- Variable job_suspension_duration: job_suspension Job.
- Variable task_suspension_bound: Task -> time.
-
- (* Assume any FP policy that is reflexive, transitive and total. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: FP_is_total_over_task_set higher_eq_priority ts.
- Let job_higher_eq_priority := FP_to_JLDP job_task higher_eq_priority.
-
- (* Recall the definition of a valid suspension-aware and jitter-aware schedules. *)
- Let is_valid_suspension_aware_schedule :=
- valid_suspension_aware_schedule job_arrival arr_seq job_higher_eq_priority
- job_suspension_duration.
- Let is_valid_jitter_aware_schedule :=
- valid_jitter_aware_schedule job_arrival arr_seq job_higher_eq_priority.
-
- (* Also recall the definition of task response-time bound for given job cost and schedule. *)
- Let is_task_response_time_bound_with job_cost sched :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- (** Analysis Setup *)
-
- (* Let tsk_i be any task to be analyzed. *)
- Variable tsk_i: Task.
- Hypothesis H_tsk_in_ts: tsk_i \in ts.
-
- (* Recall the definition of higher-or-equal-priority tasks (other than tsk_i). *)
- Let other_hep_task tsk_other := higher_eq_priority tsk_other tsk_i && (tsk_other != tsk_i).
-
- (* Next, assume that for each of those higher-or-equal-priority tasks (other than tsk_i),
- we know a response-time bound R that is valid across all suspension-aware schedules of ts. *)
- Variable R: Task -> time.
- Hypothesis H_valid_response_time_bound_of_hp_tasks_in_all_schedules:
- forall job_cost sched,
- is_valid_suspension_aware_schedule job_cost sched ->
- forall tsk_hp,
- tsk_hp \in ts ->
- other_hep_task tsk_hp ->
- is_task_response_time_bound_with job_cost sched tsk_hp (R tsk_hp).
-
- (* Since this analysis is for constrained deadlines, also assume that
- (R tsk_i) is no larger than the deadline of tsk_i. *)
- Hypothesis H_R_le_deadline: R tsk_i <= task_deadline tsk_i.
-
- (** Recall: Properties of Valid Jitter-Aware Jobs *)
-
- (* Recall that a valid jitter-aware schedule must have positive job costs,... *)
- Let job_cost_positive job_cost :=
- forall j, arrives_in arr_seq j -> job_cost j > 0.
-
- (* ...job costs that are no larger than the task costs... *)
- Let job_cost_le_task_cost job_cost task_cost :=
- forall j,
- arrives_in arr_seq j ->
- job_cost j <= task_cost (job_task j).
-
- (* ...and job jitter no larger than the task jitter. *)
- Let job_jitter_le_task_jitter job_jitter task_jitter :=
- forall j,
- arrives_in arr_seq j ->
- job_jitter j <= task_jitter (job_task j).
-
- (* This is summarized in the following predicate. *)
- Definition valid_jobs_with_jitter job_cost job_jitter task_cost task_jitter :=
- job_cost_positive job_cost /\
- job_cost_le_task_cost job_cost task_cost /\
- job_jitter_le_task_jitter job_jitter task_jitter.
-
- (** Conclusion: Response-time Bound for Task tsk_i *)
-
- (* Recall the parameters of the generated jitter-aware task set. *)
- Let inflated_task_cost := ts_gen.inflated_task_cost task_cost task_suspension_bound tsk_i.
- Let task_jitter := ts_gen.task_jitter task_cost higher_eq_priority tsk_i R.
-
- (* By using a jitter-aware RTA, assume that we proved that (R tsk_i) is a valid
- response-time bound for task tsk_i in any jitter-aware schedule of the same
- arrival sequence. *)
- Hypothesis H_valid_response_time_bound_of_tsk_i:
- forall job_cost job_jitter sched,
- valid_jobs_with_jitter job_cost job_jitter inflated_task_cost task_jitter ->
- is_valid_jitter_aware_schedule job_cost job_jitter sched ->
- is_task_response_time_bound_with job_cost sched tsk_i (R tsk_i).
-
- (* Next, consider any job cost function... *)
- Variable job_cost: Job -> time.
-
- (* ...and let sched_susp be any valid suspension-aware schedule with those job costs. *)
- Variable sched_susp: schedule Job.
- Hypothesis H_valid_schedule: is_valid_suspension_aware_schedule job_cost sched_susp.
-
- (* Assume that the job costs are positive... *)
- Hypothesis H_job_cost_positive:
- forall j, arrives_in arr_seq j -> job_cost j > 0.
-
- (* ...and no larger than the task costs. *)
- Hypothesis H_job_cost_le_task_cost:
- forall j,
- arrives_in arr_seq j ->
- job_cost j <= task_cost (job_task j).
-
- (* Also assume that job suspension times are bounded by the task suspension bounds. *)
- Hypothesis H_dynamic_suspensions:
- dynamic_suspension_model job_cost job_task job_suspension_duration task_suspension_bound.
-
- (* Using the reduction to a jitter-aware schedule, we conclude that (R tsk_i) must
- also be a response-time bound for task tsk_i in the suspension-aware schedule. *)
- Theorem valid_response_time_bound_of_tsk_i:
- is_task_response_time_bound_with job_cost sched_susp tsk_i (R tsk_i).
- Proof.
- unfold is_task_response_time_bound_with,
- is_response_time_bound_of_task, is_response_time_bound_of_job in *.
- rename H_valid_response_time_bound_of_hp_tasks_in_all_schedules into RESPhp,
- H_valid_response_time_bound_of_tsk_i into RESPi.
-
- move: (H_valid_schedule) => [_ [_ [COMP _]]].
- intros j ARRj JOBtsk.
-
- (* First, rewrite the claim in terms of the *absolute* response-time bound (arrival + R) *)
- remember (job_arrival j + R tsk_i) as ctime.
-
- (* Now, we apply strong induction on the absolute response-time bound. *)
- generalize dependent j.
- induction ctime as [ctime IH] using strong_ind.
-
- intros j ARRj JOBtsk EQc; subst ctime.
-
- (* First, let's simplify the induction hypothesis. *)
- have BEFOREok:
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk_i ->
- job_arrival j0 < job_arrival j ->
- completed_by job_cost sched_susp j0 (job_arrival j0 + R tsk_i);
- [by ins; apply IH; try (by done); rewrite ltn_add2r | clear IH].
- set actual_response_time :=
- actual_response_time job_arrival job_task job_cost sched_susp R.
- set inflated_job_cost :=
- reduction.inflated_job_cost job_cost job_suspension_duration.
- set job_jitter := reduction.job_jitter job_arrival job_task
- higher_eq_priority job_cost j actual_response_time.
- try ( apply valid_response_time_bound_in_sched_susp with
- (task_period0 := task_period) (task_deadline0 := task_deadline)
- (job_deadline0 := job_deadline) (job_task0 := job_task) (ts0 := ts)
- (arr_seq0 := arr_seq) (higher_eq_priority0 := higher_eq_priority)
- (job_suspension_duration0:=job_suspension_duration); try (by done) ) ||
- apply valid_response_time_bound_in_sched_susp with
- (task_period := task_period) (task_deadline := task_deadline)
- (job_deadline := job_deadline) (job_task := job_task) (ts := ts)
- (arr_seq := arr_seq) (higher_eq_priority := higher_eq_priority)
- (job_suspension_duration:=job_suspension_duration); try (by done).
- - by intros tsk_hp IN OHEP j'; apply RESPhp.
- {
- intros j0 ARR0 LT0 JOB0.
- apply completion_monotonic with (t := job_arrival j0 + R tsk_i);
- [ | by apply BEFOREok; rewrite // -JOBtsk].
- by rewrite leq_add2l H_job_deadline_eq_task_deadline // JOB0 JOBtsk.
- }
- {
- apply RESPi with (job_jitter := job_jitter); try (by done);
- last by eapply reduction_prop.sched_jitter_is_valid; eauto 1.
- repeat split; intros j' ARR.
- - by eapply ts_membership_inflated_job_cost_positive; eauto 1.
- - by eapply ts_membership_inflated_job_cost_le_inflated_task_cost;
- eauto 1.
- - by eapply ts_membership_job_jitter_le_task_jitter; eauto 1.
- }
- Qed.
-
- End PerTaskAnalysis.
-
-End TaskSetRTA.
diff --git a/classic/analysis/uni/susp/dynamic/oblivious/fp_rta.v b/classic/analysis/uni/susp/dynamic/oblivious/fp_rta.v
deleted file mode 100644
index 4102429d90cda7d22a73318fb964948a2414ddff..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/oblivious/fp_rta.v
+++ /dev/null
@@ -1,169 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.priority prosa.classic.model.suspension prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.analysis.uni.basic.fp_rta_comp.
-Require Import prosa.classic.analysis.uni.susp.dynamic.oblivious.reduction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module SuspensionObliviousFP.
-
- Import Job TaskArrival SporadicTaskset Suspension Priority Schedulability
- PlatformWithSuspensions SuspensionIntervals.
- Export ResponseTimeIterationFP ReductionToBasicSchedule.
-
- (* In this section, we formalize the suspension-oblivious RTA
- for fixed-priority tasks under the dynamic self-suspension model.
- This is just a straightforward application of the reduction
- in analysis/uni/susp/dynamic/oblivious/reduction.v with the basic
- response-time analysis for uniprocessor FP scheduling. *)
- Section ReductionToBasicAnalysis.
-
- Context {SporadicTask: eqType}.
- Variable task_cost: SporadicTask -> time.
- Variable task_period: SporadicTask -> time.
- Variable task_deadline: SporadicTask -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> SporadicTask.
-
- (* Let ts be any task set to be analyzed... *)
- Variable ts: taskset_of SporadicTask.
-
- (* ...such that tasks have valid parameters. *)
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Next, consider any job arrival sequence with consistent, duplicate-free arrivals,... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ...in which all jobs come from task set ts, ... *)
- Hypothesis H_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...have valid parameters,...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ... and satisfy the sporadic task model. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider any FP policy that is reflexive, transitive and total, indicating
- "higher or equal task priority". *)
- Variable higher_eq_priority: FP_policy SporadicTask.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: FP_is_total_over_task_set higher_eq_priority ts.
-
- (* Assume that the total suspension time of any job is bounded according
- to the dynamic suspension model. *)
- Variable next_suspension: job_suspension Job.
- Variable task_suspension_bound: SporadicTask -> time.
- Hypothesis H_dynamic_suspensions:
- dynamic_suspension_model job_cost job_task next_suspension task_suspension_bound.
-
- (* As part of the analysis, we are going to use task costs inflated with suspension bounds, ... *)
- Let inflated_cost := inflated_task_cost task_cost task_suspension_bound.
-
- (* ...with the condition that they are no larger than the deadline nor the period of each task. *)
- Hypothesis H_inflated_cost_le_deadline_and_period:
- forall tsk,
- tsk \in ts ->
- inflated_cost tsk <= task_deadline tsk /\
- inflated_cost tsk <= task_period tsk.
-
- (* Now we proceed with the schedulability analysis. *)
- Section MainProof.
-
- (* Consider any suspension-aware schedule of the arrival sequence... *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ...where jobs only execute after they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
-
- (* ...and no longer than their execution costs. *)
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Also assume that the schedule is work-conserving when there are non-suspended jobs, ... *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost next_suspension arr_seq sched.
-
- (* ...that the schedule respects job priority... *)
- Hypothesis H_respects_priority:
- respects_FP_policy job_arrival job_cost job_task next_suspension arr_seq
- sched higher_eq_priority.
-
- (* ...and that suspended jobs are not allowed to be scheduled. *)
- Hypothesis H_respects_self_suspensions:
- respects_self_suspensions job_arrival job_cost next_suspension sched.
-
- (* For simplicity, let's also define some local names. *)
- Let task_is_schedulable :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, recall the response-time analysis for FP scheduling instantiated with
- the inflated task costs. *)
- Let claimed_to_be_schedulable :=
- fp_schedulable inflated_cost task_period task_deadline higher_eq_priority.
-
- (* Then, we prove that if this suspension-oblivious response-time analysis suceeds... *)
- Hypothesis H_claimed_schedulable_by_suspension_oblivious_RTA:
- claimed_to_be_schedulable ts.
-
- (* ...then no task misses its deadline in the suspension-aware schedule.
- The proof is a straightforward application of the following lemma from
- reduction.v: suspension_oblivious_preserves_schedulability. *)
- Theorem suspension_oblivious_fp_rta_implies_schedulability:
- forall tsk,
- tsk \in ts ->
- task_is_schedulable tsk.
- Proof.
- rename H_claimed_schedulable_by_suspension_oblivious_RTA into SCHED,
- H_jobs_from_taskset into FROMTS, H_inflated_cost_le_deadline_and_period into LEdl.
- intros tsk INts j ARRj JOBtsk.
- try ( apply suspension_oblivious_preserves_schedulability with
- (higher_eq_priority0 := (FP_to_JLDP job_task higher_eq_priority))
- (arr_seq0 := arr_seq) (next_suspension0 := next_suspension); try (by done) ) ||
- apply suspension_oblivious_preserves_schedulability with
- (higher_eq_priority := (FP_to_JLDP job_task higher_eq_priority))
- (arr_seq := arr_seq) (next_suspension := next_suspension); try (by done).
- - by intros t y x z; apply H_priority_is_transitive.
- - by intros j1 j2 t ARR1 ARR2; apply/orP; apply H_priority_is_total; apply FROMTS.
- try ( apply jobs_schedulable_by_fp_rta with (task_cost0 := inflated_cost) (ts0 := ts)
- (task_period0 := task_period) (task_deadline0 := task_deadline) (job_task0 := job_task)
- (higher_eq_priority0 := higher_eq_priority); try (by done) ) ||
- apply jobs_schedulable_by_fp_rta with (task_cost := inflated_cost) (ts := ts)
- (task_period := task_period) (task_deadline := task_deadline) (job_task := job_task)
- (higher_eq_priority := higher_eq_priority); try (by done).
- - by apply suspension_oblivious_task_parameters_remain_valid.
- - try ( by apply suspension_oblivious_job_parameters_remain_valid with (ts0 := ts)
- (task_period0 := task_period) ) ||
- by apply suspension_oblivious_job_parameters_remain_valid with (ts := ts)
- (task_period := task_period).
- - by apply sched_newjobs_come_from_arrival_sequence.
- - by apply sched_new_jobs_must_arrive_to_execute.
- - by apply sched_new_completed_jobs_dont_execute.
- - by apply sched_new_work_conserving.
- {
- intros j_low j_hp t; apply sched_new_respects_policy; try (by done).
- - by intros t' j1 j2 j3; apply H_priority_is_transitive.
- - by intros j1 j2 t' ARR1 ARR2; apply/orP; apply H_priority_is_total; apply FROMTS.
- }
- Qed.
-
- End MainProof.
-
- End ReductionToBasicAnalysis.
-
-End SuspensionObliviousFP.
diff --git a/classic/analysis/uni/susp/dynamic/oblivious/reduction.v b/classic/analysis/uni/susp/dynamic/oblivious/reduction.v
deleted file mode 100644
index c628567ccb3971e8020035d33a2b3f3c6bb6d0b1..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/dynamic/oblivious/reduction.v
+++ /dev/null
@@ -1,745 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability.
-Require Import prosa.classic.model.schedule.uni.basic.platform.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-Require Import prosa.classic.implementation.uni.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop path.
-
-Module ReductionToBasicSchedule.
-
- Import Job SporadicTaskset Suspension Priority SuspensionIntervals
- Schedulability ScheduleConstruction.
-
- (* Recall the platform constraints for suspension-oblivious and suspension-aware schedules. *)
- Module susp := ScheduleWithSuspensions.
- Module susp_oblivious := Platform.
- Module susp_aware := PlatformWithSuspensions.
-
- (* In this section, we perform a reduction from a suspension-aware schedule
- to a suspension-oblivious schedule, in which jobs have inflated execution costs. *)
- Section Reduction.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Let ts be any task set to be analyzed. *)
- Variable ts: seq Task.
-
- (* Next, consider any consistent job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
-
- (* ...whose jobs come from task set ts. *)
- Hypothesis H_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Consider any JLDP policy that is reflexive, transitive and total, i.e., that
- indicates "higher or equal priority". *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_is_reflexive: JLDP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: JLDP_is_total arr_seq higher_eq_priority.
-
- (* Consider the original job and task costs. *)
- Variable original_job_cost: Job -> time.
- Variable original_task_cost: Task -> time.
-
- (* Assume that the maximum suspension time of any job is bounded according
- to the dynamic suspension model. *)
- Variable next_suspension: job_suspension Job.
- Variable task_suspension_bound: Task -> time.
- Hypothesis H_dynamic_suspensions:
- dynamic_suspension_model original_job_cost job_task next_suspension task_suspension_bound.
-
- (* Next, consider any suspension-aware schedule of this arrival sequence. *)
- Variable sched_susp: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched_susp arr_seq.
-
- (* Assume that jobs only execute after they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched_susp.
-
- (* ...and no longer than their execution costs. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute original_job_cost sched_susp.
-
- (* Also assume that the schedule is work-conserving if there are non-suspended jobs, ... *)
- Hypothesis H_work_conserving:
- susp_aware.work_conserving job_arrival original_job_cost next_suspension arr_seq sched_susp.
-
- (* ...that the schedule respects job priority... *)
- Hypothesis H_respects_priority:
- susp_aware.respects_JLDP_policy job_arrival original_job_cost next_suspension
- arr_seq sched_susp higher_eq_priority.
-
- (* ...and that suspended jobs are not allowed to be scheduled. *)
- Hypothesis H_respects_self_suspensions:
- respects_self_suspensions job_arrival original_job_cost next_suspension sched_susp.
-
- (* Now we proceed with the reduction. First, we formalize the inflation of job and task costs. *)
- Section CostInflation.
-
- (* Recall the total suspension time of a job in the original schedule. *)
- Let job_total_suspension :=
- total_suspension original_job_cost next_suspension.
-
- (* To inflate job costs, we just add the total suspension of the job. *)
- Definition inflated_job_cost (j: Job) :=
- original_job_cost j + job_total_suspension j.
-
- (* Similarly, to inflate task costs, we just add its suspension bound. *)
- Definition inflated_task_cost (tsk: Task) :=
- original_task_cost tsk + task_suspension_bound tsk.
-
- (* As shown next, this inflation produces job valid parameters. *)
- Section NewParametersAreValid.
-
- (* Recall the definition of valid sporadic jobs and tasks. *)
- Let jobs_are_valid job_cost task_cost :=
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
- Let tasks_are_valid task_cost :=
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* If the inflated task costs are no larger than the deadline nor period of each task, ... *)
- Hypothesis H_inflated_cost_le_deadline_and_period:
- forall tsk,
- tsk \in ts ->
- inflated_task_cost tsk <= task_deadline tsk /\
- inflated_task_cost tsk <= task_period tsk.
-
- (* ...then we can prove that job parameters remain valid after the inflation. *)
- Lemma suspension_oblivious_job_parameters_remain_valid:
- jobs_are_valid original_job_cost original_task_cost ->
- jobs_are_valid inflated_job_cost inflated_task_cost.
- Proof.
- rename H_inflated_cost_le_deadline_and_period into LEdl,
- H_dynamic_suspensions into DYN, H_jobs_from_taskset into FROMTS.
- unfold jobs_are_valid, valid_sporadic_job, valid_realtime_job.
- intros VALIDjob j ARRj; specialize (VALIDjob j ARRj); des.
- split.
- {
- split;
- first by apply leq_trans with (n := original_job_cost j);
- last by apply leq_addr.
- split; last by done.
- rewrite /job_cost_le_deadline /inflated_job_cost.
- feed (LEdl (job_task j)); [by apply FROMTS | move: LEdl => [LEdl _]].
- apply leq_trans with (n := inflated_task_cost (job_task j));
- last by rewrite VALIDjob1 LEdl.
- by apply leq_add; last by apply DYN.
- }
- split; last by done.
- by apply leq_add; last by apply DYN.
- Qed.
-
- (* The same applies for task parameters. *)
- Lemma suspension_oblivious_task_parameters_remain_valid:
- tasks_are_valid original_task_cost -> tasks_are_valid inflated_task_cost.
- Proof.
- rename H_inflated_cost_le_deadline_and_period into LEdl.
- unfold tasks_are_valid, valid_sporadic_taskset, is_valid_sporadic_task.
- intros VALIDtask tsk IN; specialize (VALIDtask tsk IN); des.
- split;
- first by apply: (leq_trans VALIDtask); last by apply leq_addr.
- specialize (LEdl tsk IN); move: LEdl => [LEdl LEp].
- by repeat split.
- Qed.
-
- End NewParametersAreValid.
-
- End CostInflation.
-
- (* Now, we are going to generate a suspension-oblivious schedule with the inflated
- job costs. For that, we always try to copy the original schedule, as long as that
- doesn't break the priority enforcement in the generated schedule. *)
-
- Section ScheduleConstruction.
-
- (* In this section, we define the schedule construction function. *)
- Section ConstructionStep.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job.
- Variable t: time.
-
- (* First, consider the list of pending jobs at time t in the generated schedule. *)
- Let job_is_pending := pending job_arrival inflated_job_cost sched_prefix.
- Definition pending_jobs :=
- [seq j <- jobs_arrived_up_to arr_seq t | job_is_pending j t].
-
- (* From the list of pending jobs, we take one of the (possibly many) highest-priority
- jobs, or None, in case there are no pending jobs. *)
- Definition highest_priority_job := seq_min (higher_eq_priority t) pending_jobs.
-
- (* Then, we construct the schedule at time t as follows.
- a) If there's a job scheduled in the original schedule at time t that is also a
- highest-priority pending job in the generated schedule, copy this job.
- b) Else, pick one of the highest priority pending jobs in the generated schedule. *)
-
- Definition build_schedule : option Job :=
- (* If there is a highest-priority job j_hp in the generated schedule, ...*)
- if highest_priority_job is Some j_hp then
- (* ...and there is some job scheduled in the original schedule... *)
- if (sched_susp t) is Some j_sched then
- (* ...that is a highest-priority pending job,...*)
- if job_is_pending j_sched t && higher_eq_priority t j_sched j_hp then
- Some j_sched (* ...copy this scheduled job. *)
- else
- highest_priority_job (* In the remaining cases, just pick the *)
- else highest_priority_job (* highest-priority job in the generated schedule. *)
- else highest_priority_job.
-
- End ConstructionStep.
-
- (* Next, starting from the empty schedule, ...*)
- Let empty_schedule : schedule Job := fun t => None.
-
- (* ...we use the recursive definition above to construct the suspension-oblivious schedule. *)
- Definition sched_new := build_schedule_from_prefixes build_schedule empty_schedule.
-
- (* Then, by showing that the construction function depends only on the previous service, ... *)
- Lemma sched_new_depends_only_on_service:
- forall sched1 sched2 t,
- (forall j, service sched1 j t = service sched2 j t) ->
- build_schedule sched1 t = build_schedule sched2 t.
- Proof.
- intros sched1 sched2 t ALL.
- rewrite /build_schedule /highest_priority_job.
- have SAME: pending_jobs sched1 t = pending_jobs sched2 t.
- {
- apply eq_in_filter.
- intros j IN.
- eapply in_arrivals_implies_arrived_before in IN; last by eauto.
- rewrite /arrived_before ltnS in IN.
- rewrite /pending /has_arrived IN 2!andTb.
- by rewrite /completed_by ALL.
- }
- have SAME': forall j, pending job_arrival inflated_job_cost sched1 j t =
- pending job_arrival inflated_job_cost sched2 j t.
- {
- intros j; rewrite /pending.
- case: (has_arrived _ j t); [rewrite 2!andTb | by done].
- by rewrite /completed_by ALL.
- }
- rewrite SAME.
- desf; try (by done).
- - by rewrite SAME' in Heq1.
- - by rewrite -SAME' in Heq2.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary sched_new_uses_construction_function:
- forall t,
- sched_new t = build_schedule sched_new t.
- Proof.
- by ins; apply service_dependent_schedule_construction,
- sched_new_depends_only_on_service.
- Qed.
-
- End ScheduleConstruction.
-
- (* Next, we prove that the generated schedule is well-formed. *)
- Section GeneratedScheduleIsValid.
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma sched_newjobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched_new arr_seq.
- Proof.
- rename H_jobs_come_from_arrival_sequence into FROM.
- move => j t /eqP SCHED.
- rewrite sched_new_uses_construction_function in SCHED.
- rewrite /build_schedule in SCHED.
- destruct (highest_priority_job sched_new t) as [j_hp|] eqn:HP; last by done.
- have ARRhp: arrives_in arr_seq j_hp.
- {
- rewrite /highest_priority_job in HP.
- apply seq_min_in_seq in HP.
- rewrite mem_filter in HP; move: HP => /andP [_ ARR].
- by eapply in_arrivals_implies_arrived, ARR.
- }
- destruct (sched_susp t) eqn:SUSP; last by case: SCHED => SAME; subst.
- by move: SCHED; case PEND: (_ && _); case => EQ; subst;
- first by apply (FROM j t); apply/eqP.
- Qed.
-
- (* Next, we show that jobs do not execute before their arrival times... *)
- Lemma sched_new_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched_new.
- Proof.
- move => j t /eqP SCHED.
- rewrite sched_new_uses_construction_function in SCHED.
- rewrite /build_schedule in SCHED.
- destruct (highest_priority_job sched_new t) as [j_hp|] eqn:HP; last by done.
- have IN: has_arrived job_arrival j_hp t.
- {
- suff IN: j_hp \in pending_jobs sched_new t.
- by rewrite mem_filter in IN; move: IN => /andP [/andP [ARR _] _].
- by apply: (seq_min_in_seq (higher_eq_priority t)).
- }
- destruct (sched_susp t) eqn:SUSP; last by move: SCHED; case => EQ; subst.
- move: SCHED; case: ifP; last by move => _; case => SAME; subst.
- by move => /andP [/andP [ARR _] _]; case => SAME; subst.
- Qed.
-
- (* ...nor longer than their execution costs. *)
- Lemma sched_new_completed_jobs_dont_execute:
- completed_jobs_dont_execute inflated_job_cost sched_new.
- Proof.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[inflated_job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite sched_new_uses_construction_function.
- rewrite /build_schedule.
- destruct (highest_priority_job sched_new t) as [j_hp|] eqn:HP; last by done.
- rewrite /highest_priority_job in HP.
- destruct (sched_susp t) eqn:SUSP.
- {
- case: ifP => [PEND | NOTPEND].
- {
- apply/eqP; case => SAME; subst.
- move: PEND => /andP [PEND _].
- by rewrite /pending /completed_by EQ leqnn andbF in PEND.
- }
- {
- apply/eqP; case => SAME; subst.
- suff IN: j \in pending_jobs sched_new t.
- {
- rewrite mem_filter in IN; move: IN => /andP [/andP [_ NOTCOMP] _].
- by rewrite /completed_by EQ leqnn in NOTCOMP.
- }
- by apply: (seq_min_in_seq (higher_eq_priority t)).
- }
- }
- {
- apply/eqP; case => SAME; subst.
- suff IN: j \in pending_jobs sched_new t.
- {
- rewrite mem_filter in IN; move: IN => /andP [/andP [_ NOTCOMP] _].
- by rewrite /completed_by EQ leqnn in NOTCOMP.
- }
- by apply: (seq_min_in_seq (higher_eq_priority t)).
- }
- Qed.
-
- (* In addition, we prove that the schedule is (suspension-oblivious) work-conserving... *)
- Lemma sched_new_work_conserving:
- susp_oblivious.work_conserving job_arrival inflated_job_cost arr_seq sched_new.
- Proof.
- intros j t ARRj BACK.
- move: BACK => /andP [/andP [ARR NOTCOMP] NOTSCHED].
- rewrite /scheduled_at sched_new_uses_construction_function /build_schedule in NOTSCHED.
- rewrite /scheduled_at sched_new_uses_construction_function /build_schedule.
- destruct (highest_priority_job sched_new t) as [j_hp|] eqn:HP.
- {
- destruct (sched_susp t) as [j0 |] eqn:SUSP; last by exists j_hp.
- by case: ifP => [_ | _]; [exists j0 | exists j_hp].
- }
- {
- rewrite /highest_priority_job in HP.
- have IN: j \in pending_jobs sched_new t.
- {
- rewrite mem_filter /pending ARR NOTCOMP 2!andTb.
- by eapply arrived_between_implies_in_arrivals, ARR.
- }
- by apply seq_min_exists with (rel := higher_eq_priority t) in IN; rewrite HP eq_refl in IN.
- }
- Qed.
-
- (* ...and respects job priorities. *)
- Lemma sched_new_respects_policy:
- susp_oblivious.respects_JLDP_policy job_arrival inflated_job_cost
- arr_seq sched_new higher_eq_priority.
- Proof.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL,
- H_priority_is_reflexive into REFL.
- move => j1 j2 t ARRj1 BACK /eqP SCHED.
- move: BACK => /andP [/andP [ARR NOTCOMP] NOTSCHED].
- rewrite /scheduled_at sched_new_uses_construction_function /build_schedule in NOTSCHED.
- rewrite /scheduled_at sched_new_uses_construction_function /build_schedule in SCHED.
- destruct (highest_priority_job sched_new t) as [j_hp|] eqn:HP; last by done.
- rewrite /highest_priority_job in HP.
- have ALL: forall j, j \in pending_jobs sched_new t -> higher_eq_priority t j_hp j.
- {
- intros j IN; apply seq_min_computes_min with (y := j) in HP; try (by done).
- intros x y; rewrite 2!mem_filter; move => /andP [_ INx] /andP [_ INy].
- by apply TOTAL; eapply in_arrivals_implies_arrived; eauto 1.
- }
- have IN: j1 \in pending_jobs sched_new t.
- {
- rewrite mem_filter /pending ARR NOTCOMP 2!andTb.
- by eapply arrived_between_implies_in_arrivals, ARR.
- }
- destruct (sched_susp t) as [j0|] eqn:SUSP;
- last by case: SCHED => SAME; subst; apply ALL; last by done.
- destruct (pending job_arrival inflated_job_cost sched_new j0 t
- && higher_eq_priority t j0 j_hp) eqn:PEND;
- last by case: SCHED => SAME; subst; apply ALL.
- move: PEND => /andP [PEND HPj]; case: SCHED => SAME; subst.
- by apply: (TRANS _ j_hp); last by apply ALL.
- Qed.
-
- (* In addition, due to the copy step in the schedule construction, we show that in case
- there are multiple highest-priority jobs, we pick the same job as in the original
- schedule. *)
- Lemma sched_new_breaks_ties:
- forall j1 j2 t,
- higher_eq_priority t j1 j2 ->
- higher_eq_priority t j2 j1 ->
- scheduled_at sched_susp j1 t ->
- pending job_arrival inflated_job_cost sched_new j1 t ->
- scheduled_at sched_new j2 t ->
- j1 = j2.
- Proof.
- move => j1 j2 t HP1 HP2 /eqP SCHEDs PEND /eqP SCHEDn.
- rewrite sched_new_uses_construction_function /build_schedule in SCHEDn.
- destruct (highest_priority_job sched_new t) as [j_hp|] eqn:HP; last by done.
- destruct (sched_susp t) eqn:SUSP; last by done.
- case: SCHEDs => SAME; subst.
- rewrite PEND andTb in SCHEDn.
- move: SCHEDn; case: ifP => HP'; case => SAME; subst; first by done.
- by rewrite HP1 in HP'.
- Qed.
-
- (* To reason about schedulability, we now prove that the generated schedule
- preserves the service received by each job. *)
- Section Service.
-
- (* Recall the definitions of suspended job, cumulative service and
- cumulative suspension time in the suspension-aware schedule. *)
- Let job_suspended_at (sched: schedule Job) :=
- suspended_at job_arrival original_job_cost next_suspension sched.
- Let job_cumulative_suspension :=
- cumulative_suspension job_arrival original_job_cost next_suspension sched_susp.
- Let job_service_with_suspensions := service sched_susp.
-
- (* Also recall the definition of cumulative service in the generated schedule. *)
- Let job_service_without_suspensions := service sched_new.
-
- (* We are going to prove that for any job j, at any time t, the service received by j
- in the generated schedule (without suspensions) is no larger than the sum of the
- cumulative service plus suspension time in the original schedule (with suspensions).
- The proof follows by induction on time. Since the base case is trivial, we focus
- on the inductive step. *)
- Section InductiveStep.
-
- (* Assume that the claim we want to prove holds for the interval [0, t). *)
- Variable t: time.
- Hypothesis H_induction_hypothesis:
- forall j,
- arrives_in arr_seq j ->
- job_service_without_suspensions j t <=
- job_service_with_suspensions j t + job_cumulative_suspension j t.
-
- (* Now, let j be any job in arrival sequence. We are going to prove that the claim
- continues to hold for job j in the interval [0, t + 1). *)
- Variable j: Job.
- Hypothesis H_comes_from_arrival_sequence: arrives_in arr_seq j.
-
- (* If j has not arrived by time t, then the proof is trivial, ... *)
- Lemma reduction_inductive_step_not_arrived:
- ~~ has_arrived job_arrival j t ->
- job_service_without_suspensions j t.+1 <=
- job_service_with_suspensions j t.+1 + job_cumulative_suspension j t.+1.
- Proof.
- rewrite -ltnNge; intro NOTARR.
- rewrite /job_service_without_suspensions /job_service_with_suspensions
- /service /service_during.
- rewrite (cumulative_service_before_job_arrival_zero job_arrival) //.
- by apply sched_new_jobs_must_arrive_to_execute.
- Qed.
-
- (* ...so let's assume instead that j has arrived by time t. *)
- Hypothesis H_j_has_arrived: has_arrived job_arrival j t.
-
- (* We begin by performing a case analysis on whether j has completed in the
- suspension-aware schedule. *)
- Section CompletedInSuspensionAwareSchedule.
-
- (* Case 1) If j has completed by time t in the suspension-aware schedule, ... *)
- Hypothesis H_j_has_completed:
- completed_by original_job_cost sched_susp j t.
-
- (* ...then it follows from the induction hypothesis that the service
- received by j is preserved up in the interval [0, t + 1). *)
- Lemma reduction_inductive_step_case1_completed:
- job_service_without_suspensions j t.+1 <=
- job_service_with_suspensions j t.+1 + job_cumulative_suspension j t.+1.
- Proof.
- rename H_j_has_completed into COMP, H_induction_hypothesis into IH.
- apply leq_trans with (n := original_job_cost j +
- total_suspension original_job_cost next_suspension j).
- { by apply leq_trans with (n := inflated_job_cost j);
- first apply cumulative_service_le_job_cost,
- sched_new_completed_jobs_dont_execute.
- }
- rewrite leq_add //; first by ( try ( apply completion_monotonic with (t0 := t) ) ||
- apply completion_monotonic with (t := t)).
- apply completion_monotonic with (t' := t.+1) in COMP; try done.
- rewrite /job_cumulative_suspension.
- by rewrite -> cumulative_suspension_eq_total_suspension with
- (job_cost := original_job_cost).
- Qed.
-
- End CompletedInSuspensionAwareSchedule.
-
- (* Next, consider the complementary case. *)
- Section PendingInSuspensionAwareSchedule.
-
- (* Case 2) Since job j has arrived by time t, let's assume that j has not completed
- by time t in the suspension-aware schedule, i.e., j is still pending. *)
- Hypothesis H_j_is_pending:
- ~~ completed_by original_job_cost sched_susp j t.
-
- (* Since we know from the induction hypothesis that the service received by j is
- preserved in the interval [0, t), now we only have to consider the state of job j
- at time t in both schedules. That is, we need to prove the following property:
-
-
-
- scheduled_at sched_new j t <=
- job_suspended_at sched_susp j t + scheduled_at sched_susp j t. *)
-
- (* If j is not scheduled in the suspension-oblivious schedule, then the claim follows. *)
- Lemma reduction_inductive_step_not_scheduled_in_new:
- ~~ scheduled_at sched_new j t ->
- scheduled_at sched_new j t <=
- job_suspended_at sched_susp j t + scheduled_at sched_susp j t.
- Proof.
- by case: scheduled_at.
- Qed.
-
- (* Likewise, if j is scheduled in the suspension-aware schedule, then the claim is also
- trivial. *)
- Lemma reduction_inductive_step_scheduled_in_susp:
- scheduled_at sched_susp j t ->
- scheduled_at sched_new j t <=
- job_suspended_at sched_susp j t + scheduled_at sched_susp j t.
- Proof.
- by move ->; case: scheduled_at; [by apply leq_addl | by rewrite addn1].
- Qed.
-
- (* Having proved the simple cases, let's now move to the harder case. *)
- Section NotScheduledInSuspensionAware.
-
- (* Assume that j is scheduled in the suspension-oblivious schedule, but
- not in the suspension-aware schedule. *)
- Hypothesis H_j_scheduled_in_new: scheduled_at sched_new j t.
- Hypothesis H_j_not_scheduled_in_susp: ~~ scheduled_at sched_susp j t.
-
- (* It remains to show that j is suspended at time t in the suspension-aware schedule.
- We are going to prove that by contradiction. *)
- Section ProofByContradiction.
-
- (* Assume that j it not suspended at time t in the suspension-aware schedule, ... *)
- Hypothesis H_j_is_not_suspended: ~~ job_suspended_at sched_susp j t.
-
- (* ...which implies that j is backlogged at time t in the suspension-aware schedule. *)
- Lemma reduction_inductive_step_j_is_backlogged:
- susp.backlogged job_arrival original_job_cost next_suspension sched_susp j t.
- Proof.
- by repeat (apply/andP; split).
- Qed.
-
- (* By work conservation, there must be a scheduled job with higher or equal
- priority in the suspension-aware schedule. *)
- Lemma reduction_inductive_step_exists_hep_job:
- exists j_hp, arrives_in arr_seq j_hp /\
- scheduled_at sched_susp j_hp t /\
- higher_eq_priority t j_hp j.
- Proof.
- rename H_work_conserving into WORKs, H_respects_priority into PRIOs,
- H_jobs_come_from_arrival_sequence into FROM.
- have BACKs := reduction_inductive_step_j_is_backlogged.
- move: (BACKs) => BACKs'; apply WORKs in BACKs; last by done.
- move: BACKs => [j_hp SCHEDhp]; exists j_hp.
- split; first by apply (FROM j_hp t).
- by split; last by apply PRIOs.
- Qed.
-
- (* Let j_hp be this job with higher-or-equal priority. *)
- Variable j_hp: Job.
- Hypothesis H_j_hp_comes_from_sequence: arrives_in arr_seq j_hp.
- Hypothesis H_j_hp_is_scheduled: scheduled_at sched_susp j_hp t.
- Hypothesis H_higher_or_equal_priority: higher_eq_priority t j_hp j.
-
- (* First, note that j and j_hp cannot be the same job, since j is not scheduled
- in the suspension-aware schedule at time t. Moreover, since the generated
- schedule breaks ties when there are multiple highest-priority jobs (by copying
- the original schedule), it follows that the higher-priority job j_hp must have
- completed earlier in the suspension-oblivious schedule. *)
- Lemma reduction_inductive_step_j_hp_completed_in_new:
- completed_by inflated_job_cost sched_new j_hp t.
- Proof.
- rename H_j_not_scheduled_in_susp into NOTSCHEDs, H_j_scheduled_in_new into SCHEDn.
- move: H_j_hp_is_scheduled (H_j_hp_is_scheduled) => SCHEDhp PENDhp.
- ( try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost := original_job_cost) in PENDhp) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := original_job_cost) in PENDhp); try (by done).
- move: PENDhp => /andP [ARRhp _].
- apply contraT; intro NOTCOMPhp.
- have PENDhp: pending job_arrival inflated_job_cost sched_new j_hp t
- by apply/andP; split.
- destruct (boolP (scheduled_at sched_new j_hp t)) as [SCHEDhp' | NOTSCHEDhp'].
- {
- have SAME: j = j_hp by apply only_one_job_scheduled with (j1 := j) in SCHEDhp'.
- by subst; rewrite SCHEDhp in NOTSCHEDs.
- }
- have BACKhp: backlogged job_arrival inflated_job_cost sched_new j_hp t by apply/andP.
- have HP': higher_eq_priority t j j_hp by apply sched_new_respects_policy.
- apply sched_new_breaks_ties in HP'; try (by done).
- by subst; rewrite SCHEDn in NOTSCHEDhp'.
- Qed.
-
- (* However, recall from the induction hypothesis how the service in the two schedules
- are related. From that, we can conclude that j_hp must have completed in the
- suspension-aware schedule as well, ... *)
- Lemma reduction_inductive_step_j_hp_completed_in_susp:
- completed_by original_job_cost sched_susp j_hp t.
- Proof.
- have COMPNEW := reduction_inductive_step_j_hp_completed_in_new.
- rename H_induction_hypothesis into IHt.
- rewrite /completed_by.
- rewrite -(leq_add2r (total_suspension original_job_cost next_suspension j_hp)).
- rewrite -/(inflated_job_cost _).
- apply leq_trans with (n := job_service_without_suspensions j_hp t).
- apply COMPNEW.
- feed (IHt j_hp); first by done.
- apply: (leq_trans IHt).
- by rewrite leq_add2l; apply cumulative_suspension_le_total_suspension.
- Qed.
-
- (* ...which of course is a contradiction, since we assumed that j_hp was scheduled
- in the the suspension-aware schedule at time t. *)
- Lemma reduction_inductive_step_contradiction: False.
- Proof.
- have COMPhp' := reduction_inductive_step_j_hp_completed_in_susp.
- rename H_j_hp_is_scheduled into SCHEDhp.
- apply completed_implies_not_scheduled in COMPhp'; try (by done).
- by rewrite SCHEDhp in COMPhp'.
- Qed.
-
- End ProofByContradiction.
-
- End NotScheduledInSuspensionAware.
-
- (* From the lemmas above, we infer that the claim to be proven holds if job j
- is pending in the suspension-aware schedule. *)
- Lemma reduction_inductive_step_case2_pending:
- job_service_without_suspensions j t.+1 <=
- job_service_with_suspensions j t.+1 + job_cumulative_suspension j t.+1.
- Proof.
- have CONTRA := reduction_inductive_step_contradiction.
- have HP := reduction_inductive_step_exists_hep_job.
- rename H_induction_hypothesis into IHt.
- rewrite /job_service_without_suspensions /job_service_with_suspensions
- /job_cumulative_suspension /cumulative_suspension
- /cumulative_suspension_during /service /service_during /service_at.
- rewrite !big_nat_recr //=.
- rewrite -addnA [scheduled_at sched_susp _ _ + _]addnC !addnA -addnA.
- apply leq_add; first by apply IHt.
- destruct (boolP (scheduled_at sched_new j t)) as [SCHEDn |]; last by done.
- destruct (boolP (scheduled_at sched_susp j t)) as [SCHEDs | NOTSCHEDs];
- [by apply leq_addl | rewrite addn0].
- apply eq_leq; symmetry; apply/eqP; rewrite eqb1.
- apply contraT; intro NOTSUSP.
- specialize (HP NOTSCHEDs NOTSUSP); specialize (CONTRA SCHEDn NOTSCHEDs NOTSUSP).
- move: HP => [j_hp [INhp [SCHEDhp HP]]].
- by exfalso; apply CONTRA with (j_hp := j_hp).
- Qed.
-
- End PendingInSuspensionAwareSchedule.
-
- End InductiveStep.
-
- (* Using the proof by induction, we show that the service received by any
- job j at any time t is preserved in the suspension-aware schedule. *)
- Theorem suspension_oblivious_preserves_service:
- forall j t,
- arrives_in arr_seq j ->
- job_service_without_suspensions j t <= job_service_with_suspensions j t
- + job_cumulative_suspension j t.
- Proof.
- have CASE1 := reduction_inductive_step_case1_completed.
- have CASE2 := reduction_inductive_step_case2_pending.
- move => j t; move: t j.
- induction t;
- first by ins; rewrite /job_service_without_suspensions/service/service_during big_geq.
- intros j ARRj.
- destruct (boolP (has_arrived job_arrival j t)) as [ARR | NOTARR];
- last by apply reduction_inductive_step_not_arrived.
- destruct (boolP (completed_by original_job_cost sched_susp j t)) as [COMP | NOTCOMP];
- first by apply CASE1.
- by apply CASE2.
- Qed.
-
- (* As a corollary, we show that if a job has completed in the suspension-oblivious
- schedule, it must have completed in the suspension-aware schedule as well. *)
- Corollary suspension_oblivious_preserves_completion:
- forall j t,
- arrives_in arr_seq j ->
- completed_by inflated_job_cost sched_new j t ->
- completed_by original_job_cost sched_susp j t.
- Proof.
- have COMP := sched_new_completed_jobs_dont_execute.
- have SERV := suspension_oblivious_preserves_service.
- intros j t ARRj COMPLETED.
- unfold completed_by in *.
- rewrite -(leq_add2r (total_suspension original_job_cost next_suspension j)).
- rewrite -/(inflated_job_cost j).
- apply leq_trans with (service sched_new j t); first by done.
- apply: (leq_trans (SERV j t ARRj)); rewrite leq_add2l.
- by apply cumulative_suspension_le_total_suspension.
- Qed.
-
- End Service.
-
- End GeneratedScheduleIsValid.
-
- (* To conclude, based on the definition of schedulability, ...*)
- Let schedulable_without_suspensions :=
- job_misses_no_deadline job_arrival inflated_job_cost job_deadline sched_new.
- Let schedulable_with_suspensions :=
- job_misses_no_deadline job_arrival original_job_cost job_deadline sched_susp.
-
- (* ...we prove that if no job misses a deadline in the suspension-oblivious schedule, ... *)
- Hypothesis H_schedulable_without_suspensions:
- forall j,
- arrives_in arr_seq j ->
- schedulable_without_suspensions j.
-
- (* ...then no job misses a deadline in the suspension-aware schedule. *)
- Corollary suspension_oblivious_preserves_schedulability:
- forall j,
- arrives_in arr_seq j ->
- schedulable_with_suspensions j.
- Proof.
- rename H_schedulable_without_suspensions into SCHED.
- by intros j ARRj; apply suspension_oblivious_preserves_completion, SCHED.
- Qed.
-
- End Reduction.
-
-End ReductionToBasicSchedule.
diff --git a/classic/analysis/uni/susp/sustainability/allcosts/main_claim.v b/classic/analysis/uni/susp/sustainability/allcosts/main_claim.v
deleted file mode 100644
index 676199b7f390c434e1c5cb277a8c772741c365bb..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/sustainability/allcosts/main_claim.v
+++ /dev/null
@@ -1,168 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.response_time
- prosa.classic.model.schedule.uni.sustainability.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.valid_schedule
- prosa.classic.model.schedule.uni.susp.build_suspension_table
- prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.analysis.uni.susp.sustainability.allcosts.reduction
- prosa.classic.analysis.uni.susp.sustainability.allcosts.reduction_properties.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we use the reduction we derived to show the weak sustainability with
- job costs and varying suspension times in the dynamic suspension model. *)
-Module SustainabilityAllCostsProperty.
-
- Import ScheduleWithSuspensions Suspension Priority SuspensionIntervals
- PlatformWithSuspensions ResponseTime Sustainability
- ValidSuspensionAwareSchedule.
-
- Module reduction := SustainabilityAllCosts.
- Module reduction_prop := SustainabilityAllCostsProperties.
-
- Section SustainabilityProperty.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
-
- (** Defining the task model *)
-
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_reflexive: JLDP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_transitive: JLDP_is_transitive higher_eq_priority.
-
- Variable job_task: Job -> Task.
- Variable task_suspension_bound: Task -> duration.
-
- (* First, we state all properties about suspension, ... *)
- Let satisfies_suspension_properties (params: seq (job_parameter Job)) :=
- dynamic_suspension_model (return_param JOB_COST params) job_task
- (return_param JOB_SUSPENSION params) task_suspension_bound.
-
- (* ...all properties of the schedule, ... *)
- Let satisfies_schedule_properties (params: seq (job_parameter Job)) (arr_seq: arrival_sequence Job)
- (sched: schedule Job) :=
- let job_arrival := return_param JOB_ARRIVAL params in
- let job_cost := return_param JOB_COST params in
- let job_suspension_duration := return_param JOB_SUSPENSION params in
- jobs_come_from_arrival_sequence sched arr_seq /\
- jobs_must_arrive_to_execute job_arrival sched /\
- completed_jobs_dont_execute job_cost sched /\
- work_conserving job_arrival job_cost job_suspension_duration arr_seq sched /\
- respects_JLDP_policy job_arrival job_cost job_suspension_duration arr_seq
- sched higher_eq_priority /\
- respects_self_suspensions job_arrival job_cost job_suspension_duration sched.
-
- (* ...and all properties of the arrival sequence. *)
- Let satisfies_arrival_sequence_properties (params: seq (job_parameter Job))
- (arr_seq: arrival_sequence Job) :=
- arrival_times_are_consistent (return_param JOB_ARRIVAL params) arr_seq /\
- JLDP_is_total arr_seq higher_eq_priority.
-
- (* Then, we define the task model as the combination of such properties. *)
- Let belongs_to_task_model (params: seq (job_parameter Job))
- (arr_seq: arrival_sequence Job) (sched: schedule Job) :=
- satisfies_arrival_sequence_properties params arr_seq /\
- satisfies_schedule_properties params arr_seq sched /\
- satisfies_suspension_properties params.
-
- (** Sustainability Claim *)
-
- (* We use as schedulability property the notion of response-time bound, i.e., we are
- going to show that improving job parameters leads to "no worse response times". *)
- Variable R: time.
- Let response_time_bounded_by_R (params: seq (job_parameter Job)) (sched: schedule Job) (j: Job) :=
- is_response_time_bound_of_job (return_param JOB_ARRIVAL params)
- (return_param JOB_COST params) sched j R.
-
- (* Next, we recall the definition of weakly-sustainable policy with job costs
- and varying suspension times... *)
- Let all_params := [:: JOB_ARRIVAL; JOB_COST; JOB_SUSPENSION].
- Let sustainable_param := JOB_COST.
- Let variable_params := [:: JOB_SUSPENSION].
- Let has_better_sustainable_param (cost cost': Job -> time) := forall j, cost j >= cost' j.
-
- Let weakly_sustainable_with_job_costs_and_variable_suspension_times :=
- weakly_sustainable all_params response_time_bounded_by_R belongs_to_task_model
- sustainable_param has_better_sustainable_param variable_params.
-
- (* ...and prove that it holds for this scheduling policy and task model. *)
- Theorem policy_is_weakly_sustainable:
- weakly_sustainable_with_job_costs_and_variable_suspension_times.
- Proof.
- intros params good_params CONS CONS' ONLY BETTER VSCHED good_arr_seq good_sched good_j BELONGS.
- split_conj BELONGS; split_conj BELONGS; split_conj BELONGS0; split_conj BELONGS1.
- set job_arrival := return_param JOB_ARRIVAL good_params.
- unfold differ_only_by in *.
- have EQarr: job_arrival = return_param JOB_ARRIVAL params.
- {
- move: CONS CONS' => [UNIQ [IFF _]] [UNIQ' [IFF' _]].
- have ARR: JOB_ARRIVAL \in labels_of params by apply IFF.
- have ARR': JOB_ARRIVAL \in labels_of good_params by apply IFF'.
- move: ARR ARR' => /mapP2 [p IN EQ] => /mapP2 [p' IN' EQ'].
- symmetry in EQ; symmetry in EQ'.
- have EQp := found_param_label params p JOB_ARRIVAL UNIQ IN EQ.
- have EQp' := found_param_label good_params p' JOB_ARRIVAL UNIQ' IN' EQ'.
- specialize (ONLY p p' IN IN').
- feed_n 2 ONLY; [by rewrite EQ | by rewrite EQ |].
- rewrite ONLY EQp' in EQp.
- by inversion EQp.
- }
- set good_cost := return_param JOB_COST good_params.
- set bad_cost := return_param JOB_COST params.
- set good_suspension := return_param JOB_SUSPENSION good_params.
- set bad_sched := reduction.sched_new job_arrival good_cost good_arr_seq higher_eq_priority
- good_sched bad_cost good_j R.
- set reduced_suspension_duration := reduction.reduced_suspension_duration job_arrival good_cost
- good_arr_seq higher_eq_priority good_sched good_suspension bad_cost good_j R.
- set bad_params := [:: param JOB_ARRIVAL job_arrival; param JOB_COST bad_cost;
- param JOB_SUSPENSION reduced_suspension_duration].
- try ( apply reduction_prop.sched_new_response_time_of_job_j with (arr_seq := good_arr_seq)
- (higher_eq_priority0 := higher_eq_priority) (inflated_job_cost := bad_cost);
- try done ) ||
- apply reduction_prop.sched_new_response_time_of_job_j with (arr_seq := good_arr_seq)
- (higher_eq_priority := higher_eq_priority) (inflated_job_cost := bad_cost);
- try done.
- feed (VSCHED bad_params).
- {
- split; first by done.
- split; first by intros l; split;
- move => IN; rewrite /= 2!in_cons mem_seq1 in IN;
- move: IN => /orP [/eqP EQ | /orP [/eqP EQ | /eqP EQ]]; rewrite EQ.
- intros l IN; move: CONS => [_ [IFF CONS]].
- specialize (CONS l IN); apply IFF in CONS.
- rewrite 2!in_cons mem_seq1 in CONS.
- by move: CONS => /orP [/eqP EQ | /orP [/eqP EQ | /eqP EQ]]; rewrite EQ.
- }
- rewrite -/bad_sched.
- apply VSCHED with (arr_seq := good_arr_seq).
- {
- intros P1 P2 IN1 IN2 EQ NOTIN; simpl in IN2.
- move: CONS CONS' => [UNIQ _] [UNIQ' [IN' _]].
- move: IN2 => [EQ2a | [EQ2c | [EQ2s | BUG]]]; try done; first last.
- - by rewrite EQ -EQ2s in NOTIN.
- - by rewrite -EQ2c; apply found_param_label; rewrite // EQ -EQ2c.
- - by rewrite -EQ2a EQarr; apply found_param_label; rewrite // EQ -EQ2a.
- }
- {
- repeat split; try (by done).
- - by apply reduction_prop.sched_new_jobs_come_from_arrival_sequence.
- - by apply reduction_prop.sched_new_jobs_must_arrive_to_execute.
- - by apply reduction_prop.sched_new_completed_jobs_dont_execute.
- - by apply reduction_prop.sched_new_work_conserving.
- - by apply reduction_prop.sched_new_respects_policy.
- - by apply reduction_prop.sched_new_respects_self_suspensions.
- intros j0.
- apply leq_trans with (n := total_suspension good_cost good_suspension j0); last by done.
- by apply reduction_prop.sched_new_has_shorter_total_suspension.
- }
- Qed.
-
- End SustainabilityProperty.
-
-End SustainabilityAllCostsProperty.
diff --git a/classic/analysis/uni/susp/sustainability/allcosts/reduction.v b/classic/analysis/uni/susp/sustainability/allcosts/reduction.v
deleted file mode 100644
index 0b0664e2232f6ca974dacdbc63011bc461e8161f..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/sustainability/allcosts/reduction.v
+++ /dev/null
@@ -1,165 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.platform
- prosa.classic.model.schedule.uni.susp.build_suspension_table.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq bigop fintype.
-
-(* In this file, we prove that uniprocessor suspension-aware scheduling is
- sustainable with job costs under the dynamic suspension model. *)
-Module SustainabilityAllCosts.
-
- Import ScheduleWithSuspensions Suspension Priority PlatformWithSuspensions
- ScheduleConstruction SuspensionTableConstruction.
-
- Section Reduction.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (** Basic Setup & Setting *)
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and assume any (schedule-independent) job-level priorities. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, consider any suspension-aware schedule of the arrival sequence... *)
- Variable sched_susp: schedule Job.
-
- (* ...and the associated job suspension durations. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (** Definition of the Reduction *)
-
- (* Now we proceed with the reduction.
- Let inflated_job_cost denote any job cost inflation, i.e., the cost of
- every job is as large as in the original schedule. *)
- Variable inflated_job_cost: Job -> time.
-
- (* To simplify the analysis, instead of observing an infinite schedule, we
- focus on the finite window delimited by the job we want to analyze.
- Let's call this job j, with arrival time arr_j, ... *)
- Variable j: Job.
- Let arr_j := job_arrival j.
-
- (* ...and suppose that we want to prove that the response time of j in sched_susp
- is upper-bounded by some value R.
- In the analysis, we only need to focus on the schedule prefix [0, arr_j + R). *)
- Variable R: time.
-
- (* In this sustainability proof, we must construct a new schedule with the inflated
- job costs that is no "better" for job j than the original schedule.
- Since we also modify the suspension durations, the construction is divided in
- two parts: (A) Schedule Construction, and (B) Definition of Suspension Times. *)
-
- (** (A) Schedule Construction *)
- Section ScheduleConstruction.
-
- (* Let's begin by defining the schedule construction function. *)
- Section ConstructionStep.
-
- (* For any time t, suppose that we have generated the schedule prefix [0, t).
- Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job.
- Variable t: time.
-
- (* Consider the set of jobs that arrived up to time t. *)
- Let arrivals := jobs_arrived_up_to arr_seq t.
-
- (* Recall whether a job is pending in the new schedule. *)
- Let job_is_pending := pending job_arrival inflated_job_cost sched_prefix.
-
- (* Also, let's denote as late any job whose service in the new schedule is strictly
- less than the service in sched_susp plus the difference between job costs. *)
- Definition job_is_late any_j t :=
- service sched_prefix any_j t
- < service sched_susp any_j t + (inflated_job_cost any_j - job_cost any_j).
-
- (* In order not to have to prove complex properties about the entire schedule,
- we split the construction for the schedule prefix [0, arr_j + R) and for the
- suffix [arr_j + R, ...). *)
-
- (** (A.1) The prefix is built in a way that prevents jobs from getting late. *)
- Section Prefix.
-
- (* Consider the list of pending jobs in the new schedule that are either late
- or scheduled in sched_susp.
- (Note that when there are no late jobs, we pick the jobs that are scheduled
- in sched_susp so that the suspension times remain consistent.) *)
- Definition jobs_that_are_late_or_scheduled_in_sched_susp :=
- [seq any_j <- arrivals | job_is_pending any_j t &&
- (job_is_late any_j t || scheduled_at sched_susp any_j t)].
-
- (* From that list, we take one of the (possibly many) highest-priority jobs,
- or None, in case there are no late jobs and sched_susp is idle. *)
- Definition highest_priority_late_job :=
- seq_min (higher_eq_priority t) jobs_that_are_late_or_scheduled_in_sched_susp.
-
- End Prefix.
-
- (** (A.2) In the suffix, we just pick the highest-priority pending job
- so that the schedule constraints are satisfied. *)
- Section Suffix.
-
- (* From the list of pending jobs in the new schedule, ... *)
- Definition pending_jobs :=
- [seq any_j <- arrivals | job_is_pending any_j t ].
-
- (* ...let's take one of the (possibly many) highest-priority jobs. *)
- Definition highest_priority_job :=
- seq_min (higher_eq_priority t) pending_jobs.
-
- End Suffix.
-
- (** (A.3) In the end, we just combine the prefix and suffix schedules. *)
- Definition build_schedule :=
- if t < arr_j + R then
- highest_priority_late_job (* PREFIX (see A.1) *)
- else
- highest_priority_job. (* SUFFIX (see A.2) *)
-
- End ConstructionStep.
-
- (* To conclude, starting from the empty schedule, ...*)
- Let empty_schedule : schedule Job := fun t => None.
-
- (* ...we use the recursive definition above to construct the new schedule. *)
- Definition sched_new :=
- build_schedule_from_prefixes build_schedule empty_schedule.
-
- End ScheduleConstruction.
-
- (** (B) Definition of Suspension Times *)
-
- (* Having decided when jobs should be scheduled, we now define when they should suspend
- so that the schedule properties remain consistent. *)
- Section DefiningSuspension.
-
- (* Recall the definition of a suspended job in sched_susp. *)
- Let job_is_suspended_in_sched_susp :=
- suspended_at job_arrival job_cost job_suspension_duration sched_susp.
-
- (* Based on the notion of a "late" job from the schedule construction, we say that a
- job is suspended at time t in sched_new iff:
- (a) time t precedes arr_j + R (i.e., suspensions only occur in the prefix),
- (b) the job is suspended in sched_susp at time t, and
- (c) the job is not late in sched_new at time t. *)
- Definition suspended_in_sched_new (any_j: Job) (t: time) :=
- (t < arr_j + R) && job_is_suspended_in_sched_susp any_j t
- && ~~ job_is_late sched_new any_j t.
-
- (* Next, using this suspension predicate, we build a table of suspension durations
- that is valid up to time (arr_j + R).
- For more details, see model/schedule/uni/susp/build_suspension_table. *)
- Definition reduced_suspension_duration :=
- build_suspension_duration sched_new (arr_j + R) suspended_in_sched_new.
-
- End DefiningSuspension.
-
- End Reduction.
-
-End SustainabilityAllCosts.
\ No newline at end of file
diff --git a/classic/analysis/uni/susp/sustainability/allcosts/reduction_properties.v b/classic/analysis/uni/susp/sustainability/allcosts/reduction_properties.v
deleted file mode 100644
index 5f9290dc016626a797918debcfcc0bfd62d3b210..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/sustainability/allcosts/reduction_properties.v
+++ /dev/null
@@ -1,935 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.valid_schedule
- prosa.classic.model.schedule.uni.susp.build_suspension_table
- prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.analysis.uni.susp.sustainability.allcosts.reduction.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we prove several properties about the schedule we constructed
- in the sustainability proof. *)
-Module SustainabilityAllCostsProperties.
-
- Import ScheduleWithSuspensions Suspension Priority SuspensionIntervals
- PlatformWithSuspensions ResponseTime ScheduleConstruction
- SuspensionTableConstruction ValidSuspensionAwareSchedule.
-
- Module reduction := SustainabilityAllCosts.
-
- Section ReductionProperties.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (** Basic Setup & Setting*)
-
- (* Consider any job arrival sequence with consistent job arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
-
- (* Assume any (schedule-independent) JLDP policy that is reflexive, transitive and total,
- i.e., that indicates "higher-or-equal priority". *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_is_reflexive: JLDP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: JLDP_is_total arr_seq higher_eq_priority.
-
- (* Next, consider any suspension-aware schedule of the arrival sequence... *)
- Variable sched_susp: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched_susp arr_seq.
-
- (* ...and the associated job suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (* Assume that, in this schedule, jobs only execute after they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched_susp.
-
- (* ...and no longer than their execution costs. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched_susp.
-
- (* Also assume that the schedule is work-conserving if there are non-suspended jobs, ... *)
- Hypothesis H_work_conserving:
- work_conserving job_arrival job_cost job_suspension_duration arr_seq sched_susp.
-
- (* ...that the schedule respects job priorities... *)
- Hypothesis H_respects_priority:
- respects_JLDP_policy job_arrival job_cost job_suspension_duration arr_seq
- sched_susp higher_eq_priority.
-
- (* ...and that suspended jobs are not allowed to be scheduled. *)
- Hypothesis H_respects_self_suspensions:
- respects_self_suspensions job_arrival job_cost job_suspension_duration sched_susp.
-
- (** Reduction Setup *)
-
- (* Now we prove properties about the reduction.
- Let j be the job to be analyzed with arrival time arr_j. *)
- Variable j: Job.
- Let arr_j := job_arrival j.
-
- (* Suppose that we want to prove that the response time of job j in sched_susp
- is upper-bounded by some value R. This allows us to restrict our analysis
- to the finite scheduling window [0, arr_j + R) during the reduction. *)
- Variable R: time.
-
- (* Next, consider any job cost inflation... *)
- Variable inflated_job_cost: Job -> time.
-
- (* ...in which the cost of every job is no less than in the original schedule. *)
- Hypothesis H_job_costs_do_not_decrease:
- forall any_j, inflated_job_cost any_j >= job_cost any_j.
-
- (* Recall the schedule we constructed from sched_susp using these inflated costs. *)
- Let sched_new := reduction.sched_new job_arrival job_cost arr_seq higher_eq_priority
- sched_susp inflated_job_cost j R.
-
- (* Also recall the predicate we defined for a suspended job in the new schedule... *)
- Let suspended_in_sched_new :=
- reduction.suspended_in_sched_new job_arrival job_cost arr_seq higher_eq_priority
- sched_susp job_suspension_duration inflated_job_cost j R.
-
- (* ...and the corresponding suspension table. *)
- Let reduced_suspension_duration :=
- reduction.reduced_suspension_duration job_arrival job_cost arr_seq higher_eq_priority
- sched_susp job_suspension_duration inflated_job_cost j R.
-
- (* For simplicity, let's define some local names. *)
- Let job_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_job job_arrival job_cost sched_susp.
- Let job_response_time_in_sched_new_bounded_by :=
- is_response_time_bound_of_job job_arrival inflated_job_cost sched_new.
- Let suspended_in_sched_susp :=
- suspended_at job_arrival job_cost job_suspension_duration sched_susp.
- Let job_is_late := reduction.job_is_late job_cost sched_susp inflated_job_cost sched_new.
- Let build_schedule := reduction.build_schedule job_arrival job_cost arr_seq higher_eq_priority
- sched_susp inflated_job_cost j R.
- Let late_or_sched_jobs := reduction.jobs_that_are_late_or_scheduled_in_sched_susp
- job_arrival job_cost arr_seq sched_susp inflated_job_cost sched_new.
- Let hp_job := reduction.highest_priority_job job_arrival arr_seq higher_eq_priority
- inflated_job_cost sched_new.
- Let hp_late_job := reduction.highest_priority_late_job job_arrival job_cost arr_seq
- higher_eq_priority sched_susp inflated_job_cost sched_new.
- Let completed_in_sched_susp := completed_by job_cost sched_susp.
- Let completed_in_sched_new := completed_by inflated_job_cost sched_new.
-
- (** Properties of the Schedule Construction *)
-
- (* In this section, we prove that the new schedule is equivalent to its construction function. *)
- Section PropertiesOfScheduleConstruction.
-
- (* By showing that the construction function depends only on the service, ... *)
- Lemma sched_new_depends_only_on_service:
- forall sched1 sched2 t,
- (forall j, service sched1 j t = service sched2 j t) ->
- build_schedule sched1 t = build_schedule sched2 t.
- Proof.
- intros sched1 sched2 t SAME.
- rewrite /build_schedule /reduction.build_schedule.
- case: (_ < _).
- {
- rewrite /reduction.highest_priority_late_job; f_equal.
- apply eq_in_filter; intros j0 IN0; f_equal;
- first by rewrite /pending /completed_by SAME.
- by f_equal; rewrite /reduction.job_is_late SAME.
- }
- {
- rewrite /reduction.highest_priority_job; f_equal.
- apply eq_in_filter; intros j0 IN0.
- by rewrite /pending /completed_by SAME.
- }
- Qed.
-
- (* ...we infer that the new schedule is equivalent to the construction function. *)
- Corollary sched_new_uses_construction_function:
- forall t,
- sched_new t = build_schedule sched_new t.
- Proof.
- by ins; apply service_dependent_schedule_construction,
- sched_new_depends_only_on_service.
- Qed.
-
- End PropertiesOfScheduleConstruction.
-
- (** Basic Properties of the Generated Schedule *)
-
- (* In this section, we prove some properties about the generated schedule that
- only depend on the construction function but not on suspension times. *)
- Section BasicScheduleProperties.
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma sched_new_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched_new arr_seq.
- Proof.
- move => j0 t /eqP SCHEDn.
- rewrite /scheduled_at sched_new_uses_construction_function in SCHEDn.
- rewrite /build_schedule /reduction.build_schedule in SCHEDn.
- case (ltnP t (arr_j + R)) => [LT | GE].
- {
- rewrite LT /reduction.highest_priority_late_job in SCHEDn;
- apply seq_min_in_seq in SCHEDn.
- rewrite mem_filter in SCHEDn.
- move: SCHEDn => /andP [_ IN].
- by eapply in_arrivals_implies_arrived; eauto 1.
- }
- {
- rewrite ltnNge GE /= in SCHEDn.
- rewrite /reduction.highest_priority_job in SCHEDn; apply seq_min_in_seq in SCHEDn.
- rewrite mem_filter in SCHEDn.
- move: SCHEDn => /andP [_ IN].
- by eapply in_arrivals_implies_arrived; eauto 1.
- }
- Qed.
-
- (* Next, we show that jobs do not execute before their arrival times... *)
- Lemma sched_new_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched_new.
- Proof.
- move => j0 t /eqP SCHEDn.
- rewrite /scheduled_at sched_new_uses_construction_function in SCHEDn.
- rewrite /build_schedule /reduction.build_schedule in SCHEDn.
- case (ltnP t (arr_j + R)) => [LT | GE].
- {
- rewrite LT /reduction.highest_priority_late_job in SCHEDn;
- apply seq_min_in_seq in SCHEDn.
- rewrite mem_filter in SCHEDn.
- by move: SCHEDn => /andP [/andP [/andP [ARR _] _] _].
- }
- {
- rewrite ltnNge GE /= in SCHEDn.
- rewrite /reduction.highest_priority_job in SCHEDn; apply seq_min_in_seq in SCHEDn.
- rewrite mem_filter in SCHEDn.
- by move: SCHEDn => /andP [/andP [ARR _] _].
- }
- Qed.
-
- (* ...nor longer than their execution costs. *)
- Lemma sched_new_completed_jobs_dont_execute:
- completed_jobs_dont_execute inflated_job_cost sched_new.
- Proof.
- intros j0 t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[inflated_job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite sched_new_uses_construction_function /build_schedule
- /reduction.build_schedule.
- case: (_ < _); rewrite /reduction.highest_priority_job
- /reduction.highest_priority_late_job.
- { apply/eqP; intro SCHEDn.
- apply seq_min_in_seq in SCHEDn.
- rewrite mem_filter in SCHEDn.
- move: SCHEDn => /andP [/andP [/andP [_ NOTCOMP] _] _].
- by rewrite /completed_by EQ leqnn in NOTCOMP.
- }
- { apply/eqP; intro SCHEDn.
- apply seq_min_in_seq in SCHEDn.
- rewrite mem_filter in SCHEDn.
- move: SCHEDn => /andP [/andP [_ NOTCOMP] _].
- by rewrite /completed_by EQ leqnn in NOTCOMP.
- }
- Qed.
-
- End BasicScheduleProperties.
-
- (** Service Invariants *)
-
- (* In this section, we prove some service invariants guaranteed by the new schedule
- up to time (arr_j + R).
- Note that these properties follow directly from the schedule construction and
- do not depend on suspension times. *)
- Section ServiceInvariant.
-
- (* Let t be any time in the interval [0, arr_j + R]. *)
- Variable t: time.
- Hypothesis H_before_R: t <= arr_j + R.
-
- (* By induction on time, we prove that for any job, the service received up to
- time t in the new schedule is no more than the service received up to time t in
- the original schedule, plus the difference between job costs due to inflation. *)
- Lemma sched_new_service_invariant:
- forall any_j,
- service sched_new any_j t
- <= service sched_susp any_j t + (inflated_job_cost any_j - job_cost any_j).
- Proof.
- rename H_priority_is_total into TOTAL, H_priority_is_transitive into TRANS,
- H_respects_priority into PRIO, H_work_conserving into WORK.
- rename t into t', H_before_R into BEFORE.
- move: t' BEFORE.
- induction t';
- first by intros _ j0; rewrite /service /service_during big_geq.
- intros LTr; feed IHt'; first by apply ltnW.
- intros j0.
- case (boolP (scheduled_at sched_new j0 t')) => [SCHEDn| NOTSCHEDn]; last first.
- {
- apply negbTE in NOTSCHEDn.
- rewrite /service /service_during big_nat_recr //=.
- rewrite /service_at NOTSCHEDn addn0.
- apply: (leq_trans (IHt' j0)).
- by rewrite leq_add2r extend_sum.
- }
- move: (SCHEDn) => IN.
- rewrite /scheduled_at sched_new_uses_construction_function in IN.
- rewrite /build_schedule /reduction.build_schedule LTr in IN; move: IN => /eqP IN.
- rewrite /reduction.highest_priority_late_job in IN.
- apply seq_min_in_seq in IN; rewrite mem_filter in IN.
- move: IN => /andP [/andP [PEND OR] IN].
- move: OR => /orP [LT | SCHEDs].
- {
- apply leq_trans with (n := service sched_new j0 t' + 1);
- first by rewrite /service/service_during big_nat_recr // leq_add ?leq_b1.
- rewrite addn1.
- by apply: (leq_trans LT); rewrite leq_add2r extend_sum.
- }
- {
- rewrite /service /service_during big_nat_recr // big_nat_recr //=.
- rewrite /service_at SCHEDn SCHEDs -addnA [1 + _]addnC addnA leq_add2r.
- by apply IHt'.
- }
- Qed.
-
- (* From the previous lemma, we conclude that any job that completes in the new
- schedule up to time t must have completed in the original schedule as well. *)
- Corollary sched_new_jobs_complete_later:
- forall any_j,
- completed_by inflated_job_cost sched_new any_j t ->
- completed_by job_cost sched_susp any_j t.
- Proof.
- intros j0 COMPn.
- unfold completed_by in *.
- rewrite -(leq_add2r (inflated_job_cost j0 - job_cost j0)).
- rewrite subnKC; last by eauto 1.
- apply leq_trans with (service sched_new j0 t); first by done.
- by apply sched_new_service_invariant.
- Qed.
-
- End ServiceInvariant.
-
- (** Properties of the Suspension Predicate *)
-
- (* In order to prove schedule properties that depend on suspension times, we first
- prove some facts about the suspension predicate we defined. *)
- Section SuspensionPredicate.
-
- (* Let any_j be any job. *)
- Variable any_j: Job.
-
- (* First, we show that if the suspension predicate holds for any_j at time t,
- then any_j must have arrived... *)
- Lemma suspended_in_sched_new_implies_arrived:
- forall t,
- suspended_in_sched_new any_j t -> has_arrived job_arrival any_j t.
- Proof.
- rename any_j into j0.
- move => t /andP [/andP [LT SUSPs] _].
- by eapply suspended_implies_arrived; eauto 1.
- Qed.
-
- (* ...and cannot have completed. *)
- Lemma suspended_in_sched_new_implies_not_completed:
- forall t,
- suspended_in_sched_new any_j t -> ~~ completed_in_sched_new any_j t.
- Proof.
- rename any_j into j0.
- move => t /andP [/andP [LT SUSPs] _].
- apply/negP; intro COMPn.
- apply suspended_implies_not_completed in SUSPs.
- apply sched_new_jobs_complete_later in COMPn; last by apply ltnW.
- by rewrite COMPn in SUSPs.
- Qed.
-
- (* Next, we show that if the suspension predicate changes from false at time t
- to true at time (t + 1), then any_j must be scheduled at time t. *)
- Lemma executes_before_suspension_in_sched_new:
- forall t,
- t < arr_j + R ->
- has_arrived job_arrival any_j t ->
- ~~ suspended_in_sched_new any_j t ->
- suspended_in_sched_new any_j t.+1 ->
- scheduled_at sched_new any_j t.
- Proof.
- rename any_j into j0.
- intros t LTr ARR NOTSUSPn SUSPn'.
- rewrite negb_and LTr /= negbK -/suspended_in_sched_susp -/job_is_late in NOTSUSPn.
- move: NOTSUSPn => /orP [NOTSUSPs | LATE]; last first.
- {
- apply contraT; intro NOTSCHEDn.
- move: SUSPn' => /andP [_ NOTLATE].
- rewrite /job_is_late /reduction.job_is_late -leqNgt -/sched_new in LATE NOTLATE.
- have GT: service sched_new j0 t < service sched_new j0 t.+1.
- {
- apply: (leq_trans LATE); apply: (leq_trans _ NOTLATE).
- by rewrite leq_add2r extend_sum.
- }
- rewrite /service/service_during big_nat_recr// -addn1 leq_add2l in GT.
- rewrite lt0n eqb0 negbK in GT.
- by rewrite GT in NOTSCHEDn.
- }
- move: (SUSPn') => /andP [/andP [_ SUSPs'] NOTLATE'].
- rewrite -/suspended_in_sched_susp in SUSPs'.
- rewrite /reduction.job_is_late -/sched_new -leqNgt in NOTLATE'.
- apply contraT; intro NOTSCHEDn.
- have SAME: service sched_new j0 t.+1 = service sched_new j0 t.
- {
- apply negbTE in NOTSCHEDn.
- by rewrite /service /service_during big_nat_recr //= /service_at NOTSCHEDn addn0.
- }
- rewrite SAME {SAME} in NOTLATE'.
- have INV := sched_new_service_invariant t (ltnW LTr) j0.
- have SCHEDs: ~~ scheduled_at sched_susp j0 t.
- {
- apply contraT; rewrite negbK; intro SCHEDs.
- have BUG: service sched_susp j0 t + 1 <= service sched_susp j0 t.
- {
- rewrite -(leq_add2r (inflated_job_cost j0 - job_cost j0)).
- apply: (leq_trans _ INV); apply: (leq_trans _ NOTLATE').
- rewrite leq_add2r.
- by rewrite /service /service_during big_nat_recr //= /service_at SCHEDs.
- }
- by rewrite addn1 ltnn in BUG.
- }
- suff BUG: scheduled_at sched_susp j0 t by rewrite BUG in SCHEDs.
- by eapply executes_before_suspension; eauto 1.
- Qed.
-
- (* For simplicity, let's call suspension_start the time following the last
- execution of a job. *)
- Let suspension_start := time_after_last_execution job_arrival.
-
- (* Then, we prove that if any_j is suspended at time t, it does not receive
- any service between time t and the previous beginning of suspension. *)
- Lemma suspended_in_sched_new_no_service_since_execution:
- forall t t_mid,
- suspended_in_sched_new any_j t ->
- suspension_start sched_new any_j t <= t_mid < t ->
- service sched_new any_j t <= service sched_new any_j t_mid.
- Proof.
- have BEFORE := executes_before_suspension_in_sched_new.
- rename any_j into j0.
- induction t; first by intros t_susp _; rewrite ltn0 andbF.
- move => t_mid SUSPn' /andP [GE LT].
- move: (SUSPn') => /andP [/andP [LTr' SUSPs'] _].
- have LTr: t < arr_j + R by apply: (ltn_trans _ LTr').
- have ARR: has_arrived job_arrival j0 t.+1.
- by apply suspended_implies_arrived in SUSPs'.
- rewrite /has_arrived leq_eqVlt in ARR; move: ARR => /orP [/eqP EQ | ARR].
- {
- rewrite /service /service_during.
- rewrite (cumulative_service_before_job_arrival_zero job_arrival) ?EQ //.
- by apply sched_new_jobs_must_arrive_to_execute.
- }
- case (boolP (scheduled_at sched_new j0 t)) => [SCHEDn | NOTSCHEDn]; last first.
- {
- apply leq_trans with (n := service sched_new j0 t).
- {
- apply negbTE in NOTSCHEDn; rewrite /service/service_during.
- by rewrite big_nat_recr //= /service_at NOTSCHEDn addn0.
- }
- case (boolP (t_mid == t)) => [/eqP EQ | DIFF]; first by subst.
- apply IHt.
- {
- apply contraT; intro NOTSUSPn.
- suff SCHEDn: scheduled_at sched_new j0 t by rewrite SCHEDn in NOTSCHEDn.
- by apply BEFORE.
- }
- apply/andP; split.
- {
- apply: (leq_trans _ GE); apply last_execution_monotonic; last by done.
- by apply sched_new_jobs_must_arrive_to_execute.
- }
- by rewrite ltn_neqAle -ltnS LT andbT.
- }
- set start := suspension_start sched_new.
- apply leq_trans with (n := service sched_new j0 (start j0 t.+1));
- last by apply extend_sum.
- apply extend_sum; first by done.
- rewrite /start /suspension_start /time_after_last_execution.
- have EX: [exists t0:'I_t.+1, scheduled_at sched_new j0 t0].
- by apply/existsP; exists (Ordinal (ltnSn t)).
- rewrite EX -addn1 leq_add2r addn1.
- have GEt := @leq_bigmax_cond _ (fun x:'I_t.+1 => scheduled_at sched_new j0 x)
- id (Ordinal (ltnSn t)).
- by apply GEt.
- Qed.
-
- (* Next, we prove that if the suspension predicate holds for any_j at time t,
- then the latest execution of any_j in the new schedule is no earlier than
- its latest execution in the original schedule. *)
- Lemma suspended_in_sched_new_suspension_starts_no_earlier:
- forall t,
- has_arrived job_arrival any_j t ->
- suspended_in_sched_new any_j t ->
- suspension_start sched_susp any_j t <= suspension_start sched_new any_j t.
- Proof.
- have BEFORE := executes_before_suspension_in_sched_new.
- rename any_j into j0.
- induction t.
- {
- intros ARR SUSPs; apply leq_trans with (n := 0); last by done.
- rewrite /suspension_start /time_after_last_execution.
- have NOTEX: [exists t0: 'I_0, scheduled_at sched_susp j0 t0] = false.
- by apply negbTE; rewrite negb_exists; apply/forallP; intros [x LT0].
- by rewrite NOTEX {NOTEX}.
- }
- {
- intros ARR SUSPn'.
- move: (SUSPn') => /andP [/andP [LTr _] _].
- have LTr': t < arr_j + R by apply: (ltn_trans _ LTr).
- rewrite /has_arrived leq_eqVlt in ARR; move: ARR => /orP [/eqP EQ | ARR].
- {
- have LAST := last_execution_after_arrival.
- rewrite /suspension_start /has_arrived in LAST *.
- apply leq_trans with (n := job_arrival j0);
- last by apply LAST, sched_new_jobs_must_arrive_to_execute.
- rewrite /time_after_last_execution.
- suff NOTEX: [exists t0: 'I_t.+1, scheduled_at sched_susp j0 t0] = false
- by rewrite NOTEX.
- apply negbTE; rewrite negb_exists; apply/forallP; intros t0.
- apply/negP; intro SCHED0.
- apply H_jobs_must_arrive_to_execute in SCHED0.
- suff BUG: t0 < t0 by rewrite ltnn in BUG.
- by apply: (leq_trans _ SCHED0); rewrite EQ.
- }
- rewrite ltnS in ARR.
- case (boolP (suspended_in_sched_new j0 t)) => [SUSPn | NOTSUSPn].
- {
- apply leq_trans with (n := suspension_start sched_new j0 t); last first.
- {
- apply last_execution_monotonic; last by done.
- by apply sched_new_jobs_must_arrive_to_execute.
- }
- apply leq_trans with (n := suspension_start sched_susp j0 t); [|by apply IHt].
- apply eq_leq, same_service_implies_same_last_execution.
- rewrite /service /service_during big_nat_recr //= /service_at.
- case (boolP (scheduled_at sched_susp j0 t)); last by rewrite addn0.
- intros SCHEDs; apply H_respects_self_suspensions in SCHEDs.
- by move: SUSPn => /andP [/andP [_ SUSPs] _].
- }
- move: (SUSPn') => /andP [/andP [_ SUSPs']] _.
- have SCHEDn := BEFORE t LTr' ARR NOTSUSPn SUSPn'.
- apply leq_trans with (n := t.+1);
- first by move: SUSPs' => /andP [_ /andP [LE _]].
- rewrite /suspension_start /time_after_last_execution.
- have EX: [exists t0:'I_t.+1, scheduled_at sched_new j0 t0].
- by apply/existsP; exists (Ordinal (ltnSn t)).
- rewrite EX -addn1 leq_add2r addn1.
- have GE := @leq_bigmax_cond _ (fun x:'I_t.+1 => scheduled_at sched_new j0 x)
- id (Ordinal (ltnSn t)).
- by apply GE.
- }
- Qed.
-
- (* using the previous lemmas, we conclude that the suspension predicate is continuous
- between any suspension point and the last execution of the job. *)
- Lemma suspended_in_sched_new_is_continuous:
- forall t t_mid,
- suspended_in_sched_new any_j t ->
- suspension_start sched_new any_j t <= t_mid < t ->
- suspended_in_sched_new any_j t_mid.
- Proof.
- have NOSERV := suspended_in_sched_new_no_service_since_execution.
- have NOEARLIER := suspended_in_sched_new_suspension_starts_no_earlier.
- rename any_j into j0; intros t.
- induction t_mid as [k IH] using strong_ind.
- have INV := sched_new_service_invariant.
- move => SUSPn /andP [GE LT].
- move: (SUSPn) => /andP [/andP [LTr SUSPt] NOTLATEt].
- rewrite -/job_is_late in NOTLATEt.
- apply/andP; split; last first.
- {
- rewrite /reduction.job_is_late -/sched_new -2!leqNgt in NOTLATEt *.
- feed (INV t); [by apply ltnW | specialize (INV j0)].
- set Sn := service sched_new in INV NOTLATEt *.
- set Ss := service sched_susp in INV NOTLATEt *.
- set cost0 := job_cost j0 in INV NOTLATEt *.
- set cost0' := inflated_job_cost j0 in INV NOTLATEt *.
- have SAME: Sn j0 t = Ss j0 t + (cost0' - cost0).
- by apply/eqP; rewrite eqn_leq; apply/andP.
- clear INV.
- apply leq_trans with (n := Ss j0 t + (cost0' - cost0));
- first by rewrite leq_add2r; apply extend_sum; last by apply ltnW.
- rewrite -SAME {SAME}.
- by apply NOSERV; rewrite ?SUSPn ?LTr ?SUSPt ?GE ?LT.
- }
- apply/andP; split; first by apply: (ltn_trans _ LTr).
- try ( apply suspended_in_suspension_interval with (t0 := t); try done ) ||
- apply suspended_in_suspension_interval with (t := t); try done.
- {
- apply/negP; intro COMPmid.
- apply suspended_implies_not_completed in SUSPt.
- suff BUG: completed_by job_cost sched_susp j0 t by rewrite BUG in SUSPt.
- try ( by apply completion_monotonic with (t0 := k); [ apply ltnW |] ) ||
- by apply completion_monotonic with (t := k); [ apply ltnW |].
- }
- apply/andP; split;
- last by apply: (ltn_trans LT); move: SUSPt => /andP [_ /andP [_ GTt]].
- apply: (leq_trans _ GE).
- apply NOEARLIER; try done.
- by apply suspended_implies_arrived in SUSPt.
- Qed.
-
- End SuspensionPredicate.
-
- (** Properties of the Suspension Table *)
-
- (* In this section, we prove some properties about the suspension table. *)
- Section SuspensionTable.
-
- (* First, we show that no job ever suspends after (arr_j + R). *)
- Lemma suspended_in_sched_new_only_inside_window:
- forall any_j t,
- arr_j + R <= t ->
- ~~ suspended_at job_arrival inflated_job_cost reduced_suspension_duration
- sched_new any_j t.
- Proof.
- intros any_j t LE.
- case (boolP (has_arrived job_arrival any_j t)) => [ARR | NOTARR]; last first.
- {
- apply/negP; intro SUSP.
- apply suspended_implies_arrived in SUSP;
- last by apply sched_new_jobs_must_arrive_to_execute.
- by rewrite SUSP in NOTARR.
- }
- apply suspension_duration_no_suspension_after_t_max; try done;
- first by apply sched_new_jobs_must_arrive_to_execute.
- intros j0 t0 LT.
- rewrite /reduction.suspended_in_sched_new LT /=.
- move => /andP [SUSPs _].
- by apply suspended_implies_arrived in SUSPs.
- Qed.
-
- (* Next, using the lemmas about the suspension predicate, we show that the suspension
- predicate for the new schedule matches the generated suspension table.
- (see model/schedule/uni/susp/build_suspension_table.v) *)
- Lemma sched_new_suspension_matches:
- forall any_j t,
- t < arr_j + R ->
- suspended_in_sched_new any_j t =
- suspended_at job_arrival inflated_job_cost reduced_suspension_duration sched_new any_j t.
- Proof.
- apply suspension_duration_matches_predicate_up_to_t_max;
- first by apply sched_new_jobs_must_arrive_to_execute.
- - by intros j0 t LT SUSP; apply suspended_in_sched_new_implies_arrived.
- - by intros j0 t LT SUSP; apply suspended_in_sched_new_implies_not_completed.
- - by intros j0 t LT SUSP; apply suspended_in_sched_new_is_continuous.
- Qed.
-
- (* Recall the definition of cumulative suspension in both schedules. *)
- Let cumulative_suspension_in_sched_susp :=
- cumulative_suspension job_arrival job_cost job_suspension_duration sched_susp.
- Let cumulative_suspension_in_sched_new :=
- cumulative_suspension job_arrival inflated_job_cost reduced_suspension_duration sched_new.
-
- (* To conclude, we prove that the cumulative suspension in the new schedule is no
- larger than in the original schedule,... *)
- Lemma sched_new_has_shorter_suspension:
- forall any_j t,
- cumulative_suspension_in_sched_new any_j t
- <= cumulative_suspension_in_sched_susp any_j t.
- Proof.
- intros j0 t.
- apply leq_sum; intros i _.
- case (ltnP i (arr_j + R)) => [LTr | GEr].
- {
- rewrite -sched_new_suspension_matches //.
- rewrite /suspended_in_sched_new /reduction.suspended_in_sched_new.
- rewrite LTr /=.
- by case: (X in (_ && X)); rewrite ?andbT ?andbF.
- }
- {
- apply leq_trans with (n := 0); last by done.
- rewrite leqn0 eqb0.
- case (boolP (has_arrived job_arrival j0 i)) => [ARR | NOTARR];
- first by apply suspended_in_sched_new_only_inside_window.
- apply/negP; intro SUSPn.
- apply suspended_implies_arrived in SUSPn; first by rewrite SUSPn in NOTARR.
- by apply sched_new_jobs_must_arrive_to_execute.
- }
- Qed.
-
- (* ... which implies that the total suspension is also no larger. *)
- Corollary sched_new_has_shorter_total_suspension:
- forall any_j,
- total_suspension inflated_job_cost reduced_suspension_duration any_j <=
- total_suspension job_cost job_suspension_duration any_j.
- Proof.
- intros any_j.
- apply leq_trans with (n := cumulative_suspension_in_sched_new any_j (arr_j + R)).
- {
- unfold total_suspension, reduced_suspension_duration, reduction.reduced_suspension_duration,
- build_suspension_duration.
- rewrite -/sched_new.
- set SUSP_new := _ job_arrival job_cost _ _ _ _ _ _ _.
- set cost' := inflated_job_cost.
- set arr := job_arrival j.
- apply leq_trans with (n := \sum_(0 <= t < cost' any_j) \sum_(0 <= t0 < arr + R)
- if (service sched_new any_j t0 == t) then SUSP_new any_j t0 else false);
- first by apply leq_sum; ins; rewrite big_mkcond; apply leq_sum; ins; case: (_ == _).
- rewrite exchange_big /=.
- apply leq_sum_nat; move => i /= LT _.
- case COMP: (completed_in_sched_new any_j i).
- { apply leq_trans with 0; last by done.
- rewrite big_nat_cond big1 //; move => s /= LTs.
- case EQ: (_ == _); last by done.
- move: EQ => /eqP EQ; rewrite andbT -EQ {EQ} in LTs.
- by exfalso; move: LTs; rewrite ltnNge; move => /negP LTs; apply: LTs.
- }
- { apply negbT in COMP; rewrite -ltnNge in COMP.
- set s := service sched_new any_j i; rewrite -/s in COMP.
- rewrite -> big_cat_nat with (n := s); [simpl | by done | by apply ltnW].
- rewrite -> big_cat_nat with (m := s) (n := s.+1); [simpl | by done | by done].
- rewrite big_nat_cond big1; last first.
- {
- move => i0; rewrite andbT; move => /= LT0.
- by case EQ: (_ == _) => //; move: EQ => /eqP EQ; subst; rewrite ltnn in LT0.
- }
- rewrite add0n big_nat_recr //= eq_refl big_geq // add0n.
- rewrite big_nat_cond big1; [rewrite addn0 |]; last first.
- {
- move => i0; rewrite andbT; move => /andP [LT0 _].
- rewrite ltn_neqAle in LT0; move: LT0 => /andP [NEQ _].
- by apply negbTE in NEQ; rewrite NEQ.
- }
- by rewrite -sched_new_suspension_matches.
- }
- }
- apply leq_trans with (n := cumulative_suspension_in_sched_susp any_j (arr_j + R));
- first by apply sched_new_has_shorter_suspension.
- by apply cumulative_suspension_le_total_suspension.
- Qed.
-
- End SuspensionTable.
-
- (** Suspension-Related Schedule Properties *)
-
- (* Having shown that the suspension table matches the suspension predicate,
- we now analyze the suspension predicate and prove that the generated
- schedule satisfies all the remaining properties. *)
- Section AdditionalScheduleProperties.
-
- (* First, we show that the new schedule respects self-suspensions. *)
- Lemma sched_new_respects_self_suspensions:
- respects_self_suspensions job_arrival inflated_job_cost reduced_suspension_duration sched_new.
- Proof.
- move => j0 t /eqP SCHEDn; apply/negP.
- case (ltnP t (arr_j + R)) => [LTr | GEr];
- last by apply suspended_in_sched_new_only_inside_window.
- rewrite -sched_new_suspension_matches /suspended_in_sched_new //.
- rewrite negb_and negbK.
- rewrite /scheduled_at sched_new_uses_construction_function in SCHEDn.
- rewrite /build_schedule /reduction.build_schedule in SCHEDn.
- case (ltnP t (arr_j + R)) => [LT | GE]; last by rewrite ltnNge GE.
- rewrite LT /reduction.highest_priority_late_job in SCHEDn.
- apply seq_min_in_seq in SCHEDn.
- rewrite mem_filter in SCHEDn.
- move: SCHEDn => /andP [/andP [PEND OR] _].
- move: OR => /orP [SERV | SCHED]; first by rewrite SERV orbT.
- apply/orP; left.
- rewrite negb_and; apply/orP; right.
- by apply/negP; apply H_respects_self_suspensions.
- Qed.
-
- (* Next, we prove that the new schedule is (suspension-aware) work-conserving... *)
- Lemma sched_new_work_conserving:
- work_conserving job_arrival inflated_job_cost reduced_suspension_duration
- arr_seq sched_new.
- Proof.
- have COMPnew := sched_new_completed_jobs_dont_execute.
- have MATCH := sched_new_suspension_matches.
- rename H_work_conserving into WORKs, H_respects_priority into PRIOs.
- intros j0 t IN BACK.
- move: BACK => /andP [/andP[PEND NOTSCHED] NOTSUSP].
- rewrite /scheduled_at sched_new_uses_construction_function in NOTSCHED *.
- rewrite /build_schedule /reduction.build_schedule in NOTSCHED *.
- case: (ltnP t (arr_j + R)) => [BEFORE | AFTER]; last first.
- {
- clear NOTSUSP; rewrite ltnNge AFTER /= in NOTSCHED.
- rewrite -/hp_job in NOTSCHED *.
- destruct (hp_job t) eqn:SCHEDn; first by exists s.
- exfalso; clear NOTSCHED.
- suff NOTNONE: hp_job t != None by rewrite SCHEDn in NOTNONE.
- move: (PEND) => /andP [ARR NOTCOMPn].
- have IN0: j0 \in jobs_arrived_up_to arr_seq t.
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- apply seq_min_exists with (x := j0).
- by rewrite mem_filter PEND IN0.
- }
- rewrite -MATCH // in NOTSUSP.
- rewrite /suspended_in_sched_new negb_and negbK in NOTSUSP.
- rewrite BEFORE /= in NOTSUSP NOTSCHED.
- rewrite -/hp_late_job in NOTSCHED *.
- destruct (hp_late_job t) eqn:SCHEDn; first by exists s.
- exfalso; clear NOTSCHED.
- suff NOTNONE: hp_late_job t != None by rewrite SCHEDn in NOTNONE.
- move: (PEND) => /andP [ARR NOTCOMPn].
- have IN0: j0 \in jobs_arrived_up_to arr_seq t.
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- move: NOTSUSP => /orP [NOTSUSPs | LT]; last first.
- { clear SCHEDn; apply seq_min_exists with (x := j0).
- by rewrite mem_filter PEND IN0 andbT LT.
- }
- case (boolP (completed_by job_cost sched_susp j0 t)) => [COMPs | NOTCOMPs].
- { clear SCHEDn; apply seq_min_exists with (x := j0).
- rewrite mem_filter PEND IN0 andbT /=.
- apply/orP; left.
- apply leq_trans with (n := job_cost j0 + (inflated_job_cost j0 - job_cost j0));
- last by rewrite leq_add2r.
- rewrite subnKC; last by apply H_job_costs_do_not_decrease.
- by rewrite ltnNge.
- }
- case (boolP (scheduled_at sched_susp j0 t)) => [SCHEDs | NOTSCHEDs].
- { clear SCHEDn; apply seq_min_exists with (x := j0).
- by rewrite mem_filter PEND IN0 andbT SCHEDs orbT.
- }
- feed (WORKs j0 t IN); first by repeat (apply/andP; split).
- move: WORKs => [j_hp SCHEDhp].
- clear SCHEDn; apply seq_min_exists with (x := j_hp).
- have ARRhp: has_arrived job_arrival j_hp t.
- by apply H_jobs_must_arrive_to_execute.
- have ARRINhp: arrives_in arr_seq j_hp.
- by eapply H_jobs_come_from_arrival_sequence; eauto 1.
- have INhp: j_hp \in jobs_arrived_up_to arr_seq t.
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- rewrite mem_filter INhp andbT SCHEDhp orbT andbT.
- apply/andP; split; first by done.
- apply contraT; rewrite negbK; intro COMPhpN.
- have COMPhpS: completed_by job_cost sched_susp j_hp t.
- by apply sched_new_jobs_complete_later; first by apply ltnW.
- by apply completed_implies_not_scheduled in COMPhpS;
- first by rewrite SCHEDhp in COMPhpS.
- Qed.
-
- (* ...and respects job priorities. *)
- Lemma sched_new_respects_policy:
- respects_JLDP_policy job_arrival inflated_job_cost reduced_suspension_duration
- arr_seq sched_new higher_eq_priority.
- Proof.
- have MATCH := sched_new_suspension_matches.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL,
- H_priority_is_reflexive into REFL, H_work_conserving into WORKs,
- H_respects_priority into PRIOs.
- move => j1 j2 t ARRin BACK /eqP SCHED.
- move: BACK => /andP [/andP [PEND NOTSCHED] NOTSUSPn].
- rewrite /scheduled_at sched_new_uses_construction_function /build_schedule
- /reduction.build_schedule in SCHED NOTSCHED *.
- case: (ltnP t (arr_j + R)) => [BEFORE | AFTER]; last first.
- {
- rewrite ltnNge AFTER /= in SCHED NOTSCHED.
- rewrite /reduction.highest_priority_job in SCHED NOTSCHED.
- set jobs := reduction.pending_jobs _ _ _ _ _ in SCHED NOTSCHED.
- have IN: j1 \in jobs.
- {
- rewrite mem_filter PEND /=.
- move: PEND => /andP [ARR _].
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- }
- apply seq_min_computes_min with (y := j1) in SCHED; try (by done).
- by intros x y; rewrite 2!mem_filter; move => /andP [_ INx] /andP [_ INy];
- apply TOTAL; eapply in_arrivals_implies_arrived; eauto 2.
- }
- rewrite BEFORE in SCHED NOTSCHED.
- rewrite /reduction.highest_priority_late_job in SCHED NOTSCHED.
- set jobs := _ sched_new t in SCHED NOTSCHED.
- rewrite -MATCH // negb_and negbK in NOTSUSPn.
- have TOT: forall x y, x \in jobs -> y \in jobs ->
- higher_eq_priority t x y || higher_eq_priority t y x.
- {
- intros x y INx INy; rewrite 2!mem_filter in INx INy.
- move: INx INy => /andP [_ INx] /andP [_ INy].
- by apply TOTAL; eapply in_arrivals_implies_arrived; eauto 1.
- }
- have ARR1: has_arrived job_arrival j1 t by move: PEND => /andP [ARR _].
- have IN1: j1 \in jobs_arrived_up_to arr_seq t.
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- move: NOTSUSPn => /orP [NOTSUSPs | LT]; last first.
- {
- apply seq_min_computes_min with (l := jobs); try done.
- by rewrite mem_filter IN1 andbT PEND LT.
- }
- rewrite BEFORE /= in NOTSUSPs.
- case (boolP (scheduled_at sched_susp j1 t)) => [SCHEDs | NOTSCHEDs].
- {
- apply seq_min_computes_min with (l := jobs); try done.
- by rewrite mem_filter IN1 andbT PEND SCHEDs orbT.
- }
- case (boolP (completed_by job_cost sched_susp j1 t)) => [COMPs | NOTCOMPs].
- {
- apply seq_min_computes_min with (l := jobs); try (by done).
- rewrite mem_filter PEND /= IN1 andbT.
- apply/orP; left.
- rewrite /reduction.job_is_late.
- apply leq_trans with (job_cost j1 + (inflated_job_cost j1 - job_cost j1)); last by rewrite leq_add2r.
- rewrite subnKC; last by eauto 1.
- move: PEND => /andP [_ NOTCOMP].
- by rewrite ltnNge.
- }
- feed (WORKs j1 t ARRin); first by repeat (apply/andP; split).
- move: WORKs => [j_hp SCHEDhp].
- apply: (TRANS _ j_hp);
- last by apply PRIOs; try done; repeat (apply/andP; split).
- have ARRhp: has_arrived job_arrival j_hp t.
- by apply H_jobs_must_arrive_to_execute.
- have ARRINhp: arrives_in arr_seq j_hp.
- by eapply H_jobs_come_from_arrival_sequence; eauto 1.
- have INhp: j_hp \in jobs_arrived_up_to arr_seq t.
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- apply seq_min_computes_min with (l := jobs); try done.
- rewrite mem_filter INhp andbT SCHEDhp orbT andbT.
- apply/andP; split; first by done.
- apply contraT; rewrite negbK; intro COMPhpN.
- have COMPhpS: completed_by job_cost sched_susp j_hp t.
- by apply sched_new_jobs_complete_later; first by apply ltnW.
- by apply completed_implies_not_scheduled in COMPhpS;
- first by rewrite SCHEDhp in COMPhpS.
- Qed.
-
- End AdditionalScheduleProperties.
-
- (** Final Remarks *)
-
- Section FinalRemarks.
-
- (* To summarize, we conclude that the new schedule is a valid suspension-aware schedule ... *)
- Remark sched_new_is_valid:
- valid_suspension_aware_schedule job_arrival arr_seq higher_eq_priority
- reduced_suspension_duration inflated_job_cost sched_new.
- Proof.
- repeat split.
- - by apply sched_new_jobs_come_from_arrival_sequence.
- - by apply sched_new_jobs_must_arrive_to_execute.
- - by apply sched_new_completed_jobs_dont_execute.
- - by apply sched_new_work_conserving.
- - by apply sched_new_respects_policy.
- - by apply sched_new_respects_self_suspensions.
- Qed.
-
- (* ...and that if the analyzed job j has response-time bound R in the schedule,
- then it also has response-time bound R in the original schedule. *)
- Remark sched_new_response_time_of_job_j:
- job_response_time_in_sched_new_bounded_by j R ->
- job_response_time_in_sched_susp_bounded_by j R.
- Proof.
- by apply sched_new_jobs_complete_later.
- Qed.
-
- End FinalRemarks.
-
- End ReductionProperties.
-
-End SustainabilityAllCostsProperties.
diff --git a/classic/analysis/uni/susp/sustainability/singlecost/reduction.v b/classic/analysis/uni/susp/sustainability/singlecost/reduction.v
deleted file mode 100644
index a93726a37fd226255e98ecaf57052c1e5cb8fbe6..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/sustainability/singlecost/reduction.v
+++ /dev/null
@@ -1,102 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.schedule.uni.susp.schedule.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq.
-
-(* In this file, we propose a reduction that converts a suspension-aware
- schedule to another suspension-aware schedule where the cost of a certain
- job is inflated and its response time does not decrease. *)
-Module SustainabilitySingleCost.
-
- Import ScheduleWithSuspensions Suspension Priority ScheduleConstruction.
-
- Section Reduction.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (** Basic Setup & Setting*)
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and assume any (schedule-independent) JLDP policy. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, consider any suspension-aware schedule of the arrival sequence... *)
- Variable sched_susp: schedule Job.
-
- (* ...and the associated job suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (** Definition of the Reduction *)
-
- (* Now we proceed with the reduction. Let j be the job to be analyzed. *)
- Variable j: Job.
-
- (* Next, consider any job cost inflation that does not decrease the cost of job j
- and that preserves the cost of the remaining jobs. *)
- Variable inflated_job_cost: Job -> time.
-
- (** Schedule Construction *)
-
- (* We are going to construct a new schedule that copies the original suspension-aware
- schedule and tries to preserve the service received by job j, until the time when
- it completes in the original schedule. *)
- Section ScheduleConstruction.
-
- (* First, we define the schedule construction function. *)
- Section ConstructionStep.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job.
- Variable t: time.
-
- (* For simplicity, let's define some local names. *)
- Let job_is_pending := pending job_arrival inflated_job_cost sched_prefix.
- Let job_is_suspended :=
- suspended_at job_arrival inflated_job_cost job_suspension_duration sched_prefix.
- Let actual_job_arrivals_up_to := jobs_arrived_up_to arr_seq.
-
- (* Recall that a job is ready in the new schedule iff it is pending and not suspended. *)
- Let job_is_ready j t := job_is_pending j t && ~~ job_is_suspended j t.
-
- (* Then, consider the list of ready jobs at time t in the new schedule. *)
- Definition ready_jobs :=
- [seq j_other <- actual_job_arrivals_up_to t | job_is_ready j_other t].
-
- (* From the list of ready jobs, we take one of the (possibly many)
- highest-priority jobs, or None, in case there are no ready jobs. *)
- Definition highest_priority_job := seq_min (higher_eq_priority t) ready_jobs.
-
- (* Then, we construct the new schedule at time t as follows.
- a) If the currently scheduled job in sched_susp is ready to execute in the new schedule
- and has highest priority, pick that job.
- b) Else, pick one of the highest priority ready jobs in the new schedule. *)
- Definition build_schedule : option Job :=
- if highest_priority_job is Some j_hp then
- if sched_susp t is Some j_in_susp then
- if job_is_ready j_in_susp t && higher_eq_priority t j_in_susp j_hp then
- Some j_in_susp
- else
- Some j_hp
- else Some j_hp
- else None.
-
- End ConstructionStep.
-
- (* To conclude, starting from the empty schedule, ...*)
- Let empty_schedule : schedule Job := fun t => None.
-
- (* ...we use the recursive definition above to construct the new schedule. *)
- Definition sched_susp_highercost :=
- build_schedule_from_prefixes build_schedule empty_schedule.
-
- End ScheduleConstruction.
-
- End Reduction.
-
-End SustainabilitySingleCost.
\ No newline at end of file
diff --git a/classic/analysis/uni/susp/sustainability/singlecost/reduction_properties.v b/classic/analysis/uni/susp/sustainability/singlecost/reduction_properties.v
deleted file mode 100644
index 6c534f919a984632476c76a28b585674fa4a0383..0000000000000000000000000000000000000000
--- a/classic/analysis/uni/susp/sustainability/singlecost/reduction_properties.v
+++ /dev/null
@@ -1,736 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals
- prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.analysis.uni.susp.sustainability.singlecost.reduction.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we prove that the in the generated suspension-aware schedule,
- the response time of the job whose cost is inflated does not decrease. *)
-Module SustainabilitySingleCostProperties.
-
- Import ScheduleWithSuspensions Suspension Priority SuspensionIntervals
- PlatformWithSuspensions ResponseTime ScheduleConstruction.
-
- Module reduction := SustainabilitySingleCost.
-
- Section ReductionProperties.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (** Basic Setup & Setting*)
-
- (* Consider any job arrival sequence with consistent job arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
-
- (* Assume any (schedule-independent) JLDP policy that is reflexive, transitive and total,
- i.e., that indicates "higher-or-equal priority". *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_is_reflexive: JLDP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: JLDP_is_total arr_seq higher_eq_priority.
-
- (* Next, consider any suspension-aware schedule of the arrival sequence... *)
- Variable sched_susp: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched_susp arr_seq.
-
- (* ...and the associated job suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (* Assume that, in this schedule, jobs only execute after they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched_susp.
-
- (* ...and no longer than their execution costs. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched_susp.
-
- (* Also assume that the schedule is work-conserving if there are non-suspended jobs, ... *)
- Hypothesis H_work_conserving:
- work_conserving job_arrival job_cost job_suspension_duration arr_seq sched_susp.
-
- (* ...that the schedule respects job priorities... *)
- Hypothesis H_respects_priority:
- respects_JLDP_policy job_arrival job_cost job_suspension_duration arr_seq
- sched_susp higher_eq_priority.
-
- (* ...and that suspended jobs are not allowed to be scheduled. *)
- Hypothesis H_respects_self_suspensions:
- respects_self_suspensions job_arrival job_cost job_suspension_duration sched_susp.
-
- (** Reduction Setup *)
-
- (* Now we prove properties about the reduction. Let j be any job. *)
- Variable j: Job.
- Let arr_j := job_arrival j.
-
- (* Next, consider any job cost inflation... *)
- Variable inflated_job_cost: Job -> time.
-
- (* ...that does not decrease the cost of job j... *)
- Hypothesis H_cost_of_j_does_not_decrease: inflated_job_cost j >= job_cost j.
-
- (* ...and that preserves the cost of the remaining jobs. *)
- Hypothesis H_inflation_only_for_job_j:
- forall any_j,
- any_j != j ->
- inflated_job_cost any_j = job_cost any_j.
-
- (* Recall the schedule we constructed from sched_susp by inflating the cost of job j. *)
- Let sched_susp_highercost := reduction.sched_susp_highercost job_arrival arr_seq higher_eq_priority
- sched_susp job_suspension_duration inflated_job_cost.
-
- (* For simplicity, we define some local names for the definitions related to both schedules. *)
- Let job_response_time_in_sched_susp_bounded_by :=
- is_response_time_bound_of_job job_arrival job_cost sched_susp.
- Let job_response_time_in_sched_susp_highercost_bounded_by :=
- is_response_time_bound_of_job job_arrival inflated_job_cost sched_susp_highercost.
- Let ready_jobs := reduction.ready_jobs job_arrival arr_seq job_suspension_duration
- inflated_job_cost sched_susp_highercost.
- Let hp_job := reduction.highest_priority_job job_arrival arr_seq higher_eq_priority
- job_suspension_duration inflated_job_cost sched_susp_highercost.
- Let completed_in_sched_susp := completed_by job_cost sched_susp.
- Let completed_in_sched_susp_highercost := completed_by inflated_job_cost sched_susp_highercost.
- Let suspended_in_sched_susp :=
- suspended_at job_arrival job_cost job_suspension_duration sched_susp.
- Let suspended_in_sched_susp_highercost :=
- suspended_at job_arrival inflated_job_cost job_suspension_duration sched_susp_highercost.
- Let service_in_sched_susp := service sched_susp.
- Let service_in_sched_susp_highercost := service sched_susp_highercost.
-
- (** Properties of the Schedule Construction *)
-
- (* In this section, we prove that the new schedule uses its construction function. *)
- Section PropertiesOfScheduleConstruction.
-
- (* Recall the construction function of the new schedule. *)
- Let build_schedule := reduction.build_schedule job_arrival arr_seq higher_eq_priority
- sched_susp job_suspension_duration inflated_job_cost.
-
- (* By showing that the construction function depends only on the schedule prefix, ... *)
- Lemma sched_susp_highercost_depends_only_on_prefix:
- forall sched1 sched2 t,
- (forall t0, t0 < t -> sched1 t0 = sched2 t0) ->
- build_schedule sched1 t = build_schedule sched2 t.
- Proof.
- intros sched1 sched2 t ALL.
- rewrite /build_schedule /reduction.build_schedule /reduction.highest_priority_job.
- have COMP: forall j, completed_by inflated_job_cost sched1 j t =
- completed_by inflated_job_cost sched2 j t.
- {
- intros j0; rewrite /completed_by; f_equal.
- apply eq_big_nat; move => i /= LTi.
- by rewrite /service_at /scheduled_at ALL.
- }
- set pend1 := pending _ _ sched1.
- set pend2 := pending _ _ sched2.
- set susp1 := suspended_at _ _ _ sched1.
- set susp2 := suspended_at _ _ _ sched2.
- have SAME: forall j, pend1 j t = pend2 j t.
- {
- intros j0; rewrite /pend1 /pend2 /pending.
- by case: has_arrived => //=; rewrite COMP.
- }
- set readyjobs := reduction.ready_jobs _ _ _ _.
- have EX: forall j0, [exists t0: 'I_t, scheduled_at sched1 j0 t0] =
- [exists t0: 'I_t, scheduled_at sched2 j0 t0].
- {
- intros j0; apply/idP/idP.
- - by move => /existsP [t0 SCHED]; apply/existsP; exists t0; rewrite /scheduled_at -ALL.
- - by move => /existsP [t0 SCHED]; apply/existsP; exists t0; rewrite /scheduled_at ALL.
- }
- have BEG: forall j0, time_after_last_execution job_arrival sched1 j0 t =
- time_after_last_execution job_arrival sched2 j0 t.
- {
- intros j0; rewrite /time_after_last_execution EX.
- case: ifP => _; last by done.
- by f_equal; apply eq_bigl; intros t0; rewrite /scheduled_at ALL.
- }
- have SUSP: forall j0, has_arrived job_arrival j0 t ->
- suspension_duration job_arrival job_suspension_duration sched1 j0 t =
- suspension_duration job_arrival job_suspension_duration sched2 j0 t.
- {
- intros j0 ARR0; rewrite /suspension_duration BEG; f_equal.
- rewrite /service /service_during big_nat_cond [in RHS]big_nat_cond.
- apply congr_big; try (by done).
- move => i /= /andP [LTi _].
- rewrite /service_at /scheduled_at ALL //.
- apply: (leq_trans LTi).
- by apply last_execution_bounded_by_identity.
- }
- have SAMEsusp: forall j0, has_arrived job_arrival j0 t -> susp1 j0 t = susp2 j0 t.
- by intros j0 ARR0; rewrite /susp1 /susp2 /suspended_at COMP BEG SUSP.
- have SAMEready: readyjobs sched1 t = readyjobs sched2 t.
- {
- apply eq_in_filter; intros j0 IN.
- rewrite -/pend1 -/pend2 SAME; f_equal.
- rewrite /suspended_at COMP BEG SUSP; first by done.
- by rewrite /has_arrived -ltnS; eapply in_arrivals_implies_arrived_before; eauto 1.
- }
- rewrite SAMEready; desf; try (by done); rewrite SAME SAMEsusp in Heq1; try (by done);
- by apply H_jobs_must_arrive_to_execute; apply/eqP.
- Qed.
-
- (* ...we infer that the new schedule is indeed based on the construction function. *)
- Corollary sched_susp_highercost_uses_construction_function:
- forall t,
- sched_susp_highercost t = build_schedule sched_susp_highercost t.
- Proof.
- by ins; apply prefix_dependent_schedule_construction,
- sched_susp_highercost_depends_only_on_prefix.
- Qed.
-
- End PropertiesOfScheduleConstruction.
-
- (** Basic Properties of the Generated Schedule *)
-
- (* In this section, we prove that sched_susp_highercost is a valid suspension-aware schedule. *)
- Section ScheduleIsValid.
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma sched_susp_highercost_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched_susp_highercost arr_seq.
- Proof.
- rename H_jobs_come_from_arrival_sequence into FROM.
- move => j0 t /eqP SCHED.
- rewrite sched_susp_highercost_uses_construction_function /reduction.build_schedule
- -/hp_job in SCHED.
- destruct (hp_job t) as [j_hp|] eqn:HP; last by done.
- have IN: j_hp \in ready_jobs t.
- by rewrite /hp_job /reduction.highest_priority_job in HP; apply seq_min_in_seq in HP.
- have ARRhp: arrives_in arr_seq j_hp.
- {
- rewrite mem_filter in IN; move: IN => /andP [/andP _ IN].
- by apply in_arrivals_implies_arrived in IN.
- }
- destruct (sched_susp t) eqn:SCHEDs; last by case: SCHED => SAME; subst.
- move: SCHEDs => /eqP SCHEDs; apply FROM in SCHEDs.
- case: ifP SCHED; first by move => /andP [PEND _]; case => <-.
- by move => NOTPEND; case => <-.
- Qed.
-
- (* Next, we show that jobs do not execute before their arrival times... *)
- Lemma sched_susp_highercost_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched_susp_highercost.
- Proof.
- have FUNC := sched_susp_highercost_uses_construction_function.
- rename H_jobs_must_arrive_to_execute into MUST.
- move => j0 t /eqP SCHED.
- rewrite FUNC /reduction.build_schedule -/hp_job in SCHED.
- destruct (hp_job t) as [j_hp|] eqn:HP; last by done.
- have IN: j_hp \in ready_jobs t.
- by rewrite /hp_job /reduction.highest_priority_job in HP; apply seq_min_in_seq in HP.
- have ARRhp: has_arrived job_arrival j_hp t.
- {
- rewrite mem_filter in IN; move: IN => /andP [/andP _ IN].
- by eapply in_arrivals_implies_arrived_before in IN; eauto.
- }
- destruct (sched_susp t) eqn:SCHEDs; last by case: SCHED => SAME; subst.
- case: ifP SCHED;
- first by move => /andP [PEND _]; case => <-; apply MUST; apply/eqP.
- by move => NOTPEND; case => <-.
- Qed.
-
- (* ...nor longer than their execution costs. *)
- Lemma sched_susp_highercost_completed_jobs_dont_execute:
- completed_jobs_dont_execute inflated_job_cost sched_susp_highercost.
- Proof.
- intros j0 t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[inflated_job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite sched_susp_highercost_uses_construction_function /reduction.build_schedule
- -/hp_job.
- destruct (hp_job t) as [j_hp|] eqn:HP; last by done.
- have IN: j_hp \in ready_jobs t.
- by rewrite /hp_job /reduction.highest_priority_job in HP; apply seq_min_in_seq in HP.
- have PENDhp: pending job_arrival inflated_job_cost sched_susp_highercost j_hp t.
- {
- rewrite mem_filter in IN; move: IN => /andP [/andP [PEND _] IN].
- by eapply in_arrivals_implies_arrived_before in IN; eauto.
- }
- destruct (sched_susp t) eqn:SCHEDs; last first.
- { apply/eqP; case => SAME; subst j0.
- suff NOTPEND: ~~ pending job_arrival inflated_job_cost sched_susp_highercost j_hp t.
- - by rewrite PENDhp in NOTPEND.
- - by rewrite /pending negb_and; apply/orP; right; rewrite negbK /completed_by EQ.
- }
- { case: ifP => [PEND | NOTPEND]; apply/eqP; case => SAME; subst j0;
- last by move: PENDhp => /andP [_ NC]; rewrite /completed_by EQ leqnn in NC.
- move: PEND => /andP [/andP [/andP [_ NC] _] _].
- by rewrite /completed_by EQ leqnn in NC.
- }
- Qed.
-
- (* In addition, we prove that the new schedule is work-conserving,... *)
- Lemma sched_susp_highercost_work_conserving:
- work_conserving job_arrival inflated_job_cost job_suspension_duration
- arr_seq sched_susp_highercost.
- Proof.
- intros j0 t IN BACK.
- move: BACK => /andP [/andP[PEND NOTSCHED] NOTSUSP].
- rewrite /scheduled_at sched_susp_highercost_uses_construction_function
- /reduction.build_schedule -/hp_job in NOTSCHED *.
- destruct (hp_job) as [j_hp|] eqn:HP.
- {
- destruct (sched_susp t) eqn:SCHEDs; last by exists j_hp.
- by case: ifP; intros _; [exists s | exists j_hp].
- }
- {
- have IN0: j0 \in ready_jobs t.
- {
- rewrite mem_filter PEND NOTSUSP /=.
- eapply arrived_between_implies_in_arrivals; eauto 1.
- by move: PEND => /andP [ARR _].
- }
- suff NOTNONE: hp_job t != None by rewrite HP in NOTNONE.
- by apply seq_min_exists with (x := j0).
- }
- Qed.
-
- (* ...respects job priorities, ... *)
- Lemma sched_susp_highercost_respects_policy:
- respects_JLDP_policy job_arrival inflated_job_cost job_suspension_duration
- arr_seq sched_susp_highercost higher_eq_priority.
- Proof.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL,
- H_priority_is_reflexive into REFL.
- move => j1 j2 t IN BACK /eqP SCHED.
- move: BACK => /andP [/andP [PEND NOTSCHED] NOTSUSP].
- rewrite /scheduled_at sched_susp_highercost_uses_construction_function /reduction.build_schedule
- -/hp_job in SCHED NOTSCHED *.
- set pend := pending _ _ _ in SCHED NOTSCHED.
- have ALL: forall j_hi j_lo, hp_job t = Some j_hi ->
- j_lo \in ready_jobs t ->
- higher_eq_priority t j_hi j_lo.
- {
- intros j_hi j_lo SOME INlo; move: SCHED => MIN.
- rewrite /hp_job /reduction.highest_priority_job in SOME.
- apply seq_min_computes_min with (y := j_lo) in SOME; try (by done).
- intros x y; rewrite mem_filter [y \in _]mem_filter /jobs_arrived_up_to.
- move => /andP [_ INx] /andP [_ INy].
- by apply TOTAL; eapply in_arrivals_implies_arrived; eauto 1.
- }
- destruct (hp_job t) as [j_hp |] eqn:HP; last by done.
- have HIGHER: higher_eq_priority t j_hp j1.
- {
- apply ALL; first by done.
- move: PEND => /andP [ARR NOTCOMP].
- rewrite mem_filter /pending ARR NOTCOMP NOTSUSP /=.
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- }
- destruct (sched_susp t) eqn:SCHEDs; last by case: SCHED => SAME; subst j2.
- move: SCHED; case: ifP => [/andP[ PENDs HPs] | NOTPENDs]; case => SAME; subst;
- first by apply (TRANS t (j_hp)).
- apply ALL; first by done.
- move: PEND => /andP [ARR NOTCOMP].
- rewrite mem_filter /pending ARR NOTCOMP NOTSUSP /=.
- by eapply arrived_between_implies_in_arrivals; eauto 1.
- Qed.
-
- (* ...and does not allow suspended jobs to be scheduled. *)
- Lemma sched_susp_highercost_respects_self_suspensions:
- respects_self_suspensions job_arrival inflated_job_cost
- job_suspension_duration sched_susp_highercost.
- Proof.
- rename H_respects_self_suspensions into SELF.
- move => j0 t /eqP SCHED SUSP.
- set suspended := suspended_at _ _ _ _ in SUSP.
- rewrite sched_susp_highercost_uses_construction_function /reduction.build_schedule
- -/hp_job in SCHED.
- destruct (hp_job t) as [j_hp|] eqn:HP; last by done.
- have IN: j_hp \in ready_jobs t.
- by rewrite /hp_job /reduction.highest_priority_job in HP; apply seq_min_in_seq in HP.
- have NOTSUSP: ~~ suspended j_hp t.
- {
- by rewrite mem_filter in IN; move: IN => /andP [/andP [_ NOTs] _].
- }
- destruct (sched_susp t) eqn:SCHEDs;
- last by case: SCHED => SAME; subst; rewrite SUSP in NOTSUSP.
- case: ifP SCHED; last by move => _; case => SAME; subst; rewrite SUSP in NOTSUSP.
- move: SCHEDs; move => /eqP SCHEDs /andP [/andP [PEND NOTSUSPs] _]; case => SAME; subst.
- by rewrite -/suspended SUSP in NOTSUSPs.
- Qed.
-
- End ScheduleIsValid.
-
- (** Scheduling Invariant *)
-
- (* In this section, we compare the two schedules to determine they are the same
- while job j has not completed in sched_susp. *)
- Section SchedulingInvariant.
-
- (* To prove that the schedules are the same, we use induction over time. *)
- Section InductiveStep.
-
- (* Consider any time t by which job j has not completed in sched_susp. *)
- Variable t: time.
- Hypothesis H_j_has_not_completed: ~~ completed_in_sched_susp j t.
-
- (* Induction Hypothesis:
- Assume that at every time prior to time t, any job that is scheduled
- in sched_susp is also scheduled in sched_susp_highercost. *)
- Hypothesis H_schedules_are_the_same:
- forall k any_j,
- k < t ->
- scheduled_at sched_susp any_j k = scheduled_at sched_susp_highercost any_j k.
-
- (* Then, let k be any time no later than t. *)
- Variable k: time.
- Hypothesis H_k_before_t: k <= t.
-
- (* First, we prove that jobs complete at time k in sched_susp iff they
- complete in the new schedule. *)
- Lemma sched_susp_highercost_same_completion:
- forall any_j,
- completed_in_sched_susp any_j k = completed_in_sched_susp_highercost any_j k.
- Proof.
- rename H_j_has_not_completed into NOTCOMPj,
- H_schedules_are_the_same into IH, H_cost_of_j_does_not_decrease into COSTj,
- H_inflation_only_for_job_j into COSTother.
- have COMPLETIONw := sched_susp_highercost_completed_jobs_dont_execute.
- rewrite /completed_in_sched_susp/completed_in_sched_susp_highercost
- /completed_by -ltnNge in NOTCOMPj *.
- intros any_j; apply/idP/idP.
- { intros COMPs.
- case (boolP (any_j == j)) => [/eqP EQ | NEQ]; subst.
- { unfold completed_jobs_dont_execute in *.
- have BUG: service sched_susp j t >= job_cost j.
- { try ( apply completion_monotonic with (t0 := k); try (by done); apply ltnW ) ||
- apply completion_monotonic with (t := k); try (by done); apply ltnW. }
- by exfalso; move: BUG; rewrite leqNgt; move => /negP BUG; apply: BUG.
- }
- rewrite COSTother //.
- apply leq_trans with (service sched_susp any_j k); first by done.
- rewrite /service /service_during big_nat_cond [X in _ <= X]big_nat_cond.
- rewrite leq_sum //; move => i /= /andP [LT _].
- by rewrite /service_at IH //; apply: (leq_trans LT).
- }
- { intros COMPw.
- apply leq_trans with (n := inflated_job_cost any_j);
- first by case (boolP (any_j==j)) => [/eqP EQ | NEQ]; subst; rewrite ?COSTj ?COSTother.
- apply leq_trans with (service sched_susp_highercost any_j k); first by done.
- apply leq_sum_nat; move => i /= LT _.
- by rewrite /service_at IH //; apply: (leq_trans LT).
- }
- Qed.
-
- (* We also prove the execution patterns of the jobs coincide... *)
- Lemma sched_susp_highercost_same_time_after_last_exec:
- forall any_j,
- time_after_last_execution job_arrival sched_susp any_j k =
- time_after_last_execution job_arrival sched_susp_highercost any_j k.
- Proof.
- rename H_schedules_are_the_same into IH.
- intros any_j; rewrite /time_after_last_execution.
- have EXsame: [exists t0:'I_k, scheduled_at sched_susp any_j t0] =
- [exists t0:'I_k, scheduled_at sched_susp_highercost any_j t0].
- {
- by apply/idP/idP; move => /existsP [t0 LT0];
- apply/existsP; exists t0; rewrite ?IH//-?IH//; apply leq_trans with (n := k).
- }
- rewrite EXsame {EXsame}; case: ifP => [EX | _]; last by done.
- f_equal; apply eq_bigl; intros i; rewrite IH //.
- by apply leq_trans with (n := k).
- Qed.
-
- (* ...and the jobs have the same suspension intervals, ... *)
- Lemma sched_susp_highercost_same_suspension_duration:
- forall any_j,
- has_arrived job_arrival any_j k ->
- suspension_duration job_arrival job_suspension_duration sched_susp any_j k =
- suspension_duration job_arrival job_suspension_duration sched_susp_highercost any_j k.
- Proof.
- intros any_j ARR.
- rewrite /suspension_duration /service /service_during; f_equal.
- rewrite sched_susp_highercost_same_time_after_last_exec.
- rewrite big_nat_cond [X in _ = X]big_nat_cond; apply eq_bigr.
- move => i /= /andP [LT _].
- rewrite /service_at H_schedules_are_the_same //.
- apply leq_trans with (n := k); last by done.
- apply: (leq_trans LT).
- by apply last_execution_bounded_by_identity.
- Qed.
-
- (* ...which implies that jobs suspend at time k in sched_susp iff they suspend
- in the new schedule as well. *)
- Lemma sched_susp_highercost_same_suspension:
- forall any_j,
- has_arrived job_arrival any_j k ->
- suspended_in_sched_susp any_j k = suspended_in_sched_susp_highercost any_j k.
- Proof.
- intros any_j ARR.
- rewrite /suspended_in_sched_susp /suspended_in_sched_susp_highercost /suspended_at.
- rewrite -/completed_in_sched_susp_highercost -sched_susp_highercost_same_completion.
- rewrite sched_susp_highercost_same_time_after_last_exec.
- by rewrite sched_susp_highercost_same_suspension_duration.
- Qed.
-
- (* Using the lemmas above, we conclude the inductive step by showing that the
- two schedules are the same at time k. *)
- Lemma sched_susp_highercost_same_schedule:
- forall any_j,
- scheduled_at sched_susp any_j k = scheduled_at sched_susp_highercost any_j k.
- Proof.
- have FUNC := sched_susp_highercost_uses_construction_function.
- have SELFw := sched_susp_highercost_respects_self_suspensions.
- have COMPLETIONw := sched_susp_highercost_completed_jobs_dont_execute.
- have LEMMAcomp := sched_susp_highercost_same_completion.
- have LEMMAsusp := sched_susp_highercost_same_suspension.
- rename H_jobs_must_arrive_to_execute into MUSTARR,
- H_cost_of_j_does_not_decrease into HIGHER,
- H_inflation_only_for_job_j into SAME,
- H_respects_self_suspensions into SELFs,
- H_work_conserving into WORKs, H_priority_is_reflexive into REFL,
- H_respects_priority into PRIOs.
- rewrite /service_in_sched_susp /service_in_sched_susp_highercost /service /service_during.
- suff EQsched: sched_susp k = sched_susp_highercost k by rewrite /scheduled_at EQsched.
- rewrite /scheduled_at FUNC /reduction.build_schedule -/hp_job.
- destruct (hp_job k) as [j_hp|] eqn:HP; last first.
- {
- destruct (sched_susp k) as [j_s|] eqn:SCHEDs; last by done.
- suff NOTNONE: hp_job k != None by rewrite HP in NOTNONE.
- apply seq_min_exists with (x := j_s).
- have NOTCOMPs: ~~ completed_in_sched_susp j_s k.
- {
- apply/negP; intros COMP'.
- apply completed_implies_not_scheduled in COMP'; try (by done).
- by rewrite /scheduled_at SCHEDs eq_refl in COMP'.
- }
- have ARR: has_arrived job_arrival j_s k by apply MUSTARR; apply/eqP.
- have NOTCOMPw: ~~ completed_by inflated_job_cost sched_susp_highercost j_s k.
- by rewrite -/completed_in_sched_susp_highercost -LEMMAcomp //.
- have NOTSUSPs: ~~ suspended_in_sched_susp j_s k by apply/negP; apply SELFs; apply/eqP.
- have NOTSUSPw: ~~ suspended_in_sched_susp_highercost j_s k by rewrite -LEMMAsusp //.
- have ARRw: j_s \in jobs_arrived_up_to arr_seq k.
- {
- eapply arrived_between_implies_in_arrivals; eauto 1.
- by apply H_jobs_come_from_arrival_sequence with (t := k); apply/eqP.
- }
- by rewrite mem_filter; repeat (apply/andP; split).
- }
- {
- have IN: j_hp \in ready_jobs k.
- by apply seq_min_in_seq with (rel := higher_eq_priority k).
- rewrite mem_filter in IN; move: IN => /andP [/andP [/andP [ARRhp NOTCOMPhp] NOTSUSP] IN].
- have ARRINhp: arrives_in arr_seq j_hp by apply in_arrivals_implies_arrived in IN.
- destruct (sched_susp k) as [j_s|] eqn:SCHEDs.
- {
- case: ifP => // NOTPEND.
- have PENDw: pending job_arrival inflated_job_cost sched_susp_highercost j_s k.
- {
- apply/andP; split; first by apply MUSTARR; apply/eqP.
- rewrite -/completed_in_sched_susp_highercost -LEMMAcomp //.
- apply/negP; intros COMPs.
- apply completed_implies_not_scheduled in COMPs; try (by done).
- by rewrite /scheduled_at SCHEDs eq_refl in COMPs.
- }
- have ARRs: has_arrived job_arrival j_s k by apply MUSTARR; apply/eqP.
- have NOTSUSPs: ~~ suspended_in_sched_susp j_s k by apply/negP; apply SELFs; apply/eqP.
- have NOTSUSPw: ~~ suspended_in_sched_susp_highercost j_s k by rewrite -LEMMAsusp.
- rewrite -/suspended_in_sched_susp_highercost PENDw NOTSUSPw /= in NOTPEND.
- suff PRIOINV: higher_eq_priority k j_s j_hp by rewrite PRIOINV in NOTPEND.
- apply PRIOs; try (by done); last by apply/eqP.
- have NOTCOMPhp': ~~ completed_by job_cost sched_susp j_hp k.
- by rewrite -/completed_in_sched_susp LEMMAcomp.
- have NOTSCHEDhp: ~~ scheduled_at sched_susp j_hp k.
- {
- apply/negP; intro SCHEDs'.
- apply only_one_job_scheduled with (j1 := j_s) in SCHEDs'; subst; last by apply/eqP.
- suff BUG: higher_eq_priority k j_hp j_hp by rewrite BUG in NOTPEND.
- by apply REFL.
- }
- have NOTSUSPhp: ~~ suspended_in_sched_susp j_hp k by rewrite LEMMAsusp.
- by repeat (apply/andP; split).
- }
- {
- have NOTCOMPhp': ~~ completed_by job_cost sched_susp j_hp k.
- by rewrite -/completed_in_sched_susp LEMMAcomp.
- have NOTSCHEDhp: ~~ scheduled_at sched_susp j_hp k by rewrite /scheduled_at SCHEDs.
- have NOTSUSPhp: ~~ suspended_in_sched_susp j_hp k by rewrite LEMMAsusp.
- feed (WORKs j_hp k ARRINhp); first by repeat (apply/andP; split).
- move: WORKs => [j_x SCHEDx].
- by rewrite /scheduled_at SCHEDs in SCHEDx.
- }
- }
- Qed.
-
- End InductiveStep.
-
- (* Using the inductive step above, we prove that before the completion of job j
- in sched_susp, the two schedules are exactly the same. *)
- Lemma scheduled_in_susp_iff_scheduled_in_wcet:
- forall t any_j,
- ~~ completed_in_sched_susp j t ->
- scheduled_at sched_susp any_j t = scheduled_at sched_susp_highercost any_j t.
- Proof.
- have LEMMAsched := sched_susp_highercost_same_schedule.
- induction t as [t IHtmp] using strong_ind.
- intros j' NOTCOMP.
- suff IH: forall k any_j, k < t ->
- scheduled_at sched_susp any_j k = scheduled_at sched_susp_highercost any_j k.
- by apply LEMMAsched with (t := t).
- intros k any_j LT; apply IHtmp; first by done.
- apply/negP; intro COMPk.
- suff COMPt: completed_in_sched_susp j t by rewrite COMPt in NOTCOMP.
- try ( by apply completion_monotonic with (t0 := k);[apply ltnW|] ) ||
- by apply completion_monotonic with (t := k);[apply ltnW|].
- Qed.
-
- End SchedulingInvariant.
-
- (** Comparison of Response-time Bounds *)
-
- (* In this section, we use the scheduling invariant above to compare response-time bounds
- for job j in both schedules. *)
- Section ComparingResponseTimes.
-
- (* Assume that job j has positive cost. *)
- Hypothesis H_cost_j_positive: job_cost j > 0.
-
- (* Also assume that the response time of job j in sched_susp is equal to some value r... *)
- Variable r: time.
- Hypothesis H_response_time_bound_in_sched_susp:
- job_response_time_in_sched_susp_bounded_by j r.
- Hypothesis H_response_time_bound_is_tight:
- forall r', job_response_time_in_sched_susp_bounded_by j r' -> r <= r'.
-
- (* ...and that the response time of j in the new schedule is upper-bounded by some value R. *)
- Variable R: time.
- Hypothesis H_response_time_bound_in_sched_susp_highercost:
- job_response_time_in_sched_susp_highercost_bounded_by j R.
-
- (* Using the scheduling invariant, we show that job j receives the same service
- in both schedules up to time (arr_j + r). *)
- Lemma sched_susp_highercost_same_service_for_j:
- forall t,
- t <= arr_j + r ->
- service_in_sched_susp j t = service_in_sched_susp_highercost j t.
- Proof.
- rename H_response_time_bound_is_tight into TIGHT.
- have IFF := scheduled_in_susp_iff_scheduled_in_wcet.
- rewrite /service_in_sched_susp /service_in_sched_susp_highercost /service /service_during.
- induction t; first by intros _; rewrite big_geq // big_geq.
- intros LT.
- feed IHt; first by apply ltnW.
- rewrite big_nat_recr // big_nat_recr //=.
- f_equal; first by done.
- rewrite /service_at IFF; first by done.
- apply/negP; intro COMPt.
- suff BUG: t >= arr_j + r by rewrite leqNgt LT in BUG.
- have AFTER: arr_j <= t.
- { apply contraT; rewrite -ltnNge; intro BEFORE.
- suff BUG: ~~ completed_in_sched_susp j t by rewrite COMPt in BUG.
- rewrite /completed_in_sched_susp /completed_by /service /service_during.
- rewrite (cumulative_service_before_job_arrival_zero job_arrival) //; last by apply ltnW.
- by rewrite -ltnNge.
- }
- rewrite -[t](addKn arr_j) -addnBA //.
- rewrite leq_add2l; apply TIGHT.
- rewrite /job_response_time_in_sched_susp_bounded_by /is_response_time_bound_of_job.
- by rewrite subnKC.
- Qed.
-
- (* Next, since r is an exact response time bound, we show that r <= R... *)
- Lemma sched_susp_highercost_r_le_R: r <= R.
- Proof.
- have SAME := sched_susp_highercost_same_service_for_j.
- rename H_response_time_bound_in_sched_susp_highercost into RESPw,
- H_response_time_bound_in_sched_susp into RESPs,
- H_response_time_bound_is_tight into TIGHT,
- H_cost_of_j_does_not_decrease into COSTj.
- unfold job_response_time_in_sched_susp_bounded_by, service_in_sched_susp_highercost,
- job_response_time_in_sched_susp_highercost_bounded_by, service_in_sched_susp,
- is_response_time_bound_of_job, completed_by, service in *.
- set Sw := service_during sched_susp_highercost in RESPw RESPs TIGHT SAME.
- set Ss := service_during sched_susp in RESPs TIGHT SAME.
- apply contraT; rewrite -ltnNge; intros LT.
- have RESPs': job_cost j == Ss j 0 (job_arrival j + r).
- { rewrite eqn_leq; apply/andP; split; try done.
- by apply H_completed_jobs_dont_execute.
- }
- suff BUG: job_cost j > inflated_job_cost j by rewrite ltnNge COSTj in BUG.
- move: RESPs RESPs' => _ /eqP RESPs; rewrite RESPs.
- apply leq_ltn_trans with (Sw j 0 (job_arrival j + R)); first by done.
- rewrite /Ss /service_during.
- rewrite -> big_cat_nat with (n := arr_j + R);
- [simpl | by done | by rewrite leq_add2l ltnW].
- rewrite -addn1; apply leq_add;
- first by rewrite -SAME; [apply leqnn | rewrite leq_add2l ltnW].
- rewrite lt0n; apply/eqP; intro ZERO.
- suff BUG: R >= r by rewrite leqNgt LT in BUG.
- apply TIGHT.
- rewrite -(leq_add2r 0) -{3}ZERO addn0.
- rewrite -big_cat_nat //=; last by rewrite leq_add2l ltnW.
- by rewrite RESPs.
- Qed.
-
- (* ...and also prove that R must be as large as the inflated job cost. *)
- Lemma R_bounds_inflated_cost: R >= inflated_job_cost j.
- Proof.
- apply leq_trans with (n := service sched_susp_highercost j (arr_j + R)); first by done.
- rewrite /service /service_during.
- rewrite (ignore_service_before_arrival job_arrival) //; first last.
- - by apply leq_addr.
- - by apply sched_susp_highercost_jobs_must_arrive_to_execute.
- by apply cumulative_service_le_delta.
- Qed.
-
- (* To conclude, we prove that the difference between the response-time bound and the job cost
- is larger in the new schedule. *)
- Theorem sched_susp_highercost_incurs_more_interference:
- r - job_cost j <= R - inflated_job_cost j.
- Proof.
- have GECOST := R_bounds_inflated_cost.
- have LEQ := sched_susp_highercost_r_le_R.
- have SAME := sched_susp_highercost_same_service_for_j.
- rename H_response_time_bound_in_sched_susp into RESPs,
- H_response_time_bound_in_sched_susp_highercost into RESPw.
- rewrite leq_subLR.
- rewrite addnBA; last by apply GECOST.
- apply leq_trans with
- (n := service_in_sched_susp j (arr_j + r) + R - service_in_sched_susp_highercost j (arr_j + R));
- last by rewrite leq_sub // leq_add2r.
- rewrite addnC.
- rewrite /service_in_sched_susp /service_in_sched_susp_highercost /service
- /service_during in SAME *.
- rewrite -> big_cat_nat with (n := arr_j+r) (p := arr_j+R);
- [simpl | by done | by rewrite leq_add2l].
- feed (SAME (arr_j + r)); first by apply leqnn.
- rewrite -/(service_during sched_susp_highercost _ _ _)
- -/(service_during sched_susp_highercost _ _ _)
- -/(service_during sched_susp _ _ _) in SAME *.
- set Ss := service_during sched_susp in SAME *; set Sw := service_during sched_susp_highercost.
- rewrite -subnBA;
- last by apply leq_trans with (n := Sw j 0 (arr_j + r)); [rewrite SAME | apply leq_addr].
- rewrite addnC -addnBA; last by rewrite SAME.
- apply leq_trans with (n := R - (Sw j (arr_j + r) (arr_j + R) + 0));
- last by rewrite leq_sub2l // leq_add2l; apply eq_leq; apply/eqP; rewrite subn_eq0 SAME.
- rewrite addn0 leq_subRL_impl // addnC.
- apply leq_trans with (n := r + \sum_(arr_j+r<=t<arr_j+R) 1);
- first by rewrite leq_add2l; apply leq_sum; intros t _; apply leq_b1.
- by simpl_sum_const; rewrite subnDl subnKC.
- Qed.
-
- End ComparingResponseTimes.
-
- End ReductionProperties.
-
-End SustainabilitySingleCostProperties.
diff --git a/classic/implementation/apa/arrival_sequence.v b/classic/implementation/apa/arrival_sequence.v
deleted file mode 100644
index 24b6bc8724c485ae481f55c1621d08623f55035f..0000000000000000000000000000000000000000
--- a/classic/implementation/apa/arrival_sequence.v
+++ /dev/null
@@ -1,113 +0,0 @@
-(* We can reuse the.apa definition of periodic arrival sequence. *)
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.implementation.apa.task prosa.classic.implementation.apa.job.
-From mathcomp Require Import ssreflect ssrbool ssrfun ssrnat eqtype seq div.
-
-Module ConcreteArrivalSequence.
-
- Import Job ArrivalSequence ConcreteTask ConcreteJob SporadicTaskset TaskArrival.
-
- Section PeriodicArrivals.
-
- Context {num_cpus: nat}.
- Variable ts: concrete_taskset num_cpus.
-
- (* At any time t, we release Some job of tsk if t is a multiple of the period,
- otherwise we release None. *)
- Definition add_job (arr: time) (tsk: @concrete_task num_cpus) : option (@concrete_job _) :=
- if task_period tsk %| arr then
- Some (Build_concrete_job (arr %/ task_period tsk) arr (task_cost tsk) (task_deadline tsk) tsk)
- else
- None.
-
- (* The arrival sequence at any time t is simply the partial map of add_job. *)
- Definition periodic_arrival_sequence (t: time) := pmap (add_job t) ts.
-
- End PeriodicArrivals.
-
- Section Proofs.
-
- Context {num_cpus: nat}.
-
- (* Let ts be any concrete task set with valid parameters. *)
- Variable ts: concrete_taskset num_cpus.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Regarding the periodic arrival sequence built from ts, we prove that...*)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* ... arrival times are consistent, ... *)
- Theorem periodic_arrivals_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Proof.
- move => j t ARRj.
- rewrite /arrives_at mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ... every job comes from the task set, ... *)
- Theorem periodic_arrivals_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
- Proof.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ..., jobs have valid parameters, ... *)
- Theorem periodic_arrivals_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj; move: ARRj => /mapP [tsk IN SOME].
- unfold add_job in SOME; desf.
- specialize (PARAMS tsk IN); des.
- unfold valid_sporadic_job, valid_realtime_job, job_cost_positive.
- by repeat split; try (by done); apply leqnn.
- Qed.
-
- (* ... job arrivals satisfy the sporadic task model, ... *)
- Theorem periodic_arrivals_are_sporadic:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Proof.
- move => j j' /eqP DIFF [arr ARR] [arr' ARR'] SAMEtsk LE.
- rewrite eqE /= /job_eqdef negb_and /= SAMEtsk eq_refl orbF in DIFF.
- rewrite 2!mem_pmap in ARR ARR'.
- move: ARR ARR' => /mapP [tsk_j INj SOMEj] /mapP [tsk_j' INj' SOMEj'].
- unfold add_job in SOMEj, SOMEj'; desf; simpl in *;
- move: Heq0 Heq => /dvdnP [k DIV] /dvdnP [k' DIV'].
- {
- rewrite DIV DIV' -mulSnr.
- rewrite leq_eqVlt in LE; move: LE => /orP [/eqP EQ | LESS].
- {
- exfalso; move: DIFF => /negP DIFF; apply DIFF.
- by subst; rewrite EQ !eq_refl.
- }
- subst; rewrite leq_mul2r; apply/orP; right.
- by rewrite ltn_mul2r in LESS; move: LESS => /andP [_ LT].
- }
- Qed.
-
- (* ... and the arrival sequence has no duplicate jobs. *)
- Theorem periodic_arrivals_is_a_set:
- arrival_sequence_is_a_set arr_seq.
- Proof.
- intros t.
- unfold arr_seq, periodic_arrival_sequence.
- apply (pmap_uniq) with (g := job_task); last by destruct ts.
- by unfold add_job, ocancel; intro tsk; desf.
- Qed.
-
- End Proofs.
-
-End ConcreteArrivalSequence.
\ No newline at end of file
diff --git a/classic/implementation/apa/bertogna_edf_example.v b/classic/implementation/apa/bertogna_edf_example.v
deleted file mode 100644
index b4c29d2f80a6e5f328f7832a7e53481f320ead96..0000000000000000000000000000000000000000
--- a/classic/implementation/apa/bertogna_edf_example.v
+++ /dev/null
@@ -1,189 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.affinity prosa.classic.model.schedule.apa.interference prosa.classic.model.schedule.apa.platform.
-Require Import prosa.classic.analysis.apa.workload_bound
- prosa.classic.analysis.apa.interference_bound_edf
- prosa.classic.analysis.apa.bertogna_edf_comp.
-Require Import prosa.classic.implementation.apa.job
- prosa.classic.implementation.apa.task
- prosa.classic.implementation.apa.schedule
- prosa.classic.implementation.apa.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq fintype bigop div.
-
-Module ResponseTimeAnalysisEDF.
-
- Import Job Schedule SporadicTaskset Priority Schedulability
- Affinity Platform InterferenceBoundEDF WorkloadBound
- Interference ResponseTimeIterationEDF.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we instantiate a simple example to show that the theorems
- contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Let (cpu j) denote the j-th processor *)
- Let cpu j := @Ordinal num_cpus j.
-
- (* Define alpha1 := {cpu 0, cpu 1} with the two processors. *)
- Program Let alpha1 : affinity num_cpus :=
- (Build_set [:: cpu 0 _; cpu 1 _] _).
-
- (* Define the singleton affinity alpha2 := {cpu 0}. *)
- Program Let alpha2 : affinity num_cpus :=
- (Build_set [:: cpu 0 _] _).
-
- (* Define the singleton affinity alpha3 := {cpu 1}. *)
- Program Let alpha3 : affinity num_cpus :=
- (Build_set [:: cpu 1 _] _).
-
- (* Now we create three tasks using the affinities above ... *)
- Let tsk1 := {| task_id := 1; task_cost := 3; task_period := 5;
- task_deadline := 3; task_affinity := alpha1|}.
- Let tsk2 := {| task_id := 2; task_cost := 2; task_period := 6;
- task_deadline := 5; task_affinity := alpha2|}.
- Let tsk3 := {| task_id := 3; task_cost := 2; task_period := 12;
- task_deadline := 11; task_affinity := alpha3|}.
-
- (* ... and group these tasks into task set ts. *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- (* In this section, we let Coq compute a few properties about ts. *)
- Section FactsAboutTaskset.
-
- (* There are no empty affinities. *)
- Fact ts_non_empty_affinities:
- forall tsk,
- tsk \in ts ->
- #|task_affinity tsk| > 0.
- Proof.
- intros tsk IN.
- by repeat (move: IN => /orP [/eqP EQ | IN]; subst; rewrite ?set_card; compute).
- Qed.
-
- (* The tasks have valid parameters (e.g., cost > 0). *)
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- by repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute).
- Qed.
-
- (* The task set has constrained deadlines. *)
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- by repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute).
- Qed.
-
- End FactsAboutTaskset.
-
- (* Next, recall the EDF RTA schedulability test for APA scheduling.
- Note that the task functions (from implementation/apa/task.v)
- require num_cpus as a parameter, so we leave a blank space so that
- can be inferred automatically. *)
- Let schedulability_test :=
- edf_schedulable (@task_cost _) (@task_period _)
- (@task_deadline _) num_cpus task_affinity
- task_affinity. (* For simplicity, we use subaffinity alpha' = alpha. *)
-
- (* Now, we guide Coq to compute the schedulability test function
- and show it returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, edf_schedulable, edf_claimed_bounds; desf.
- apply negbT in Heq; move: Heq => /negP ALL.
- exfalso; apply ALL; clear ALL.
- assert (STEPS: \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1 = 13).
- {
- by rewrite unlock; compute.
- } rewrite STEPS; clear STEPS.
-
- Local Ltac f :=
- unfold edf_rta_iteration; simpl;
- unfold edf_response_time_bound, div_floor, total_interference_bound_edf, interference_bound_edf, interference_bound_generic, W, edf_specific_interference_bound, different_task_in, affinity_intersects; simpl;
- rewrite !addnE !set_card !big_cons ?big_nil /=.
-
- Local Ltac g := destruct master_key; f; simpl_exists_ord.
- rewrite [edf_rta_iteration]lock; simpl.
- unfold locked at 13; g.
- unfold locked at 12; g.
- unfold locked at 11; g.
- unfold locked at 10; g.
- unfold locked at 9; g.
- unfold locked at 8; g.
- unfold locked at 7; g.
- unfold locked at 6; g.
- unfold locked at 5; g.
- unfold locked at 4; g.
- unfold locked at 3; g.
- unfold locked at 2; g.
- by unfold locked at 1; g.
- Qed.
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Let sched be the weak APA EDF scheduler. *)
- Let sched := scheduler job_arrival job_cost job_task num_cpus arr_seq task_affinity
- (JLFP_to_JLDP (EDF job_arrival job_deadline)).
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* To show that the RTA works, we infer the schedulability of the task
- set from the result of the RTA procedure. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have VALIDTS := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_edf_rta with (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (alpha := task_affinity) (alpha' := task_affinity)
- (ts0 := ts); try (by done) ) ||
- apply taskset_schedulable_by_edf_rta with (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (alpha := task_affinity) (alpha' := task_affinity)
- (ts := ts); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply ts_non_empty_affinities.
- - by ins.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_must_arrive_to_execute.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - apply scheduler_sequential_jobs.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_respects_affinity.
- - apply scheduler_apa_work_conserving.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisEDF.
diff --git a/classic/implementation/apa/bertogna_fp_example.v b/classic/implementation/apa/bertogna_fp_example.v
deleted file mode 100644
index fe65e131bb730515c67a6bf34943a1e5cdc015d1..0000000000000000000000000000000000000000
--- a/classic/implementation/apa/bertogna_fp_example.v
+++ /dev/null
@@ -1,276 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.affinity prosa.classic.model.schedule.apa.interference prosa.classic.model.schedule.apa.platform.
-Require Import prosa.classic.analysis.apa.workload_bound
- prosa.classic.analysis.apa.interference_bound_fp
- prosa.classic.analysis.apa.bertogna_fp_comp.
-Require Import prosa.classic.implementation.apa.job
- prosa.classic.implementation.apa.task
- prosa.classic.implementation.apa.schedule
- prosa.classic.implementation.apa.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype fintype seq bigop div.
-
-Module ResponseTimeAnalysisFP.
-
- Import Job Schedule SporadicTaskset Priority Schedulability Platform
- Interference InterferenceBoundFP WorkloadBound
- ResponseTimeIterationFP Affinity.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we instantiate a simple example to show that the theorems
- contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Let (cpu j) denote the j-th processor *)
- Let cpu j := @Ordinal num_cpus j.
-
- (* Define alpha1 := {cpu 0, cpu 1} with the two processors. *)
- Program Let alpha1 : affinity num_cpus :=
- (Build_set [:: cpu 0 _; cpu 1 _] _).
-
- (* Define the singleton affinity alpha2 := {cpu 0}. *)
- Program Let alpha2 : affinity num_cpus :=
- (Build_set [:: cpu 0 _] _).
-
- (* Define the singleton affinity alpha3 := {cpu 1}. *)
- Program Let alpha3 : affinity num_cpus :=
- (Build_set [:: cpu 1 _] _).
-
- (* Now we create three tasks using the affinities above ... *)
- Let tsk1 := {| task_id := 1; task_cost := 3; task_period := 5;
- task_deadline := 3; task_affinity := alpha1|}.
- Let tsk2 := {| task_id := 2; task_cost := 2; task_period := 6;
- task_deadline := 5; task_affinity := alpha2|}.
- Let tsk3 := {| task_id := 3; task_cost := 2; task_period := 12;
- task_deadline := 11; task_affinity := alpha3|}.
-
- (* ... and group these tasks into task set ts. *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- (* In this section, we let Coq compute a few properties about ts. *)
- Section FactsAboutTaskset.
-
- (* There are no empty affinities. *)
- Fact ts_non_empty_affinities:
- forall tsk,
- tsk \in ts -> #|task_affinity tsk| > 0.
- Proof.
- intros tsk IN.
- by repeat (move: IN => /orP [/eqP EQ | IN]; subst; rewrite ?set_card; compute).
- Qed.
-
- (* The tasks have valid parameters (e.g., cost > 0). *)
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- by repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute).
- Qed.
-
- (* The task set has constrained deadlines. *)
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- by repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute).
- Qed.
-
- End FactsAboutTaskset.
-
- (* Then, let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Assume rate-monotonic priorities. *)
- Let higher_priority : JLDP_policy (@concrete_job_eqType num_cpus) :=
- FP_to_JLDP job_task (RM task_period).
-
- Section FactsAboutPriorityOrder.
-
- Lemma ts_has_unique_priorities :
- FP_is_antisymmetric_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN' HP HP'.
- have EQ: task_period tsk = task_period tsk' by apply/eqP; rewrite eqn_leq HP HP'.
- clear HP HP'.
- rewrite !in_cons 2!in_nil 2!orbF in IN IN'; des; rewrite IN IN'; try (by done);
- subst tsk tsk'; simpl in *; by done.
- Qed.
-
- Lemma priority_is_total :
- FP_is_total_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN'.
- destruct (leqP (task_period tsk) (task_period tsk'));
- [by left | by right; apply ltnW].
- Qed.
-
- End FactsAboutPriorityOrder.
-
- (* Next, recall the FP RTA schedulability test for APA scheduling.
- Note that the task functions (from implementation/apa/task.v)
- require num_cpus as a parameter, so we leave a blank space so that
- can be inferred automatically. *)
- Let schedulability_test :=
- fp_schedulable (@task_cost _) (@task_period _) (@task_deadline _)
- num_cpus (RM task_period) task_affinity
- task_affinity. (* For simplicity, we use subaffinity alpha' = alpha. *)
-
- (* Now we show that the schedulability test returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, fp_schedulable, fp_claimed_bounds; simpl.
- unfold total_interference_bound_fp, div_floor.
- rewrite big_nil div0n addn0 /=.
- unfold div_floor; rewrite !set_card /=.
-
- set I2 := total_interference_bound_fp task_cost task_period
- task_affinity tsk2 alpha2 [:: (tsk1, 3)].
-
- assert (H1: I2 2 (RM task_period) = 1).
- {
- unfold I2, total_interference_bound_fp; rewrite big_cons big_nil.
- unfold higher_priority_task_in; simpl.
- by rewrite /affinity_intersects; simpl_exists_ord; compute.
- }
- rewrite H1 !divn1 !addn1; clear H1.
- assert (H1: I2 3 (RM task_period) = 2).
- {
- unfold I2, total_interference_bound_fp; rewrite big_cons big_nil.
- unfold higher_priority_task_in; simpl.
- by rewrite /affinity_intersects; simpl_exists_ord; compute.
- }
- rewrite H1 !addn2; clear H1.
- assert (H1: I2 4 (RM task_period) = 3).
- {
- unfold I2, total_interference_bound_fp; rewrite big_cons big_nil.
- unfold higher_priority_task_in; simpl.
- by rewrite /affinity_intersects; simpl_exists_ord; compute.
- }
- rewrite H1 !addn3; clear H1.
- assert (H1: I2 5 (RM task_period) = 3).
- {
- unfold I2, total_interference_bound_fp; rewrite big_cons big_nil.
- unfold higher_priority_task_in; simpl.
- by rewrite /affinity_intersects; simpl_exists_ord; compute.
- }
- rewrite H1 !addn3; clear H1.
- have H2: 4 < 5 by compute.
- rewrite H2; clear H2 I2.
- unfold fp_bound_of_task.
-
- Ltac f := unfold div_floor;
- rewrite !big_cons big_nil /= /higher_priority_task_in /=
- /affinity_intersects !addn0 /= ?set_card ?divn1 ?addn0;
- unfold interference_bound_generic, W, max_jobs, div_floor;
- rewrite addn1 ?addn0.
-
- have H4: per_task_rta task_cost task_period num_cpus (RM task_period) task_affinity task_affinity tsk3 [:: (tsk1, 3); (tsk2, 5)]
- (max_steps task_cost task_deadline tsk3) = 5.
- {
- rewrite /per_task_rta iterSr /div_floor set_card.
- Ltac g :=
- rewrite /total_interference_bound_fp /interference_bound_generic
- /W /max_jobs /div_floor !big_cons big_nil /= /higher_priority_task_in /=
- /affinity_intersects.
-
- set x9 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I9: x9 = 1 by unfold x9; g; simpl_exists_ord; compute.
- rewrite I9 iterSr.
- set x8 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I8: x8 = 2 by unfold x8; g; simpl_exists_ord; compute.
- rewrite I8 iterSr.
- set x7 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I7: x7 = 3 by unfold x7; g; simpl_exists_ord; compute.
- rewrite I7 iterSr.
- set x6 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I6: x6 = 3 by unfold x6; g; simpl_exists_ord; compute.
- rewrite I6 iterSr.
- set x5 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I5: x5 = 3 by unfold x5; g; simpl_exists_ord; compute.
- rewrite I5 iterSr.
- set x4 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I4: x4 = 3 by unfold x4; g; simpl_exists_ord; compute.
- rewrite I4 iterSr.
- set x3 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I3: x3 = 3 by unfold x3; g; simpl_exists_ord; compute.
- rewrite I3 iterSr.
- set x2 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I2: x2 = 3 by unfold x2; g; simpl_exists_ord; compute.
- rewrite I2 iterSr.
- set x1 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I1: x1 = 3 by unfold x1; g; simpl_exists_ord; compute.
- rewrite I1 iterSr /=.
- set x0 := total_interference_bound_fp _ _ _ _ _ _ _ _.
- have I0: x0 = 3 by unfold x0; g; simpl_exists_ord; compute.
- by rewrite I0; compute.
- }
- by rewrite H4.
- Qed.
-
- (* Let sched be the work-conserving RM APA scheduler. *)
- Let sched :=
- scheduler job_arrival job_cost job_task num_cpus arr_seq task_affinity higher_priority.
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, we prove that ts is schedulable with the result of the test. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts0 := ts) (higher_priority0 := RM task_period)
- (alpha := task_affinity) (alpha' := task_affinity); try (by done) ) ||
- apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts := ts) (higher_priority := RM task_period)
- (alpha := task_affinity) (alpha' := task_affinity); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply ts_non_empty_affinities.
- - by ins.
- - by apply ts_has_unique_priorities.
- - by apply priority_is_total.
- - by apply RM_is_transitive.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_must_arrive_to_execute.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - apply scheduler_sequential_jobs.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_respects_affinity.
- - apply scheduler_apa_work_conserving.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/implementation/apa/job.v b/classic/implementation/apa/job.v
deleted file mode 100644
index 2d639cd769cf89153ee36133993783270b6ea11c..0000000000000000000000000000000000000000
--- a/classic/implementation/apa/job.v
+++ /dev/null
@@ -1,65 +0,0 @@
-Require Import prosa.classic.model.time prosa.classic.util.all.
-Require Import prosa.classic.implementation.apa.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteJob.
-
- Import Time.
- Import ConcreteTask.
-
- Section Defs.
-
- Context {num_cpus: nat}.
-
- (* Definition of a concrete task. *)
- Record concrete_job :=
- {
- job_id: nat;
- job_arrival: nat;
- job_cost: time;
- job_deadline: time;
- job_task: @concrete_task num_cpus
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete jobs. *)
- Definition job_eqdef (j1 j2: concrete_job) :=
- (job_id j1 == job_id j2) &&
- (job_arrival j1 == job_arrival j2) &&
- (job_cost j1 == job_cost j2) &&
- (job_deadline j1 == job_deadline j2) &&
- (job_task j1 == job_task j2).
-
- (* Next, we prove that job_eqdef is indeed an equality, ... *)
- Lemma eqn_job : Equality.axiom job_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (job_eqdef x y) eqn:EQ.
- {
- apply ReflectT; unfold job_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP ARRIVAL] /eqP COST] /eqP DL] /eqP TASK].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold job_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP TASK]; last by apply TASK; inversion BUG.
- move: EQ => /orP [EQ | /eqP DL]; last by apply DL; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP COST]; last by apply COST; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP ARRIVAL]; last by apply ARRIVAL; inversion BUG.
- by apply ID; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_job_eqMixin := EqMixin eqn_job.
- Canonical concrete_job_eqType := Eval hnf in EqType concrete_job concrete_job_eqMixin.
-
- End Defs.
-
-End ConcreteJob.
\ No newline at end of file
diff --git a/classic/implementation/apa/schedule.v b/classic/implementation/apa/schedule.v
deleted file mode 100644
index 4c864dd311cb4aafb2969ccaf9973576385b6e0e..0000000000000000000000000000000000000000
--- a/classic/implementation/apa/schedule.v
+++ /dev/null
@@ -1,667 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.affinity prosa.classic.model.schedule.apa.platform.
-Require Import prosa.classic.model.schedule.global.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path.
-
-Module ConcreteScheduler.
-
- Import SporadicTaskset ArrivalSequence Schedule Platform Priority Affinity ScheduleConstruction.
-
- (* In this section, we implement a concrete weak APA scheduler. *)
- Section Implementation.
-
- Context {Job: eqType}.
- Context {sporadic_task: eqType}.
-
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Let num_cpus denote the number of processors, ...*)
- Variable num_cpus: nat.
-
- (* ... and let arr_seq be any arrival sequence.*)
- Variable arr_seq: arrival_sequence Job.
-
- (* Let alpha be an affinity associated with each task. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Assume a JLDP policy is given. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, we show how to recursively construct the schedule. *)
- Section ScheduleConstruction.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job num_cpus.
- Variable cpu: processor num_cpus.
- Variable t: time.
-
- (* For simplicity, let's use some local names. *)
- Let is_pending := pending job_arrival job_cost sched_prefix.
- Let actual_arrivals := jobs_arrived_up_to arr_seq.
-
- (* Consider the list of pending jobs at time t, ... *)
- Definition pending_jobs := [seq j <- actual_arrivals t | is_pending j t].
-
- (* ...which we sort by priority. *)
- Definition sorted_pending_jobs := sort (higher_eq_priority t) pending_jobs.
-
- (* Now we implement the algorithm that generates the APA schedule. *)
-
- (* Given a job j at time t, we first define a predicate that states
- whether j should preempt a mapping (cpu, x), where x is either Some j'
- that is currently mapped to cpu or None. *)
- Definition should_be_scheduled (j: Job) p :=
- let '(cpu, mapped_job) := p in
- if mapped_job is Some j' then (* If there is a job j', check the priority and affinity. *)
- (can_execute_on alpha (job_task j) cpu) &&
- ~~ (higher_eq_priority t j' j)
- else (* Else, if cpu is idle, check only the affinity. *)
- (can_execute_on alpha (job_task j) cpu).
-
- (* Next, using the "should_be_scheduled" predicate, we define a function
- that tries to schedule job j by updating a list of mappings.
- It does so by replacing the first pair (cpu, x) where j can be
- scheduled (if it exists). *)
- Definition update_available_cpu allocation j :=
- replace_first (should_be_scheduled j) (* search for processors that j can preempt *)
- (set_pair_2nd (Some j)) (* replace the mapping in that processor with j *)
- allocation. (* list of mappings *)
-
- (* Consider the empty mapping. *)
- Let empty_mapping : seq (processor num_cpus * option Job) :=
- (zip (enum (processor num_cpus)) (nseq num_cpus None)).
-
- (* Using the fuction "update_available_cpu", we now define an iteration
- that iteratively maps each pending job to a processor.
-
- Starting with an empty mapping,
- <(cpu0, None), (cpu1, None), (cpu2, None), ...>,
- it tries to schedule each job on some processor and yields an updated list:
- <(cpu0, None), (cpu1, Some j5), (cpu2, Some j9), ...>. *)
- Definition schedule_jobs_from_list l :=
- foldl update_available_cpu empty_mapping l.
-
- (* To conclude, we take the list of pairs and convert to a function denoting
- the actual schedule. *)
- Definition apa_schedule :=
- pairs_to_function None (schedule_jobs_from_list sorted_pending_jobs) cpu.
-
- End ScheduleConstruction.
-
- (* Starting from the empty schedule, the final schedule is obtained by iteratively
- picking the highest-priority job. *)
- Let empty_schedule : schedule Job num_cpus := fun cpu t => None.
- Definition scheduler :=
- build_schedule_from_prefixes num_cpus apa_schedule empty_schedule.
-
- (* Then, by showing that the construction function depends only on the prefix, ... *)
- Lemma scheduler_depends_only_on_prefix:
- forall sched1 sched2 cpu t,
- (forall t0 cpu0, t0 < t -> sched1 cpu0 t0 = sched2 cpu0 t0) ->
- apa_schedule sched1 cpu t = apa_schedule sched2 cpu t.
- Proof.
- intros sched1 sched2 cpu t ALL.
- rewrite /apa_schedule /schedule_jobs_from_list; do 2 f_equal.
- rewrite /sorted_pending_jobs; f_equal.
- apply eq_in_filter.
- intros j ARR.
- rewrite /pending; do 2 f_equal.
- rewrite /completed; f_equal.
- apply eq_big_nat; move => i /= LTi.
- rewrite /service_at /scheduled_on; apply eq_bigl; move => cpu'.
- by rewrite ALL.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary scheduler_uses_construction_function:
- forall t cpu, scheduler cpu t = apa_schedule scheduler cpu t.
- Proof.
- by ins; apply prefix_dependent_schedule_construction,
- scheduler_depends_only_on_prefix.
- Qed.
-
- End Implementation.
-
- (* In this section, we prove several properties about the scheduling algorithm we
- implemented. For example, we show that it is APA work conserving. *)
- Section Proofs.
-
- Context {Job: eqType}.
- Context {sporadic_task: eqType}.
-
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume a positive number of processors. *)
- Variable num_cpus: nat.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Let alpha be an affinity associated with each task. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Let arr_seq be any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Consider any JLDP policy higher_eq_priority that is transitive and total. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_total: forall t, total (higher_eq_priority t).
-
- (* Let sched denote our concrete scheduler implementation. *)
- Let sched := scheduler job_arrival job_cost job_task num_cpus arr_seq alpha higher_eq_priority.
-
- (* Next, we provide some helper lemmas about the scheduler construction. *)
- Section HelperLemmas.
-
- (* To avoid many parameters, let's also rename the scheduling function.
- We make a generic version (for any list of jobs l), ... *)
- Let schedule_jobs t l := schedule_jobs_from_list job_task num_cpus alpha higher_eq_priority t l.
- (* ... and a specific version (for the pending jobs in sched). *)
- Let schedule_pending_jobs t :=
- schedule_jobs t (sorted_pending_jobs job_arrival job_cost num_cpus arr_seq
- higher_eq_priority sched t).
-
- (* Next, we show that there are no duplicate cpus in the mapping. *)
- Lemma scheduler_uniq_cpus :
- forall t l,
- uniq (unzip1 (schedule_jobs t l)).
- Proof.
- intros t l.
- induction l as [| l' j_last] using last_ind.
- {
- by rewrite unzip1_zip; [rewrite enum_uniq | rewrite size_enum_ord size_nseq].
- }
- {
- rewrite /schedule_jobs /schedule_jobs_from_list -cats1 foldl_cat /=.
- set up := update_available_cpu _ _ _ _ _.
- assert (EQ: forall l j, unzip1 (up l j) = unzip1 l).
- {
- intros l j; clear -l j.
- induction l; first by done.
- rewrite /up /update_available_cpu /=.
- by case SHOULD: should_be_scheduled; simpl; f_equal.
- }
- by rewrite EQ.
- }
- Qed.
-
- (* Next, we show that if a job j is in the mapping, then j must come from the list
- of jobs l used in the construction. *)
- Lemma scheduler_job_in_mapping :
- forall l j t cpu,
- (cpu, Some j) \in schedule_jobs t l -> j \in l.
- Proof.
- intros l j t cpu SOME; clear -SOME.
- induction l as [| l' j'] using last_ind; simpl in *.
- {
- apply mem_zip in SOME; last by rewrite size_enum_ord size_nseq.
- by move: SOME => [_ /nseqP [SOME _]].
- }
- {
- rewrite /schedule_jobs /schedule_jobs_from_list -cats1 foldl_cat /= in SOME.
- unfold update_available_cpu in SOME.
- elim (replace_first_cases SOME) => [IN | [y [NEW IN]]].
- {
- by rewrite mem_rcons in_cons; apply/orP; right; apply IHl.
- }
- {
- case: NEW => EQ1 EQ2; subst.
- by rewrite mem_rcons in_cons eq_refl orTb.
- }
- }
- Qed.
-
- (* Next, we prove that if a pair (cpu, j) is in the mapping, then
- cpu must be part of j's affinity. *)
- Lemma scheduler_mapping_respects_affinity :
- forall j t cpu,
- (cpu, Some j) \in schedule_pending_jobs t ->
- can_execute_on alpha (job_task j) cpu.
- Proof.
- intros j t cpu SOME.
- unfold schedule_pending_jobs in SOME.
- set l := sorted_pending_jobs _ _ _ _ _ _ _ in SOME.
- induction l as [| l' j'] using last_ind; simpl in *.
- {
- apply mem_zip in SOME; last by rewrite size_enum_ord size_nseq.
- by move: SOME => [_ /nseqP [BUG _]].
- }
- {
- unfold schedule_jobs, schedule_jobs_from_list in SOME.
- rewrite -cats1 foldl_cat /= in SOME.
- elim (replace_first_cases SOME) => [IN | [y [NEW [SHOULD _]]]];
- first by apply IHl.
- case: NEW => EQ1 EQ2; subst.
- by unfold should_be_scheduled in SHOULD; desf.
- }
- Qed.
-
- (* Next, we show that the mapping does not schedule the same job j in two
- different cpus. *)
- Lemma scheduler_has_no_duplicate_jobs :
- forall j t cpu1 cpu2,
- (cpu1, Some j) \in schedule_pending_jobs t ->
- (cpu2, Some j) \in schedule_pending_jobs t ->
- cpu1 = cpu2.
- Proof.
- intros j t cpu1 cpu2 SOME1 SOME2.
- unfold schedule_pending_jobs in *.
- set l := sorted_pending_jobs _ _ _ _ _ _ _ in SOME1 SOME2.
- assert (UNIQ: uniq l).
- by rewrite sort_uniq; eapply filter_uniq, arrivals_uniq; eauto 1.
-
- induction l as [| l' j'] using last_ind; simpl in *.
- {
- apply mem_zip in SOME1; last by rewrite size_enum_ord size_nseq.
- by move: SOME1 => [_ /nseqP [BUG _]].
- }
- {
- rewrite rcons_uniq in UNIQ; move: UNIQ => /andP [NOTIN UNIQ].
- rewrite /schedule_jobs /schedule_jobs_from_list -cats1 foldl_cat /= in SOME1 SOME2.
- destruct (replace_first_cases SOME1) as [SAME1 | [[cpu1' p1] [EQ1 [SHOULD1 PREV1]]]];
- destruct (replace_first_cases SOME2) as [SAME2 | [[cpu2' p2] [EQ2 [SHOULD2 PREV2]]]].
- {
- by apply IHl.
- }
- {
- move: EQ2; case => EQ1 EQ2; subst cpu2' j'.
- destruct p2 as [j2 |].
- {
- apply scheduler_job_in_mapping in SAME1.
- by rewrite SAME1 in NOTIN.
- }
- by apply (replace_first_new _ _ _ (cpu2, Some j)) in SOME1;
- [by move: SOME1; case => -> | | | by done];
- apply/negP; intro BUG;
- apply scheduler_job_in_mapping in BUG;
- by rewrite BUG in NOTIN.
- }
- {
- move: EQ1; case => EQ1 EQ2; subst cpu1' j'.
- destruct p1 as [j1 |].
- {
- apply scheduler_job_in_mapping in SAME2.
- by rewrite SAME2 in NOTIN.
- }
- by apply (replace_first_new _ _ _ (cpu2, Some j)) in SOME1;
- [by move: SOME1; case => -> | | | by done];
- apply/negP; intro BUG;
- apply scheduler_job_in_mapping in BUG;
- by rewrite BUG in NOTIN.
- }
- {
- move: EQ1; case => /= EQ1' /= EQ2'; subst cpu1' j'.
- move: EQ2; case => EQ1'; subst cpu2'.
- by apply (replace_first_new _ _ _ (cpu2, Some j)) in SOME1;
- [by move: SOME1; case => -> | | | by done];
- apply/negP; intro BUG;
- apply scheduler_job_in_mapping in BUG;
- by rewrite BUG in NOTIN.
- }
- }
- Qed.
-
- (* Based on the definition of the schedule, a job j is scheduled on cpu
- iff (cpu, Some j) is the final mapping. *)
- Lemma scheduler_scheduled_on :
- forall j cpu t,
- scheduled_on sched j cpu t = ((cpu, Some j) \in schedule_pending_jobs t).
- Proof.
- unfold schedule_pending_jobs, schedule_jobs in *.
- intros j cpu t.
- apply/idP/idP.
- {
- move => /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function /apa_schedule in SCHED.
- by apply pairs_to_function_neq_default in SCHED; last by done.
- }
- {
- intros SCHED.
- have MEM := pairs_to_function_mem None.
- apply MEM in SCHED; clear MEM; last by apply scheduler_uniq_cpus.
- apply/eqP.
- by rewrite /sched scheduler_uses_construction_function.
- }
- Qed.
-
- (* Now we show that for every cpu, there is always a pair in the mapping. *)
- Lemma scheduler_has_cpus :
- forall cpu t l,
- exists x,
- (cpu, x) \in schedule_jobs t l.
- Proof.
- intros cpu t l.
- induction l as [| l' j_last] using last_ind; simpl in *.
- {
- by exists None; rewrite mem_zip_nseq_r;
- [by rewrite mem_enum | by rewrite size_enum_ord].
- }
- {
- rewrite /schedule_jobs /schedule_jobs_from_list -cats1 foldl_cat /=.
- move: IHl => [x IN].
- eapply replace_first_previous in IN; des;
- first by exists x; apply IN.
- rewrite /set_pair_2nd in IN.
- by exists (Some j_last); apply IN0.
- }
- Qed.
-
- (* Next, consider a list of jobs l that is sorted by priority and does not have
- duplicates.
- We prove that for any job j in l, if j is not scheduled at time t,
- then every cpu in j's affinity has some job mapped at time t. *)
- Lemma scheduler_mapping_is_work_conserving :
- forall j cpu t l,
- j \in l ->
- sorted (higher_eq_priority t) l ->
- uniq l ->
- (forall cpu, (cpu, Some j) \notin schedule_jobs t l) ->
- can_execute_on alpha (job_task j) cpu ->
- exists j_other,
- (cpu, Some j_other) \in schedule_jobs t l.
- Proof.
- intros j cpu t l IN SORT UNIQ NOTSCHED CAN.
- generalize dependent cpu.
- induction l as [| l' j_last] using last_ind; simpl in *;
- first by rewrite in_nil in IN.
- {
- intros cpu CAN.
- rewrite rcons_uniq in UNIQ; move: UNIQ => /andP [NOTIN UNIQ].
- rewrite /schedule_jobs /schedule_jobs_from_list -cats1 foldl_cat /= in NOTSCHED *.
- set prev := foldl _ _ _ in NOTSCHED *.
- rewrite mem_rcons in_cons in IN.
- move: IN => /orP [/eqP IN | LAST]; subst.
- {
- clear IHl.
- assert (ALL: forall x, x \in prev ->
- ~~ (should_be_scheduled job_task num_cpus alpha higher_eq_priority t j_last) x).
- {
- apply replace_first_failed with (f := set_pair_2nd (Some j_last)).
- by intros [cpu' j'] IN; apply NOTSCHED.
- }
- have [x IN] := scheduler_has_cpus cpu t l'; fold prev in IN.
- specialize (ALL (cpu, x) IN).
- simpl in ALL.
- destruct x as [j' |]; last by rewrite CAN in ALL.
- eapply replace_first_previous in IN; des; first by exists j'; apply IN.
- by exists j_last; apply IN0.
- }
- {
- specialize (IHl LAST).
- feed_n 2 IHl;
- [by apply sorted_rcons_prefix in SORT | by done | ].
- feed IHl.
- {
- clear IHl; intros cpu'; specialize (NOTSCHED cpu').
- apply/negP; intro BUG.
- apply replace_first_previous with (f := set_pair_2nd (Some j_last))
- (P := should_be_scheduled job_task num_cpus alpha higher_eq_priority t j_last)
- in BUG; des;
- first by rewrite BUG in NOTSCHED.
- move: BUG => /andP [_ /negP HP].
- by apply HP, order_sorted_rcons with (xs := l'); try by done.
- }
- move: (IHl cpu CAN) => [j_old IN]; clear IHl LAST.
- by eapply replace_first_previous in IN; des;
- [exists j_old; apply IN | exists j_last; apply IN0].
- }
- }
- Qed.
-
- (* Next, we prove that the mapping respects priority. *)
- Lemma scheduler_priority :
- forall j j_hp cpu t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- can_execute_on alpha (job_task j) cpu ->
- scheduled_on sched j_hp cpu t ->
- higher_eq_priority t j_hp j.
- Proof.
- have SCHED_ON := scheduler_scheduled_on.
- intros j j_hp cpu t ARRj BACK CAN SCHED.
- move: BACK => /andP [PENDING NOTSCHED'].
- assert (NOTSCHED: forall cpu, (cpu, Some j) \notin schedule_pending_jobs t).
- {
- intros cpu'; rewrite -SCHED_ON.
- by rewrite negb_exists in NOTSCHED'; move: NOTSCHED' => /forallP ALL; apply ALL.
- }
- rewrite SCHED_ON in SCHED.
- clear NOTSCHED' SCHED_ON.
-
- unfold schedule_pending_jobs, schedule_jobs, schedule_jobs_from_list in *.
- set l := sorted_pending_jobs _ _ _ _ _ _ _ in SCHED NOTSCHED.
-
- have IN: j \in l.
- {
- rewrite mem_sort mem_filter PENDING andTb.
- move: PENDING => /andP [ARR IN]; rewrite /has_arrived in ARR.
- try ( by apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival) ) ||
- by apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival).
- }
- have INhp: j_hp \in l by apply scheduler_job_in_mapping in SCHED.
- have SORT : sorted (higher_eq_priority t) l by apply sort_sorted, H_priority_total.
- have UNIQ: uniq l.
- by rewrite sort_uniq filter_uniq // (arrivals_uniq job_arrival) //.
-
- induction l as [| l' j_last] using last_ind;
- first by rewrite in_nil in IN.
- {
- rewrite /schedule_jobs_from_list -cats1 foldl_cat /= in SCHED.
- rewrite /schedule_jobs_from_list -cats1 foldl_cat /= in NOTSCHED.
- set prev := foldl _ _ _ in SCHED NOTSCHED.
- rewrite rcons_uniq in UNIQ; move: UNIQ => /andP [NOTIN UNIQ].
- rewrite 2!mem_rcons 2!in_cons in IN INhp.
- move: IN => /orP [/eqP EQ | IN];
- move: INhp => /orP [/eqP EQhp | INhp].
- {
- subst j_last j_hp.
- by specialize (NOTSCHED cpu); rewrite SCHED in NOTSCHED.
- }
- {
- subst j_last.
- by apply order_sorted_rcons with (xs := l').
- }
- {
- subst j_last; clear IHl.
- destruct (replace_first_cases SCHED) as [PREV | [[cpu' y] [EQ [SHOULD IN']]]].
- {
- unfold prev in PREV.
- apply scheduler_job_in_mapping in PREV.
- by rewrite PREV in NOTIN.
- }
- {
- move: EQ; case; intro EQ1; subst cpu'.
- destruct y as [j'|].
- {
- unfold should_be_scheduled in SHOULD.
- move: SHOULD => /andP [CAN' /negP HP].
- unfold prev in IN'.
- apply scheduler_job_in_mapping in IN'.
- by exfalso; apply HP, order_sorted_rcons with (xs := l').
- }
- {
- destruct [exists cpu, ((cpu, Some j) \in prev)] eqn:EX.
- {
- move: EX => /existsP [cpu' IN''].
- unfold prev in IN''.
- apply replace_first_previous with (f := set_pair_2nd (Some j_hp))
- (P := should_be_scheduled job_task num_cpus alpha higher_eq_priority t j_hp)
- in IN''; des;
- first by specialize (NOTSCHED cpu'); rewrite IN'' in NOTSCHED.
- move: IN'' => /andP [_ /negP HP].
- by exfalso; apply HP, order_sorted_rcons with (xs := l').
- }
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP EX.
- apply sorted_rcons_prefix in SORT.
- move: (scheduler_mapping_is_work_conserving j cpu t l' IN SORT UNIQ EX CAN) => [j' BUG].
- have MEM := pairs_to_function_mem None.
- apply MEM in BUG; last by apply scheduler_uniq_cpus.
- have UNIQ' := scheduler_uniq_cpus t l'.
- apply MEM in IN'; last by apply UNIQ'.
- by rewrite IN' in BUG.
- }
- }
- }
- }
- {
- apply IHl; try (by done); last first.
- {
- by apply sorted_rcons_prefix in SORT.
- }
- {
- intros cpu0; apply/negP; intro BUG.
- unfold update_available_cpu in NOTSCHED.
- apply replace_first_previous with (f := set_pair_2nd (Some j_last))
- (P := should_be_scheduled job_task num_cpus alpha higher_eq_priority t j_last)
- in BUG; des.
- {
- by specialize (NOTSCHED cpu0); rewrite BUG in NOTSCHED.
- }
- {
- move: BUG => /andP [_ /negP HP].
- by apply HP, order_sorted_rcons with (xs := l'); try by done.
- }
- }
- {
- destruct (replace_first_cases SCHED) as [| [[cpu' y][EQ [SHOULD IN']]]]; first by done.
- move: EQ; case; intros EQ1 EQ2; subst cpu' j_last.
- by rewrite INhp in NOTIN.
- }
- }
- }
- Qed.
-
- End HelperLemmas.
-
- (* Now, we prove the important properties about the implementation. *)
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma scheduler_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
- Proof.
- move => j t /existsP [cpu SCHED].
- rewrite scheduler_scheduled_on in SCHED.
- apply scheduler_job_in_mapping in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- move: SCHED => /andP [_ ARR].
- by apply in_arrivals_implies_arrived in ARR.
- Qed.
-
- (* Jobs do not execute before they arrive, ...*)
- Theorem scheduler_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Proof.
- move => j t /existsP [cpu SCHED].
- rewrite scheduler_scheduled_on in SCHED.
- apply scheduler_job_in_mapping in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- by move: SCHED => /andP [/andP [ARR _] _].
- Qed.
-
- (* ..., jobs are sequential, ... *)
- Theorem scheduler_sequential_jobs: sequential_jobs sched.
- Proof.
- intros j t cpu1 cpu2 SCHED1 SCHED2.
- by apply scheduler_has_no_duplicate_jobs with (j := j) (t := t);
- rewrite -scheduler_scheduled_on; apply/eqP.
- Qed.
-
- (* ... and jobs do not execute after completion. *)
- Theorem scheduler_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- Proof.
- have SEQ := scheduler_sequential_jobs.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- apply leq_add; first by done.
- rewrite /service_at.
- case (boolP ([exists cpu, scheduled_on sched j cpu t])) => [EX | ALL]; last first.
- {
- rewrite negb_exists in ALL; move: ALL => /forallP ALL.
- rewrite big1 //; intros cpu SCHED.
- by specialize (ALL cpu); rewrite SCHED in ALL.
- }
- move: EX => /existsP [cpu SCHED].
- rewrite (bigD1 cpu) /=; last by done.
- rewrite big1; first by rewrite addn0.
- move => cpu' /andP [SCHED' NEQ].
- move: SCHED SCHED' => /eqP SCHED /eqP SCHED'.
- move: NEQ => /eqP NEQ; exfalso; apply: NEQ.
- by apply SEQ with (j := j) (t := t).
- }
- rewrite -[job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 /service_at big1 //.
- move => cpu SCHED.
- rewrite scheduler_scheduled_on in SCHED.
- apply scheduler_job_in_mapping in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- move: SCHED => /andP [/andP [_ NOTCOMP] _].
- by rewrite /completed EQ leqnn in NOTCOMP.
- Qed.
-
- (* In addition, the scheduler is APA work conserving, ... *)
- Theorem scheduler_apa_work_conserving:
- apa_work_conserving job_arrival job_cost job_task arr_seq sched alpha.
- Proof.
- intros j t ARRj BACK cpu CAN.
- set l := (sorted_pending_jobs job_arrival job_cost num_cpus arr_seq higher_eq_priority sched t).
- have SORT : sorted (higher_eq_priority t) l by apply sort_sorted, H_priority_total.
- have UNIQ: uniq l.
- by rewrite sort_uniq filter_uniq // (arrivals_uniq job_arrival) //.
- move: BACK => /andP [PENDING NOTSCHED].
- have IN: j \in l.
- {
- rewrite mem_sort mem_filter PENDING andTb.
- move: PENDING => /andP [ARR _].
- try ( by apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival) ) ||
- by apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival).
- }
- have WORK := scheduler_mapping_is_work_conserving j cpu t l IN SORT UNIQ.
- exploit WORK; try by done.
- {
- rewrite negb_exists in NOTSCHED; move: NOTSCHED => /forallP NOTSCHED.
- by intros cpu0; specialize (NOTSCHED cpu0); rewrite -scheduler_scheduled_on.
- }
- by move => [j_other IN']; exists j_other; rewrite scheduler_scheduled_on.
- Qed.
-
- (* ..., respects affinities, ... *)
- Theorem scheduler_respects_affinity:
- respects_affinity job_task sched alpha.
- Proof.
- unfold respects_affinity; intros j cpu t SCHED.
- apply scheduler_mapping_respects_affinity with (t := t).
- by rewrite -scheduler_scheduled_on.
- Qed.
-
- (* ... and respects the JLDP policy under weak APA scheduling. *)
- Theorem scheduler_respects_policy :
- respects_JLDP_policy_under_weak_APA job_arrival job_cost job_task arr_seq
- sched alpha higher_eq_priority.
- Proof.
- unfold respects_JLDP_policy_under_weak_APA.
- intros j j_hp cpu t ARRj BACK SCHED ALPHA.
- rewrite scheduler_scheduled_on in SCHED.
- apply scheduler_priority with (cpu := cpu); try by done.
- by rewrite scheduler_scheduled_on.
- Qed.
-
- End Proofs.
-
-End ConcreteScheduler.
diff --git a/classic/implementation/apa/task.v b/classic/implementation/apa/task.v
deleted file mode 100644
index f2aff9e2111e2a098f82e105f8ee1d55c37d55da..0000000000000000000000000000000000000000
--- a/classic/implementation/apa/task.v
+++ /dev/null
@@ -1,77 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.schedule.apa.affinity.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteTask.
-
- Import Time SporadicTaskset Affinity.
-
- Section Defs.
-
- (* Let num_cpus be the number of processors. *)
- Context {num_cpus: nat}.
-
- (* Definition of a concrete task. *)
- Record concrete_task :=
- {
- task_id: nat; (* for uniqueness *)
- task_cost: time;
- task_period: time;
- task_deadline: time;
- task_affinity: affinity num_cpus
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete tasks. *)
- Definition task_eqdef (t1 t2: concrete_task) :=
- (task_id t1 == task_id t2) &&
- (task_cost t1 == task_cost t2) &&
- (task_period t1 == task_period t2) &&
- (task_deadline t1 == task_deadline t2) &&
- (task_affinity t1 == task_affinity t2).
-
- (* Next, we prove that task_eqdef is indeed an equality, ... *)
- Lemma eqn_task : Equality.axiom task_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (task_eqdef x y) eqn:EQ.
- {
- apply ReflectT.
- unfold task_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP COST]] /eqP PERIOD] /eqP DL] /eqP ALPHA.
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold task_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP DL]; last by apply DL; inversion BUG.
- move: EQ => /orP [EQ | /eqP PERIOD]; last by apply PERIOD; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP COST]; last by apply COST; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP ALPHA]; last by apply ALPHA; inversion BUG.
- by apply ID; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_task_eqMixin := EqMixin eqn_task.
- Canonical concrete_task_eqType := Eval hnf in EqType concrete_task concrete_task_eqMixin.
-
- End Defs.
-
- Section ConcreteTaskset.
-
- (* Let num_cpus be the number of processors. *)
- Variable num_cpus: nat.
-
- Definition concrete_taskset :=
- taskset_of (@concrete_task_eqType num_cpus).
-
- End ConcreteTaskset.
-
-End ConcreteTask.
\ No newline at end of file
diff --git a/classic/implementation/arrival_sequence.v b/classic/implementation/arrival_sequence.v
deleted file mode 100644
index fa70a4aebc0fb202d5257806d8df09be8320394e..0000000000000000000000000000000000000000
--- a/classic/implementation/arrival_sequence.v
+++ /dev/null
@@ -1,111 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.implementation.task prosa.classic.implementation.job.
-From mathcomp Require Import ssreflect ssrbool ssrfun ssrnat eqtype seq div.
-
-Module ConcreteArrivalSequence.
-
- Import Job ArrivalSequence ConcreteTask ConcreteJob SporadicTaskset TaskArrival.
-
- Section PeriodicArrivals.
-
- Variable ts: concrete_taskset.
-
- (* At any time t, we release Some job of tsk if t is a multiple of the period,
- otherwise we release None. *)
- Definition add_job (arr_time: time) (tsk: concrete_task) :=
- if task_period tsk %| arr_time then
- Some (Build_concrete_job (arr_time %/ task_period tsk) arr_time
- (task_cost tsk) (task_deadline tsk) tsk)
- else
- None.
-
- (* The arrival sequence at any time t is simply the partial map of add_job. *)
- Definition periodic_arrival_sequence (t: time) := pmap (add_job t) ts.
-
- End PeriodicArrivals.
-
- Section Proofs.
-
- (* Let ts be any concrete task set with valid parameters. *)
- Variable ts: concrete_taskset.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Regarding the periodic arrival sequence built from ts, we prove that...*)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* ... arrival times are consistent, ... *)
- Theorem periodic_arrivals_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Proof.
- move => j t ARRj.
- rewrite /arrives_at mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ... every job comes from the task set, ... *)
- Theorem periodic_arrivals_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
- Proof.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ..., jobs have valid parameters, ... *)
- Theorem periodic_arrivals_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj; move: ARRj => /mapP [tsk IN SOME].
- unfold add_job in SOME; desf.
- specialize (PARAMS tsk IN); des.
- unfold valid_sporadic_job, valid_realtime_job, job_cost_positive.
- by repeat split; try (by done); apply leqnn.
- Qed.
-
- (* ... job arrivals satisfy the sporadic task model, ... *)
- Theorem periodic_arrivals_are_sporadic:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Proof.
- move => j j' /eqP DIFF [arr ARR] [arr' ARR'] SAMEtsk LE.
- rewrite eqE /= /job_eqdef negb_and /= SAMEtsk eq_refl orbF in DIFF.
- rewrite 2!mem_pmap in ARR ARR'.
- move: ARR ARR' => /mapP [tsk_j INj SOMEj] /mapP [tsk_j' INj' SOMEj'].
- unfold add_job in SOMEj, SOMEj'; desf; simpl in *;
- move: Heq0 Heq => /dvdnP [k DIV] /dvdnP [k' DIV'].
- {
- rewrite DIV DIV' -mulSnr.
- rewrite leq_eqVlt in LE; move: LE => /orP [/eqP EQ | LESS].
- {
- exfalso; move: DIFF => /negP DIFF; apply DIFF.
- by subst; rewrite EQ !eq_refl.
- }
- subst; rewrite leq_mul2r; apply/orP; right.
- by rewrite ltn_mul2r in LESS; move: LESS => /andP [_ LT].
- }
- Qed.
-
- (* ... and the arrival sequence has no duplicate jobs. *)
- Theorem periodic_arrivals_is_a_set:
- arrival_sequence_is_a_set arr_seq.
- Proof.
- intros t.
- unfold arr_seq, periodic_arrival_sequence.
- apply (pmap_uniq) with (g := job_task); last by destruct ts.
- by unfold add_job, ocancel; intro tsk; desf.
- Qed.
-
- End Proofs.
-
-End ConcreteArrivalSequence.
\ No newline at end of file
diff --git a/classic/implementation/global/basic/bertogna_edf_example.v b/classic/implementation/global/basic/bertogna_edf_example.v
deleted file mode 100644
index ff0179db376e8509666c9d24175c9295b6d13b71..0000000000000000000000000000000000000000
--- a/classic/implementation/global/basic/bertogna_edf_example.v
+++ /dev/null
@@ -1,134 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform.
-Require Import prosa.classic.analysis.global.basic.workload_bound
- prosa.classic.analysis.global.basic.interference_bound_edf
- prosa.classic.analysis.global.basic.bertogna_edf_comp.
-Require Import prosa.classic.implementation.job prosa.classic.implementation.task
- prosa.classic.implementation.arrival_sequence.
-Require Import prosa.classic.implementation.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisEDF.
-
- Import Job Schedule SporadicTaskset Priority Schedulability Platform InterferenceBoundEDF WorkloadBound ResponseTimeIterationEDF.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 2; task_period := 5; task_deadline := 3|}.
- Let tsk2 := {| task_id := 2; task_cost := 4; task_period := 6; task_deadline := 5|}.
- Let tsk3 := {| task_id := 3; task_cost := 3; task_period := 12; task_deadline := 11|}.
-
- (* Let ts be a task set containing these three tasks. *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- Section FactsAboutTaskset.
-
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- End FactsAboutTaskset.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Recall the EDF RTA schedulability test. *)
- Let schedulability_test :=
- edf_schedulable task_cost task_period task_deadline num_cpus.
-
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, edf_schedulable, edf_claimed_bounds; desf.
- apply negbT in Heq; move: Heq => /negP ALL.
- exfalso; apply ALL; clear ALL.
- assert (STEPS: \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1 = 11).
- {
- by rewrite unlock; compute.
- } rewrite STEPS; clear STEPS.
-
- Ltac f :=
- unfold edf_rta_iteration; simpl;
- unfold edf_response_time_bound, div_floor, total_interference_bound_edf, interference_bound_edf, interference_bound_generic, W; simpl;
- repeat rewrite addnE;
- repeat rewrite big_cons; repeat rewrite big_nil;
- repeat rewrite addnE; simpl;
- unfold num_cpus, divn; simpl.
-
- rewrite [edf_rta_iteration]lock; simpl.
-
- unfold locked at 11; destruct master_key; f.
- unfold locked at 10; destruct master_key; f.
- unfold locked at 9; destruct master_key; f.
- unfold locked at 8; destruct master_key; f.
- unfold locked at 7; destruct master_key; f.
- unfold locked at 6; destruct master_key; f.
- unfold locked at 5; destruct master_key; f.
- unfold locked at 4; destruct master_key; f.
- unfold locked at 3; destruct master_key; f.
- unfold locked at 2; destruct master_key; f.
- by unfold locked at 1; destruct master_key; f.
- Qed.
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Let sched be the work-conserving EDF scheduler. *)
- Let sched := scheduler job_arrival job_cost num_cpus arr_seq
- (JLFP_to_JLDP (EDF job_arrival job_deadline)).
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, we prove that ts is schedulable with the result of the test. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_edf_rta with (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (ts0 := ts); try (by done) ) ||
- apply taskset_schedulable_by_edf_rta with (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (ts := ts); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_must_arrive_to_execute.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - apply scheduler_sequential_jobs.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisEDF.
diff --git a/classic/implementation/global/basic/bertogna_fp_example.v b/classic/implementation/global/basic/bertogna_fp_example.v
deleted file mode 100644
index 81562051b42fda9d22e79689cfa421217690602c..0000000000000000000000000000000000000000
--- a/classic/implementation/global/basic/bertogna_fp_example.v
+++ /dev/null
@@ -1,177 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform.
-Require Import prosa.classic.analysis.global.basic.workload_bound
- prosa.classic.analysis.global.basic.interference_bound_fp
- prosa.classic.analysis.global.basic.bertogna_fp_comp.
-Require Import prosa.classic.implementation.job prosa.classic.implementation.task
- prosa.classic.implementation.arrival_sequence.
-Require Import prosa.classic.implementation.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisFP.
-
- Import Job Schedule SporadicTaskset Priority Schedulability Platform InterferenceBoundFP WorkloadBound ResponseTimeIterationFP.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we instantiate a simple example to show that the theorems
- contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 2; task_period := 5; task_deadline := 3|}.
- Let tsk2 := {| task_id := 2; task_cost := 4; task_period := 6; task_deadline := 5|}.
- Let tsk3 := {| task_id := 3; task_cost := 3; task_period := 12; task_deadline := 11|}.
-
- (* Let ts be a task set containing these three tasks (sorted by rate-monotonic priority). *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- Section FactsAboutTaskset.
-
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- End FactsAboutTaskset.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Recall the FP RTA schedulability test. *)
- Let schedulability_test :=
- fp_schedulable task_cost task_period task_deadline num_cpus.
-
- (* Now we show that the schedulability test returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, fp_schedulable, fp_claimed_bounds; simpl.
- unfold total_interference_bound_fp, div_floor.
- rewrite big_nil div0n addn0 /=.
- unfold div_floor; simpl.
- set I2 := total_interference_bound_fp task_cost task_period tsk2
- [:: (tsk1, 2)].
- assert (H1: I2 4 = 1).
- {
- by unfold I2, total_interference_bound_fp; rewrite big_cons big_nil; compute.
- }
- rewrite H1.
- have H2: 4 + 1 %/ num_cpus = 4 by compute.
- rewrite H2 H1 H2.
- have H3: 3 < 5 by compute.
- rewrite H3.
- unfold fp_bound_of_task.
- have H4: per_task_rta task_cost task_period num_cpus tsk3 [:: (tsk1, 2); (tsk2, 4)]
- (max_steps task_cost task_deadline tsk3) = 5.
- {
- unfold per_task_rta; simpl.
- unfold total_interference_bound_fp at 9.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 8.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 7.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 6.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 5.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 4.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 3.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 2.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 1.
- by rewrite !big_cons big_nil /=; compute.
- }
- by rewrite H4.
- Qed.
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Assume rate-monotonic priorities. *)
- Let higher_priority := FP_to_JLDP job_task (RM task_period).
-
- Section FactsAboutPriorityOrder.
-
- Lemma ts_has_unique_priorities :
- FP_is_antisymmetric_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN' HP HP'.
- have EQ: task_period tsk = task_period tsk' by apply/eqP; rewrite eqn_leq HP HP'.
- clear HP HP'.
- rewrite !in_cons 2!in_nil 2!orbF in IN IN'; des; rewrite IN IN'; try (by done);
- subst tsk tsk'; simpl in *; by done.
- Qed.
-
- Lemma priority_is_total :
- FP_is_total_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN'.
- destruct (leqP (task_period tsk) (task_period tsk'));
- [by left | by right; apply ltnW].
- Qed.
-
- End FactsAboutPriorityOrder.
-
- (* Let sched be the work-conserving RM scheduler. *)
- Let sched := scheduler job_arrival job_cost num_cpus arr_seq higher_priority.
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, we prove that ts is schedulable with the result of the test. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts0 := ts) (higher_priority0 := RM task_period); try (by done) ) ||
- apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts := ts) (higher_priority := RM task_period); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply ts_has_unique_priorities.
- - by apply priority_is_total.
- - by apply RM_is_transitive.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_must_arrive_to_execute.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - apply scheduler_sequential_jobs.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/implementation/global/basic/schedule.v b/classic/implementation/global/basic/schedule.v
deleted file mode 100644
index 9bf0d619699838ea38bc89c101c5da9bd3262c34..0000000000000000000000000000000000000000
--- a/classic/implementation/global/basic/schedule.v
+++ /dev/null
@@ -1,267 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform.
-Require Import prosa.classic.model.schedule.global.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path.
-
-Module ConcreteScheduler.
-
- Import ArrivalSequence Schedule Platform Priority ScheduleConstruction.
-
- Section Implementation.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Let num_cpus denote the number of processors, ...*)
- Variable num_cpus: nat.
-
- (* ... and let arr_seq be any arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume a JLDP policy is given. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, we show how to recursively construct the schedule. *)
- Section ScheduleConstruction.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job num_cpus.
- Variable cpu: processor num_cpus.
- Variable t: time.
-
- (* For simplicity, let's use some local names. *)
- Let is_pending := pending job_arrival job_cost sched_prefix.
- Let arrivals := jobs_arrived_up_to arr_seq.
-
- (* Consider the list of pending jobs at time t, ... *)
- Definition pending_jobs := [seq j <- arrivals t | is_pending j t].
-
- (* ...which we sort by priority. *)
- Definition sorted_pending_jobs :=
- sort (higher_eq_priority t) pending_jobs.
-
- (* Then, we take the n-th highest-priority job from the list. *)
- Definition nth_highest_priority_job :=
- nth_or_none sorted_pending_jobs cpu.
-
- End ScheduleConstruction.
-
- (* Starting from the empty schedule, the final schedule is obtained by iteratively
- picking the highest-priority job. *)
- Let empty_schedule : schedule Job num_cpus := fun cpu t => None.
- Definition scheduler :=
- build_schedule_from_prefixes num_cpus nth_highest_priority_job empty_schedule.
-
- (* Then, by showing that the construction function depends only on the prefix, ... *)
- Lemma scheduler_depends_only_on_prefix:
- forall sched1 sched2 cpu t,
- (forall t0 cpu0, t0 < t -> sched1 cpu0 t0 = sched2 cpu0 t0) ->
- nth_highest_priority_job sched1 cpu t = nth_highest_priority_job sched2 cpu t.
- Proof.
- intros sched1 sched2 cpu t ALL.
- rewrite /nth_highest_priority_job.
- suff SAME: sorted_pending_jobs sched1 t = sorted_pending_jobs sched2 t by rewrite SAME.
- rewrite /sorted_pending_jobs; f_equal.
- apply eq_in_filter.
- intros j ARR.
- rewrite /pending; do 2 f_equal.
- rewrite /completed; f_equal.
- apply eq_big_nat; move => i /= LTi.
- rewrite /service_at /scheduled_on; apply eq_bigl; move => cpu'.
- by rewrite ALL.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary scheduler_uses_construction_function:
- forall t cpu, scheduler cpu t = nth_highest_priority_job scheduler cpu t.
- Proof.
- by ins; apply prefix_dependent_schedule_construction,
- scheduler_depends_only_on_prefix.
- Qed.
-
- End Implementation.
-
- Section Proofs.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Assume a positive number of processors. *)
- Variable num_cpus: nat.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Let arr_seq be any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Consider any JLDP policy higher_eq_priority that is transitive and total. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_total: forall t, total (higher_eq_priority t).
-
- (* Let sched denote our concrete scheduler implementation. *)
- Let sched := scheduler job_arrival job_cost num_cpus arr_seq higher_eq_priority.
-
- (* Next, we provide some helper lemmas about the scheduler construction. *)
- Section HelperLemmas.
-
- Let sorted_jobs :=
- sorted_pending_jobs job_arrival job_cost num_cpus arr_seq higher_eq_priority sched.
-
- (* First, we recall that the schedule picks the nth highest-priority job. *)
- Corollary scheduler_nth_or_none_mapping :
- forall t cpu,
- sched cpu t = nth_or_none (sorted_jobs t) cpu.
- Proof.
- intros t cpu.
- by rewrite /sched scheduler_uses_construction_function.
- Qed.
-
- (* We also prove that a backlogged job has priority larger than or equal to the number
- of processors. *)
- Lemma scheduler_nth_or_none_backlogged :
- forall j t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- exists i,
- nth_or_none (sorted_jobs t) i = Some j /\ i >= num_cpus.
- Proof.
- intros j t ARRj BACK.
- move: BACK => /andP [PENDING /negP NOTCOMP].
- assert (IN: j \in sorted_jobs t).
- {
- rewrite mem_sort mem_filter PENDING andTb.
- move: PENDING => /andP [ARRIVED _].
- try ( by apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival) ) ||
- by apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival).
- }
- apply nth_or_none_mem_exists in IN; des.
- exists n; split; first by done.
- rewrite leqNgt; apply/negP; red; intro LT.
- apply NOTCOMP; clear NOTCOMP PENDING.
- apply/existsP; exists (Ordinal LT); apply/eqP.
- by rewrite scheduler_nth_or_none_mapping.
- Qed.
-
- End HelperLemmas.
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma scheduler_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
- Proof.
- move => j t /existsP [cpu /eqP SCHED].
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_mem in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- move: SCHED => /andP [_ ARR].
- rewrite /jobs_arrived_up_to in ARR.
- by eapply in_arrivals_implies_arrived; eauto 1.
- Qed.
-
- (* Next, we show that jobs do not execute before their arrival times... *)
- Theorem scheduler_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Proof.
- move => j t /existsP [cpu /eqP SCHED].
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_mem in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- by move: SCHED => /andP [/andP [ARR _] _].
- Qed.
-
- (* ...jobs are sequential, ... *)
- Theorem scheduler_sequential_jobs: sequential_jobs sched.
- Proof.
- intros j t cpu1 cpu2 SCHED1 SCHED2.
- rewrite 2!scheduler_nth_or_none_mapping in SCHED1 SCHED2.
- set l := sorted_pending_jobs _ _ _ _ _ _ _ in SCHED1 SCHED2.
- try ( apply ord_inj, nth_or_none_uniq with (l0 := l) (x := j); try (by done) ) ||
- apply ord_inj, nth_or_none_uniq with (l := l) (x := j); try (by done).
- by rewrite sort_uniq filter_uniq //; eapply arrivals_uniq; eauto 1.
- Qed.
-
- (* ... and jobs do not execute after completion. *)
- Theorem scheduler_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- Proof.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- apply leq_add; first by done.
- rewrite /service_at.
- case (boolP ([exists cpu, scheduled_on sched j cpu t])) => [EX | ALL]; last first.
- {
- rewrite negb_exists in ALL; move: ALL => /forallP ALL.
- rewrite big1 //; intros cpu SCHED.
- by specialize (ALL cpu); rewrite SCHED in ALL.
- }
- move: EX => /existsP [cpu SCHED].
- rewrite (bigD1 cpu) /=; last by done.
- rewrite big1; first by rewrite addn0.
- move => cpu' /andP [SCHED' NEQ].
- move: NEQ => /eqP NEQ; exfalso; apply NEQ, ord_inj.
- move: SCHED SCHED' => /eqP SCHED /eqP SCHED'.
- rewrite 2!scheduler_nth_or_none_mapping in SCHED SCHED'.
- set l := sorted_pending_jobs _ _ _ _ _ _ _ in SCHED SCHED'.
- try ( apply nth_or_none_uniq with (l0 := l) (x := j); try (by done) ) ||
- apply nth_or_none_uniq with (l := l) (x := j); try (by done).
- by rewrite sort_uniq filter_uniq //; eapply arrivals_uniq; eauto 1.
- }
- rewrite -[job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 /service_at big1 // /scheduled_on.
- move => cpu /eqP SCHED.
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_mem in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- move: SCHED => /andP [/andP [_ NOTCOMP] _].
- by rewrite /completed EQ leqnn in NOTCOMP.
- Qed.
-
- (* In addition, the scheduler is work conserving, ... *)
- Theorem scheduler_work_conserving:
- work_conserving job_arrival job_cost arr_seq sched.
- Proof.
- intros j t ARRj BACK cpu.
- set jobs := sorted_pending_jobs job_arrival job_cost num_cpus arr_seq higher_eq_priority sched t.
- destruct (sched cpu t) as [j0 |] eqn:SCHED; first by exists j0; apply/eqP.
- apply scheduler_nth_or_none_backlogged in BACK; last by done.
- destruct BACK as [cpu_out [NTH GE]].
- exfalso; rewrite leqNgt in GE; move: GE => /negP GE; apply GE.
- apply leq_ltn_trans with (n := cpu); last by done.
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_size_none in SCHED.
- apply leq_trans with (n := size jobs); last by done.
- by apply nth_or_none_size_some in NTH; apply ltnW.
- Qed.
-
- (* ...and respects the JLDP policy. *)
- Theorem scheduler_respects_policy :
- respects_JLDP_policy job_arrival job_cost arr_seq sched higher_eq_priority.
- Proof.
- move => j j_hp t ARRj BACK /existsP [cpu /eqP SCHED].
- apply scheduler_nth_or_none_backlogged in BACK; last by done.
- set jobs := sorted_pending_jobs _ _ _ _ _ _ _ in BACK.
- destruct BACK as [cpu_out [SOME GE]].
- rewrite scheduler_nth_or_none_mapping in SCHED.
- have EQ1 := nth_or_none_nth jobs cpu j_hp j SCHED.
- have EQ2 := nth_or_none_nth jobs cpu_out j j SOME.
- rewrite -EQ1 -{2}EQ2.
- apply sorted_lt_idx_implies_rel; try (by done); last 2 first.
- - by apply leq_trans with (n := num_cpus).
- - by apply nth_or_none_size_some in SOME.
- - by apply sort_sorted, H_priority_total.
- Qed.
-
- End Proofs.
-
-End ConcreteScheduler.
diff --git a/classic/implementation/global/jitter/arrival_sequence.v b/classic/implementation/global/jitter/arrival_sequence.v
deleted file mode 100644
index 26a37e9e5a5ce9044a364eea625f0099f55fc4a4..0000000000000000000000000000000000000000
--- a/classic/implementation/global/jitter/arrival_sequence.v
+++ /dev/null
@@ -1,110 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.jitter.job.
-Require Import prosa.classic.implementation.global.jitter.task prosa.classic.implementation.global.jitter.job.
-From mathcomp Require Import ssreflect ssrbool ssrfun ssrnat eqtype seq div.
-
-Module ConcreteArrivalSequence.
-
- Import JobWithJitter ArrivalSequence ConcreteTask ConcreteJob SporadicTaskset TaskArrival.
-
- Section PeriodicArrivals.
-
- Variable ts: concrete_taskset.
-
- (* At any time t, we release Some job of tsk if t is a multiple of the period,
- otherwise we release None. *)
- Definition add_job (arr: time) (tsk: concrete_task) :=
- if task_period tsk %| arr then
- Some (Build_concrete_job (arr %/ task_period tsk) arr (task_cost tsk) (task_deadline tsk) (task_jitter tsk) tsk)
- else
- None.
-
- (* The arrival sequence at any time t is simply the partial map of add_job. *)
- Definition periodic_arrival_sequence (t: time) := pmap (add_job t) ts.
-
- End PeriodicArrivals.
-
- Section Proofs.
-
- (* Let ts be any concrete task set with valid parameters. *)
- Variable ts: concrete_taskset.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Regarding the periodic arrival sequence built from ts, we prove that...*)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* ... arrival times are consistent, ... *)
- Theorem periodic_arrivals_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Proof.
- move => j t ARRj.
- rewrite /arrives_at mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ... every job comes from the task set, ... *)
- Theorem periodic_arrivals_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
- Proof.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ..., jobs have valid parameters, ... *)
- Theorem periodic_arrivals_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job_with_jitter task_cost task_deadline task_jitter job_cost job_deadline job_task job_jitter j.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj; move: ARRj => /mapP [tsk IN SOME].
- unfold add_job in SOME; desf.
- specialize (PARAMS tsk IN); des.
- unfold valid_sporadic_job, valid_realtime_job, job_cost_positive.
- by repeat split; try (by done); apply leqnn.
- Qed.
-
- (* ... job arrivals satisfy the sporadic task model, ... *)
- Theorem periodic_arrivals_are_sporadic:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Proof.
- move => j j' /eqP DIFF [arr ARR] [arr' ARR'] SAMEtsk LE.
- rewrite eqE /= /job_eqdef negb_and /= SAMEtsk eq_refl orbF in DIFF.
- rewrite 2!mem_pmap in ARR ARR'.
- move: ARR ARR' => /mapP [tsk_j INj SOMEj] /mapP [tsk_j' INj' SOMEj'].
- unfold add_job in SOMEj, SOMEj'; desf; simpl in *;
- move: Heq0 Heq => /dvdnP [k DIV] /dvdnP [k' DIV'].
- {
- rewrite DIV DIV' -mulSnr.
- rewrite leq_eqVlt in LE; move: LE => /orP [/eqP EQ | LESS].
- {
- exfalso; move: DIFF => /negP DIFF; apply DIFF.
- by subst; rewrite EQ !eq_refl.
- }
- subst; rewrite leq_mul2r; apply/orP; right.
- by rewrite ltn_mul2r in LESS; move: LESS => /andP [_ LT].
- }
- Qed.
-
- (* ... and the arrival sequence has no duplicate jobs. *)
- Theorem periodic_arrivals_is_a_set:
- arrival_sequence_is_a_set arr_seq.
- Proof.
- intros t.
- unfold arr_seq, periodic_arrival_sequence.
- apply (pmap_uniq) with (g := job_task); last by destruct ts.
- by unfold add_job, ocancel; intro tsk; desf.
- Qed.
-
- End Proofs.
-
-End ConcreteArrivalSequence.
\ No newline at end of file
diff --git a/classic/implementation/global/jitter/bertogna_edf_example.v b/classic/implementation/global/jitter/bertogna_edf_example.v
deleted file mode 100644
index b2e25bd31c152dd063ce48c24bd0a458b55f53f1..0000000000000000000000000000000000000000
--- a/classic/implementation/global/jitter/bertogna_edf_example.v
+++ /dev/null
@@ -1,140 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.platform.
-Require Import prosa.classic.analysis.global.jitter.workload_bound
- prosa.classic.analysis.global.jitter.interference_bound_edf
- prosa.classic.analysis.global.jitter.bertogna_edf_comp.
-Require Import prosa.classic.implementation.global.jitter.job
- prosa.classic.implementation.global.jitter.task
- prosa.classic.implementation.global.jitter.schedule
- prosa.classic.implementation.global.jitter.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisEDF.
-
- Import JobWithJitter ScheduleWithJitter SporadicTaskset Priority Schedulability Platform InterferenceBoundEDFJitter WorkloadBoundJitter ResponseTimeIterationEDF.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 2; task_period := 5; task_deadline := 3; task_jitter := 1|}.
- Let tsk2 := {| task_id := 2; task_cost := 4; task_period := 6; task_deadline := 5; task_jitter := 0|}.
- Let tsk3 := {| task_id := 3; task_cost := 2; task_period := 12; task_deadline := 11; task_jitter := 2|}.
-
- (* Let ts be a task set containing these three tasks. *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- Section FactsAboutTaskset.
-
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- End FactsAboutTaskset.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Recall the EDF RTA schedulability test. *)
- Let schedulability_test :=
- edf_schedulable task_cost task_period task_deadline task_jitter num_cpus.
-
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, edf_schedulable, edf_claimed_bounds; desf.
- apply negbT in Heq; move: Heq => /negP ALL.
- exfalso; apply ALL; clear ALL.
- assert (STEPS: \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1 = 12).
- {
- by rewrite unlock; compute.
- } rewrite STEPS; clear STEPS.
-
- Ltac f :=
- unfold edf_rta_iteration; simpl;
- unfold edf_response_time_bound, div_floor, total_interference_bound_edf, interference_bound_edf, interference_bound_generic, W_jitter; simpl;
- repeat rewrite addnE;
- repeat rewrite big_cons; repeat rewrite big_nil;
- repeat rewrite addnE; simpl;
- unfold num_cpus, divn; simpl.
-
- rewrite [edf_rta_iteration]lock; simpl.
-
- unfold locked at 12; destruct master_key; f.
- unfold locked at 11; destruct master_key; f.
- unfold locked at 10; destruct master_key; f.
- unfold locked at 9; destruct master_key; f.
- unfold locked at 8; destruct master_key; f.
- unfold locked at 7; destruct master_key; f.
- unfold locked at 6; destruct master_key; f.
- unfold locked at 5; destruct master_key; f.
- unfold locked at 4; destruct master_key; f.
- unfold locked at 3; destruct master_key; f.
- unfold locked at 2; destruct master_key; f.
- by unfold locked at 1; destruct master_key; f.
- Qed.
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Let sched be the work-conserving EDF scheduler. *)
- Let sched := scheduler job_arrival job_cost job_jitter num_cpus arr_seq
- (JLFP_to_JLDP (EDF job_arrival job_deadline)).
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, we prove that ts is schedulable with the result of the test. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have VALIDTS := ts_has_valid_parameters.
- unfold valid_sporadic_job_with_jitter,
- valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_edf_rta with (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (ts0 := ts) (task_jitter := task_jitter)
- (job_jitter := job_jitter); try (by done) ) ||
- apply taskset_schedulable_by_edf_rta with (task_cost := task_cost) (task_period := task_period)
- (task_deadline := task_deadline) (ts := ts) (task_jitter := task_jitter)
- (job_jitter := job_jitter); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_execute_after_jitter.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - apply scheduler_sequential_jobs.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisEDF.
diff --git a/classic/implementation/global/jitter/bertogna_fp_example.v b/classic/implementation/global/jitter/bertogna_fp_example.v
deleted file mode 100644
index 7f907041fb359891c5f150b088c0d1352befb427..0000000000000000000000000000000000000000
--- a/classic/implementation/global/jitter/bertogna_fp_example.v
+++ /dev/null
@@ -1,182 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.platform.
-Require Import prosa.classic.analysis.global.jitter.workload_bound
- prosa.classic.analysis.global.jitter.interference_bound_fp
- prosa.classic.analysis.global.jitter.bertogna_fp_comp.
-Require Import prosa.classic.implementation.global.jitter.job
- prosa.classic.implementation.global.jitter.task
- prosa.classic.implementation.global.jitter.schedule
- prosa.classic.implementation.global.jitter.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisFP.
-
- Import JobWithJitter ScheduleWithJitter SporadicTaskset Priority Schedulability Platform InterferenceBoundFP WorkloadBoundJitter ResponseTimeIterationFP.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we instantiate a simple example to show that the theorems
- contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 2; task_period := 5; task_deadline := 3; task_jitter := 0|}.
- Let tsk2 := {| task_id := 2; task_cost := 4; task_period := 6; task_deadline := 5; task_jitter := 1|}.
- Let tsk3 := {| task_id := 3; task_cost := 3; task_period := 12; task_deadline := 11; task_jitter := 2|}.
-
- (* Let ts be a task set containing these three tasks (sorted by rate-monotonic priority). *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- Section FactsAboutTaskset.
-
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- End FactsAboutTaskset.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Recall the FP RTA schedulability test. *)
- Let schedulability_test :=
- fp_schedulable task_cost task_period task_deadline task_jitter num_cpus.
-
- (* Now we show that the schedulability test returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, fp_schedulable, fp_claimed_bounds; simpl.
- unfold total_interference_bound_fp, div_floor.
- rewrite big_nil div0n addn0 /=.
- unfold div_floor; simpl.
- set I2 := total_interference_bound_fp task_cost task_period
- task_jitter tsk2 [:: (tsk1, 2)].
- assert (H1: I2 4 = 1).
- {
- by unfold I2, total_interference_bound_fp; rewrite big_cons big_nil; compute.
- }
- rewrite H1.
- have H2: 4 + 1 %/ num_cpus = 4 by compute.
- rewrite H2 H1 H2.
- have H3: (1 + 4 <= 5) by compute.
- rewrite H3.
- unfold fp_bound_of_task.
- have H4: per_task_rta task_cost task_period task_jitter num_cpus
- tsk3 [:: (tsk1, 2); (tsk2, 4)]
- (max_steps task_cost task_deadline tsk3) = 5.
- {
- unfold per_task_rta; simpl.
- unfold total_interference_bound_fp at 9.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 8.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 7.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 6.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 5.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 4.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 3.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 2.
- rewrite !big_cons big_nil /=.
- unfold total_interference_bound_fp at 1.
- by rewrite !big_cons big_nil /=; compute.
- }
- by rewrite H4.
- Qed.
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Assume rate-monotonic priorities. *)
- Let higher_priority := FP_to_JLDP job_task (RM task_period).
-
- Section FactsAboutPriorityOrder.
-
- Lemma ts_has_unique_priorities :
- FP_is_antisymmetric_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN' HP HP'.
- have EQ: task_period tsk = task_period tsk' by apply/eqP; rewrite eqn_leq HP HP'.
- clear HP HP'.
- rewrite !in_cons 2!in_nil 2!orbF in IN IN'; des; rewrite IN IN'; try (by done);
- subst tsk tsk'; simpl in *; by done.
- Qed.
-
- Lemma priority_is_total :
- FP_is_total_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN'.
- destruct (leqP (task_period tsk) (task_period tsk'));
- [by left | by right; apply ltnW].
- Qed.
-
- End FactsAboutPriorityOrder.
-
- (* Let sched be the work-conserving RM scheduler. *)
- Let sched := scheduler job_arrival job_cost job_jitter num_cpus arr_seq higher_priority.
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, we prove that ts is schedulable with the result of the test. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job_with_jitter, valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (task_jitter := task_jitter) (job_jitter := job_jitter)
- (ts0 := ts) (higher_priority0 := RM task_period); try (by done) ) ||
- apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (task_jitter := task_jitter) (job_jitter := job_jitter)
- (ts := ts) (higher_priority := RM task_period); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply ts_has_unique_priorities.
- - by apply priority_is_total.
- - by apply RM_is_transitive.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_execute_after_jitter.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - apply scheduler_sequential_jobs.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/implementation/global/jitter/job.v b/classic/implementation/global/jitter/job.v
deleted file mode 100644
index 9e8493c3bfd5cf427ded8465e416b7be0e132215..0000000000000000000000000000000000000000
--- a/classic/implementation/global/jitter/job.v
+++ /dev/null
@@ -1,66 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.implementation.global.jitter.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteJob.
-
- Import ConcreteTask.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_job :=
- {
- job_id: nat;
- job_arrival: nat;
- job_cost: nat;
- job_deadline: nat;
- job_jitter: nat;
- job_task: concrete_task_eqType
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete jobs. *)
- Definition job_eqdef (j1 j2: concrete_job) :=
- (job_id j1 == job_id j2) &&
- (job_arrival j1 == job_arrival j2) &&
- (job_cost j1 == job_cost j2) &&
- (job_deadline j1 == job_deadline j2) &&
- (job_jitter j1 == job_jitter j2) &&
- (job_task j1 == job_task j2).
-
- (* Next, we prove that job_eqdef is indeed an equality, ... *)
- Lemma eqn_job : Equality.axiom job_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (job_eqdef x y) eqn:EQ.
- {
- apply ReflectT; unfold job_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/andP [/eqP ID /eqP ARRIVAL] /eqP COST] /eqP DL] /eqP JITTER] /eqP TASK].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold job_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP TASK]; last by apply TASK; inversion BUG.
- move: EQ => /orP [EQ | /eqP JITTER]; last by apply JITTER; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP DL]; last by apply DL; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP ID]; last by apply ID; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP ARRIVAL]; last by apply ARRIVAL; inversion BUG.
- by apply ID; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_job_eqMixin := EqMixin eqn_job.
- Canonical concrete_job_eqType := Eval hnf in EqType concrete_job concrete_job_eqMixin.
-
- End Defs.
-
-End ConcreteJob.
\ No newline at end of file
diff --git a/classic/implementation/global/jitter/schedule.v b/classic/implementation/global/jitter/schedule.v
deleted file mode 100644
index bfb5c1ba58027d6f8fea86c65bea9f7c25716649..0000000000000000000000000000000000000000
--- a/classic/implementation/global/jitter/schedule.v
+++ /dev/null
@@ -1,273 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.jitter.arrival_sequence prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.platform.
-Require Import prosa.classic.model.schedule.global.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path.
-
-Module ConcreteScheduler.
-
- Import ArrivalSequenceWithJitter ScheduleWithJitter Platform Priority ScheduleConstruction.
-
- Section Implementation.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Let num_cpus denote the number of processors, ...*)
- Variable num_cpus: nat.
-
- (* ...and let arr_seq be any job arrival sequence.*)
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume a JLDP policy is given. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, we show how to recursively construct the schedule. *)
- Section ScheduleConstruction.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job num_cpus.
- Variable cpu: processor num_cpus.
- Variable t: time.
-
- (* For simplicity, let's use some local names. *)
- Let is_pending := pending job_arrival job_cost job_jitter sched_prefix.
- Let actual_arrivals := actual_arrivals_up_to job_arrival job_jitter arr_seq.
-
- (* Consider the list of pending jobs at time t, ... *)
- Definition pending_jobs :=
- [seq j <- actual_arrivals t | is_pending j t].
-
- (* ...which we sort by priority. *)
- Definition sorted_pending_jobs :=
- sort (higher_eq_priority t) pending_jobs.
-
- (* Then, we take the n-th highest-priority job from the list. *)
- Definition nth_highest_priority_job :=
- nth_or_none sorted_pending_jobs cpu.
-
- End ScheduleConstruction.
-
- (* Starting from the empty schedule, the final schedule is obtained by iteratively
- picking the highest-priority job. *)
- Let empty_schedule : schedule Job num_cpus := fun cpu t => None.
- Definition scheduler :=
- build_schedule_from_prefixes num_cpus nth_highest_priority_job empty_schedule.
-
- (* Then, by showing that the construction function depends only on the prefix, ... *)
- Lemma scheduler_depends_only_on_prefix:
- forall sched1 sched2 cpu t,
- (forall t0 cpu0, t0 < t -> sched1 cpu0 t0 = sched2 cpu0 t0) ->
- nth_highest_priority_job sched1 cpu t = nth_highest_priority_job sched2 cpu t.
- Proof.
- intros sched1 sched2 cpu t ALL.
- rewrite /nth_highest_priority_job.
- suff SAME: sorted_pending_jobs sched1 t = sorted_pending_jobs sched2 t by rewrite SAME.
- rewrite /sorted_pending_jobs; f_equal.
- apply eq_in_filter.
- intros j ARR.
- rewrite /pending; do 2 f_equal.
- rewrite /completed; f_equal.
- apply eq_big_nat; move => i /= LTi.
- rewrite /service_at /scheduled_on; apply eq_bigl; move => cpu'.
- by rewrite ALL.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary scheduler_uses_construction_function:
- forall t cpu, scheduler cpu t = nth_highest_priority_job scheduler cpu t.
- Proof.
- by ins; apply prefix_dependent_schedule_construction,
- scheduler_depends_only_on_prefix.
- Qed.
-
- End Implementation.
-
- Section Proofs.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Assume a positive number of processors. *)
- Variable num_cpus: nat.
- Hypothesis H_at_least_one_cpu: num_cpus > 0.
-
- (* Let arr_seq be any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Consider any JLDP policy higher_eq_priority that is transitive and total. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_total: forall t, total (higher_eq_priority t).
-
- (* Let sched denote our concrete scheduler implementation. *)
- Let sched := scheduler job_arrival job_cost job_jitter num_cpus arr_seq higher_eq_priority.
-
- (* Next, we provide some helper lemmas about the scheduler construction. *)
- Section HelperLemmas.
-
- Let sorted_jobs :=
- sorted_pending_jobs job_arrival job_cost job_jitter num_cpus arr_seq higher_eq_priority sched.
-
- (* First, we recall that the schedule picks the nth highest-priority job. *)
- Corollary scheduler_nth_or_none_mapping :
- forall t cpu,
- sched cpu t = nth_or_none (sorted_jobs t) cpu.
- Proof.
- intros t cpu.
- by rewrite /sched scheduler_uses_construction_function.
- Qed.
-
- (* We also prove that a backlogged job has priority larger than or equal to the number
- of processors. *)
- Lemma scheduler_nth_or_none_backlogged :
- forall j t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- exists i,
- nth_or_none (sorted_jobs t) i = Some j /\ i >= num_cpus.
- Proof.
- intros j t ARRj BACK.
- move: BACK => /andP [PENDING /negP NOTCOMP].
- assert (IN: j \in sorted_jobs t).
- {
- rewrite mem_sort mem_filter PENDING andTb.
- move: PENDING => /andP [ARRIVED _].
- try ( by apply arrived_between_implies_in_actual_arrivals with (job_arrival0 := job_arrival) ) ||
- by apply arrived_between_implies_in_actual_arrivals with (job_arrival := job_arrival).
- }
- apply nth_or_none_mem_exists in IN; des.
- exists n; split; first by done.
- rewrite leqNgt; apply/negP; red; intro LT.
- apply NOTCOMP; clear NOTCOMP PENDING.
- apply/existsP; exists (Ordinal LT); apply/eqP.
- by rewrite scheduler_nth_or_none_mapping.
- Qed.
-
- End HelperLemmas.
-
- (* Now, we prove the important properties about the implementation. *)
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma scheduler_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
- Proof.
- move => j t /existsP [cpu /eqP SCHED].
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_mem in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- move: SCHED => /andP [_ ARR].
- rewrite /actual_arrivals_up_to in ARR.
- by eapply in_actual_arrivals_between_implies_arrived; eauto 1.
- Qed.
-
- (* Next, we show that jobs do not execute before the jitter has passed...*)
- Theorem scheduler_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Proof.
- move => j t /existsP [cpu /eqP SCHED].
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_mem in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- by move: SCHED => /andP [/andP [ARR _] _].
- Qed.
-
- (* ...jobs are sequential, ... *)
- Theorem scheduler_sequential_jobs: sequential_jobs sched.
- Proof.
- intros j t cpu1 cpu2 SCHED1 SCHED2.
- rewrite 2!scheduler_nth_or_none_mapping in SCHED1 SCHED2.
- set l := sorted_pending_jobs _ _ _ _ _ _ _ _ in SCHED1 SCHED2.
- try ( apply ord_inj, nth_or_none_uniq with (l0 := l) (x := j); try (by done) ) ||
- apply ord_inj, nth_or_none_uniq with (l := l) (x := j); try (by done).
- by rewrite sort_uniq filter_uniq // /actual_arrivals_up_to; apply actual_arrivals_uniq.
- Qed.
-
- (* ... and jobs do not execute after completion. *)
- Theorem scheduler_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- Proof.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- apply leq_add; first by done.
- rewrite /service_at.
- case (boolP ([exists cpu, scheduled_on sched j cpu t])) => [EX | ALL]; last first.
- {
- rewrite negb_exists in ALL; move: ALL => /forallP ALL.
- rewrite big1 //; intros cpu SCHED.
- by specialize (ALL cpu); rewrite SCHED in ALL.
- }
- move: EX => /existsP [cpu SCHED].
- rewrite (bigD1 cpu) /=; last by done.
- rewrite big1; first by rewrite addn0.
- move => cpu' /andP [SCHED' NEQ].
- move: NEQ => /eqP NEQ; exfalso; apply NEQ, ord_inj.
- move: SCHED SCHED' => /eqP SCHED /eqP SCHED'.
- rewrite 2!scheduler_nth_or_none_mapping in SCHED SCHED'.
- set l := sorted_pending_jobs _ _ _ _ _ _ _ _ in SCHED SCHED'.
- try ( apply nth_or_none_uniq with (l0 := l) (x := j); try (by done) ) ||
- apply nth_or_none_uniq with (l := l) (x := j); try (by done).
- by rewrite sort_uniq filter_uniq //; apply actual_arrivals_uniq.
- }
- rewrite -[job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 /service_at big1 // /scheduled_on.
- move => cpu /eqP SCHED.
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_mem in SCHED.
- rewrite mem_sort mem_filter in SCHED.
- move: SCHED => /andP [/andP [_ NOTCOMP] _].
- by rewrite /completed EQ leqnn in NOTCOMP.
- Qed.
-
- (* In addition, the scheduler is (jitter-aware) work conserving, ... *)
- Theorem scheduler_work_conserving:
- work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Proof.
- intros j t ARRj BACK cpu.
- set jobs := sorted_pending_jobs job_arrival job_cost job_jitter num_cpus
- arr_seq higher_eq_priority sched t.
- destruct (sched cpu t) as [j0 |] eqn:SCHED; first by exists j0; apply/eqP.
- apply scheduler_nth_or_none_backlogged in BACK; last by done.
- destruct BACK as [cpu_out [NTH GE]].
- exfalso; rewrite leqNgt in GE; move: GE => /negP GE; apply GE.
- apply leq_ltn_trans with (n := cpu); last by done.
- rewrite scheduler_nth_or_none_mapping in SCHED.
- apply nth_or_none_size_none in SCHED.
- apply leq_trans with (n := size jobs); last by done.
- by apply nth_or_none_size_some in NTH; apply ltnW.
- Qed.
-
- (* ...and respects the JLDP policy. *)
- Theorem scheduler_respects_policy :
- respects_JLDP_policy job_arrival job_cost job_jitter arr_seq sched higher_eq_priority.
- Proof.
- move => j j_hp t ARRj BACK /existsP [cpu /eqP SCHED].
- apply scheduler_nth_or_none_backlogged in BACK; last by done.
- set jobs := sorted_pending_jobs _ _ _ _ _ _ _ _ in BACK.
- destruct BACK as [cpu_out [SOME GE]].
- rewrite scheduler_nth_or_none_mapping in SCHED.
- have EQ1 := nth_or_none_nth jobs cpu j_hp j SCHED.
- have EQ2 := nth_or_none_nth jobs cpu_out j j SOME.
- rewrite -EQ1 -{2}EQ2.
- apply sorted_lt_idx_implies_rel; try (by done); last 2 first.
- - by apply leq_trans with (n := num_cpus).
- - by apply nth_or_none_size_some in SOME.
- - by apply sort_sorted, H_priority_total.
- Qed.
-
- End Proofs.
-
-End ConcreteScheduler.
diff --git a/classic/implementation/global/jitter/task.v b/classic/implementation/global/jitter/task.v
deleted file mode 100644
index 7979d43b8da48205e06931ce82da708294091880..0000000000000000000000000000000000000000
--- a/classic/implementation/global/jitter/task.v
+++ /dev/null
@@ -1,70 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteTask.
-
- Import SporadicTaskset.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_task :=
- {
- task_id: nat; (* for uniqueness *)
- task_cost: nat;
- task_period: nat;
- task_deadline: nat;
- task_jitter: nat
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete tasks. *)
- Definition task_eqdef (t1 t2: concrete_task) :=
- (task_id t1 == task_id t2) &&
- (task_cost t1 == task_cost t2) &&
- (task_period t1 == task_period t2) &&
- (task_deadline t1 == task_deadline t2) &&
- (task_jitter t1 == task_jitter t2).
-
- (* Next, we prove that task_eqdef is indeed an equality, ... *)
- Lemma eqn_task : Equality.axiom task_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (task_eqdef x y) eqn:EQ.
- {
- apply ReflectT.
- unfold task_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP COST] /eqP PERIOD] /eqP DL] /eqP JITTER].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold task_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [/orP [EQ | /eqP DL] | /eqP JITTER]; last by apply JITTER; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP DL]; last by apply DL; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP PERIOD]; last by apply PERIOD; inversion BUG.
- by apply ID; inversion BUG.
- by apply DL; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_task_eqMixin := EqMixin eqn_task.
- Canonical concrete_task_eqType := Eval hnf in EqType concrete_task concrete_task_eqMixin.
-
- End Defs.
-
- Section ConcreteTaskset.
-
- Definition concrete_taskset :=
- taskset_of concrete_task_eqType.
-
- End ConcreteTaskset.
-
-End ConcreteTask.
\ No newline at end of file
diff --git a/classic/implementation/global/parallel/bertogna_edf_example.v b/classic/implementation/global/parallel/bertogna_edf_example.v
deleted file mode 100644
index 80f9fb7f164e98a78d7d65d61910b7bf53b61454..0000000000000000000000000000000000000000
--- a/classic/implementation/global/parallel/bertogna_edf_example.v
+++ /dev/null
@@ -1,138 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform.
-Require Import prosa.classic.analysis.global.parallel.workload_bound
- prosa.classic.analysis.global.parallel.interference_bound_edf
- prosa.classic.analysis.global.parallel.bertogna_edf_comp.
-Require Import prosa.classic.implementation.job prosa.classic.implementation.task
- prosa.classic.implementation.arrival_sequence.
-Require Import prosa.classic.implementation.global.basic.schedule. (* Use sequential scheduler. *)
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisEDF.
-
- Import Job Schedule SporadicTaskset Priority Schedulability Platform InterferenceBoundEDF WorkloadBound ResponseTimeIterationEDF.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 2; task_period := 6; task_deadline := 6|}.
- Let tsk2 := {| task_id := 2; task_cost := 3; task_period := 8; task_deadline := 6|}.
- Let tsk3 := {| task_id := 3; task_cost := 2; task_period := 12; task_deadline := 12|}.
-
- (* Let ts be a task set containing these three tasks. *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- Section FactsAboutTaskset.
-
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- End FactsAboutTaskset.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Recall the EDF RTA schedulability test. *)
- Let schedulability_test :=
- edf_schedulable task_cost task_period task_deadline num_cpus.
-
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, edf_schedulable, edf_claimed_bounds; desf.
- apply negbT in Heq; move: Heq => /negP ALL.
- exfalso; apply ALL; clear ALL.
- assert (STEPS: \sum_(tsk <- ts) (task_deadline tsk - task_cost tsk) + 1 = 18).
- {
- by rewrite unlock; compute.
- } rewrite STEPS; clear STEPS.
-
- Ltac f :=
- unfold edf_rta_iteration; simpl;
- unfold edf_response_time_bound, div_floor, total_interference_bound_edf, interference_bound_edf, interference_bound_generic, W; simpl;
- repeat rewrite addnE;
- repeat rewrite big_cons; repeat rewrite big_nil;
- repeat rewrite addnE; simpl;
- unfold num_cpus, divn; simpl.
-
- rewrite [edf_rta_iteration]lock; simpl.
-
- unfold locked at 18; destruct master_key; f.
- unfold locked at 17; destruct master_key; f.
- unfold locked at 16; destruct master_key; f.
- unfold locked at 15; destruct master_key; f.
- unfold locked at 14; destruct master_key; f.
- unfold locked at 13; destruct master_key; f.
- unfold locked at 12; destruct master_key; f.
- unfold locked at 11; destruct master_key; f.
- unfold locked at 10; destruct master_key; f.
- unfold locked at 9; destruct master_key; f.
- unfold locked at 8; destruct master_key; f.
- unfold locked at 7; destruct master_key; f.
- unfold locked at 6; destruct master_key; f.
- unfold locked at 5; destruct master_key; f.
- unfold locked at 4; destruct master_key; f.
- unfold locked at 3; destruct master_key; f.
- unfold locked at 2; destruct master_key; f.
- by unfold locked at 1; destruct master_key; f.
- Qed.
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Let sched be the work-conserving EDF scheduler. *)
- Let sched := scheduler job_arrival job_cost num_cpus arr_seq
- (JLFP_to_JLDP (EDF job_arrival job_deadline)).
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, we prove that ts is schedulable with the result of the test. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_edf_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (ts0 := ts); try (by done) ) ||
- apply taskset_schedulable_by_edf_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (ts := ts); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_must_arrive_to_execute.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisEDF.
diff --git a/classic/implementation/global/parallel/bertogna_fp_example.v b/classic/implementation/global/parallel/bertogna_fp_example.v
deleted file mode 100644
index 39b37c91256b0b469ed690693a387101f6ae1c91..0000000000000000000000000000000000000000
--- a/classic/implementation/global/parallel/bertogna_fp_example.v
+++ /dev/null
@@ -1,196 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.platform
- prosa.classic.model.schedule.global.basic.interference.
-Require Import prosa.classic.analysis.global.parallel.workload_bound
- prosa.classic.analysis.global.parallel.interference_bound_fp
- prosa.classic.analysis.global.parallel.bertogna_fp_comp.
-Require Import prosa.classic.implementation.job prosa.classic.implementation.task
- prosa.classic.implementation.arrival_sequence.
-Require Import prosa.classic.implementation.global.basic.schedule. (* Use sequential scheduler. *)
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisFP.
-
- Import Job Schedule SporadicTaskset Priority Schedulability Platform
- Interference InterferenceBoundFP WorkloadBound
- ResponseTimeIterationFP.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we instantiate a simple example to show that the theorems
- contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 2; task_period := 6; task_deadline := 6|}.
- Let tsk2 := {| task_id := 2; task_cost := 3; task_period := 8; task_deadline := 6|}.
- Let tsk3 := {| task_id := 3; task_cost := 2; task_period := 12; task_deadline := 12|}.
-
- (* Let ts be a task set containing these three tasks (sorted by rate-monotonic priority). *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- Section FactsAboutTaskset.
-
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- Fact ts_has_constrained_deadlines:
- forall tsk,
- tsk \in ts ->
- task_deadline tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- End FactsAboutTaskset.
-
- (* Assume there are two processors. *)
- Let num_cpus := 2.
-
- (* Recall the FP RTA schedulability test. *)
- Let schedulability_test :=
- fp_schedulable task_cost task_period task_deadline num_cpus.
-
- (* Now we show that the schedulability test returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- unfold schedulability_test, fp_schedulable, fp_claimed_bounds; simpl.
- unfold total_interference_bound_fp, div_floor.
- rewrite big_nil div0n addn0 /=.
- unfold div_floor; simpl.
- set I2 := total_interference_bound_fp task_cost task_period [:: (tsk1, 2)].
- assert (H1: I2 3 = 2).
- {
- by rewrite /I2 /total_interference_bound_fp big_cons big_nil; compute.
- }
- assert (H2: I2 4 = 2).
- {
- by rewrite /I2 /total_interference_bound_fp big_cons big_nil; compute.
- }
- rewrite H1 H2.
- have H3: 3 + 2 %/ num_cpus = 4 by compute.
- rewrite H3 H2 H3 H2 H3.
- have H4: 3 < 6 by compute.
- rewrite H4; clear H4 H2 H1 I2.
- unfold fp_bound_of_task.
- have H5: per_task_rta task_cost task_period num_cpus tsk3 [:: (tsk1, 2); (tsk2, 4)] (max_steps task_cost task_deadline tsk3) = 4.
- {
- Ltac g := rewrite /total_interference_bound_fp /interference_bound_generic
- /W /max_jobs /div_floor /div_ceil !big_cons big_nil /= /higher_priority_task /= ?addn0; compute.
- rewrite /per_task_rta iterSr /div_floor.
- set x10 := total_interference_bound_fp _ _ _ _.
- have I10: x10 = 5 by unfold x10; g.
- rewrite I10 iterSr.
- set x9 := total_interference_bound_fp _ _ _ _.
- have I9: x9 = 5 by unfold x9; g.
- rewrite I9 iterSr.
- set x8 := total_interference_bound_fp _ _ _ _.
- have I8: x8 = 5 by unfold x8; g.
- rewrite I8 iterSr.
- set x7 := total_interference_bound_fp _ _ _ _.
- have I7: x7 = 5 by unfold x7; g.
- rewrite I7 iterSr.
- set x6 := total_interference_bound_fp _ _ _ _.
- have I6: x6 = 5 by unfold x6; g.
- rewrite I6 iterSr.
- set x5 := total_interference_bound_fp _ _ _ _.
- have I5: x5 = 5 by unfold x5; g.
- rewrite I5 iterSr.
- set x4 := total_interference_bound_fp _ _ _ _.
- have I4: x4 = 5 by unfold x4; g.
- rewrite I4 iterSr.
- set x3 := total_interference_bound_fp _ _ _ _.
- have I3: x3 = 5 by unfold x3; g.
- rewrite I3 iterSr.
- set x2 := total_interference_bound_fp _ _ _ _.
- have I2: x2 = 5 by unfold x2; g.
- rewrite I2 iterSr.
- set x1 := total_interference_bound_fp _ _ _ _.
- have I1: x1 = 5 by unfold x1; g.
- rewrite I1 iterSr.
- set x0 := total_interference_bound_fp _ _ _ _.
- have I0: x0 = 5 by unfold x0; g.
- by rewrite /= I0; compute.
- }
- by rewrite H5.
- Qed.
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Assume rate-monotonic priorities. *)
- Let higher_priority := FP_to_JLDP job_task (RM task_period).
-
- Section FactsAboutPriorityOrder.
-
- Lemma ts_has_unique_priorities :
- FP_is_antisymmetric_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN' HP HP'.
- have EQ: task_period tsk = task_period tsk' by apply/eqP; rewrite eqn_leq HP HP'.
- clear HP HP'.
- rewrite !in_cons 2!in_nil 2!orbF in IN IN'; des; rewrite IN IN'; try (by done);
- subst tsk tsk'; simpl in *; by done.
- Qed.
-
- Lemma priority_is_total :
- FP_is_total_over_task_set (RM task_period) ts.
- Proof.
- unfold RM; intros tsk tsk' IN IN'.
- destruct (leqP (task_period tsk) (task_period tsk'));
- [by left | by right; apply ltnW].
- Qed.
-
- End FactsAboutPriorityOrder.
-
- (* Let sched be the work-conserving RM scheduler. *)
- Let sched := scheduler job_arrival job_cost num_cpus arr_seq higher_priority.
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, we prove that ts is schedulable with the result of the test. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts0 := ts) (higher_priority0 := RM task_period); try (by done) ) ||
- apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts := ts) (higher_priority := RM task_period); try (by done).
- - by apply ts_has_constrained_deadlines.
- - by apply ts_has_unique_priorities.
- - by apply priority_is_total.
- - by apply RM_is_transitive.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_must_arrive_to_execute.
- - apply scheduler_completed_jobs_dont_execute.
- -- by apply periodic_arrivals_are_consistent.
- -- by apply periodic_arrivals_is_a_set.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy.
- -- by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by intros t x y; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/implementation/job.v b/classic/implementation/job.v
deleted file mode 100644
index d78d352ca5fbda52f82689cffb921556b202926f..0000000000000000000000000000000000000000
--- a/classic/implementation/job.v
+++ /dev/null
@@ -1,67 +0,0 @@
-Require Import prosa.classic.model.time prosa.classic.util.all.
-Require Import prosa.classic.implementation.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteJob.
-
- Import Time.
- Import ConcreteTask.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_job :=
- {
- job_id: nat;
- job_arrival: time;
- job_cost: time;
- job_deadline: time;
- job_task: concrete_task_eqType
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete jobs. *)
- Definition job_eqdef (j1 j2: concrete_job) :=
- (job_id j1 == job_id j2) &&
- (job_arrival j1 == job_arrival j2) &&
- (job_cost j1 == job_cost j2) &&
- (job_deadline j1 == job_deadline j2) &&
- (job_task j1 == job_task j2).
-
- (* Next, we prove that job_eqdef is indeed an equality, ... *)
- Lemma eqn_job : Equality.axiom job_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (job_eqdef x y) eqn:EQ.
- {
- apply ReflectT; unfold job_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP ARR] /eqP COST] /eqP DL] /eqP TASK].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold job_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP TASK].
- move: EQ => /orP [EQ | /eqP DL].
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP COST].
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP ARR].
- by apply ID; inversion BUG.
- by apply ARR; inversion BUG.
- by apply COST; inversion BUG.
- by apply DL; inversion BUG.
- by apply TASK; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_job_eqMixin := EqMixin eqn_job.
- Canonical concrete_job_eqType := Eval hnf in EqType concrete_job concrete_job_eqMixin.
-
- End Defs.
-
-End ConcreteJob.
\ No newline at end of file
diff --git a/classic/implementation/task.v b/classic/implementation/task.v
deleted file mode 100644
index b151682024b589e330d3e9e9c05f1459382e5b83..0000000000000000000000000000000000000000
--- a/classic/implementation/task.v
+++ /dev/null
@@ -1,68 +0,0 @@
-Require Import prosa.classic.model.time prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteTask.
-
- Import Time SporadicTaskset.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_task :=
- {
- task_id: nat; (* for uniqueness *)
- task_cost: time;
- task_period: time;
- task_deadline: time
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete tasks. *)
- Definition task_eqdef (t1 t2: concrete_task) :=
- (task_id t1 == task_id t2) &&
- (task_cost t1 == task_cost t2) &&
- (task_period t1 == task_period t2) &&
- (task_deadline t1 == task_deadline t2).
-
- (* Next, we prove that task_eqdef is indeed an equality, ... *)
- Lemma eqn_task : Equality.axiom task_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (task_eqdef x y) eqn:EQ.
- {
- apply ReflectT.
- unfold task_eqdef in *.
- move: EQ => /andP [/andP [/andP [/eqP ID /eqP COST] /eqP PERIOD] /eqP DL].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold task_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP DL]; last by apply DL; inversion BUG.
- move: EQ => /orP [EQ | /eqP PERIOD].
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP COST].
- by apply ID; inversion BUG.
- by apply COST; inversion BUG.
- by apply PERIOD; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_task_eqMixin := EqMixin eqn_task.
- Canonical concrete_task_eqType := Eval hnf in EqType concrete_task concrete_task_eqMixin.
-
- End Defs.
-
- Section ConcreteTaskset.
-
- Definition concrete_taskset :=
- taskset_of concrete_task_eqType.
-
- End ConcreteTaskset.
-
-End ConcreteTask.
\ No newline at end of file
diff --git a/classic/implementation/uni/basic/extraction_tdma.v b/classic/implementation/uni/basic/extraction_tdma.v
deleted file mode 100644
index 7fa87880cb209ebdcc8abd6ac4eb73061b654a86..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/basic/extraction_tdma.v
+++ /dev/null
@@ -1,93 +0,0 @@
-(* Require Import Extraction. *) (* Required for Coq 8.7 *)
-Require Import prosa.classic.analysis.uni.basic.tdma_wcrt_analysis.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Set Implicit Arguments.
-
-CoInductive Task_T :Type:=
- build_task: nat->nat->nat->nat ->
- Task_T.
-
-Definition get_slot(tsk:Task_T):=
- match tsk with
- | build_task x _ _ _ => x end.
-
-Definition get_cost (tsk:Task_T):=
- match tsk with
- | build_task _ x _ _ => x end.
-
-Definition get_D (tsk:Task_T):=
- match tsk with
- | build_task _ _ x _ => x end.
-
-Definition get_P (tsk:Task_T):=
- match tsk with
- | build_task _ _ _ x => x end.
-
-Definition task_eq (t1 t2: Task_T) :=
- (get_slot t1 == get_slot t2)&&
- (get_cost t1 == get_cost t2)&&
- (get_D t1 == get_D t2)&&
- (get_P t1 == get_P t2) .
-
-Fixpoint In (a:Task_T) (l:list Task_T) : Prop :=
- match l with
- | nil => False
- | b :: m => a=b \/ In a m
- end.
-
-Definition schedulable_tsk T tsk:=
- let bound := WCRT_OneJobTDMA.WCRT_formula T (get_slot tsk) (get_cost tsk) in
- if (bound <= get_D tsk)&& (bound <= get_P tsk) then true else false .
-
-Fixpoint schedulability_test T (l: list Task_T):=
-match l with
-|nil => true
-|x::s=> (schedulable_tsk T x) && (schedulability_test T s)
-end.
-
-Theorem schedulability_test_valid T TL:
-schedulability_test T TL
- <-> (forall tsk, In tsk TL ->schedulable_tsk T tsk) .
-Proof.
-induction TL;split;auto.
-- intros STL tsk IN. rewrite /= in IN. move:IN=> [EQ |IN];
- rewrite /= in STL; move/andP in STL.
- + rewrite EQ;apply STL.
- + apply IHTL. apply STL. assumption.
-- intro ALL. apply/andP;split.
- + apply ALL. simpl;by left.
- + apply IHTL;intros tsk IN;apply ALL;simpl;by right.
-Qed.
-
-Definition cycle l:=
-(foldr plus 0 (map get_slot l)).
-
-Definition schedulability_tdma (l: list Task_T):=
-schedulability_test (cycle l) l.
-
-Theorem schedulability_tdma_valid task_list:
- schedulability_tdma task_list
- <-> (forall tsk, In tsk task_list ->schedulable_tsk (cycle task_list) tsk) .
-Proof.
-rewrite /schedulability_tdma. apply schedulability_test_valid.
-Qed.
-
-(*Eval compute in cycle [:: build_task(2,3,4,4);(6,2,5,6)].
-
-Eval compute in WCRT_OneJobTDMA.WCRT_formula 4 2 3.
-
-Eval compute in schedulability_tdma [::(2,3,7,7);(1,2,6,6)]. *)
-
-(*Extract Inductive unit => "unit" [ "()" ].
-Extract Inductive bool =>"bool" [ "true" "false" ].
-Extract Inductive nat => int [ "0" "Pervasives.succ" ]
- "(fun fO fS n -> if n=0 then fO () else fS (n-1))".
-Extract Inductive list => "list" [ "[]" "(::)" ].
-Extract Constant eqn => "(=)".
-Extract Constant addn => "(+)".
-Extract Constant subn => "fun n m -> Pervasives.max 0 (n-m)".
-Extract Constant muln => "( * )".
-Extract Inlined Constant leq => "(<=)".
-Recursive Extraction schedulability_tdma.
-Extraction "schedulability_tdma.ml" schedulability_tdma. *)
\ No newline at end of file
diff --git a/classic/implementation/uni/basic/fp_rta_example.v b/classic/implementation/uni/basic/fp_rta_example.v
deleted file mode 100644
index f7c662d21052a7f3f264e4fb6681a579d82adfbe..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/basic/fp_rta_example.v
+++ /dev/null
@@ -1,163 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability.
-Require Import prosa.classic.analysis.uni.basic.workload_bound_fp
- prosa.classic.analysis.uni.basic.fp_rta_comp.
-Require Import prosa.classic.implementation.job prosa.classic.implementation.task
- prosa.classic.implementation.arrival_sequence.
-Require Import prosa.classic.implementation.uni.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisFP.
-
- Import Job UniprocessorSchedule SporadicTaskset Priority Schedulability
- WorkloadBoundFP ResponseTimeIterationFP.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we run the FP RTA on a simple task set to show that the theorems
- contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 1; task_period := 4; task_deadline := 5|}.
- Let tsk2 := {| task_id := 2; task_cost := 1; task_period := 6; task_deadline := 5|}.
- Let tsk3 := {| task_id := 3; task_cost := 1; task_period := 6; task_deadline := 6|}.
-
- (* Let ts be a task set containing these three tasks.
- (Note that periods are not unique and one of the tasks has an arbitrary deadline.) *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
-
- (* Also note that the task set has valid parameters. *)
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- (* Next, recall the FP RTA schedulability test using RM as the FP policy. *)
- Let RTA_claimed_bounds :=
- fp_claimed_bounds task_cost task_period task_deadline (RM task_period).
- Let schedulability_test :=
- fp_schedulable task_cost task_period task_deadline (RM task_period).
-
- (* First, we show that the schedulability test returns the following bounds, ... *)
- Fact RTA_yields_these_bounds :
- RTA_claimed_bounds ts = Some [:: (tsk1, 1); (tsk2, 3); (tsk3, 3)].
- Proof.
- rewrite /RTA_claimed_bounds /fp_claimed_bounds.
- set RESP := [seq _ | tsk <- ts].
- suff EQ: RESP = [:: (tsk1, Some 1); (tsk2, Some 3); (tsk3, Some 3)] by rewrite EQ; compute.
- rewrite /RESP /ts /=; do 2 f_equal.
- {
- rewrite /per_task_rta /=.
- have WORK: total_workload_bound_fp task_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk1 1 = 1.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=.
- }
- f_equal.
- {
- rewrite /per_task_rta /=.
- have WORK: total_workload_bound_fp task_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk2 1 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp task_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk2 3 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=.
- }
- do 2 f_equal.
- {
- rewrite /per_task_rta /=.
- have WORK: total_workload_bound_fp task_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk3 1 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp task_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk3 3 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=; clear WORK.
- }
- Qed.
-
- (* ...so the schedulability test indeed returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- rewrite /schedulability_test /fp_schedulable -/RTA_claimed_bounds.
- by rewrite RTA_yields_these_bounds.
- Qed.
-
- (* Now, let's show that the task set is schedulable. *)
-
- (* Let arr_seq be the periodic arrival sequence from ts. *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* Assume rate-monotonic priorities... *)
- Let higher_eq_priority := FP_to_JLDP job_task (RM task_period).
-
- (* ... and recall that this priority assignment is total. *)
- Fact priority_is_total:
- forall t, total (higher_eq_priority t).
- Proof.
- rewrite /higher_eq_priority /FP_to_JLDP /RM /FP_to_JLFP.
- intros t x y; apply/orP.
- case LEQ: (_ <= _); first by left.
- apply negbT in LEQ; rewrite -ltnNge in LEQ.
- by right; apply ltnW.
- Qed.
-
- (* Let sched be the work-conserving RM scheduler. *)
- Let sched := scheduler job_arrival job_cost arr_seq higher_eq_priority.
-
- (* Recall the definition of deadline miss. *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* Next, by using the result of the RTA, we prove that the task set is schedulable. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts0 := ts) (higher_eq_priority0 := RM task_period); try (by done) ) ||
- apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline)
- (ts := ts) (higher_eq_priority := RM task_period); try (by done).
- - by apply periodic_arrivals_are_consistent.
- - by apply periodic_arrivals_is_a_set.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply RM_is_reflexive.
- - by apply RM_is_transitive.
- - by apply scheduler_jobs_come_from_arrival_sequence, periodic_arrivals_are_consistent.
- - by apply scheduler_jobs_must_arrive_to_execute, periodic_arrivals_are_consistent.
- - apply scheduler_completed_jobs_dont_execute, periodic_arrivals_are_consistent.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy; first by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by apply priority_is_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/implementation/uni/basic/schedule.v b/classic/implementation/uni/basic/schedule.v
deleted file mode 100644
index 28e99a4d58f509f3f7166e51dd725e251677535a..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/basic/schedule.v
+++ /dev/null
@@ -1,192 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.schedule.uni.basic.platform.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path.
-
-Module ConcreteScheduler.
-
- Import Job ArrivalSequence UniprocessorSchedule Platform Priority ScheduleConstruction.
-
- (* In this section, we implement a priority-based uniprocessor scheduler *)
- Section Implementation.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Let arr_seq be any job arrival sequence with consistent arrivals.*)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
-
- (* Assume a JLDP policy is given. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, we show how to recursively construct the schedule. *)
- Section ScheduleConstruction.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job.
- Variable t: time.
-
- (* For simplicity, let's use some local names. *)
- Let is_pending := pending job_arrival job_cost sched_prefix.
-
- (* Consider the list of pending jobs at time t. *)
- Definition pending_jobs :=
- [seq j <- jobs_arrived_up_to arr_seq t | is_pending j t].
-
- (* To make the scheduling decision, we just pick one of the highest-priority jobs
- that are pending (if it exists). *)
- Definition highest_priority_job :=
- seq_min (higher_eq_priority t) pending_jobs.
-
- End ScheduleConstruction.
-
- (* Starting from the empty schedule, the final schedule is obtained by iteratively
- picking the highest-priority job. *)
- Let empty_schedule : schedule Job := fun t => None.
- Definition scheduler :=
- build_schedule_from_prefixes highest_priority_job empty_schedule.
-
- (* Then, by showing that the construction function depends only on the prefix, ... *)
- Lemma scheduler_depends_only_on_prefix:
- forall sched1 sched2 t,
- (forall t0, t0 < t -> sched1 t0 = sched2 t0) ->
- highest_priority_job sched1 t = highest_priority_job sched2 t.
- Proof.
- intros sched1 sched2 t ALL.
- rewrite /highest_priority_job.
- suff SAME: pending_jobs sched1 t = pending_jobs sched2 t by rewrite SAME.
- apply eq_in_filter.
- intros j ARR.
- ( try ( apply in_arrivals_implies_arrived_before with (job_arrival0 := job_arrival) in ARR ) ||
- apply in_arrivals_implies_arrived_before with (job_arrival := job_arrival) in ARR);
- last by done.
- rewrite /arrived_before ltnS in ARR.
- rewrite /pending /has_arrived ARR 2!andTb; f_equal.
- rewrite /completed_by; f_equal.
- apply eq_big_nat; move => i /= LTi.
- by rewrite /service_at /scheduled_at ALL.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary scheduler_uses_construction_function:
- forall t, scheduler t = highest_priority_job scheduler t.
- Proof.
- by ins; apply prefix_dependent_schedule_construction,
- scheduler_depends_only_on_prefix.
- Qed.
-
- End Implementation.
-
- (* In this section, we prove the properties of the scheduler that are used
- as hypotheses in the analyses. *)
- Section Proofs.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Let arr_seq be any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Consider any JLDP policy that is transitive and total. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_is_transitive: forall t, transitive (higher_eq_priority t).
- Hypothesis H_priority_is_total: forall t, total (higher_eq_priority t).
-
- (* Let sched denote our concrete scheduler implementation. *)
- Let sched := scheduler job_arrival job_cost arr_seq higher_eq_priority.
-
- (* To conclude, we prove the important properties of the scheduler implementation. *)
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma scheduler_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
- Proof.
- move => j t /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function // /highest_priority_job in SCHED.
- apply seq_min_in_seq in SCHED.
- rewrite mem_filter in SCHED.
- move: SCHED => /andP [_ ARR].
- by eapply in_arrivals_implies_arrived, ARR.
- Qed.
-
- (* Next, we show that jobs do not execute before they arrive...*)
- Theorem scheduler_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Proof.
- move => j t /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function // /highest_priority_job in SCHED.
- apply seq_min_in_seq in SCHED.
- rewrite mem_filter in SCHED.
- by move: SCHED => /andP [/andP [ARR _] _].
- Qed.
-
- (* ... nor after completion. *)
- Theorem scheduler_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- Proof.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite /sched scheduler_uses_construction_function //.
- rewrite /highest_priority_job.
- apply/eqP; intro HP.
- apply seq_min_in_seq in HP.
- by rewrite mem_filter /pending /completed_by -EQ /sched leqnn andbF andFb in HP.
- Qed.
-
- (* In addition, the scheduler is work conserving, ... *)
- Theorem scheduler_work_conserving:
- work_conserving job_arrival job_cost arr_seq sched.
- Proof.
- intros j t IN BACK.
- move: BACK => /andP [/andP [ARR NOTCOMP] NOTSCHED].
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in NOTSCHED.
- rewrite /scheduled_at /sched scheduler_uses_construction_function //.
- case HP: (highest_priority_job _ _ _ _ ) => [j_hp|]; first by exists j_hp.
- set hp := highest_priority_job _ _ _ _ _ _ in NOTSCHED HP.
- suff BUG: hp != None by rewrite HP in BUG.
- apply seq_min_exists with (x := j).
- rewrite mem_filter /pending ARR NOTCOMP /=.
- by eapply arrived_between_implies_in_arrivals, ARR.
- Qed.
-
- (* ...and respects the JLDP policy. *)
- Theorem scheduler_respects_policy :
- respects_JLDP_policy job_arrival job_cost arr_seq sched higher_eq_priority.
- Proof.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL.
- move => j1 j2 t ARR1 BACK /eqP SCHED.
- move: BACK => /andP [/andP [ARR NOTCOMP] NOTSCHED].
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in NOTSCHED.
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in SCHED.
- rewrite /highest_priority_job in SCHED NOTSCHED.
- set jobs := pending_jobs _ _ _ _ _ in SCHED NOTSCHED.
- have IN: j1 \in jobs.
- {
- rewrite mem_filter /pending ARR NOTCOMP /=.
- by eapply arrived_between_implies_in_arrivals, ARR.
- }
- apply seq_min_computes_min with (y := j1) in SCHED; try (by done).
- by intros x y; rewrite 2!mem_filter; move => /andP [_ INx] /andP [_ INy];
- apply TOTAL; eapply in_arrivals_implies_arrived; eauto 2.
- Qed.
-
- End Proofs.
-
-End ConcreteScheduler.
diff --git a/classic/implementation/uni/basic/schedule_tdma.v b/classic/implementation/uni/basic/schedule_tdma.v
deleted file mode 100644
index 0b53ea6c8e724280bdbea93327f397343c93478c..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/basic/schedule_tdma.v
+++ /dev/null
@@ -1,234 +0,0 @@
-Require Import prosa.classic.util.all prosa.classic.util.find_seq
- Arith.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.schedule.uni.basic.platform_tdma
- prosa.classic.model.arrival.basic.task prosa.classic.model.policy_tdma.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability.
-Require Import prosa.classic.model.priority
- prosa.classic.analysis.uni.basic.tdma_rta_theory
- prosa.classic.model.schedule.uni.transformation.construction.
-Require Import prosa.classic.implementation.job prosa.classic.implementation.task
- prosa.classic.implementation.arrival_sequence
- prosa.classic.implementation.uni.basic.schedule.
-
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Set Bullet Behavior "Strict Subproofs".
-Module ConcreteSchedulerTDMA.
-
- Import Job ArrivalSequence UniprocessorSchedule SporadicTaskset Schedulability Priority
- ResponseTimeAnalysisTDMA PolicyTDMA ScheduleConstruction Platform_TDMA.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler BigOp.
-
- Section ImplementationTDMA.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- Variable arr_seq: arrival_sequence Job.
-
- Variable ts: {set Task}.
-
- Variable time_slot: TDMA_slot Task.
-
- Variable slot_order: TDMA_slot_order Task.
-
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
-
- Section JobSchedule.
-
- Variable sched: schedule Job.
- Variable t:time.
-
- Let is_pending := pending job_arrival job_cost sched.
-
- Definition pending_jobs:=
- [seq j <- jobs_arrived_up_to arr_seq t | is_pending j t].
-
-
- Let job_in_time_slot:=
- fun job => Task_in_time_slot ts slot_order (job_task job) time_slot t.
-
-
- Definition job_to_schedule :=
- find_seq.findP job_in_time_slot pending_jobs.
-
- Section Lemmas.
-
- Hypothesis arr_seq_is_a_set:
- arrival_sequence_is_a_set arr_seq.
-
- Lemma pending_jobs_uniq:
- uniq pending_jobs.
- Proof.
- try ( apply filter_uniq
- , arrivals_uniq with (job_arrival0:=job_arrival);auto ) ||
- apply filter_uniq
- , arrivals_uniq with (job_arrival:=job_arrival);auto.
- Qed.
-
-
- Lemma respects_FIFO:
- forall j j', j \in pending_jobs -> j' \in pending_jobs ->
- find (fun job => job==j') pending_jobs
- < find (fun job => job==j) pending_jobs ->
- job_arrival j' <= job_arrival j.
- Proof.
- rewrite /job_to_schedule /pending_jobs /jobs_arrived_up_to
- /jobs_arrived_between. intros*.
- repeat rewrite mem_filter.
- move=> /andP [PENJ JIN] /andP [PENJ' J'IN] LEQ.
- apply mem_bigcat_nat_exists in JIN.
- apply mem_bigcat_nat_exists in J'IN.
- destruct JIN as [arrj [JIN _]].
- destruct J'IN as [arrj' [J'IN _]].
- have ARRJ: job_arrival j = arrj by eauto.
- have ARRJ': job_arrival j' = arrj' by eauto.
- have JLT: arrj' <= t by move:PENJ'=>/andP [HAD _]; eauto.
- destruct (leqP arrj' arrj) as [G|G]. eauto.
- apply mem_bigcat_nat with (m:=0) (n:=arrj.+1) in JIN;auto.
- apply mem_bigcat_nat with (m:=arrj.+1) (n:=t.+1) in J'IN;auto.
- have BIGJ: j \in [seq j <- \big[cat/[::]]_(0 <= i < arrj.+1)
- jobs_arriving_at arr_seq i | is_pending j t]
- by rewrite mem_filter;apply /andP.
- have BIGJ': j' \in [seq j <- \big[cat/[::]]_(arrj.+1 <= i < t.+1)
- jobs_arriving_at arr_seq i | is_pending j t]
- by rewrite mem_filter;apply /andP.
- rewrite ->big_cat_nat with (n:=arrj.+1) in LEQ;try lia.
- rewrite filter_cat find_cat /=in LEQ.
- rewrite find_cat /= in LEQ.
- have F: (has (fun job : Job => job == j')
- [seq j <- \big[cat/[::]]_(0 <= i < arrj.+1)
- jobs_arriving_at arr_seq i
- | is_pending j t]) = false .
- apply find_uniq with (l2:=
- [seq j <- \big[cat/[::]]_(arrj.+1 <= i < t.+1)
- jobs_arriving_at arr_seq i
- | is_pending j t]);auto.
- rewrite -filter_cat -big_cat_nat;auto. apply pending_jobs_uniq.
- lia.
- have TT: (has (fun job : Job => job == j)
- [seq j <- \big[cat/[::]]_(0 <= i < arrj.+1)
- jobs_arriving_at arr_seq i
- | is_pending j t]) = true. apply /hasP. by exists j.
- have FI: find (fun job : Job => job == j)
- [seq j <- \big[cat/[::]]_(0 <= t < arrj.+1)
- jobs_arriving_at arr_seq t
- | is_pending j t] < size (
- [seq j <- \big[cat/[::]]_(0 <= t < arrj.+1)
- jobs_arriving_at arr_seq t
- | is_pending j t]). by rewrite -has_find.
- rewrite F TT in LEQ. lia.
- Qed.
-
- Lemma pending_job_in_penging_list:
- forall j, arrives_in arr_seq j ->
- pending job_arrival job_cost sched j t ->
- j \in pending_jobs.
- Proof.
- intros* ARRJ PEN.
- rewrite mem_filter. apply /andP. split.
- apply PEN. rewrite /jobs_arrived_up_to.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0:=job_arrival) ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival:=job_arrival).
- apply H_arrival_times_are_consistent. auto.
- rewrite /arrived_between. simpl.
- rewrite /pending in PEN. move:PEN=>/andP [ARRED _].
- rewrite /has_arrived in ARRED. auto.
- Qed.
-
- Lemma pendinglist_jobs_in_arr_seq:
- forall j, j \in pending_jobs ->
- arrives_in arr_seq j.
- Proof.
- intros* JIN.
- rewrite mem_filter in JIN. move /andP in JIN.
- destruct JIN as [PEN ARR]. rewrite /jobs_arrived_up_to in ARR.
- by apply in_arrivals_implies_arrived with (t1:= 0)(t2:= t.+1).
- Qed.
- End Lemmas.
-
- End JobSchedule.
-
-
-
- Section SchedulerTDMA.
-
- Let empty_schedule : schedule Job := fun t => None.
- Definition scheduler_tdma:=
- build_schedule_from_prefixes job_to_schedule empty_schedule.
-
- Lemma scheduler_depends_only_on_prefix:
- forall sched1 sched2 t,
- (forall t0, t0 < t -> sched1 t0 = sched2 t0) ->
- job_to_schedule sched1 t = job_to_schedule sched2 t.
- Proof.
- intros * ALL.
- rewrite /job_to_schedule. f_equal.
- apply eq_in_filter.
- intros j ARR.
- try ( apply in_arrivals_implies_arrived_before
- with (job_arrival0 := job_arrival) in ARR ) ||
- apply in_arrivals_implies_arrived_before
- with (job_arrival := job_arrival) in ARR.
- rewrite /arrived_before ltnS in ARR.
- rewrite /pending /has_arrived ARR. repeat rewrite andTb; f_equal.
- rewrite /completed_by; f_equal.
- apply eq_big_nat. intros.
- by rewrite /service_at /scheduled_at ALL.
- assumption.
- Qed.
-
- Lemma scheduler_uses_construction_function:
- forall t, scheduler_tdma t = job_to_schedule scheduler_tdma t.
- Proof.
- intro t. apply prefix_dependent_schedule_construction.
- apply scheduler_depends_only_on_prefix.
- Qed.
-
- End SchedulerTDMA.
-
-
- Let sched:=
- scheduler_tdma.
-
-
- Theorem scheduler_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Proof.
- move => j t /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function /job_to_schedule in SCHED.
- apply findP_in_seq in SCHED. move:SCHED => [IN PEN].
- rewrite mem_filter in PEN.
- by move: PEN => /andP [/andP [ARR _] _].
- Qed.
-
- Theorem scheduler_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- Proof.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite /sched scheduler_uses_construction_function //.
- rewrite /job_to_schedule.
- apply/eqP; intro FIND.
- apply findP_in_seq in FIND. move:FIND => [IN PEN].
- by rewrite mem_filter /pending /completed_by -EQ leqnn andbF andFb in PEN.
- Qed.
-
- End ImplementationTDMA.
-
-End ConcreteSchedulerTDMA.
diff --git a/classic/implementation/uni/basic/tdma_rta_example.v b/classic/implementation/uni/basic/tdma_rta_example.v
deleted file mode 100644
index f409eb8e820a5c5a573f161738c24ff3d6d83a5e..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/basic/tdma_rta_example.v
+++ /dev/null
@@ -1,227 +0,0 @@
-Require Import prosa.classic.util.all prosa.classic.util.find_seq
- .
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.schedule.uni.basic.platform_tdma
- prosa.classic.model.arrival.basic.task prosa.classic.model.policy_tdma.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability.
-Require Import prosa.classic.model.priority
- prosa.classic.analysis.uni.basic.tdma_rta_theory
- prosa.classic.analysis.uni.basic.tdma_wcrt_analysis.
-Require Import prosa.classic.implementation.job prosa.classic.implementation.task
- prosa.classic.implementation.arrival_sequence
- prosa.classic.implementation.uni.basic.schedule_tdma.
-
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Set Bullet Behavior "Strict Subproofs".
-Module ResponseTimeAnalysisExemple.
-
- Import Job ArrivalSequence UniprocessorSchedule SporadicTaskset Schedulability Priority
- ResponseTimeAnalysisTDMA PolicyTDMA Platform_TDMA.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence BigOp
- ConcreteSchedulerTDMA WCRT_OneJobTDMA.
-
-
- Section ExampleTDMA.
-
- Context {Job: eqType}.
-
- Let tsk1 := {| task_id := 1; task_cost := 1; task_period := 16; task_deadline := 15|}.
- Let tsk2 := {| task_id := 2; task_cost := 1; task_period := 8; task_deadline := 5|}.
- Let tsk3 := {| task_id := 3; task_cost := 1; task_period := 9; task_deadline := 6|}.
-
-
-
- Let time_slot1 := 1.
- Let time_slot2 := 4.
- Let time_slot3 := 3.
-
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- Let slot_seq := [::(tsk1,time_slot1);(tsk2,time_slot2);(tsk3,time_slot3)].
-
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk tskIN.
- repeat (move: tskIN => /orP [/eqP EQ | tskIN]; subst; compute); by done.
- Qed.
-
- Let arr_seq := periodic_arrival_sequence ts.
-
- Fact job_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Proof.
- apply periodic_arrivals_are_consistent.
- Qed.
-
-
- Definition time_slot task:=
- if task \in (map fst slot_seq) then
- let n:= find (fun tsk => tsk==task)(map fst slot_seq) in
- nth n (map snd slot_seq) n else 0.
-
-
- Fact valid_time_slots:
- forall tsk, tsk \in ts ->
- is_valid_time_slot tsk time_slot.
- Proof.
- apply/allP. by cbn.
- Qed.
-
- Definition slot_order task1 task2:=
- task_id task1 >= task_id task2.
-
-
- Let sched:=
- scheduler_tdma job_arrival job_cost job_task arr_seq ts time_slot slot_order.
-
- Let job_in_time_slot t j:=
- Task_in_time_slot ts slot_order (job_task j) time_slot t.
-
- Fact slot_order_total:
- slot_order_is_total_over_task_set ts slot_order.
- Proof.
- intros t1 t2 IN1 IN2. rewrite /slot_order.
- case LEQ: (_ <= _);first by left.
- right;move/negP /negP in LEQ;rewrite -ltnNge in LEQ;auto.
- Qed.
-
- Fact slot_order_transitive:
- slot_order_is_transitive slot_order.
- Proof.
- rewrite /slot_order.
- intros t1 t2 t3 IN1 IN2. lia.
- Qed.
-
- Fact slot_order_antisymmetric:
- slot_order_is_antisymmetric_over_task_set ts slot_order.
- Proof.
- intros x y IN1 IN2. rewrite /slot_order. intros O1 O2.
- have EQ: task_id x = task_id y by lia.
- case (x==y)eqn:XY;move/eqP in XY;auto.
- repeat (move:IN2=> /orP [/eqP TSK2 |IN2]); repeat (move:IN1=>/orP [/eqP TSK1|IN1];subst);compute ;try done.
- Qed.
-
- Fact respects_TDMA_policy:
- Respects_TDMA_policy job_arrival job_cost job_task arr_seq sched ts time_slot slot_order.
- Proof.
- intros j t ARRJ.
- split.
- - rewrite /sched_implies_in_slot /scheduled_at /sched scheduler_uses_construction_function /job_to_schedule.
- move => /eqP FUN. unfold job_in_time_slot.
- apply findP_in_seq in FUN.
- by destruct FUN as [ TskInSlot _].
- apply job_arrival_times_are_consistent.
- - rewrite /backlogged_implies_not_in_slot_or_other_job_sched /backlogged /scheduled_at /sched scheduler_uses_construction_function /job_to_schedule.
- move => /andP [PEN NOSCHED]. have NSJ:= NOSCHED.
- apply findP_notSome_in_seq in NOSCHED.
- destruct NOSCHED as [NOIN |EXIST].
- + by left.
- + case (Task_in_time_slot ts slot_order (job_task j) time_slot t) eqn:INSLOT;last by left.
- right. destruct EXIST as [y SOMEY]. exists y. have FIND:=SOMEY. apply findP_in_seq in SOMEY.
- move:SOMEY => [SLOTY YIN]. have ARRY: arrives_in arr_seq y
- by apply pendinglist_jobs_in_arr_seq in YIN.
- have SAMETSK: job_task j = job_task y.
- have EQ:Task_in_time_slot ts slot_order (job_task y) time_slot t =
- Task_in_time_slot ts slot_order (job_task j) time_slot t by rewrite INSLOT.
- try ( apply task_in_time_slot_uniq with (ts0:= ts) (t0:=t) (slot_order:=slot_order) (task_time_slot:=time_slot);auto ) ||
- apply task_in_time_slot_uniq with (ts:= ts) (t:=t) (slot_order:=slot_order) (task_time_slot:=time_slot);auto.
- intros;by apply slot_order_total.
- by apply slot_order_antisymmetric.
- by apply slot_order_transitive.
- by apply periodic_arrivals_all_jobs_from_taskset.
- by apply valid_time_slots,periodic_arrivals_all_jobs_from_taskset.
- by apply periodic_arrivals_all_jobs_from_taskset.
- by apply valid_time_slots ,periodic_arrivals_all_jobs_from_taskset.
- split;auto.
- * split;case (y==j)eqn:YJ;move/eqP in YJ;try by rewrite FIND YJ in NSJ;move/eqP in NSJ;auto.
- ( try ( apply pending_job_in_penging_list with (arr_seq0:=arr_seq) in PEN ) ||
- apply pending_job_in_penging_list with (arr_seq:=arr_seq) in PEN);auto
- ;last apply job_arrival_times_are_consistent.
- ( try ( apply findP_FIFO with (y0:=j) in FIND ) ||
- apply findP_FIFO with (y:=j) in FIND);auto. fold sched in FIND.
- apply (respects_FIFO ) in FIND;auto.
- apply periodic_arrivals_are_sporadic with (ts:=ts) in FIND;auto.
- have PERIODY:task_period (job_task y)>0 by
- apply ts_has_valid_parameters,periodic_arrivals_all_jobs_from_taskset. lia.
- apply job_arrival_times_are_consistent.
- apply periodic_arrivals_is_a_set,ts_has_valid_parameters.
- split;auto.
- by apply/eqP.
- + apply pending_job_in_penging_list;trivial.
- * by apply job_arrival_times_are_consistent.
- + by apply job_arrival_times_are_consistent.
- Qed.
-
-
- Fact job_cost_le_task_cost:
- forall j : concrete_job_eqType,
- arrives_in arr_seq j ->
- job_cost_le_task_cost task_cost job_cost job_task j.
- Proof.
- intros JOB ARR.
- apply periodic_arrivals_valid_job_parameters in ARR.
- apply ARR. by apply ts_has_valid_parameters.
- Qed.
-
-
- Let tdma_claimed_bound task:=
- WCRT task_cost time_slot ts task.
- Let tdma_valid_bound task := is_valid_tdma_bound task_deadline task (tdma_claimed_bound task).
-
- Fact valid_tdma_bounds:
- forall tsk, tsk \in ts ->
- tdma_valid_bound tsk = true.
- Proof.
- apply/allP.
- rewrite /tdma_valid_bound /tdma_claimed_bound /WCRT /TDMA_cycle.
- rewrite bigopE. by compute.
- Qed.
-
- Fact WCRT_le_period:
- forall tsk, tsk \in ts ->
- WCRT task_cost time_slot ts tsk <= task_period tsk.
- Proof.
- apply/allP.
- rewrite /tdma_valid_bound /tdma_claimed_bound /WCRT /TDMA_cycle.
- rewrite bigopE. by compute.
- Qed.
-
-
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- Theorem ts_is_schedulable_by_tdma :
- forall tsk, tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk tskIN.
- have VALID_JOB := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- try ( apply taskset_schedulable_by_tdma with (task_deadline:=task_deadline)(task_period:=task_period)
- (tsk0:=tsk)(ts0:=ts)(task_cost:=task_cost)
- (task_time_slot:=time_slot) (slot_order:= slot_order)
- (arr_seq0:=arr_seq) ) ||
- apply taskset_schedulable_by_tdma with (task_deadline:=task_deadline)(task_period:=task_period)
- (tsk:=tsk)(ts:=ts)(task_cost:=task_cost)
- (task_time_slot:=time_slot) (slot_order:= slot_order)
- (arr_seq:=arr_seq).
- - apply job_arrival_times_are_consistent.
- - apply periodic_arrivals_are_sporadic.
- - apply scheduler_jobs_must_arrive_to_execute.
- apply job_arrival_times_are_consistent.
- - apply scheduler_completed_jobs_dont_execute.
- apply job_arrival_times_are_consistent.
- - assumption.
- - by apply WCRT_le_period.
- - by apply respects_TDMA_policy.
- - by apply valid_time_slots.
- - assumption.
- - by apply job_cost_le_task_cost.
- - apply valid_tdma_bounds;auto.
- Qed.
-
- End ExampleTDMA.
-
-End ResponseTimeAnalysisExemple.
diff --git a/classic/implementation/uni/jitter/arrival_sequence.v b/classic/implementation/uni/jitter/arrival_sequence.v
deleted file mode 100644
index f1014556506214c88910f3fd31494549b9135a50..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/jitter/arrival_sequence.v
+++ /dev/null
@@ -1,117 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.task_arrival prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.implementation.uni.jitter.task
- prosa.classic.implementation.uni.jitter.job.
-From mathcomp Require Import ssreflect ssrbool ssrfun ssrnat eqtype seq div.
-
-Module ConcreteArrivalSequence.
-
- Import Job ArrivalSequence ConcreteTask ConcreteJob SporadicTaskset TaskArrival.
-
- Section PeriodicArrivals.
-
- Variable ts: concrete_taskset.
-
- (* At any time t, we release Some job of tsk if t is a multiple of the period,
- otherwise we release None. *)
- Definition add_job (arr_time: time) (tsk: concrete_task) :=
- if task_period tsk %| arr_time then
- Some (Build_concrete_job (arr_time %/ task_period tsk) arr_time
- (task_cost tsk) (task_deadline tsk) tsk)
- else
- None.
-
- (* The arrival sequence at any time t is simply the partial map of add_job. *)
- Definition periodic_arrival_sequence (t: time) := pmap (add_job t) ts.
-
- End PeriodicArrivals.
-
- Section Proofs.
-
- (* Let ts be any concrete task set with valid parameters. *)
- Variable ts: concrete_taskset.
-
- (* Regarding the periodic arrival sequence built from ts, we prove that...*)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* ... arrival times are consistent, ... *)
- Theorem periodic_arrivals_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Proof.
- move => j t ARRj.
- rewrite /arrives_at mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ... every job comes from the task set, ... *)
- Theorem periodic_arrivals_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
- Proof.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ... job arrivals satisfy the sporadic task model, ... *)
- Theorem periodic_arrivals_are_sporadic:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Proof.
- move => j j' /eqP DIFF [arr ARR] [arr' ARR'] SAMEtsk LE.
- rewrite eqE /= /job_eqdef negb_and /= SAMEtsk eq_refl orbF in DIFF.
- rewrite 2!mem_pmap in ARR ARR'.
- move: ARR ARR' => /mapP [tsk_j INj SOMEj] /mapP [tsk_j' INj' SOMEj'].
- unfold add_job in SOMEj, SOMEj'; desf; simpl in *;
- move: Heq0 Heq => /dvdnP [k DIV] /dvdnP [k' DIV'].
- {
- rewrite DIV DIV' -mulSnr.
- rewrite leq_eqVlt in LE; move: LE => /orP [/eqP EQ | LESS].
- {
- exfalso; move: DIFF => /negP DIFF; apply DIFF.
- by subst; rewrite EQ !eq_refl.
- }
- subst; rewrite leq_mul2r; apply/orP; right.
- by rewrite ltn_mul2r in LESS; move: LESS => /andP [_ LT].
- }
- Qed.
-
- (* ... and the arrival sequence has no duplicate jobs. *)
- Theorem periodic_arrivals_is_a_set:
- arrival_sequence_is_a_set arr_seq.
- Proof.
- intros t.
- unfold arr_seq, periodic_arrival_sequence.
- apply (pmap_uniq) with (g := job_task); last by destruct ts.
- by unfold add_job, ocancel; intro tsk; desf.
- Qed.
-
- (* We also show that job costs are bounded by task costs... *)
- Theorem periodic_arrivals_job_cost_le_task_cost:
- forall j,
- arrives_in arr_seq j ->
- job_cost j <= task_cost (job_task j).
- Proof.
- intros j [t ARRj].
- rewrite mem_pmap in ARRj.
- move: ARRj => /mapP [tsk_j INj SOMEj].
- by unfold add_job in SOMEj; desf.
- Qed.
-
- (* ...and that job deadlines equal task deadlines. *)
- Theorem periodic_arrivals_job_deadline_eq_task_deadline:
- forall j,
- arrives_in arr_seq j ->
- job_deadline j = task_deadline (job_task j).
- Proof.
- intros j [t ARRj].
- rewrite mem_pmap in ARRj.
- move: ARRj => /mapP [tsk_j INj SOMEj].
- by unfold add_job in SOMEj; desf.
- Qed.
-
- End Proofs.
-
-End ConcreteArrivalSequence.
\ No newline at end of file
diff --git a/classic/implementation/uni/jitter/fp_rta_example.v b/classic/implementation/uni/jitter/fp_rta_example.v
deleted file mode 100644
index 9ff1556ab460ca1d2f5400c7c71ef657d4adb158..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/jitter/fp_rta_example.v
+++ /dev/null
@@ -1,186 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.schedule.uni.schedulability.
-Require Import prosa.classic.model.arrival.jitter.job.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule.
-Require Import prosa.classic.analysis.uni.jitter.workload_bound_fp
- prosa.classic.analysis.uni.jitter.fp_rta_comp.
-Require Import prosa.classic.implementation.uni.jitter.job
- prosa.classic.implementation.uni.jitter.task
- prosa.classic.implementation.uni.jitter.arrival_sequence
- prosa.classic.implementation.uni.jitter.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisFP.
-
- Import JobWithJitter UniprocessorScheduleWithJitter SporadicTaskset Priority Schedulability
- WorkloadBoundFP ResponseTimeIterationFP.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we test the jitter-aware FP RTA on a simple task set
- to show that the theorems contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 1; task_period := 5;
- task_deadline := 6; task_jitter := 1 |}.
- Let tsk2 := {| task_id := 2; task_cost := 1; task_period := 5;
- task_deadline := 6; task_jitter := 0|}.
- Let tsk3 := {| task_id := 3; task_cost := 1; task_period := 6;
- task_deadline := 6; task_jitter := 1|}.
-
- (* Let ts be a task set containing these three tasks, ... *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- (* ...which can be shown to have valid parameters. *)
- Remark ts_has_positive_costs:
- forall tsk, tsk \in ts -> task_cost tsk > 0.
- Proof.
- intros tsk IN.
- by repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
- Remark ts_has_positive_periods:
- forall tsk, tsk \in ts -> task_period tsk > 0.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- (* Next, recall the FP RTA schedulability test using RM as the FP policy. *)
- Let RTA_claimed_bounds :=
- fp_claimed_bounds task_cost task_period task_deadline task_jitter (RM task_period).
- Let schedulability_test :=
- fp_schedulable task_cost task_period task_deadline task_jitter (RM task_period).
-
- (* First, we show that the schedulability test returns the following bounds.
- (Note that although we check the task jitter, these values only include the
- response-time bounds.) *)
- Fact RTA_yields_these_bounds :
- RTA_claimed_bounds ts = Some [:: (tsk1, 2); (tsk2, 2); (tsk3, 3)].
- Proof.
- rewrite /RTA_claimed_bounds /fp_claimed_bounds.
- set RESP := [seq _ | tsk <- ts].
- suff EQ: RESP = [:: (tsk1, Some 2); (tsk2, Some 2); (tsk3, Some 3)].
- by rewrite EQ; compute.
- rewrite /RESP /ts /=; do 2 f_equal.
- {
- rewrite /per_task_rta /=.
- have WORK: total_workload_bound_fp task_cost task_period task_jitter (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk1 1 = 2.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp task_cost task_period task_jitter (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk1 2 = 2.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=.
- }
- f_equal.
- {
- rewrite /per_task_rta /=.
- have WORK: total_workload_bound_fp task_cost task_period task_jitter (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk2 1 = 2.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp task_cost task_period task_jitter (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk2 2 = 2.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=.
- }
- do 2 f_equal.
- {
- rewrite /per_task_rta /=.
- have WORK: total_workload_bound_fp task_cost task_period task_jitter (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk3 1 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp task_cost task_period task_jitter (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk3 3 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=; clear WORK.
- }
- Qed.
-
- (* Since the response-time bounds plus task jitter are no larger than task deadlines,
- the schedulability test indeed returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- rewrite /schedulability_test /fp_schedulable -/RTA_claimed_bounds.
- by rewrite RTA_yields_these_bounds.
- Qed.
-
- (* Now, let's show that the task set is schedulable. *)
-
- (* Let arr_seq be the periodic arrival sequence from ts... *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* ...subject to rate-monotonic priority. *)
- Let higher_eq_priority := FP_to_JLDP job_task (RM task_period).
-
- (* Assume that jobs have jitter that is no larger than the jitter of their tasks. *)
- Variable job_jitter: concrete_job -> time.
- Hypothesis H_jitter_is_bounded:
- forall j,
- arrives_in arr_seq j ->
- job_jitter_leq_task_jitter task_jitter job_jitter job_task j.
-
- (* Next, let sched be the jitter-aware RM schedule with those jitter values. *)
- Let sched := scheduler job_arrival job_cost job_jitter arr_seq higher_eq_priority.
-
- (* To conclude, based on the definition of deadline miss,... *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* ...we use the result of the jitter-aware FP RTA to conclude that
- no task misses its deadline. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- rename H_jitter_is_bounded into JIT.
- intros tsk IN.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (ts0 := ts)
- (higher_eq_priority0 := RM task_period) (job_jitter0 := job_jitter)
- (task_jitter := task_jitter); try (by done) ) ||
- apply taskset_schedulable_by_fp_rta with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (ts := ts)
- (higher_eq_priority := RM task_period) (job_jitter := job_jitter)
- (task_jitter := task_jitter); try (by done).
- - by apply ts_has_positive_costs.
- - by apply ts_has_positive_periods.
- - by apply periodic_arrivals_are_consistent.
- - - apply periodic_arrivals_is_a_set.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply periodic_arrivals_job_cost_le_task_cost.
- - by apply periodic_arrivals_job_deadline_eq_task_deadline.
- - by apply RM_is_reflexive.
- - by apply RM_is_transitive.
- - by apply scheduler_jobs_come_from_arrival_sequence.
- - by apply scheduler_jobs_execute_after_jitter.
- - by apply scheduler_completed_jobs_dont_execute.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy; first by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- intros j1 j2 t ARR1 ARR2; apply leq_total.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/implementation/uni/jitter/job.v b/classic/implementation/uni/jitter/job.v
deleted file mode 100644
index 2e3e349f41c803e4ad9ea14873e5faeda76d8b29..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/jitter/job.v
+++ /dev/null
@@ -1,66 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.implementation.uni.jitter.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteJob.
-
- Import ConcreteTask.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_job :=
- {
- job_id: nat;
- job_arrival: nat;
- job_cost: nat;
- job_deadline: nat;
- job_task: concrete_task_eqType
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete jobs. *)
- Definition job_eqdef (j1 j2: concrete_job) :=
- (job_id j1 == job_id j2) &&
- (job_arrival j1 == job_arrival j2) &&
- (job_cost j1 == job_cost j2) &&
- (job_deadline j1 == job_deadline j2) &&
- (job_task j1 == job_task j2).
-
- (* Next, we prove that job_eqdef is indeed an equality, ... *)
- Lemma eqn_job : Equality.axiom job_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (job_eqdef x y) eqn:EQ.
- {
- apply ReflectT; unfold job_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP ARR] /eqP COST] /eqP DL] /eqP TASK].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold job_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP TASK].
- move: EQ => /orP [EQ | /eqP DL].
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP COST].
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP ARR].
- by apply ID; inversion BUG.
- by apply ARR; inversion BUG.
- by apply COST; inversion BUG.
- by apply DL; inversion BUG.
- by apply TASK; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_job_eqMixin := EqMixin eqn_job.
- Canonical concrete_job_eqType := Eval hnf in EqType concrete_job concrete_job_eqMixin.
-
- End Defs.
-
-End ConcreteJob.
\ No newline at end of file
diff --git a/classic/implementation/uni/jitter/schedule.v b/classic/implementation/uni/jitter/schedule.v
deleted file mode 100644
index 7e211f2fde00c0b1f3bb5e691ed9924a3ca0a6e3..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/jitter/schedule.v
+++ /dev/null
@@ -1,195 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule
- prosa.classic.model.schedule.uni.jitter.platform.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path.
-
-Module ConcreteScheduler.
-
- Import Job ArrivalSequence UniprocessorScheduleWithJitter Platform Priority
- ScheduleConstruction.
-
- (* In this section, we implement a jitter-aware priority-based uniprocessor scheduler *)
- Section Implementation.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Let arr_seq be any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Also, assume that a JLDP policy is given. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, we show how to recursively construct the schedule. *)
- Section ScheduleConstruction.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job.
- Variable t: time.
-
- (* For simplicity, let's use some local names. *)
- Let is_pending := pending job_arrival job_cost job_jitter sched_prefix.
-
- (* Consider the list of pending jobs with actual arrivals up to t. *)
- Definition pending_jobs :=
- [seq j <- actual_arrivals_up_to job_arrival job_jitter arr_seq t | is_pending j t].
-
- (* To make the scheduling decision, we just pick one of the highest-priority jobs
- that are pending (if it exists). *)
- Definition highest_priority_job :=
- seq_min (higher_eq_priority t) pending_jobs.
-
- End ScheduleConstruction.
-
- (* Starting from the empty schedule, the final schedule is obtained by iteratively
- picking the highest-priority job. *)
- Let empty_schedule : schedule Job := fun t => None.
- Definition scheduler :=
- build_schedule_from_prefixes highest_priority_job empty_schedule.
-
- (* Then, by showing that the construction function depends only on the prefix, ... *)
- Lemma scheduler_depends_only_on_prefix:
- forall sched1 sched2 t,
- (forall t0, t0 < t -> sched1 t0 = sched2 t0) ->
- highest_priority_job sched1 t = highest_priority_job sched2 t.
- Proof.
- intros sched1 sched2 t ALL.
- rewrite /highest_priority_job.
- suff SAME: pending_jobs sched1 t = pending_jobs sched2 t by rewrite SAME.
- apply eq_in_filter.
- intros j IN; rewrite mem_filter in IN.
- move: IN => /andP [ARR IN].
- rewrite ltnS /= in ARR.
- rewrite /pending /jitter_has_passed ARR 2!andTb; f_equal.
- rewrite /completed_by; f_equal.
- apply eq_big_nat; move => i /= LTi.
- by rewrite /service_at /scheduled_at ALL.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary scheduler_uses_construction_function:
- forall t, scheduler t = highest_priority_job scheduler t.
- Proof.
- by ins; apply prefix_dependent_schedule_construction,
- scheduler_depends_only_on_prefix.
- Qed.
-
- End Implementation.
-
- (* In this section, we prove the properties of the scheduler that are used
- as hypotheses in the analyses. *)
- Section Proofs.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Assume any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_no_duplicate_arrivals: arrival_sequence_is_a_set arr_seq.
-
- (* Consider any JLDP policy that is reflexive, transitive and total. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_is_reflexive: JLDP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: JLDP_is_total arr_seq higher_eq_priority.
-
- (* Let sched denote our concrete scheduler implementation. *)
- Let sched := scheduler job_arrival job_cost job_jitter arr_seq higher_eq_priority.
-
- (* To conclude, we prove the important properties of the scheduler implementation. *)
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma scheduler_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
- Proof.
- move => j t /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function // /highest_priority_job in SCHED.
- apply seq_min_in_seq in SCHED.
- rewrite mem_filter in SCHED.
- move: SCHED => /andP [_ ARR].
- rewrite /actual_arrivals_up_to in ARR.
- by apply in_actual_arrivals_between_implies_arrived in ARR.
- Qed.
-
- (* Next, we show that jobs do not execute before they arrive...*)
- Theorem scheduler_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Proof.
- move => j t /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function // /highest_priority_job in SCHED.
- apply seq_min_in_seq in SCHED.
- rewrite mem_filter in SCHED.
- by move: SCHED => /andP [/andP [ARR _] _].
- Qed.
-
- (* ... nor after completion. *)
- Theorem scheduler_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- Proof.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite /sched scheduler_uses_construction_function /highest_priority_job.
- apply/eqP; intro HP.
- apply seq_min_in_seq in HP.
- by rewrite mem_filter /pending /completed_by -EQ leqnn andbF /= in HP.
- Qed.
-
- (* In addition, the scheduler is work conserving... *)
- Theorem scheduler_work_conserving:
- work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Proof.
- intros j t IN BACK.
- move: BACK => /andP [/andP [ARR NOTCOMP] NOTSCHED].
- rewrite /scheduled_at /sched scheduler_uses_construction_function /= in NOTSCHED.
- rewrite /scheduled_at /sched scheduler_uses_construction_function /=.
- case HP: (highest_priority_job _ _ _ _ _ ) => [j_hp|]; first by exists j_hp.
- set hp := highest_priority_job _ _ _ _ _ _ _ in NOTSCHED HP.
- suff BUG: hp != None by rewrite HP in BUG.
- apply seq_min_exists with (x := j).
- rewrite mem_filter /pending ARR NOTCOMP /=.
- by eapply arrived_between_implies_in_actual_arrivals, ARR.
- Qed.
-
- (* ... and respects the JLDP policy. *)
- Theorem scheduler_respects_policy :
- respects_JLDP_policy job_arrival job_cost job_jitter arr_seq sched higher_eq_priority.
- Proof.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL.
- move => j1 j2 t ARR1 BACK /eqP SCHED.
- move: BACK => /andP [/andP [ARR NOTCOMP] NOTSCHED].
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in NOTSCHED.
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in SCHED.
- rewrite /highest_priority_job in SCHED NOTSCHED.
- set jobs := pending_jobs _ _ _ _ _ _ in SCHED NOTSCHED.
- have IN: j1 \in jobs.
- {
- rewrite mem_filter /pending ARR NOTCOMP /=.
- by eapply arrived_between_implies_in_actual_arrivals, ARR.
- }
- apply seq_min_computes_min with (y := j1) in SCHED; try (by done).
- intros x y; rewrite /jobs mem_filter [y \in _]mem_filter.
- move => /andP [_ INx] /andP [_ INy].
- rewrite /actual_arrivals_up_to in INx INy.
- by apply TOTAL; eapply in_actual_arrivals_between_implies_arrived; eauto 2.
- Qed.
-
- End Proofs.
-
-End ConcreteScheduler.
\ No newline at end of file
diff --git a/classic/implementation/uni/jitter/task.v b/classic/implementation/uni/jitter/task.v
deleted file mode 100644
index ee1e96a4f2dd7027e058281c155c1ebe80d95f21..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/jitter/task.v
+++ /dev/null
@@ -1,70 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteTask.
-
- Import SporadicTaskset.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_task :=
- {
- task_id: nat; (* for uniqueness *)
- task_cost: nat;
- task_period: nat;
- task_deadline: nat;
- task_jitter: nat
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete tasks. *)
- Definition task_eqdef (t1 t2: concrete_task) :=
- (task_id t1 == task_id t2) &&
- (task_cost t1 == task_cost t2) &&
- (task_period t1 == task_period t2) &&
- (task_deadline t1 == task_deadline t2) &&
- (task_jitter t1 == task_jitter t2).
-
- (* Next, we prove that task_eqdef is indeed an equality, ... *)
- Lemma eqn_task : Equality.axiom task_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (task_eqdef x y) eqn:EQ.
- {
- apply ReflectT.
- unfold task_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP COST] /eqP PERIOD] /eqP DL] /eqP JIT].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold task_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [/orP [EQ | /eqP DL] | /eqP JIT]; last by apply JIT; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP DL]; last by apply DL; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP PERIOD]; last by apply PERIOD; inversion BUG.
- by apply ID; inversion BUG.
- by apply DL; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_task_eqMixin := EqMixin eqn_task.
- Canonical concrete_task_eqType := Eval hnf in EqType concrete_task concrete_task_eqMixin.
-
- End Defs.
-
- Section ConcreteTaskset.
-
- Definition concrete_taskset :=
- taskset_of concrete_task_eqType.
-
- End ConcreteTaskset.
-
-End ConcreteTask.
\ No newline at end of file
diff --git a/classic/implementation/uni/susp/dynamic/arrival_sequence.v b/classic/implementation/uni/susp/dynamic/arrival_sequence.v
deleted file mode 100644
index 9ab2569a9c67cf36c907ac2a4a52427ab2d03c38..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/susp/dynamic/arrival_sequence.v
+++ /dev/null
@@ -1,111 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.task_arrival prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.implementation.uni.susp.dynamic.task
- prosa.classic.implementation.uni.susp.dynamic.job.
-From mathcomp Require Import ssreflect ssrbool ssrfun ssrnat eqtype seq div.
-
-Module ConcreteArrivalSequence.
-
- Import Job ArrivalSequence ConcreteTask ConcreteJob SporadicTaskset TaskArrival.
-
- Section PeriodicArrivals.
-
- Variable ts: concrete_taskset.
-
- (* At any time arr_time, we release Some job of tsk if t is a multiple of the period,
- otherwise we release None. *)
- Definition add_job (arr_time: time) (tsk: concrete_task) :=
- if task_period tsk %| arr_time then
- Some (Build_concrete_job (arr_time %/ task_period tsk) arr_time
- (task_cost tsk) (task_deadline tsk) tsk)
- else
- None.
-
- (* The arrival sequence at any time t is simply the partial map of add_job. *)
- Definition periodic_arrival_sequence (t: time) := pmap (add_job t) ts.
-
- End PeriodicArrivals.
-
- Section Proofs.
-
- (* Let ts be any concrete task set with valid parameters. *)
- Variable ts: concrete_taskset.
- Hypothesis H_valid_task_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
-
- (* Regarding the periodic arrival sequence built from ts, we prove that...*)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* ... arrival times are consistent, ... *)
- Theorem periodic_arrivals_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
- Proof.
- move => j t ARRj.
- rewrite /arrives_at mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ... every job comes from the task set, ... *)
- Theorem periodic_arrivals_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
- Proof.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj.
- move: ARRj => /mapP ARRj; destruct ARRj as [tsk IN SOME].
- by unfold add_job in *; desf.
- Qed.
-
- (* ..., jobs have valid parameters, ... *)
- Theorem periodic_arrivals_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
- Proof.
- rename H_valid_task_parameters into PARAMS.
- unfold valid_sporadic_taskset, is_valid_sporadic_task in *.
- move => j [t ARRj].
- rewrite mem_pmap in ARRj; move: ARRj => /mapP [tsk IN SOME].
- unfold add_job in SOME; desf.
- specialize (PARAMS tsk IN); des.
- unfold valid_sporadic_job, valid_realtime_job, job_cost_positive.
- by repeat split; try (by done); apply leqnn.
- Qed.
-
- (* ... job arrivals satisfy the sporadic task model, ... *)
- Theorem periodic_arrivals_are_sporadic:
- sporadic_task_model task_period job_arrival job_task arr_seq.
- Proof.
- move => j j' /eqP DIFF [arr ARR] [arr' ARR'] SAMEtsk LE.
- rewrite eqE /= /job_eqdef negb_and /= SAMEtsk eq_refl orbF in DIFF.
- rewrite 2!mem_pmap in ARR ARR'.
- move: ARR ARR' => /mapP [tsk_j INj SOMEj] /mapP [tsk_j' INj' SOMEj'].
- unfold add_job in SOMEj, SOMEj'; desf; simpl in *;
- move: Heq0 Heq => /dvdnP [k DIV] /dvdnP [k' DIV'].
- {
- rewrite DIV DIV' -mulSnr.
- rewrite leq_eqVlt in LE; move: LE => /orP [/eqP EQ | LESS].
- {
- exfalso; move: DIFF => /negP DIFF; apply DIFF.
- by subst; rewrite EQ !eq_refl.
- }
- subst; rewrite leq_mul2r; apply/orP; right.
- by rewrite ltn_mul2r in LESS; move: LESS => /andP [_ LT].
- }
- Qed.
-
- (* ... and the arrival sequence has no duplicate jobs. *)
- Theorem periodic_arrivals_is_a_set:
- arrival_sequence_is_a_set arr_seq.
- Proof.
- intros t.
- unfold arr_seq, periodic_arrival_sequence.
- apply (pmap_uniq) with (g := job_task); last by destruct ts.
- by unfold add_job, ocancel; intro tsk; desf.
- Qed.
-
- End Proofs.
-
-End ConcreteArrivalSequence.
\ No newline at end of file
diff --git a/classic/implementation/uni/susp/dynamic/job.v b/classic/implementation/uni/susp/dynamic/job.v
deleted file mode 100644
index 35643cc89d63f6b2c64b83ae352a0a6c6a097848..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/susp/dynamic/job.v
+++ /dev/null
@@ -1,66 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.implementation.uni.susp.dynamic.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteJob.
-
- Import ConcreteTask.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_job :=
- {
- job_id: nat;
- job_arrival: nat;
- job_cost: nat;
- job_deadline: nat;
- job_task: concrete_task_eqType
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete jobs. *)
- Definition job_eqdef (j1 j2: concrete_job) :=
- (job_id j1 == job_id j2) &&
- (job_arrival j1 == job_arrival j2) &&
- (job_cost j1 == job_cost j2) &&
- (job_deadline j1 == job_deadline j2) &&
- (job_task j1 == job_task j2).
-
- (* Next, we prove that job_eqdef is indeed an equality, ... *)
- Lemma eqn_job : Equality.axiom job_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (job_eqdef x y) eqn:EQ.
- {
- apply ReflectT; unfold job_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP ARR] /eqP COST] /eqP DL] /eqP TASK].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold job_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP TASK].
- move: EQ => /orP [EQ | /eqP DL].
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP COST].
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP ARR].
- by apply ID; inversion BUG.
- by apply ARR; inversion BUG.
- by apply COST; inversion BUG.
- by apply DL; inversion BUG.
- by apply TASK; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_job_eqMixin := EqMixin eqn_job.
- Canonical concrete_job_eqType := Eval hnf in EqType concrete_job concrete_job_eqMixin.
-
- End Defs.
-
-End ConcreteJob.
\ No newline at end of file
diff --git a/classic/implementation/uni/susp/dynamic/oblivious/fp_rta_example.v b/classic/implementation/uni/susp/dynamic/oblivious/fp_rta_example.v
deleted file mode 100644
index fb35791f9b07cef859c181786ac2b6bbf08a1152..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/susp/dynamic/oblivious/fp_rta_example.v
+++ /dev/null
@@ -1,188 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals.
-Require Import prosa.classic.analysis.uni.basic.workload_bound_fp.
-Require Import prosa.classic.analysis.uni.susp.dynamic.oblivious.fp_rta.
-Require Import prosa.classic.implementation.uni.susp.dynamic.job
- prosa.classic.implementation.uni.susp.dynamic.task
- prosa.classic.implementation.uni.susp.dynamic.arrival_sequence.
-Require Import prosa.classic.implementation.uni.susp.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-
-Module ResponseTimeAnalysisFP.
-
- Import Job UniprocessorSchedule SporadicTaskset Priority Schedulability
- SuspensionIntervals SuspensionObliviousFP WorkloadBoundFP.
- Import ConcreteJob ConcreteTask ConcreteArrivalSequence ConcreteScheduler.
-
- (* In this section, we run the suspension-oblivious FP RTA on a simple task set
- to show that the theorems contain no contradictory assumptions. *)
- Section ExampleRTA.
-
- Let tsk1 := {| task_id := 1; task_cost := 1; task_period := 5;
- task_deadline := 5; task_suspension_bound := 1 |}.
- Let tsk2 := {| task_id := 2; task_cost := 1; task_period := 5;
- task_deadline := 5; task_suspension_bound := 0|}.
- Let tsk3 := {| task_id := 3; task_cost := 1; task_period := 6;
- task_deadline := 6; task_suspension_bound := 1|}.
-
- (* Let ts be a task set containing these three tasks, ... *)
- Program Let ts := Build_set [:: tsk1; tsk2; tsk3] _.
-
- (* ...which can be shown to have valid parameters. *)
- Fact ts_has_valid_parameters:
- valid_sporadic_taskset task_cost task_period task_deadline ts.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- (* Now let's inflate the task costs with the suspension-bounds. *)
- Let inflated_cost := inflated_task_cost task_cost task_suspension_bound.
-
- (* After the inflation, note that the task costs are no larger than deadlines and periods. *)
- Fact inflated_cost_le_deadline_and_period:
- forall tsk,
- tsk \in ts ->
- inflated_cost tsk <= task_deadline tsk /\
- inflated_cost tsk <= task_period tsk.
- Proof.
- intros tsk IN.
- repeat (move: IN => /orP [/eqP EQ | IN]; subst; compute); by done.
- Qed.
-
- (* Next, recall the FP RTA schedulability test using RM as the FP policy
- and the inflated task costs. *)
- Let RTA_claimed_bounds :=
- fp_claimed_bounds inflated_cost task_period task_deadline (RM task_period).
- Let schedulability_test :=
- fp_schedulable inflated_cost task_period task_deadline (RM task_period).
-
- (* First, we show that the schedulability test returns the following bounds, ... *)
- Fact RTA_yields_these_bounds :
- RTA_claimed_bounds ts = Some [:: (tsk1, 3); (tsk2, 3); (tsk3, 5)].
- Proof.
- rewrite /RTA_claimed_bounds /fp_claimed_bounds /inflated_cost /inflated_task_cost.
- set RESP := [seq _ | tsk <- ts].
- suff EQ: RESP = [:: (tsk1, Some 3); (tsk2, Some 3); (tsk3, Some 5)] by rewrite EQ; compute.
- rewrite /RESP /ts /=; do 2 f_equal.
- {
- rewrite /per_task_rta /= addn1.
- have WORK: total_workload_bound_fp inflated_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk1 2 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp inflated_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk1 3 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=.
- }
- f_equal.
- {
- rewrite /per_task_rta /= addn0.
- have WORK: total_workload_bound_fp inflated_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk2 1 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp inflated_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk2 3 = 3.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=.
- }
- do 2 f_equal.
- {
- rewrite /per_task_rta /= addn1.
- have WORK: total_workload_bound_fp inflated_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk3 2 = 5.
- {
- by compute; rewrite unlock; compute.
- }
- rewrite !WORK /=; clear WORK.
- have WORK: total_workload_bound_fp inflated_cost task_period (RM task_period)
- [:: tsk1; tsk2; tsk3] tsk3 5 = 5.
- {
- by compute; rewrite unlock; compute.
- }
- by rewrite !WORK /=; clear WORK.
- }
- Qed.
-
- (* ...so the schedulability test indeed returns true. *)
- Fact schedulability_test_succeeds :
- schedulability_test ts = true.
- Proof.
- rewrite /schedulability_test /fp_schedulable -/RTA_claimed_bounds.
- by rewrite RTA_yields_these_bounds.
- Qed.
-
- (* Now, let's show that the task set is schedulable. *)
-
- (* Let arr_seq be the periodic arrival sequence from ts... *)
- Let arr_seq := periodic_arrival_sequence ts.
-
- (* ...where jobs have total suspension times that are no larger than
- the suspension bound of their tasks. *)
- Variable next_suspension: job_suspension concrete_job_eqType.
- Hypothesis H_dynamic_suspensions:
- dynamic_suspension_model job_cost job_task next_suspension task_suspension_bound.
-
- (* Also assume rate-monotonic priorities. *)
- Let higher_eq_priority := FP_to_JLDP job_task (RM task_period).
-
- (* Next, let sched be the suspension-aware RM schedule with those job suspension times. *)
- Let sched := scheduler job_arrival job_cost arr_seq next_suspension higher_eq_priority.
-
- (* To conclude, based on the definition of deadline miss,... *)
- Let no_deadline_missed_by :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
- (* ...we use the result of the suspension-oblivious FP RTA to conclude that
- no task misses its deadline. *)
- Corollary ts_is_schedulable:
- forall tsk,
- tsk \in ts ->
- no_deadline_missed_by tsk.
- Proof.
- intros tsk IN.
- have VALID := periodic_arrivals_valid_job_parameters ts ts_has_valid_parameters.
- have TSVALID := ts_has_valid_parameters.
- unfold valid_sporadic_job, valid_realtime_job in *; des.
- try ( apply suspension_oblivious_fp_rta_implies_schedulability with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (ts0 := ts)
- (higher_eq_priority0 := RM task_period) (next_suspension0 := next_suspension)
- (task_suspension_bound := task_suspension_bound); try (by done) ) ||
- apply suspension_oblivious_fp_rta_implies_schedulability with (task_cost := task_cost)
- (task_period := task_period) (task_deadline := task_deadline) (ts := ts)
- (higher_eq_priority := RM task_period) (next_suspension := next_suspension)
- (task_suspension_bound := task_suspension_bound); try (by done).
- - by apply periodic_arrivals_are_consistent.
- - by apply periodic_arrivals_is_a_set.
- - by apply periodic_arrivals_all_jobs_from_taskset.
- - by apply periodic_arrivals_are_sporadic.
- - by apply RM_is_reflexive.
- - by apply RM_is_transitive.
- - by intros tsk_a tsk_b INa INb; apply/orP; apply leq_total.
- - by apply inflated_cost_le_deadline_and_period.
- - by apply scheduler_jobs_come_from_arrival_sequence, periodic_arrivals_are_consistent.
- - by apply scheduler_jobs_must_arrive_to_execute, periodic_arrivals_are_consistent.
- - by apply scheduler_completed_jobs_dont_execute, periodic_arrivals_are_consistent.
- - by apply scheduler_work_conserving, periodic_arrivals_are_consistent.
- - apply scheduler_respects_policy; first by apply periodic_arrivals_are_consistent.
- -- by intros t; apply RM_is_transitive.
- -- by intros j1 j2 _ _ _; apply leq_total.
- - by apply scheduler_respects_self_suspensions, periodic_arrivals_are_consistent.
- - by apply schedulability_test_succeeds.
- Qed.
-
- End ExampleRTA.
-
-End ResponseTimeAnalysisFP.
diff --git a/classic/implementation/uni/susp/dynamic/task.v b/classic/implementation/uni/susp/dynamic/task.v
deleted file mode 100644
index 8e5ba7ca7b9c3f64d5f9ecc32711ec15f1afe8d1..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/susp/dynamic/task.v
+++ /dev/null
@@ -1,70 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task.
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq.
-
-Module ConcreteTask.
-
- Import SporadicTaskset.
-
- Section Defs.
-
- (* Definition of a concrete task. *)
- Record concrete_task :=
- {
- task_id: nat; (* for uniqueness *)
- task_cost: nat;
- task_period: nat;
- task_deadline: nat;
- task_suspension_bound: nat
- }.
-
- (* To make it compatible with ssreflect, we define a decidable
- equality for concrete tasks. *)
- Definition task_eqdef (t1 t2: concrete_task) :=
- (task_id t1 == task_id t2) &&
- (task_cost t1 == task_cost t2) &&
- (task_period t1 == task_period t2) &&
- (task_deadline t1 == task_deadline t2) &&
- (task_suspension_bound t1 == task_suspension_bound t2).
-
- (* Next, we prove that task_eqdef is indeed an equality, ... *)
- Lemma eqn_task : Equality.axiom task_eqdef.
- Proof.
- unfold Equality.axiom; intros x y.
- destruct (task_eqdef x y) eqn:EQ.
- {
- apply ReflectT.
- unfold task_eqdef in *.
- move: EQ => /andP [/andP [/andP [/andP [/eqP ID /eqP COST] /eqP PERIOD] /eqP DL] /eqP SUSP].
- by destruct x, y; simpl in *; subst.
- }
- {
- apply ReflectF.
- unfold task_eqdef, not in *; intro BUG.
- apply negbT in EQ; rewrite negb_and in EQ.
- destruct x, y.
- rewrite negb_and in EQ.
- move: EQ => /orP [/orP [EQ | /eqP DL] | /eqP SUSP]; last by apply SUSP; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [EQ | /eqP DL]; last by apply DL; inversion BUG.
- rewrite negb_and in EQ.
- move: EQ => /orP [/eqP ID | /eqP PERIOD]; last by apply PERIOD; inversion BUG.
- by apply ID; inversion BUG.
- by apply DL; inversion BUG.
- }
- Qed.
-
- (* ..., which allows instantiating the canonical structure. *)
- Canonical concrete_task_eqMixin := EqMixin eqn_task.
- Canonical concrete_task_eqType := Eval hnf in EqType concrete_task concrete_task_eqMixin.
-
- End Defs.
-
- Section ConcreteTaskset.
-
- Definition concrete_taskset :=
- taskset_of concrete_task_eqType.
-
- End ConcreteTaskset.
-
-End ConcreteTask.
\ No newline at end of file
diff --git a/classic/implementation/uni/susp/schedule.v b/classic/implementation/uni/susp/schedule.v
deleted file mode 100644
index 4d191d8087341b55214a9e59bcff1d7db3be4d01..0000000000000000000000000000000000000000
--- a/classic/implementation/uni/susp/schedule.v
+++ /dev/null
@@ -1,252 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.schedule.uni.susp.platform.
-Require Import prosa.classic.model.schedule.uni.transformation.construction.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path.
-
-Module ConcreteScheduler.
-
- Import Job ArrivalSequence UniprocessorSchedule PlatformWithSuspensions Priority
- ScheduleConstruction.
-
- (* In this section, we implement a priority-based uniprocessor scheduler *)
- Section Implementation.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Let arr_seq be any consistent job arrival sequence...*)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
-
- (* ...that is subject to job suspensions. *)
- Variable next_suspension: job_suspension Job.
-
- (* Also, assume that a JLDP policy is given. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* Next, we show how to recursively construct the schedule. *)
- Section ScheduleConstruction.
-
- (* For any time t, suppose that we have generated the schedule prefix in the
- interval [0, t). Then, we must define what should be scheduled at time t. *)
- Variable sched_prefix: schedule Job.
- Variable t: time.
-
- (* For simplicity, let's use some local names. *)
- Let is_pending := pending job_arrival job_cost sched_prefix.
- Let is_suspended :=
- suspended_at job_arrival job_cost next_suspension sched_prefix.
-
- (* Consider the list of pending, non-suspended jobs at time t. *)
- Definition pending_jobs :=
- [seq j <- jobs_arrived_up_to arr_seq t | is_pending j t && ~~ is_suspended j t].
-
- (* To make the scheduling decision, we just pick one of the highest-priority jobs
- that are pending (if it exists). *)
- Definition highest_priority_job :=
- seq_min (higher_eq_priority t) pending_jobs.
-
- End ScheduleConstruction.
-
- (* Starting from the empty schedule, the final schedule is obtained by iteratively
- picking the highest-priority job. *)
- Let empty_schedule : schedule Job := fun t => None.
- Definition scheduler :=
- build_schedule_from_prefixes highest_priority_job empty_schedule.
-
- (* Then, by showing that the construction function depends only on the prefix, ... *)
- Lemma scheduler_depends_only_on_prefix:
- forall sched1 sched2 t,
- (forall t0, t0 < t -> sched1 t0 = sched2 t0) ->
- highest_priority_job sched1 t = highest_priority_job sched2 t.
- Proof.
- intros sched1 sched2 t ALL.
- rewrite /highest_priority_job.
- suff SAME: pending_jobs sched1 t = pending_jobs sched2 t by rewrite SAME.
- apply eq_in_filter.
- rewrite /jobs_arrived_up_to; intros j IN.
- ( try ( apply in_arrivals_implies_arrived_before with (job_arrival0 := job_arrival) in IN ) ||
- apply in_arrivals_implies_arrived_before with (job_arrival := job_arrival) in IN);
- last by done.
- rewrite /arrived_before ltnS in IN.
- rewrite /pending /has_arrived IN 2!andTb.
- have COMP: completed_by job_cost sched1 j t =
- completed_by job_cost sched2 j t.
- {
- rewrite /completed_by.
- rewrite /completed_by; f_equal.
- apply eq_big_nat; move => i /= LTi.
- by rewrite /service_at /scheduled_at ALL.
- }
- rewrite COMP; do 2 f_equal.
- rewrite /suspended_at; f_equal; first by rewrite COMP.
- have EX: [exists t0: 'I_t, scheduled_at sched1 j t0] =
- [exists t0: 'I_t, scheduled_at sched2 j t0].
- {
- apply/idP/idP.
- {
- move => /existsP [t0 SCHED].
- by apply/existsP; exists t0; rewrite /scheduled_at -ALL.
- }
- {
- move => /existsP [t0 SCHED].
- by apply/existsP; exists t0; rewrite /scheduled_at ALL.
- }
- }
- have BEG: time_after_last_execution job_arrival sched1 j t =
- time_after_last_execution job_arrival sched2 j t.
- {
- rewrite /time_after_last_execution EX.
- case: ifP => _; last by done.
- f_equal; apply eq_bigl.
- by intros t0; rewrite /scheduled_at ALL.
- }
- have SUSP: suspension_duration job_arrival next_suspension sched1 j t =
- suspension_duration job_arrival next_suspension sched2 j t.
- {
- rewrite /suspension_duration BEG; f_equal.
- rewrite /service /service_during big_nat_cond [in RHS]big_nat_cond.
- apply congr_big; try (by done).
- move => i /= /andP [LTi _].
- rewrite /service_at /scheduled_at ALL //.
- apply: (leq_trans LTi).
- by apply last_execution_bounded_by_identity.
- }
- by rewrite BEG SUSP.
- Qed.
-
- (* ...we infer that the generated schedule is indeed based on the construction function. *)
- Corollary scheduler_uses_construction_function:
- forall t, scheduler t = highest_priority_job scheduler t.
- Proof.
- by ins; apply prefix_dependent_schedule_construction,
- scheduler_depends_only_on_prefix.
- Qed.
-
- End Implementation.
-
- (* In this section, we prove the properties of the scheduler that are used
- as hypotheses in the analyses. *)
- Section Proofs.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Assume any job arrival sequence with consistent, duplicate-free arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_no_duplicate_arrivals: arrival_sequence_is_a_set arr_seq.
-
- (* ...that is subject to suspension times. *)
- Variable next_suspension: job_suspension Job.
-
- (* Consider any JLDP policy that is reflexive, transitive and total. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_priority_is_transitive: JLDP_is_transitive higher_eq_priority.
- Hypothesis H_priority_is_total: JLDP_is_total arr_seq higher_eq_priority.
-
- (* Let sched denote our concrete scheduler implementation. *)
- Let sched := scheduler job_arrival job_cost arr_seq next_suspension higher_eq_priority.
-
- (* To conclude, we prove the important properties of the scheduler implementation. *)
-
- (* First, we show that scheduled jobs come from the arrival sequence. *)
- Lemma scheduler_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
- Proof.
- move => j t /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function // /highest_priority_job in SCHED.
- apply seq_min_in_seq in SCHED.
- rewrite mem_filter in SCHED.
- move: SCHED => /andP [_ ARR].
- by eapply in_arrivals_implies_arrived, ARR.
- Qed.
-
- (* Next, we show that jobs do not execute before they arrive...*)
- Theorem scheduler_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Proof.
- move => j t /eqP SCHED.
- rewrite /sched scheduler_uses_construction_function // /highest_priority_job in SCHED.
- apply seq_min_in_seq in SCHED.
- rewrite mem_filter in SCHED.
- by move: SCHED => /andP [/andP [/andP [ARR _] _] _].
- Qed.
-
- (* ... nor after completion. *)
- Theorem scheduler_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- Proof.
- intros j t.
- induction t;
- first by rewrite /service /service_during big_geq //.
- rewrite /service /service_during big_nat_recr //=.
- rewrite leq_eqVlt in IHt; move: IHt => /orP [/eqP EQ | LT]; last first.
- {
- apply: leq_trans LT; rewrite -addn1.
- by apply leq_add; last by apply leq_b1.
- }
- rewrite -[job_cost _]addn0; apply leq_add; first by rewrite -EQ.
- rewrite leqn0 eqb0 /scheduled_at.
- rewrite /sched scheduler_uses_construction_function //.
- rewrite /highest_priority_job.
- apply/eqP; intro HP.
- apply seq_min_in_seq in HP.
- by rewrite mem_filter /pending /completed_by -EQ leqnn andbF 2!andFb in HP.
- Qed.
-
- (* In addition, the scheduler is work conserving, ... *)
- Theorem scheduler_work_conserving:
- work_conserving job_arrival job_cost next_suspension arr_seq sched.
- Proof.
- intros j t IN BACK.
- move: BACK => /andP [/andP [/andP [ARR NOTCOMP] NOTSCHED] NOTSUSP].
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in NOTSCHED.
- rewrite /scheduled_at /sched scheduler_uses_construction_function //.
- case HP: (highest_priority_job _ _ _ _ _ ) => [j_hp|]; first by exists j_hp.
- set hp := highest_priority_job _ _ _ _ _ _ _ in NOTSCHED HP.
- suff BUG: hp != None by rewrite HP in BUG.
- apply seq_min_exists with (x := j).
- rewrite mem_filter /pending NOTSUSP ARR NOTCOMP /=.
- by eapply arrived_between_implies_in_arrivals, ARR.
- Qed.
-
- (* ... respects the JLDP policy..., *)
- Theorem scheduler_respects_policy :
- respects_JLDP_policy job_arrival job_cost next_suspension arr_seq sched higher_eq_priority.
- Proof.
- rename H_priority_is_transitive into TRANS, H_priority_is_total into TOTAL.
- move => j1 j2 t ARR1 BACK /eqP SCHED.
- move: BACK => /andP [/andP [/andP [ARR NOTCOMP] NOTSCHED] NOTSUSP].
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in NOTSCHED.
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in SCHED.
- rewrite /highest_priority_job in SCHED NOTSCHED.
- set jobs := pending_jobs _ _ _ _ _ _ in SCHED NOTSCHED.
- have IN: j1 \in jobs.
- {
- rewrite mem_filter /pending ARR NOTCOMP NOTSUSP /=.
- by eapply arrived_between_implies_in_arrivals, ARR.
- }
- apply seq_min_computes_min with (y := j1) in SCHED; try (by done).
- by intros x y; rewrite 2!mem_filter; move => /andP [_ INx] /andP [_ INy];
- apply TOTAL; eapply in_arrivals_implies_arrived; eauto 2.
- Qed.
-
- (* ... and respects self-suspensions. *)
- Theorem scheduler_respects_self_suspensions:
- respects_self_suspensions job_arrival job_cost next_suspension sched.
- Proof.
- move => j t /eqP SCHED.
- rewrite /scheduled_at /sched scheduler_uses_construction_function // in SCHED.
- rewrite /highest_priority_job in SCHED; apply seq_min_in_seq in SCHED.
- rewrite mem_filter in SCHED.
- by move: SCHED => /andP [/andP [_ NOTSUSP] _]; apply/negP.
- Qed.
-
- End Proofs.
-
-End ConcreteScheduler.
diff --git a/classic/model/arrival/basic/arrival_bounds.v b/classic/model/arrival/basic/arrival_bounds.v
deleted file mode 100644
index 33e8e7da83f026bcd4bb56f72b4266c4b0b3abf4..0000000000000000000000000000000000000000
--- a/classic/model/arrival/basic/arrival_bounds.v
+++ /dev/null
@@ -1,227 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path div.
-
-(* Properties of job arrival. *)
-Module ArrivalBounds.
-
- Import ArrivalSequence SporadicTaskset TaskArrival Priority.
-
- Section Lemmas.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence with consistent, duplicate-free arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* In this section, we upper bound the number of jobs that can arrive in any interval. *)
- Section BoundOnSporadicArrivals.
-
- (* Assume that jobs are sporadic. *)
- Hypothesis H_sporadic_tasks: sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider any time interval [t1, t2)... *)
- Variable t1 t2: time.
-
- (* ...and let tsk be any task with period > 0. *)
- Variable tsk: Task.
- Hypothesis H_period_gt_zero: task_period tsk > 0.
-
- (* Recall the jobs of tsk during [t1, t2), along with the number of arrivals. *)
- Let arriving_jobs := arrivals_of_task_between job_task arr_seq tsk t1 t2.
- Let num_arrivals := num_arrivals_of_task job_task arr_seq tsk t1 t2.
-
- (* We will establish an upper bound on the number of arriving jobs of tsk.
- The proof follows by case analysis. *)
-
-
- (* Case 1: Assume that no jobs of tsk arrive in the interval. *)
- Section NoJobs.
-
- (* If there are no arriving jobs in [t1, t2), ...*)
- Hypothesis H_no_jobs: num_arrivals = 0.
-
- (* ...then the arrival bound trivially holds. *)
- Lemma sporadic_arrival_bound_no_jobs:
- num_arrivals <= div_ceil (t2 - t1) (task_period tsk).
- Proof.
- by rewrite H_no_jobs.
- Qed.
-
- End NoJobs.
-
- (* Case 2: Assume that a single job of tsk arrives in the interval. *)
- Section OneJob.
-
- (* First, note that since the interval is open at time t2,
- t2 must be larger than t1. *)
- Lemma sporadic_arrival_bound_more_than_one_point:
- num_arrivals > 0 ->
- t1 < t2.
- Proof.
- unfold num_arrivals, num_arrivals_of_task in *; intros ONE.
- rewrite -/arriving_jobs in ONE *.
- destruct arriving_jobs as [| j l] eqn:EQ; first by done.
- have IN: j \in arriving_jobs by rewrite EQ in_cons eq_refl orTb.
- rewrite mem_filter in IN; move: IN => /andP [_ ARR].
- ( try ( apply in_arrivals_implies_arrived_between with (job_arrival0 := job_arrival) in ARR ) ||
- apply in_arrivals_implies_arrived_between with (job_arrival := job_arrival) in ARR);
- last by done.
- move: ARR => /andP [GE LT].
- by apply: (leq_ltn_trans GE).
- Qed.
-
- (* Therefore, if there is one job of tsk arriving during [t1, t2), ... *)
- Hypothesis H_no_jobs: num_arrivals = 1.
-
- (* ...then (t2 - t1) > 0 and the arrival bound also holds. *)
- Lemma sporadic_arrival_bound_one_job:
- num_arrivals <= div_ceil (t2 - t1) (task_period tsk).
- Proof.
- rewrite H_no_jobs.
- rewrite ceil_neq0 // ltn_subRL addn0.
- apply sporadic_arrival_bound_more_than_one_point.
- by rewrite H_no_jobs.
- Qed.
-
- End OneJob.
-
- (* Case 3: There are at least two arriving jobs. *)
- Section AtLeastTwoJobs.
-
- (* Assume that there are at least two jobs of tsk arriving in [t1,t2). *)
- Hypothesis H_at_least_two_jobs: num_arrivals >= 2.
-
- (* We prove the arrival bound by contradiction. *)
- Section DerivingContradiction.
-
- (* Suppose that the number of arrivals is larger than the bound. *)
- Hypothesis H_many_arrivals: div_ceil (t2 - t1) (task_period tsk) < num_arrivals.
-
- (* Consider the list of jobs ordered by arrival times. *)
- Let by_arrival_time j j' := job_arrival j <= job_arrival j'.
- Let sorted_jobs := sort by_arrival_time arriving_jobs.
-
- (* Based on the notation for the n-th job in the sorted list of arrivals, ... *)
- Variable elem: Job.
- Let nth_job := nth elem sorted_jobs.
-
- (* ...we identify the first and last jobs and their respective arrival times. *)
- Let j_first := nth_job 0.
- Let j_last := nth_job (num_arrivals.-1).
- Let a_first := job_arrival j_first.
- Let a_last := job_arrival j_last.
-
- (* Recall from task_arrival.v the properties of the n-th job ...*)
- Corollary sporadic_arrival_bound_properties_of_nth:
- forall idx,
- idx < num_arrivals ->
- t1 <= job_arrival (nth_job idx) < t2 /\
- job_task (nth_job idx) = tsk /\
- arrives_in arr_seq (nth_job idx).
- Proof.
- intros idx LTidx.
- by apply sorted_arrivals_properties_of_nth.
- Qed.
-
- (* ...and the distance between the first and last jobs. *)
- Corollary sporadic_arrival_bound_distance_between_first_and_last:
- a_last >= a_first + (num_arrivals-1) * task_period tsk.
- Proof.
- apply sorted_arrivals_distance_between_first_and_last; try (by done).
- by apply leq_ltn_trans with (n := 1).
- Qed.
-
- (* Because the number of arrivals is larger than the ceiling term,
- it follows that the first and last jobs are separated by at
- least the length of the interval, ... *)
- Lemma sporadic_arrival_bound_last_job_too_far:
- a_first + t2 - t1 <= a_last.
- Proof.
- have DIST := sporadic_arrival_bound_distance_between_first_and_last.
- have MORE := sporadic_arrival_bound_more_than_one_point.
- rename H_many_arrivals into MANY, H_at_least_two_jobs into TWO.
- destruct num_arrivals; first by rewrite ltn0 in TWO.
- destruct n; first by rewrite ltnn in TWO.
- rewrite subn1 /= in DIST.
- apply leq_trans with (n := a_first + n.+1*task_period tsk); last by done.
- rewrite -addnBA; last by apply ltnW, MORE.
- rewrite leq_add2l.
- {
- unfold div_ceil in MANY.
- destruct (task_period tsk %| t2 - t1) eqn:DIV;
- first by rewrite ltnS leq_divLR in MANY.
- by rewrite ltnS ltn_divLR // in MANY; apply ltnW.
- }
- Qed.
-
- (* ...which implies that the last job arrives after the interval. *)
- Lemma sporadic_arrival_bound_last_arrives_too_late:
- a_last >= t2.
- Proof.
- have NTH := sporadic_arrival_bound_properties_of_nth.
- have TOOFAR := sporadic_arrival_bound_last_job_too_far.
- apply leq_trans with (n := a_first + t2 - t1); last by done.
- apply leq_trans with (n := t1 + t2 - t1); first by rewrite addKn.
- rewrite leq_sub2r // leq_add2r.
- by feed (NTH 0); [ by apply leq_ltn_trans with (n := 1) | des].
- Qed.
-
- (* However, the last job must lie within [t1, t2). Contradiction! *)
- Lemma sporadic_arrival_bound_case_3_contradiction: False.
- Proof.
- have LATE := sporadic_arrival_bound_last_arrives_too_late.
- have NTH := sporadic_arrival_bound_properties_of_nth.
- rename H_at_least_two_jobs into TWO.
- feed (NTH num_arrivals.-1); first by destruct num_arrivals; first by rewrite ltn0 in TWO.
- move: NTH => [/andP [_ BUG] _].
- by rewrite ltnNge LATE in BUG.
- Qed.
-
- End DerivingContradiction.
-
- (* From the contradiction above, we prove that the arrival bound
- is correct for case 3 (i.e., at least two arriving jobs). *)
- Lemma sporadic_task_arrival_bound_at_least_two_jobs:
- num_arrivals <= div_ceil (t2 - t1) (task_period tsk).
- Proof.
- have CONTRA := sporadic_arrival_bound_case_3_contradiction.
- unfold num_arrivals, num_arrivals_of_task in *.
- rename H_at_least_two_jobs into TWO.
- set l := arrivals_of_task_between job_task arr_seq tsk t1 t2; fold l in TWO.
- apply contraT; rewrite -ltnNge; intro MANY; exfalso.
- have DUMMY: exists (j: Job), True.
- {
- destruct l eqn:EQ; first by rewrite /= ltn0 in TWO.
- by exists s.
- } destruct DUMMY as [elem _].
- by apply CONTRA; last by apply elem.
- Qed.
-
- End AtLeastTwoJobs.
-
- (* Using the case analysis, we prove that the number of job arrivals of tsk
- can be upper-bounded using the length of the interval as follows. *)
- Theorem sporadic_task_arrival_bound:
- num_arrivals <= div_ceil (t2 - t1) (task_period tsk).
- Proof.
- destruct num_arrivals as [|n] eqn:CEIL;
- first by rewrite -CEIL; apply sporadic_arrival_bound_no_jobs.
- destruct n as [|num_arr]; rewrite -CEIL; first by apply sporadic_arrival_bound_one_job.
- by apply sporadic_task_arrival_bound_at_least_two_jobs; rewrite CEIL.
- Qed.
-
- End BoundOnSporadicArrivals.
-
- End Lemmas.
-
-End ArrivalBounds.
diff --git a/classic/model/arrival/basic/arrival_sequence.v b/classic/model/arrival/basic/arrival_sequence.v
deleted file mode 100644
index f161591a3f878e0cac0c78c698bddde3677ede2f..0000000000000000000000000000000000000000
--- a/classic/model/arrival/basic/arrival_sequence.v
+++ /dev/null
@@ -1,232 +0,0 @@
-Require Import prosa.classic.util.all prosa.classic.model.arrival.basic.task prosa.classic.model.time.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(* Definitions and properties of job arrival sequences. *)
-Module ArrivalSequence.
-
- Export Time.
-
- (* We begin by defining a job arrival sequence. *)
- Section ArrivalSequenceDef.
-
- (* Given any job type with decidable equality, ... *)
- Variable Job: eqType.
-
- (* ..., an arrival sequence is a mapping from any time to a (finite) sequence of jobs. *)
- Definition arrival_sequence := time -> seq Job.
-
- End ArrivalSequenceDef.
-
- (* Next, we define properties of jobs in a given arrival sequence. *)
- Section JobProperties.
-
- (* Consider any job arrival sequence. *)
- Context {Job: eqType}.
- Variable arr_seq: arrival_sequence Job.
-
- (* First, we define the sequence of jobs arriving at time t. *)
- Definition jobs_arriving_at (t: time) := arr_seq t.
-
- (* Next, we say that job j arrives at a given time t iff it belongs to the
- corresponding sequence. *)
- Definition arrives_at (j: Job) (t: time) := j \in jobs_arriving_at t.
-
- (* Similarly, we define whether job j arrives at some (unknown) time t, i.e.,
- whether it belongs to the arrival sequence. *)
- Definition arrives_in (j: Job) := exists t, j \in jobs_arriving_at t.
-
- End JobProperties.
-
- (* Next, we define properties of a valid arrival sequence. *)
- Section ArrivalSequenceProperties.
-
- (* Assume that job arrival times are known. *)
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* We say that arrival times are consistent if any job that arrives in the sequence
- has the corresponding arrival time. *)
- Definition arrival_times_are_consistent :=
- forall j t,
- arrives_at arr_seq j t -> job_arrival j = t.
-
- (* We say that the arrival sequence is a set iff it doesn't contain duplicate jobs
- at any given time. *)
- Definition arrival_sequence_is_a_set := forall t, uniq (jobs_arriving_at arr_seq t).
-
- End ArrivalSequenceProperties.
-
- (* Next, we define properties of job arrival times. *)
- Section PropertiesOfArrivalTime.
-
- (* Assume that job arrival times are known. *)
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* We say that job j has arrived at time t iff it arrives at some time t_0 with t_0 <= t. *)
- Definition has_arrived (t: time) := job_arrival j <= t.
-
- (* Next, we say that job j arrived before t iff it arrives at some time t_0 with t_0 < t. *)
- Definition arrived_before (t: time) := job_arrival j < t.
-
- (* Finally, we say that job j arrives between t1 and t2 iff it arrives at some time t with
- t1 <= t < t2. *)
- Definition arrived_between (t1 t2: time) := t1 <= job_arrival j < t2.
-
- End PropertiesOfArrivalTime.
-
- (* In this section, we define arrival sequence prefixes, which are useful
- to define (computable) properties over sets of jobs in the schedule. *)
- Section ArrivalSequencePrefix.
-
- (* Assume that job arrival times are known. *)
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* By concatenation, we construct the list of jobs that arrived in the interval [t1, t2). *)
- Definition jobs_arrived_between (t1 t2: time) :=
- \cat_(t1 <= t < t2) jobs_arriving_at arr_seq t.
-
- (* Based on that, we define the list of jobs that arrived up to time t, ...*)
- Definition jobs_arrived_up_to (t: time) := jobs_arrived_between 0 t.+1.
-
- (* ...and the list of jobs that arrived strictly before time t. *)
- Definition jobs_arrived_before (t: time) := jobs_arrived_between 0 t.
-
- (* In this section, we prove some lemmas about arrival sequence prefixes. *)
- Section Lemmas.
-
- (* We begin with basic lemmas for manipulating the sequences. *)
- Section Basic.
-
- (* First, we show that the set of arriving jobs can be split
- into disjoint intervals. *)
- Lemma job_arrived_between_cat:
- forall t1 t t2,
- t1 <= t ->
- t <= t2 ->
- jobs_arrived_between t1 t2 = jobs_arrived_between t1 t ++ jobs_arrived_between t t2.
- Proof.
- unfold jobs_arrived_between; intros t1 t t2 GE LE.
- by rewrite (@big_cat_nat _ _ _ t).
- Qed.
-
- Lemma jobs_arrived_between_mem_cat:
- forall j t1 t t2,
- t1 <= t ->
- t <= t2 ->
- j \in jobs_arrived_between t1 t2 =
- (j \in jobs_arrived_between t1 t ++ jobs_arrived_between t t2).
- Proof.
- by intros j t1 t t2 GE LE; rewrite (job_arrived_between_cat _ t).
- Qed.
-
- Lemma jobs_arrived_between_sub:
- forall j t1 t1' t2 t2',
- t1' <= t1 ->
- t2 <= t2' ->
- j \in jobs_arrived_between t1 t2 ->
- j \in jobs_arrived_between t1' t2'.
- Proof.
- intros j t1 t1' t2 t2' GE1 LE2 IN.
- move: (leq_total t1 t2) => /orP [BEFORE | AFTER];
- last by rewrite /jobs_arrived_between big_geq // in IN.
- rewrite /jobs_arrived_between.
- rewrite -> big_cat_nat with (n := t1); [simpl | by done | by apply: (leq_trans BEFORE)].
- rewrite mem_cat; apply/orP; right.
- rewrite -> big_cat_nat with (n := t2); [simpl | by done | by done].
- by rewrite mem_cat; apply/orP; left.
- Qed.
-
- End Basic.
-
- (* Next, we relate the arrival prefixes with job arrival times. *)
- Section ArrivalTimes.
-
- (* Assume that job arrival times are consistent. *)
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
-
- (* First, we prove that if a job belongs to the prefix (jobs_arrived_before t),
- then it arrives in the arrival sequence. *)
- Lemma in_arrivals_implies_arrived:
- forall j t1 t2,
- j \in jobs_arrived_between t1 t2 ->
- arrives_in arr_seq j.
- Proof.
- rename H_arrival_times_are_consistent into CONS.
- intros j t1 t2 IN.
- apply mem_bigcat_nat_exists in IN.
- move: IN => [arr [IN _]].
- by exists arr.
- Qed.
-
- (* Next, we prove that if a job belongs to the prefix (jobs_arrived_between t1 t2),
- then it indeed arrives between t1 and t2. *)
- Lemma in_arrivals_implies_arrived_between:
- forall j t1 t2,
- j \in jobs_arrived_between t1 t2 ->
- arrived_between job_arrival j t1 t2.
- Proof.
- rename H_arrival_times_are_consistent into CONS.
- intros j t1 t2 IN.
- apply mem_bigcat_nat_exists in IN.
- move: IN => [t0 [IN /= LT]].
- by apply CONS in IN; rewrite /arrived_between IN.
- Qed.
-
- (* Similarly, if a job belongs to the prefix (jobs_arrived_before t),
- then it indeed arrives before time t. *)
- Lemma in_arrivals_implies_arrived_before:
- forall j t,
- j \in jobs_arrived_before t ->
- arrived_before job_arrival j t.
- Proof.
- intros j t IN.
- suff: arrived_between job_arrival j 0 t by rewrite /arrived_between /=.
- by apply in_arrivals_implies_arrived_between.
- Qed.
-
- (* Similarly, we prove that if a job from the arrival sequence arrives before t,
- then it belongs to the sequence (jobs_arrived_before t). *)
- Lemma arrived_between_implies_in_arrivals:
- forall j t1 t2,
- arrives_in arr_seq j ->
- arrived_between job_arrival j t1 t2 ->
- j \in jobs_arrived_between t1 t2.
- Proof.
- rename H_arrival_times_are_consistent into CONS.
- move => j t1 t2 [a_j ARRj] BEFORE.
- have SAME := ARRj; apply CONS in SAME; subst a_j.
- by apply mem_bigcat_nat with (j := (job_arrival j)).
- Qed.
-
- (* Next, we prove that if the arrival sequence doesn't contain duplicate jobs,
- the same applies for any of its prefixes. *)
- Lemma arrivals_uniq :
- arrival_sequence_is_a_set arr_seq ->
- forall t1 t2, uniq (jobs_arrived_between t1 t2).
- Proof.
- rename H_arrival_times_are_consistent into CONS.
- unfold jobs_arrived_up_to; intros SET t1 t2.
- apply bigcat_nat_uniq; first by done.
- intros x t t' IN1 IN2.
- by apply CONS in IN1; apply CONS in IN2; subst.
- Qed.
-
- End ArrivalTimes.
-
- End Lemmas.
-
- End ArrivalSequencePrefix.
-
-End ArrivalSequence.
\ No newline at end of file
diff --git a/classic/model/arrival/basic/job.v b/classic/model/arrival/basic/job.v
deleted file mode 100644
index c6668d2498bde11c18516a6e879a844fd0893b60..0000000000000000000000000000000000000000
--- a/classic/model/arrival/basic/job.v
+++ /dev/null
@@ -1,93 +0,0 @@
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.arrival_sequence.
-From mathcomp Require Import ssrnat ssrbool eqtype.
-
-(* Properties of different types of job: *)
-Module Job.
-
- Import Time ArrivalSequence.
-
- (* 1) Basic Job *)
- Section ValidJob.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
-
- Variable j: Job.
-
- (* The job cost must be positive. *)
- Definition job_cost_positive := job_cost j > 0.
-
- End ValidJob.
-
- (* 2) Real-time job (with a deadline) *)
- Section ValidRealtimeJob.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
-
- Variable j: Job.
-
- (* The job deadline must be positive and no less than its cost. *)
- Definition job_deadline_positive := job_deadline j > 0.
- Definition job_cost_le_deadline := job_cost j <= job_deadline j.
-
- Definition valid_realtime_job :=
- job_cost_positive job_cost j /\
- job_cost_le_deadline /\
- job_deadline_positive.
-
- End ValidRealtimeJob.
-
- (* 3) Job of sporadic task *)
- Section ValidSporadicTaskJob.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- Variable j: Job.
-
- (* The job cost cannot be larger than the task cost. *)
- Definition job_cost_le_task_cost :=
- job_cost j <= task_cost (job_task j).
-
- (* The job deadline must be equal to the task deadline. *)
- Definition job_deadline_eq_task_deadline :=
- job_deadline j = task_deadline (job_task j).
-
- Definition valid_sporadic_job :=
- valid_realtime_job job_cost job_deadline j /\
- job_cost_le_task_cost /\
- job_deadline_eq_task_deadline.
-
- End ValidSporadicTaskJob.
-
- (* 4) Job of task *)
- Section ValidTaskJob.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* The job cost from the arrival sequence
- cannot be larger than the task cost. *)
- Definition cost_of_jobs_from_arrival_sequence_le_task_cost :=
- forall j,
- arrives_in arr_seq j ->
- job_cost_le_task_cost task_cost job_cost job_task j.
-
- End ValidTaskJob.
-
-End Job.
diff --git a/classic/model/arrival/basic/task.v b/classic/model/arrival/basic/task.v
deleted file mode 100644
index da303d4790074c4d2a1d89228b7873da7a111fcf..0000000000000000000000000000000000000000
--- a/classic/model/arrival/basic/task.v
+++ /dev/null
@@ -1,82 +0,0 @@
-Require Import prosa.classic.model.time prosa.classic.util.all.
-From mathcomp Require Import ssrnat ssrbool eqtype fintype seq.
-
-(* Attributes of a valid sporadic task. *)
-Module SporadicTask.
-
- Import Time.
-
- Section BasicTask.
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
-
- Section ValidParameters.
- Variable tsk: Task.
-
- (* The cost, period and deadline of the task must be positive. *)
- Definition task_cost_positive := task_cost tsk > 0.
- Definition task_period_positive := task_period tsk > 0.
- Definition task_deadline_positive := task_deadline tsk > 0.
-
- (* The task cost cannot be larger than the deadline or the period. *)
- Definition task_cost_le_deadline := task_cost tsk <= task_deadline tsk.
- Definition task_cost_le_period := task_cost tsk <= task_period tsk.
-
- Definition is_valid_sporadic_task :=
- task_cost_positive /\ task_period_positive /\ task_deadline_positive /\
- task_cost_le_deadline /\ task_cost_le_period.
-
- End ValidParameters.
-
- End BasicTask.
-
-End SporadicTask.
-
-(* Definition and properties of a task set. *)
-Module SporadicTaskset.
- Import Time.
- Export SporadicTask.
-
- Section TasksetDefs.
-
- (* A task set is defined as a {set ...}, which denotes a sequence
- of tasks with no duplicates. *)
- Definition taskset_of (Task: eqType) := {set Task}.
-
- (* Next, we define some properties abouts sequences of tasks. *)
- Section TasksetProperties.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
-
- Let is_valid_task :=
- is_valid_sporadic_task task_cost task_period task_deadline.
-
- Variable ts: seq Task.
-
- (* A valid sporadic taskset only contains valid tasks. *)
- Definition valid_sporadic_taskset :=
- forall tsk,
- tsk \in ts -> is_valid_task tsk.
-
- (* A task set can satisfy one of three deadline models:
- implicit, constrained, or arbitrary. *)
- Definition implicit_deadline_model :=
- forall tsk,
- tsk \in ts -> task_deadline tsk = task_period tsk.
-
- Definition constrained_deadline_model :=
- forall tsk,
- tsk \in ts -> task_deadline tsk <= task_period tsk.
-
- Definition arbitrary_deadline_model := True.
-
- End TasksetProperties.
-
- End TasksetDefs.
-
-End SporadicTaskset.
\ No newline at end of file
diff --git a/classic/model/arrival/basic/task_arrival.v b/classic/model/arrival/basic/task_arrival.v
deleted file mode 100644
index c08364145e944bb877eb2f79980e974673c87ea4..0000000000000000000000000000000000000000
--- a/classic/model/arrival/basic/task_arrival.v
+++ /dev/null
@@ -1,236 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path bigop.
-
-(* Properties of job arrival. *)
-Module TaskArrival.
-
- Import ArrivalSequence SporadicTaskset.
-
- Section ArrivalModels.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Then, we define the sporadic task model as follows.*)
- Definition sporadic_task_model :=
- forall (j j': Job),
- j <> j' -> (* Given two different jobs j and j' ... *)
- arrives_in arr_seq j -> (* ...that belong to the arrival sequence... *)
- arrives_in arr_seq j' ->
- job_task j = job_task j' -> (* ... and that are spawned by the same task, ... *)
- job_arrival j <= job_arrival j' -> (* ... if the arrival of j precedes the arrival of j' ..., *)
- (* then the arrival of j and the arrival of j' are separated by at least one period. *)
- job_arrival j' >= job_arrival j + task_period (job_task j).
-
- End ArrivalModels.
-
- Section NumberOfArrivals.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and recall the list of jobs that arrive in any interval. *)
- Let arrivals_between := jobs_arrived_between arr_seq.
-
- (* Let tsk be any task. *)
- Variable tsk: Task.
-
- (* By checking the task that spawns each job, ...*)
- Definition is_job_of_task (j: Job) := job_task j == tsk.
-
- (* ...we can identify the jobs of tsk that arrived in any interval [t1, t2) ... *)
- Definition arrivals_of_task_between (t1 t2: time) :=
- [seq j <- arrivals_between t1 t2 | is_job_of_task j].
-
- (* ...we define the jobs of tsk that arrived before some time instant t ... *)
- Definition arrivals_of_task_before (t: time) :=
- arrivals_of_task_between 0 t.
-
- (* ...and also count the number of job arrivals. *)
- Definition num_arrivals_of_task (t1 t2: time) :=
- size (arrivals_of_task_between t1 t2).
-
- (* In this section we prove some basic lemmas about number of arrivals of task. *)
- Section Lemmas.
-
- (* We show that the number of arrivals of task can be split into disjoint intervals. *)
- Lemma num_arrivals_of_task_cat:
- forall t t1 t2,
- t1 <= t <= t2 ->
- num_arrivals_of_task t1 t2 = num_arrivals_of_task t1 t + num_arrivals_of_task t t2.
- Proof.
- move => t t1 t2 /andP [GE LE].
- rewrite /num_arrivals_of_task /arrivals_of_task_between
- /arrivals_between /jobs_arrived_between.
- rewrite (@big_cat_nat _ _ _ t) //=.
- by rewrite filter_cat size_cat.
- Qed.
-
- End Lemmas.
-
- End NumberOfArrivals.
-
- (* In this section, we prove some basic results regarding the
- distance between sporadically released jobs. *)
- Section DistanceBetweenSporadicJobs.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals, ... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_consistent_arrivals: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_no_duplicate_arrivals: arrival_sequence_is_a_set arr_seq.
-
- (* ...where jobs follow the sporadic task model. *)
- Hypothesis H_sporadic_jobs:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Let tsk be any task to be scheduled. *)
- Variable tsk: Task.
-
- (* Consider any time interval [t1, t2). *)
- Variable t1 t2: time.
-
- (* Recall the jobs of tsk during [t1, t2), along with the number of arrivals. *)
- Let arriving_jobs := arrivals_of_task_between job_task arr_seq tsk t1 t2.
- Let num_arrivals := num_arrivals_of_task job_task arr_seq tsk t1 t2.
-
- (* Consider the sequence of jobs ordered by arrival times. *)
- Let by_arrival_time (j j': Job) := job_arrival j <= job_arrival j'.
- Let sorted_jobs := sort by_arrival_time arriving_jobs.
-
- (* Let (nth_job i) denote the i-th job in the sorted sequence. *)
- Variable elem: Job.
- Let nth_job := nth elem sorted_jobs.
-
- (* First, we recall some trivial properties about nth_job. *)
- Remark sorted_arrivals_properties_of_nth:
- forall idx,
- idx < num_arrivals ->
- t1 <= job_arrival (nth_job idx) < t2 /\
- job_task (nth_job idx) = tsk /\
- arrives_in arr_seq (nth_job idx).
- Proof.
- rename H_consistent_arrivals into CONS.
- intros idx LTidx.
- have IN: nth_job idx \in sorted_jobs by rewrite mem_nth // size_sort.
- rewrite mem_sort mem_filter in IN.
- move: IN => /andP [JOB IN]; move: (IN) => LT.
- apply in_arrivals_implies_arrived in IN.
- eapply in_arrivals_implies_arrived_between in LT; last by eauto.
- by repeat split; try (by done); apply/eqP.
- Qed.
-
- (* Next, we conclude that consecutive jobs are different. *)
- Lemma sorted_arrivals_current_differs_from_next:
- forall idx,
- idx < num_arrivals.-1 ->
- nth_job idx <> nth_job idx.+1.
- Proof.
- intros idx LT; apply/eqP.
- destruct num_arrivals eqn:EQ; first by rewrite ltn0 in LT.
- destruct n; [by rewrite ltn0 in LT | simpl in LT].
- rewrite nth_uniq ?size_sort /arriving_jobs
- -/(num_arrivals_of_task _ _ _ _ _) -/num_arrivals;
- first by rewrite neq_ltn ltnSn orTb.
- - by apply leq_trans with (n := n.+1); last by rewrite EQ.
- - by rewrite EQ ltnS.
- - by rewrite sort_uniq filter_uniq //; eapply arrivals_uniq; eauto 1.
- Qed.
-
- (* Since the list is sorted, we prove that each job arrives at
- least (task_period tsk) time units after the previous job. *)
- Lemma sorted_arrivals_separated_by_period:
- forall idx,
- idx < num_arrivals.-1 ->
- job_arrival (nth_job idx.+1) >= job_arrival (nth_job idx) + task_period tsk.
- Proof.
- have NTH := sorted_arrivals_properties_of_nth.
- have NEQ := sorted_arrivals_current_differs_from_next.
- rename H_sporadic_jobs into SPO.
- intros idx LT.
- destruct num_arrivals eqn:EQ; first by rewrite ltn0 in LT.
- destruct n; [by rewrite ltn0 in LT | simpl in LT].
- exploit (NTH idx);
- [by apply leq_trans with (n := n.+1) | intro NTH1].
- exploit (NTH idx.+1); [by rewrite ltnS | intro NTH2].
- move: NTH1 NTH2 => [_ [JOB1 ARR1]] [_ [JOB2 ARR2]].
- rewrite -JOB1.
- apply SPO; try (by done); [by apply NEQ | by rewrite JOB1 JOB2 |].
- suff ORDERED: by_arrival_time (nth_job idx) (nth_job idx.+1) by done.
- apply sort_ordered;
- first by apply sort_sorted; intros x y; apply leq_total.
- rewrite size_sort.
- rewrite /arriving_jobs -/(num_arrivals_of_task _ _ _ _ _) -/num_arrivals.
- by rewrite EQ.
- Qed.
-
- (* If the list of arrivals is not empty, we analyze the distance between
- the first and last jobs. *)
- Section FirstAndLastJobs.
-
- (* Suppose that there is at least one job, ... *)
- Hypothesis H_at_least_one_job:
- num_arrivals >= 1.
-
- (* ...in which case we identify the first and last jobs and their
- respective arrival times (note that they could be the same job). *)
- Let j_first := nth_job 0.
- Let j_last := nth_job (num_arrivals.-1).
- Let a_first := job_arrival j_first.
- Let a_last := job_arrival j_last.
-
- (* By induction, we prove that that each job with index 'idx' arrives at
- least idx*(task_period tsk) units after the first job. *)
- Lemma sorted_arrivals_distance_from_first_job:
- forall idx,
- idx < num_arrivals ->
- job_arrival (nth_job idx) >= a_first + idx * task_period tsk.
- Proof.
- have SEP := sorted_arrivals_separated_by_period.
- unfold sporadic_task_model in *.
- rename H_sporadic_jobs into SPO.
- induction idx; first by intros _; rewrite mul0n addn0.
- intros LT.
- have LT': idx < num_arrivals by apply leq_ltn_trans with (n := idx.+1).
- specialize (IHidx LT').
- apply leq_trans with (n := job_arrival (nth_job idx) + task_period tsk);
- first by rewrite mulSn [task_period _ + _]addnC addnA leq_add2r.
- apply SEP.
- by rewrite -(ltn_add2r 1) 2!addn1 (ltn_predK LT).
- Qed.
-
- (* Therefore, the first and last jobs are separated by at least
- (num_arrivals - 1) periods. *)
- Corollary sorted_arrivals_distance_between_first_and_last:
- a_last >= a_first + (num_arrivals-1) * task_period tsk.
- Proof.
- rename H_at_least_one_job into TWO.
- have DIST := sorted_arrivals_distance_from_first_job.
- rewrite subn1; apply DIST.
- by destruct num_arrivals; first by rewrite ltn0 in TWO.
- Qed.
-
- End FirstAndLastJobs.
-
- End DistanceBetweenSporadicJobs.
-
-End TaskArrival.
\ No newline at end of file
diff --git a/classic/model/arrival/curves/bounds.v b/classic/model/arrival/curves/bounds.v
deleted file mode 100644
index b14fd8b94f26613249ce206e53990ae75a557066..0000000000000000000000000000000000000000
--- a/classic/model/arrival/curves/bounds.v
+++ /dev/null
@@ -1,90 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.arrival.basic.task_arrival.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq div.
-
-(* In this section, we define the notion of arrival curves, which
- can be used to reason about the frequency of job arrivals. *)
-Module ArrivalCurves.
-
- Import ArrivalSequence TaskArrival.
-
- Section DefiningArrivalCurves.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Recall the job arrivals of tsk in a given interval [t1, t2). *)
- Let arrivals_of_tsk tsk := arrivals_of_task_between job_task arr_seq tsk.
- Let num_arrivals_of_tsk tsk := num_arrivals_of_task job_task arr_seq tsk.
-
- (* First, we define what constitutes an arrival bound for task tsk. *)
- Section ArrivalBound.
-
- (* Let max_arrivals denote any function that takes an interval length and
- returns the associated number of job arrivals of task.
- (This corresponds to the eta+ function in the literature.) *)
- Variable max_arrivals: Task -> time -> nat.
-
- (* Then, we say that max_arrivals is an arrival bound iff, for any interval [t1, t2),
- [num_arrivals (t2 - t1)] bounds the number of jobs of tsk that arrive in that interval. *)
- Definition is_arrival_bound (tsk: Task) :=
- forall (t1 t2: time),
- t1 <= t2 ->
- num_arrivals_of_tsk tsk t1 t2 <= max_arrivals tsk (t2 - t1).
-
- (* We say that max_arrivals is an arrival bound for taskset ts
- iff max_arrival is an arrival bound for any task from ts. *)
- Definition is_arrival_bound_for_taskset (ts: seq Task) :=
- forall (tsk: Task), tsk \in ts -> is_arrival_bound tsk.
-
- (* We provide the notion of an arrival curve that equals 0 for the empty interval. *)
- Definition zero_arrival_curve (tsk: Task) :=
- max_arrivals tsk 0 = 0.
-
- (* Next, we provide the notion of a monotonic arrival curve. *)
- Definition monotonic_arrival_curve (tsk: Task) :=
- monotone (max_arrivals tsk) leq.
-
- (* We say that max_arrivals is a proper arrival curve for task tsk iff
- [max_arrivals tsk] is an arrival bound for task tsk and [max_arrivals tsk]
- is a monotonic function that equals 0 for the empty interval delta = 0. *)
- Definition proper_arrival_curve (tsk: Task) :=
- is_arrival_bound tsk /\
- zero_arrival_curve tsk /\
- monotonic_arrival_curve tsk.
-
- (* We say that max_arrivals is a family of proper arrival curves iff
- for all tsk in ts [max_arrival tsk] is a proper arrival curve. *)
- Definition family_of_proper_arrival_curves (ts: seq Task) :=
- forall (tsk: Task), tsk \in ts -> proper_arrival_curve tsk.
-
- End ArrivalBound.
-
- (* Next, we define the notion of a separation bound for task tsk, i.e., the smallest
- interval length in which a certain number of jobs of tsk can be spawned. *)
- Section SeparationBound.
-
- (* Let min_length denote any function that takes a number of jobs and
- returns an associated interval length.
- (This corresponds to the delta- function in the literature.) *)
- Variable min_length: Task -> nat -> time.
-
- (* Then, we say that min_length is a separation bound iff, for any number of jobs
- of tsk, min_separation lower-bounds the minimum interval length in which that number
- of jobs can be spawned. *)
- Definition is_separation_bound tsk :=
- forall t1 t2,
- t1 <= t2 ->
- min_length tsk (num_arrivals_of_tsk tsk t1 t2) <= t2 - t1.
-
- End SeparationBound.
-
- End DefiningArrivalCurves.
-
-End ArrivalCurves.
-
diff --git a/classic/model/arrival/jitter/arrival_bounds.v b/classic/model/arrival/jitter/arrival_bounds.v
deleted file mode 100644
index bbce3c4f2878d9e13a61b6c22e13d47fef49b4c4..0000000000000000000000000000000000000000
--- a/classic/model/arrival/jitter/arrival_bounds.v
+++ /dev/null
@@ -1,250 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.jitter.job
- prosa.classic.model.arrival.jitter.arrival_sequence
- prosa.classic.model.arrival.jitter.task_arrival.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path div.
-
-(* In this file, we prove bounds on the number of actual task arrivals, i.e,
- taking release jitter into account. *)
-Module ArrivalBounds.
-
- Import JobWithJitter ArrivalSequenceWithJitter SporadicTaskset Priority
- TaskArrivalWithJitter.
-
- Section BoundingActualArrivals.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
- Variable task_jitter: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence with consistent, duplicate-free arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arrival_sequence_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* ...where the jitter of each job is bounded by the jitter of its task. *)
- Hypothesis H_job_jitter_bounded:
- forall j,
- arrives_in arr_seq j ->
- job_jitter_leq_task_jitter task_jitter job_jitter job_task j.
-
- (* For simplicity, let's define some local names. *)
- Let actual_job_arrival := actual_arrival job_arrival job_jitter.
-
- (* In this section, we prove an upper bound on the number of jobs with actual arrival time
- in a given interval. *)
- Section UpperBoundOn.
-
- (* Assume that jobs are sporadic. *)
- Hypothesis H_sporadic_tasks: sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider any time interval [t1, t2)... *)
- Variable t1 t2: time.
-
- (* ...and let tsk be any task with period > 0. *)
- Variable tsk: Task.
- Hypothesis H_period_gt_zero: task_period tsk > 0.
-
- (* Recall the jobs of tsk with actual arrival time in [t1, t2), along with the corresponding
- number of arrivals. *)
- Let actual_arrivals := actual_arrivals_of_task_between job_arrival job_jitter
- job_task arr_seq tsk t1 t2.
- Let num_actual_arrivals := num_actual_arrivals_of_task job_arrival job_jitter job_task
- arr_seq tsk t1 t2.
-
- (* We will establish an upper bound on the number of actual arrivals of tsk.
- The proof follows by case analysis. *)
-
- (* Case 1: Assume that there are no jobs of tsk with actual arrival time in the interval. *)
- Section NoJobs.
-
- (* If there are no actual arrivals in [t1, t2), ...*)
- Hypothesis H_no_jobs: num_actual_arrivals = 0.
-
- (* ...then the arrival bound trivially holds. *)
- Lemma sporadic_arrival_bound_no_jobs:
- num_actual_arrivals <= div_ceil (t2 + task_jitter tsk - t1) (task_period tsk).
- Proof.
- by rewrite H_no_jobs.
- Qed.
-
- End NoJobs.
-
- (* Case 2: Assume that a single job of tsk has actual arrival time in the interval. *)
- Section OneJob.
-
- (* First, note that since the interval is open at time t2,
- t2 must be larger than t1. *)
- Lemma sporadic_arrival_bound_more_than_one_point:
- num_actual_arrivals > 0 ->
- t1 < t2.
- Proof.
- unfold num_actual_arrivals, num_actual_arrivals_of_task in *; intros ONE.
- rewrite -/actual_arrivals in ONE *.
- destruct actual_arrivals as [| j l] eqn:EQ; first by done.
- have IN: j \in actual_arrivals by rewrite EQ in_cons eq_refl orTb.
- rewrite mem_filter in IN; move: IN => /andP [_ ARR].
- rewrite mem_filter in ARR; move: ARR => /andP [GE ARR].
- by move: GE => /andP [GE LE]; apply: (leq_ltn_trans GE).
- Qed.
-
- (* Therefore, if there is one job of tsk with actual arrival time in [t1, t2), ... *)
- Hypothesis H_no_jobs: num_actual_arrivals = 1.
-
- (* ...then (t2 - t1) > 0 and the arrival bound also holds. *)
- Lemma sporadic_arrival_bound_one_job:
- num_actual_arrivals <= div_ceil (t2 + task_jitter tsk - t1) (task_period tsk).
- Proof.
- rewrite H_no_jobs.
- rewrite ceil_neq0 // ltn_subRL addn0.
- apply leq_trans with (n := t2); last by apply leq_addr.
- apply sporadic_arrival_bound_more_than_one_point.
- by rewrite H_no_jobs.
- Qed.
-
- End OneJob.
-
- (* Case 3: There are at least two actual job arrivals. *)
- Section AtLeastTwoJobs.
-
- (* Assume that there are at least two jobs of tsk with actual arrival in [t1,t2). *)
- Hypothesis H_at_least_two_jobs: num_actual_arrivals >= 2.
-
- (* We prove the arrival bound by contradiction. *)
- Section DerivingContradiction.
-
- (* Suppose that the number of arrivals is larger than the bound. *)
- Hypothesis H_many_arrivals:
- div_ceil (t2 + task_jitter tsk - t1) (task_period tsk) < num_actual_arrivals.
-
- (* Consider the list of jobs ordered by arrival times. *)
- Let by_arrival_time j j' := job_arrival j <= job_arrival j'.
- Let sorted_jobs := sort by_arrival_time actual_arrivals.
-
- (* Based on the notation for the n-th job in the sorted list of arrivals, ... *)
- Variable elem: Job.
- Let nth_job := nth elem sorted_jobs.
-
- (* ...we identify the first and last jobs and their respective arrival times. *)
- Let j_first := nth_job 0.
- Let j_last := nth_job (num_actual_arrivals.-1).
- Let a_first := job_arrival j_first.
- Let a_last := job_arrival j_last.
-
- (* Next, we recall from task_arrival.v the properties of the n-th job in
- the sequence... *)
- Corollary sporadic_arrival_bound_properties_of_nth:
- forall idx,
- idx < num_actual_arrivals ->
- t1 <= actual_job_arrival (nth_job idx) < t2 /\
- job_task (nth_job idx) = tsk /\
- arrives_in arr_seq (nth_job idx).
- Proof.
- by intros idx LTidx; apply sorted_arrivals_properties_of_nth.
- Qed.
-
- (* ...and that the first and last jobs are separated by at least
- (num_actual_arrivals - 1) periods. *)
- Corollary sporadic_arrival_bound_distance_between_first_and_last:
- a_last >= a_first + (num_actual_arrivals - 1) * task_period tsk.
- Proof.
- rename H_at_least_two_jobs into TWO.
- apply sorted_arrivals_distance_between_first_and_last; try (by done).
- by apply leq_ltn_trans with (n := 1).
- Qed.
-
- (* Next, because the number of actual arrivals is larger than the ceiling term,
- it follows that the first and last jobs are separated by at least the
- length of the interval plus the jitter of the task, ... *)
- Lemma sporadic_arrival_bound_last_job_too_far:
- a_first + t2 + task_jitter tsk - t1 <= a_last.
- Proof.
- have DIST := sporadic_arrival_bound_distance_between_first_and_last.
- have MORE := sporadic_arrival_bound_more_than_one_point.
- rename H_many_arrivals into MANY, H_at_least_two_jobs into TWO.
- destruct num_actual_arrivals; first by rewrite ltn0 in TWO.
- destruct n; first by rewrite ltnn in TWO.
- rewrite subn1 /= in DIST.
- apply leq_trans with (n := a_first + n.+1*task_period tsk); last by done.
- rewrite -addnA -addnBA;
- last by apply leq_trans with (n := t2); [by apply ltnW, MORE | by apply leq_addr].
- rewrite leq_add2l.
- unfold div_ceil in MANY.
- destruct (task_period tsk %| t2 + task_jitter tsk - t1) eqn:DIV;
- first by rewrite ltnS leq_divLR in MANY.
- by rewrite ltnS ltn_divLR // in MANY; apply ltnW.
- Qed.
-
- (* ...which implies that the last job arrives after the interval. *)
- Lemma sporadic_arrival_bound_last_arrives_too_late:
- a_last >= t2.
- Proof.
- have NTH := sporadic_arrival_bound_properties_of_nth.
- have TOOFAR := sporadic_arrival_bound_last_job_too_far.
- apply leq_trans with (n := a_first + t2 + task_jitter tsk - t1); last by done.
- apply leq_trans with (n := t1 + t2 - t1); first by rewrite addKn.
- rewrite leq_sub2r // -addnA [t2 + _]addnC addnA leq_add2r.
- feed (NTH 0); [ by apply leq_ltn_trans with (n := 1) | des].
- apply leq_trans with (n := a_first + job_jitter j_first); first by done.
- by rewrite leq_add2l -NTH0; apply H_job_jitter_bounded.
- Qed.
-
- (* However, the actual arrival time of the last job must lie within [t1, t2).
- Contradiction! *)
- Lemma sporadic_arrival_bound_case_3_contradiction: False.
- Proof.
- have LATE := sporadic_arrival_bound_last_arrives_too_late.
- have NTH := sporadic_arrival_bound_properties_of_nth.
- rename H_at_least_two_jobs into TWO.
- feed (NTH num_actual_arrivals.-1);
- first by destruct num_actual_arrivals; first by rewrite ltn0 in TWO.
- move: NTH => [/andP [_ BUG] _].
- rewrite ltnNge in BUG; move: BUG => /negP BUG; apply: BUG.
- by apply leq_trans with (n := a_last); last by apply leq_addr.
- Qed.
-
- End DerivingContradiction.
-
- (* From the contradiction above, we prove that the arrival bound
- is correct for case 3 (i.e., at least two actual arrivals). *)
- Lemma sporadic_task_arrival_bound_at_least_two_jobs:
- num_actual_arrivals <= div_ceil (t2 + task_jitter tsk - t1) (task_period tsk).
- Proof.
- have CONTRA := sporadic_arrival_bound_case_3_contradiction.
- unfold num_actual_arrivals, num_actual_arrivals_of_task in *.
- rename H_at_least_two_jobs into TWO.
- set l := actual_arrivals_of_task_between _ _ _ _ _ _; fold l in TWO.
- apply contraT; rewrite -ltnNge; intro MANY; exfalso.
- have DUMMY: exists (j: Job), True.
- {
- destruct l eqn:EQ; first by rewrite /= ltn0 in TWO.
- by exists s.
- } destruct DUMMY as [elem _].
- by apply CONTRA; last by apply elem.
- Qed.
-
- End AtLeastTwoJobs.
-
- (* Using the case analysis above, we prove that the number of actual arrivals of tsk
- can be upper-bounded using the length of the interval as follows. *)
- Theorem sporadic_task_with_jitter_arrival_bound:
- num_actual_arrivals <= div_ceil (t2 + task_jitter tsk - t1) (task_period tsk).
- Proof.
- destruct num_actual_arrivals as [|n] eqn:CEIL;
- first by rewrite -CEIL; apply sporadic_arrival_bound_no_jobs.
- destruct n as [|num_arr]; rewrite -CEIL; first by apply sporadic_arrival_bound_one_job.
- by apply sporadic_task_arrival_bound_at_least_two_jobs; rewrite CEIL.
- Qed.
-
- End UpperBoundOn.
-
- End BoundingActualArrivals.
-
-End ArrivalBounds.
\ No newline at end of file
diff --git a/classic/model/arrival/jitter/arrival_sequence.v b/classic/model/arrival/jitter/arrival_sequence.v
deleted file mode 100644
index fcfcd0bbfaae83f97936d5e39422bd0973572d9b..0000000000000000000000000000000000000000
--- a/classic/model/arrival/jitter/arrival_sequence.v
+++ /dev/null
@@ -1,229 +0,0 @@
-Require Import prosa.classic.util.all prosa.classic.model.arrival.basic.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(* In this file we provide extra definitions for job arrival sequences with jitter. *)
-Module ArrivalSequenceWithJitter.
-
- Export ArrivalSequence.
-
- (* First, we identify the actual arrival time of a job. *)
- Section ActualArrival.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* We define the actual arrival of job j as the time when the jitter ends. *)
- Definition actual_arrival := job_arrival j + job_jitter j.
-
- (* Next, we state whether the actual arrival of job j occurs in some interval [0, t], ... *)
- Definition jitter_has_passed (t: time) := actual_arrival <= t.
-
- (* ...along with the variants for interval [0, t), ... *)
- Definition actual_arrival_before (t: time) := actual_arrival < t.
-
- (* ...and interval [t1, t2). *)
- Definition actual_arrival_between (t1 t2: time) :=
- t1 <= actual_arrival < t2.
-
- End ActualArrival.
-
- (* In this section, we show how to compute the list of arriving jobs. *)
- Section ArrivingJobs.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_jitter: Job -> time.
- Variable arr_seq: arrival_sequence Job.
-
- (* For simplicity, let's define some local names. *)
- Let actual_job_arrival := actual_arrival job_arrival job_jitter.
- Let actual_job_arrival_between := actual_arrival_between job_arrival job_jitter.
- Let actual_job_arrival_before := actual_arrival_before job_arrival job_jitter.
- Let arrivals_before := jobs_arrived_before arr_seq.
-
- (* First, we define the actual job arrivals in the interval [t1, t2). *)
- Definition actual_arrivals_between (t1 t2: time) :=
- [seq j <- arrivals_before t2 | t1 <= actual_job_arrival j < t2].
-
- (* Similarly, we define the actual job arrivals up to time t... *)
- Definition actual_arrivals_up_to (t: time) := actual_arrivals_between 0 t.+1.
-
- (* ...and the actual job arrivals strictly before time t. *)
- Definition actual_arrivals_before (t: time) := actual_arrivals_between 0 t.
-
- (* In this section, we prove some lemmas about the arrival sequence prefixes. *)
- Section Lemmas.
-
- (* Assume that job arrival times are consistent. *)
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
-
- (* We begin with basic lemmas for manipulating the sequences. *)
- Section Basic.
-
- (* First, we show that the set of arriving jobs can be split
- into disjoint intervals. *)
- Lemma actual_arrivals_between_mem_cat:
- forall j t1 t t2,
- t1 <= t ->
- t <= t2 ->
- j \in actual_arrivals_between t1 t2 =
- (j \in actual_arrivals_between t1 t ++ actual_arrivals_between t t2).
- Proof.
- unfold actual_arrivals_between; intros j t1 t t2 GE LE.
- apply/idP/idP.
- {
- intros IN.
- rewrite mem_filter in IN; move: IN => /andP [/andP [GE1 LT2] IN].
- rewrite mem_cat; apply/orP.
- rewrite 2!mem_filter.
- case (ltnP (actual_job_arrival j) t) => [BEFORE | AFTER]; last by right; rewrite LT2.
- left; rewrite GE1 /=.
- have INarr: arrives_in arr_seq j by apply in_arrivals_implies_arrived in IN.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival);
- try (by done) ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival);
- try (by done).
- by apply: (leq_ltn_trans _ BEFORE); apply leq_addr.
- }
- {
- rewrite mem_cat; move => /orP [LEFT | RIGHT].
- {
- rewrite mem_filter in LEFT; move: LEFT => /andP [ /andP [GE0 LT0] IN0].
- rewrite mem_filter GE0 /=.
- apply/andP; split; first by apply: (leq_trans _ LE).
- have INarr: arrives_in arr_seq j by apply in_arrivals_implies_arrived in IN0.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival);
- try (by done) ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival);
- try (by done).
- rewrite /arrived_between /=.
- by apply: (leq_trans _ LE); apply: (leq_ltn_trans _ LT0); apply leq_addr.
- }
- {
- rewrite mem_filter in RIGHT; move: RIGHT => /andP [/andP [GE0 LT0] IN0].
- rewrite mem_filter LT0 /= andbT.
- apply/andP; split; first by apply: (leq_trans GE).
- have INarr: arrives_in arr_seq j by apply in_arrivals_implies_arrived in IN0.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival);
- try (by done) ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival);
- try (by done).
- by apply: (leq_ltn_trans _ LT0); apply leq_addr.
- }
- }
- Qed.
-
- Lemma actual_arrivals_between_sub:
- forall j t1 t1' t2 t2',
- t1' <= t1 ->
- t2 <= t2' ->
- j \in actual_arrivals_between t1 t2 ->
- j \in actual_arrivals_between t1' t2'.
- Proof.
- intros j t1 t1' t2 t2' GE1 LE2 IN.
- rewrite mem_filter in IN; move: IN => /andP [/andP [GE LE] IN].
- move: (leq_total t1 t2) => /orP [BEFORE | AFTER]; last first.
- {
- suff BUG: t2 < t2 by rewrite ltnn in BUG.
- by apply: (leq_ltn_trans AFTER); apply: (leq_ltn_trans GE).
- }
- rewrite -> actual_arrivals_between_mem_cat with (t := t1);
- [| by done | by apply: (leq_trans BEFORE)].
- rewrite mem_cat; apply/orP; right.
- rewrite -> actual_arrivals_between_mem_cat with (t := t2);
- [| by done | by done].
- rewrite mem_cat; apply/orP; left.
- by rewrite mem_filter; repeat (apply/andP; split).
- Qed.
-
- End Basic.
-
- (* Next, we relate the arrival prefixes with job arrival times. *)
- Section ArrivalTimes.
-
- (* First, we prove that if a job belongs to the prefix (actual_arrivals_before t),
- then it arrives in the arrival sequence. *)
- Lemma in_actual_arrivals_between_implies_arrived:
- forall j t1 t2,
- j \in actual_arrivals_between t1 t2 ->
- arrives_in arr_seq j.
- Proof.
- rename H_arrival_times_are_consistent into CONS.
- intros j t1 t2 IN.
- rewrite mem_filter in IN; move: IN => /andP [_ IN].
- apply mem_bigcat_nat_exists in IN.
- by move: IN => [t0 /= [IN _]]; exists t0.
- Qed.
-
- Lemma in_actual_arrivals_before_implies_arrived:
- forall j t,
- j \in actual_arrivals_before t ->
- arrives_in arr_seq j.
- Proof.
- rename H_arrival_times_are_consistent into CONS.
- intros j t IN.
- rewrite mem_filter in IN; move: IN => /andP [_ IN].
- apply mem_bigcat_nat_exists in IN.
- by move: IN => [t0 /= [IN _]]; exists t0.
- Qed.
-
- (* Next, we prove that if a job belongs to the prefix (actual_arrivals_before t),
- then its actual job arrival occured before t. *)
- Lemma in_actual_arrivals_implies_arrived_before:
- forall j t,
- j \in actual_arrivals_before t ->
- actual_job_arrival_before j t.
- Proof.
- intros j t IN.
- by rewrite mem_filter /= in IN; move: IN => /andP [LTt _].
- Qed.
-
- (* We also prove that if a job belongs to the prefix (actual_arrivals_between t1 t2),
- then its actual job arrival occured between t1 and t2. *)
- Lemma in_actual_arrivals_implies_arrived_between:
- forall j t1 t2,
- j \in actual_arrivals_between t1 t2 ->
- actual_job_arrival_between j t1 t2.
- Proof.
- intros j t1 t2 IN.
- by rewrite mem_filter /= in IN; move: IN => /andP [LTt _].
- Qed.
-
- (* Similarly, we prove that if a job from the arrival sequence has actual arrival
- before time t, then it belongs to the sequence (actual_arrivals_before t). *)
- Lemma arrived_between_implies_in_actual_arrivals:
- forall j t1 t2,
- arrives_in arr_seq j ->
- actual_job_arrival_between j t1 t2 ->
- j \in actual_arrivals_between t1 t2.
- Proof.
- intros j t1 t2 IN BEFORE.
- rewrite mem_filter; apply/andP; split; first by done.
- eapply arrived_between_implies_in_arrivals; [by eauto | by done |].
- rewrite /arrived_between /=.
- move: BEFORE => /andP [_ LE].
- by apply: (leq_ltn_trans _ LE); apply leq_addr.
- Qed.
-
- (* Next, we prove that if the arrival sequence doesn't contain duplicate jobs,
- the same applies for any of its prefixes. *)
- Lemma actual_arrivals_uniq :
- arrival_sequence_is_a_set arr_seq ->
- forall t1 t2, uniq (actual_arrivals_between t1 t2).
- Proof.
- intros SET t1 t2.
- by eapply filter_uniq, arrivals_uniq, SET; eauto 1.
- Qed.
-
- End ArrivalTimes.
-
- End Lemmas.
-
- End ArrivingJobs.
-
-End ArrivalSequenceWithJitter.
diff --git a/classic/model/arrival/jitter/job.v b/classic/model/arrival/jitter/job.v
deleted file mode 100644
index 7891987dc0fd2d5236982a220aece4a9ab7d66e1..0000000000000000000000000000000000000000
--- a/classic/model/arrival/jitter/job.v
+++ /dev/null
@@ -1,43 +0,0 @@
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task.
-From mathcomp Require Import ssrnat ssrbool eqtype.
-
-Require Export prosa.classic.model.arrival.basic.job.
-
-(* In this file, we define properties of jobs with jitter. *)
-Module JobWithJitter.
-
- Import Time.
- Export Job.
-
- Section ValidSporadicTaskJobWithJitter.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* First, we define whether the actual jitter of the job is no larger
- than the jitter of its task. *)
- Definition job_jitter_leq_task_jitter :=
- job_jitter j <= task_jitter (job_task j).
-
- (* Then, based on the definition of valid sporadic job, ...*)
- Let j_is_valid_job :=
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* ...we define a valid sporadic job with jitter. *)
- Definition valid_sporadic_job_with_jitter :=
- j_is_valid_job /\ job_jitter_leq_task_jitter.
-
- End ValidSporadicTaskJobWithJitter.
-
-End JobWithJitter.
\ No newline at end of file
diff --git a/classic/model/arrival/jitter/task_arrival.v b/classic/model/arrival/jitter/task_arrival.v
deleted file mode 100644
index a0bf3610a141cc27293964ef88dd0e60c76c2c22..0000000000000000000000000000000000000000
--- a/classic/model/arrival/jitter/task_arrival.v
+++ /dev/null
@@ -1,199 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.arrival.jitter.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path.
-
-(* In this file, we provide definitions and lemmas about task arrivals
- in jitter-aware schedules. *)
-Module TaskArrivalWithJitter.
-
- Import ArrivalSequenceWithJitter SporadicTaskset.
- Export TaskArrival.
-
- (* First, we identify the arrivals of a particular task. *)
- Section NumberOfArrivals.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and recall the list of jobs with actual arrival time in a given interval. *)
- Let arrivals_between := actual_arrivals_between job_arrival job_jitter arr_seq.
-
- (* Next, let tsk be any task. *)
- Variable tsk: Task.
-
- (* By checking the jobs spawned by tsk... *)
- Definition is_job_of_tsk := is_job_of_task job_task tsk.
-
- (* ...we identify the jobs of tsk that arrived in any interval [t1, t2) ... *)
- Definition actual_arrivals_of_task_between (t1 t2: time) :=
- [seq j <- arrivals_between t1 t2 | is_job_of_tsk j].
-
- (* ...and also count the number of such job arrivals. *)
- Definition num_actual_arrivals_of_task (t1 t2: time) :=
- size (actual_arrivals_of_task_between t1 t2).
-
- End NumberOfArrivals.
-
- (* Next, we prove properties about lists of actual arrivals
- that are sorted by arrival time. *)
- Section DistanceBetweenSporadicJobs.
-
- Context {Task: eqType}.
- Variable task_period: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, duplicate-free arrivals, ... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_consistent_arrivals: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_no_duplicate_arrivals: arrival_sequence_is_a_set arr_seq.
-
- (* ...where jobs are sporadic. *)
- Hypothesis H_sporadic_jobs:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* For simplicity, let's define some local names. *)
- Let actual_job_arrival := actual_arrival job_arrival job_jitter.
-
- (* Next, let tsk be any task to be scheduled. *)
- Variable tsk: Task.
-
- (* Consider any time interval [t1, t2)... *)
- Variable t1 t2: time.
-
- (* ...and the associated actual arrivals of task tsk. *)
- Let arriving_jobs := actual_arrivals_of_task_between job_arrival job_jitter
- job_task arr_seq tsk t1 t2.
- Let num_arrivals := num_actual_arrivals_of_task job_arrival job_jitter job_task arr_seq tsk t1 t2.
-
- (* Then, consider the sequence of such jobs ordered by arrival times... *)
- Let by_arrival_time j j' := job_arrival j <= job_arrival j'.
- Let sorted_jobs := sort by_arrival_time arriving_jobs.
-
- (* ...and let (nth_job i) denote the i-th job in the sorted sequence. *)
- Variable elem: Job.
- Let nth_job := nth elem sorted_jobs.
-
- (* First, we recall some trivial properties about nth_job. *)
- Remark sorted_arrivals_properties_of_nth:
- forall idx,
- idx < num_arrivals ->
- t1 <= actual_job_arrival (nth_job idx) < t2 /\
- job_task (nth_job idx) = tsk /\
- arrives_in arr_seq (nth_job idx).
- Proof.
- intros idx LTidx.
- have IN: nth_job idx \in sorted_jobs by rewrite mem_nth // size_sort.
- rewrite mem_sort mem_filter in IN.
- move: IN => /andP [JOB IN]; move: (IN) => LT.
- apply in_actual_arrivals_between_implies_arrived in IN.
- eapply in_actual_arrivals_implies_arrived_between in LT.
- by repeat split; try (by done); apply/eqP.
- Qed.
-
- (* Next, we conclude that consecutive jobs are different. *)
- Lemma sorted_arrivals_current_differs_from_next:
- forall idx,
- idx < num_arrivals.-1 ->
- nth_job idx <> nth_job idx.+1.
- Proof.
- intros idx LT; apply/eqP.
- destruct num_arrivals eqn:EQ; first by rewrite ltn0 in LT.
- destruct n; [by rewrite ltn0 in LT | simpl in LT].
- rewrite nth_uniq ?size_sort /arriving_jobs
- -/(num_actual_arrivals_of_task _ _ _ _ _ _ _) -/num_arrivals;
- first by rewrite neq_ltn ltnSn orTb.
- - by apply leq_trans with (n := n.+1); last by rewrite EQ.
- - by rewrite EQ ltnS.
- - by rewrite sort_uniq filter_uniq //; apply actual_arrivals_uniq; eauto 1.
- Qed.
-
- (* Since the list is sorted, we prove that each job arrives at
- least (task_period tsk) time units after the previous job. *)
- Lemma sorted_arrivals_separated_by_period:
- forall idx,
- idx < num_arrivals.-1 ->
- job_arrival (nth_job idx.+1) >= job_arrival (nth_job idx) + task_period tsk.
- Proof.
- have NTH := sorted_arrivals_properties_of_nth.
- have NEQ := sorted_arrivals_current_differs_from_next.
- rename H_sporadic_jobs into SPO.
- intros idx LT.
- destruct num_arrivals eqn:EQ; first by rewrite ltn0 in LT.
- destruct n; [by rewrite ltn0 in LT | simpl in LT].
- exploit (NTH idx);
- [by apply leq_trans with (n := n.+1) | intro NTH1].
- exploit (NTH idx.+1); [by rewrite ltnS | intro NTH2].
- move: NTH1 NTH2 => [_ [JOB1 ARR1]] [_ [JOB2 ARR2]].
- rewrite -JOB1.
- apply SPO; try (by done); [by apply NEQ | by rewrite JOB1 JOB2 |].
- suff ORDERED: by_arrival_time (nth_job idx) (nth_job idx.+1) by done.
- apply sort_ordered;
- first by apply sort_sorted; intros x y; apply leq_total.
- rewrite size_sort.
- rewrite /arriving_jobs -/(num_actual_arrivals_of_task _ _ _ _ _ _ _) -/num_arrivals.
- by rewrite EQ.
- Qed.
-
- (* If the list of arrivals is not empty, we analyze the distance between
- the first and last jobs. *)
- Section FirstAndLastJobs.
-
- (* Suppose that there is at least one job, ... *)
- Hypothesis H_at_least_one_job:
- num_arrivals >= 1.
-
- (* ...in which case we identify the first and last jobs and their
- respective arrival times (note that they could be the same job). *)
- Let j_first := nth_job 0.
- Let j_last := nth_job (num_arrivals.-1).
- Let a_first := job_arrival j_first.
- Let a_last := job_arrival j_last.
-
- (* By induction, we prove that that each job with index 'idx' arrives at
- least idx*(task_period tsk) units after the first job. *)
- Lemma sorted_arrivals_distance_from_first_job:
- forall idx,
- idx < num_arrivals ->
- job_arrival (nth_job idx) >= a_first + idx * task_period tsk.
- Proof.
- have SEP := sorted_arrivals_separated_by_period.
- unfold sporadic_task_model in *.
- rename H_sporadic_jobs into SPO.
- induction idx; first by intros _; rewrite mul0n addn0.
- intros LT.
- have LT': idx < num_arrivals by apply leq_ltn_trans with (n := idx.+1).
- specialize (IHidx LT').
- apply leq_trans with (n := job_arrival (nth_job idx) + task_period tsk);
- first by rewrite mulSn [task_period _ + _]addnC addnA leq_add2r.
- apply SEP.
- by rewrite -(ltn_add2r 1) 2!addn1 (ltn_predK LT).
- Qed.
-
- (* Therefore, the first and last jobs are separated by at least
- (num_arrivals - 1) periods. *)
- Corollary sorted_arrivals_distance_between_first_and_last:
- a_last >= a_first + (num_arrivals-1) * task_period tsk.
- Proof.
- rename H_at_least_one_job into TWO.
- have DIST := sorted_arrivals_distance_from_first_job.
- rewrite subn1; apply DIST.
- by destruct num_arrivals; first by rewrite ltn0 in TWO.
- Qed.
-
- End FirstAndLastJobs.
-
- End DistanceBetweenSporadicJobs.
-
-End TaskArrivalWithJitter.
\ No newline at end of file
diff --git a/classic/model/policy_tdma.v b/classic/model/policy_tdma.v
deleted file mode 100644
index 194f2293a597ba364375bba2e394517597ac4686..0000000000000000000000000000000000000000
--- a/classic/model/policy_tdma.v
+++ /dev/null
@@ -1,213 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time
- prosa.classic.model.arrival.basic.task
- prosa.classic.model.arrival.basic.job.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop div.
-
-Module PolicyTDMA.
-
- Import Time.
-
- (** In this section, we define the TDMA policy.*)
- Section TDMA.
- (* The TDMA policy is based on two properties.
- (1) Each task has a fixed, reserved time slot for execution;
- (2) These time slots are ordered in sequence to form a TDMA cycle, which repeats along the timeline.
- An example of TDMA schedule is illustrated in the following.
- ______________________________
- | s1 | s2 |s3| s1 | s2 |s3|...
- --------------------------------------------->
- 0 t
- *)
- Variable Task: eqType.
- (* With each task, we associate the duration of the corresponding TDMA slot. *)
- Definition TDMA_slot:= Task -> duration.
- (* Moreover, within each TDMA cycle, task slots are ordered according to some relation. *)
- Definition TDMA_slot_order:= rel Task.
-
- End TDMA.
-
- (** In this section, we define the properties of TDMA and prove some basic lemmas. *)
- Section PropertiesTDMA.
-
- Context {Task:eqType}.
-
- (* Consider any task set ts... *)
- Variable ts: {set Task}.
-
- (* ...and any slot order (i.e, slot_order slot1 slot2 means that slot1 comes before slot2 in a TDMA cycle). *)
- Variable slot_order: TDMA_slot_order Task.
-
- (* First, we define the properties of a valid time slot order. *)
- Section Relation.
- (* Time slot order must transitive... *)
- Definition slot_order_is_transitive:= transitive slot_order.
-
- (* ..., totally ordered over the task set... *)
- Definition slot_order_is_total_over_task_set :=
- total_over_list slot_order ts.
-
- (* ... and antisymmetric over task set. *)
- Definition slot_order_is_antisymmetric_over_task_set :=
- antisymmetric_over_list slot_order ts.
-
- End Relation.
-
- (* Next, we define some properties of task time slots *)
- Section TimeSlot.
-
- (* Consider any task in task set ts*)
- Variable task: Task.
- Hypothesis H_task_in_ts: task \in ts.
-
- (* Consider any TDMA slot assignment for these tasks *)
- Variable task_time_slot: TDMA_slot Task.
-
- (* A valid time slot must be positive *)
- Definition is_valid_time_slot:=
- task_time_slot task > 0.
-
- (* We define the TDMA cycle as the sum of all the tasks' time slots *)
- Definition TDMA_cycle:=
- \sum_(tsk <- ts) task_time_slot tsk.
-
- (* We define the function returning the slot offset for each task:
- i.e., the distance between the start of the TDMA cycle and
- the start of the task time slot *)
- Definition Task_slot_offset:=
- \sum_(prev_task <- ts | slot_order prev_task task && (prev_task != task)) task_time_slot prev_task.
-
- (* The following function tests whether a task is in its time slot at instant t *)
- Definition Task_in_time_slot (t:time):=
- ((t + TDMA_cycle - (Task_slot_offset)%% TDMA_cycle) %% TDMA_cycle)
- < (task_time_slot task).
-
- Section BasicLemmas.
-
- (* Assume task_time_slot is valid time slot*)
- Hypothesis time_slot_positive:
- is_valid_time_slot.
-
- (* Obviously, the TDMA cycle is greater or equal than any task time slot which is
- in TDMA cycle *)
- Lemma TDMA_cycle_ge_each_time_slot:
- TDMA_cycle >= task_time_slot task.
- Proof.
- rewrite /TDMA_cycle (big_rem task) //.
- apply:leq_trans; last by exact: leq_addr.
- by apply leqnn.
- Qed.
-
- (* Thus, a TDMA cycle is always positive *)
- Lemma TDMA_cycle_positive:
- TDMA_cycle > 0.
- Proof.
- move:time_slot_positive. move/leq_trans;apply;apply TDMA_cycle_ge_each_time_slot.
- Qed.
-
- (* Slot offset is less then cycle *)
- Lemma Offset_lt_cycle:
- Task_slot_offset < TDMA_cycle.
- Proof.
- rewrite /Task_slot_offset /TDMA_cycle big_mkcond.
- apply leq_ltn_trans with (n:=\sum_(prev_task <- ts )if prev_task!=task then task_time_slot prev_task else 0).
- - apply leq_sum. intros* T. case (slot_order i task);auto.
- - rewrite -big_mkcond. rewrite-> bigD1_seq with (j:=task);auto.
- rewrite -subn_gt0 -addnBA. rewrite subnn addn0 //.
- trivial. apply (set_uniq ts).
- Qed.
-
- (* For a task, the sum of its slot offset and its time slot is
- less then or equal to cycle. *)
- Lemma Offset_add_slot_leq_cycle:
- Task_slot_offset + task_time_slot task <= TDMA_cycle.
- Proof.
- rewrite /Task_slot_offset /TDMA_cycle.
- rewrite addnC (bigD1_seq task) //=. rewrite leq_add2l.
- rewrite big_mkcond.
- replace (\sum_(i <- ts | i != task) task_time_slot i)
- with (\sum_(i <- ts ) if i != task then task_time_slot i else 0).
- apply leq_sum. intros*T. case (slot_order i task);auto.
- by rewrite -big_mkcond. apply (set_uniq ts).
- Qed.
-
- End BasicLemmas.
-
- End TimeSlot.
-
- (* In this section, we prove that no two tasks share the same time slot at any time. *)
- Section InTimeSlotUniq.
-
- (* Consider any TDMA slot assignment for these tasks *)
- Variable task_time_slot: TDMA_slot Task.
-
- (* Assume that slot order is total... *)
- Hypothesis slot_order_total:
- slot_order_is_total_over_task_set.
-
- (*..., antisymmetric... *)
- Hypothesis slot_order_antisymmetric:
- slot_order_is_antisymmetric_over_task_set.
-
- (*... and transitive. *)
- Hypothesis slot_order_transitive:
- slot_order_is_transitive.
-
- (* Then, we can prove that the difference value between two offsets is
- at least a slot *)
- Lemma relation_offset:
- forall tsk1 tsk2, tsk1 \in ts -> tsk2 \in ts ->
- slot_order tsk1 tsk2 -> tsk1 != tsk2 ->
- Task_slot_offset tsk2 task_time_slot >= Task_slot_offset tsk1 task_time_slot + task_time_slot tsk1 .
- Proof.
- intros* IN1 IN2 ORDER NEQ.
- rewrite /Task_slot_offset big_mkcond addnC.
- replace (\sum_(tsk <- ts | slot_order tsk tsk2 && (tsk != tsk2)) task_time_slot tsk)
- with (task_time_slot tsk1 + \sum_(tsk <- ts )if slot_order tsk tsk2 && (tsk != tsk1) && (tsk!=tsk2) then task_time_slot tsk else O).
- rewrite leq_add2l. apply leq_sum_seq. intros* IN T.
- case (slot_order i tsk1)eqn:SI2;auto. case (i==tsk1)eqn:IT2;auto;simpl.
- case (i==tsk2)eqn:IT1;simpl;auto.
- - by move/eqP in IT1;rewrite IT1 in SI2;apply slot_order_antisymmetric in ORDER;auto;apply ORDER in SI2;move/eqP in NEQ.
- - by rewrite (slot_order_transitive _ _ _ SI2 ORDER).
- - symmetry. rewrite big_mkcond /=. rewrite->bigD1_seq with (j:=tsk1);auto;last by apply (set_uniq ts).
- move/eqP /eqP in ORDER. move/eqP in NEQ. rewrite ORDER //=. apply /eqP.
- have TS2: (tsk1 != tsk2) = true . apply /eqP;auto. rewrite TS2.
- rewrite eqn_add2l. rewrite big_mkcond. apply/eqP. apply eq_bigr;auto.
- intros* T. case(i!=tsk1);case (slot_order i tsk2);case (i!=tsk2) ;auto.
- Qed.
-
- (* Then, we proved that no two tasks share the same time slot at any time. *)
- Lemma task_in_time_slot_uniq:
- forall tsk1 tsk2 t, tsk1 \in ts -> task_time_slot tsk1 > 0 ->
- tsk2 \in ts -> task_time_slot tsk2 > 0 ->
- Task_in_time_slot tsk1 task_time_slot t ->
- Task_in_time_slot tsk2 task_time_slot t ->
- tsk1 = tsk2.
- Proof.
- intros* IN1 SLOT1 IN2 SLOT2.
- rewrite /Task_in_time_slot.
- set cycle:=TDMA_cycle task_time_slot.
- set O1:= Task_slot_offset tsk1 task_time_slot.
- set O2:= Task_slot_offset tsk2 task_time_slot.
- have CO1: O1 < cycle by apply Offset_lt_cycle.
- have CO2: O2 < cycle by apply Offset_lt_cycle.
- have C: cycle > 0 by apply (TDMA_cycle_positive tsk1).
- have GO1:O1 %% cycle = O1 by apply modn_small,Offset_lt_cycle. rewrite GO1.
- have GO2:O2 %% cycle = O2 by apply modn_small,Offset_lt_cycle. rewrite GO2.
- have SO1:O1 + task_time_slot tsk1 <= cycle by apply (Offset_add_slot_leq_cycle tsk1).
- have SO2:O2 + task_time_slot tsk2 <= cycle by apply (Offset_add_slot_leq_cycle tsk2).
- repeat rewrite mod_elim;auto.
- case (O1 <= t%%cycle)eqn:O1T;case (O2 <= t %%cycle)eqn:O2T;intros G1 G2;try lia.
- rewrite ltn_subLR // in G1; rewrite ltn_subLR // in G2. case (tsk1==tsk2) eqn:NEQ;move/eqP in NEQ;auto.
- destruct (slot_order_total tsk1 tsk2) as [order |order];auto;apply relation_offset in order;
- fold O1 O2 in order;try lia;auto. by move/eqP in NEQ. apply /eqP;auto.
- Qed.
-
- End InTimeSlotUniq.
-
- End PropertiesTDMA.
-
-End PolicyTDMA.
-
-
-
diff --git a/classic/model/priority.v b/classic/model/priority.v
deleted file mode 100644
index bbea9d2139f28c6de63d20209bb64ca0fd3655b8..0000000000000000000000000000000000000000
--- a/classic/model/priority.v
+++ /dev/null
@@ -1,356 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq.
-
-(* Definitions of FP, JLFP and JLDP priority relations. *)
-Module Priority.
-
- Import SporadicTaskset ArrivalSequence.
-
- Section PriorityDefs.
-
- Variable Task: eqType.
- Variable Job: eqType.
-
- (* We define an FP policy as a relation between tasks, ... *)
- Definition FP_policy := rel Task.
-
- (* ...JLFP policy as a relation between jobs, ... *)
- Definition JLFP_policy := rel Job.
-
- (* ...and JLDP as any time-dependent relation between jobs. *)
- Definition JLDP_policy := time -> rel Job.
-
- End PriorityDefs.
-
- (* Since FP policies are also JLFP and JLDP policies, we define
- next conversion functions to do the generalization. *)
- Section Generalization.
-
- (* Consider any arrival sequence of jobs spawned by tasks. *)
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> Task.
-
- (* We show how to convert FP to JLFP,... *)
- Definition FP_to_JLFP (task_hp: FP_policy Task) :=
- fun (jhigh jlow: Job) =>
- task_hp (job_task jhigh) (job_task jlow).
-
- (* ...FP to JLDP, ... *)
- Definition FP_to_JLDP (task_hp: FP_policy Task) :=
- fun (t: time) => FP_to_JLFP task_hp.
-
- (* ...and JLFP to JLDP. *)
- Definition JLFP_to_JLDP (job_hp: JLFP_policy Job) :=
- fun (t: time) => job_hp.
-
- End Generalization.
-
- (* Next we define properties of an FP policy. *)
- Section PropertiesFP.
-
- (* Assume that jobs are spawned by tasks. *)
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> Task.
-
- (* Let task_priority be any FP policy. *)
- Variable task_priority: FP_policy Task.
-
- (* Now we define the properties. *)
-
- (* Whether the FP policy is reflexive. *)
- Definition FP_is_reflexive := reflexive task_priority.
-
- (* Whether the FP policy is irreflexive. *)
- Definition FP_is_irreflexive := irreflexive task_priority.
-
- (* Whether the FP policy is transitive. *)
- Definition FP_is_transitive := transitive task_priority.
-
- Section Antisymmetry.
-
- (* Consider any task set ts. *)
- Variable ts: seq Task.
-
- (* First we define whether task set ts is totally ordered with
- the priority. *)
- Definition FP_is_total_over_task_set :=
- total_over_list task_priority ts.
-
- (* Then we define whether an FP policy is antisymmetric over task set ts, i.e.,
- whether the task set has unique priorities. *)
- Definition FP_is_antisymmetric_over_task_set :=
- antisymmetric_over_list task_priority ts.
-
- End Antisymmetry.
-
- End PropertiesFP.
-
- (* Next, we define properties of a JLFP policy. *)
- Section PropertiesJLFP.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> Task.
- Variable job_arrival: Job -> time.
-
- (* Consider any arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Consider any JLFP policy. *)
- Variable job_priority: JLFP_policy Job.
-
- (* Now we define the properties. *)
-
- (* Whether the JLFP policy is reflexive. *)
- Definition JLFP_is_reflexive := reflexive job_priority.
-
- (* Whether the JLFP policy is irreflexive. *)
- Definition JLFP_is_irreflexive := irreflexive job_priority.
-
- (* Whether the JLFP policy is transitive. *)
- Definition JLFP_is_transitive := transitive job_priority.
-
- (* Whether the JLFP policy is total over the arrival sequence. *)
- Definition JLFP_is_total :=
- forall j1 j2,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- job_priority j1 j2 || job_priority j2 j1.
-
- (* Recall that the jobs are sequential if they are executed
- in the order they arrived (for more details see file
- prosa.classic.model.schedule.uni.schedule.v).
-
- An arbitrary JLFP can violate the sequential jobs hypothesis.
- For example, consider two jobs j1, j2 of the same task such that
- [job_arrival j1 < job_arrival j2]. It is possible that the policy
- will assign a higher priority to the second job [i.e., π(j1) < π(j2)].
- But this situation contradicts to sequential job hypothesis.
-
- We say that JLFP respects sequential jobs if for any two jobs
- j1, j2 from the same task the fact that [job_arrival j1 <= job_arrival j2]
- implies [π(j1) >= π(j2)]. *)
- Definition JLFP_respects_sequential_jobs :=
- forall j1 j2,
- job_task j1 == job_task j2 ->
- job_arrival j1 <= job_arrival j2 ->
- job_priority j1 j2.
-
- End PropertiesJLFP.
-
- (* Next, we define properties of a JLDP policy. *)
- Section PropertiesJLDP.
-
- (* Consider any JLDP policy. *)
- Context {Job: eqType}.
- Variable arr_seq: arrival_sequence Job.
-
- Variable job_priority: JLDP_policy Job.
-
- (* Now we define the properties. *)
-
- (* Whether the JLDP policy is reflexive. *)
- Definition JLDP_is_reflexive :=
- forall t, reflexive (job_priority t).
-
- (* Whether the JLDP policy is irreflexive. *)
- Definition JLDP_is_irreflexive :=
- forall t, irreflexive (job_priority t).
-
- (* Whether the JLDP policy is transitive. *)
- Definition JLDP_is_transitive :=
- forall t, transitive (job_priority t).
-
- (* Whether the JLDP policy is total. *)
- Definition JLDP_is_total :=
- forall j1 j2 t,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- job_priority t j1 j2 || job_priority t j2 j1.
-
- End PropertiesJLDP.
-
- (* Next we define some known FP policies. *)
- Section KnownFPPolicies.
-
- Context {Job: eqType}.
- Context {Task: eqType}.
- Variable task_period: Task -> time.
- Variable task_deadline: Task -> time.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Rate-monotonic orders tasks by smaller periods. *)
- Definition RM (tsk1 tsk2: Task) :=
- task_period tsk1 <= task_period tsk2.
-
- (* Deadline-monotonic orders tasks by smaller relative deadlines. *)
- Definition DM (tsk1 tsk2: Task) :=
- task_deadline tsk1 <= task_deadline tsk2.
-
- Section Properties.
-
- (* RM is reflexive. *)
- Lemma RM_is_reflexive : FP_is_reflexive RM.
- Proof.
- unfold FP_is_reflexive, reflexive, RM.
- by intros tsk; apply leqnn.
- Qed.
-
- (* RM is transitive. *)
- Lemma RM_is_transitive : FP_is_transitive RM.
- Proof.
- unfold FP_is_transitive, transitive, RM.
- by intros y x z; apply leq_trans.
- Qed.
-
- (* DM is reflexive. *)
- Lemma DM_is_reflexive : FP_is_reflexive DM.
- Proof.
- unfold FP_is_reflexive, reflexive, DM.
- by intros tsk; apply leqnn.
- Qed.
-
- (* DM is transitive. *)
- Lemma DM_is_transitive : FP_is_transitive DM.
- Proof.
- unfold FP_is_transitive, transitive, DM.
- by intros y x z; apply leq_trans.
- Qed.
-
- (* Any FP respects sequential jobs. *)
- Lemma any_reflexive_FP_respects_sequential_jobs:
- forall job_priority: FP_policy Task,
- FP_is_reflexive job_priority ->
- JLFP_respects_sequential_jobs
- job_task job_arrival (FP_to_JLFP job_task job_priority).
- Proof.
- intros HP REFL j1 j2 TSK ARR.
- move: TSK => /eqP TSK.
- unfold FP_to_JLFP; rewrite TSK.
- by apply REFL.
- Qed.
-
- End Properties.
-
- End KnownFPPolicies.
-
- (* In this section, we define known JLFP policies. *)
- Section KnownJLFPPolicies.
-
- (* EDF policy. *)
- Section EDF.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_deadline: Job -> time.
-
- Variable arr_seq: arrival_sequence Job.
-
- (* We define earliest deadline first (EDF) as ordering jobs by absolute deadlines. *)
- Definition EDF (j1 j2: Job) :=
- job_arrival j1 + job_deadline j1 <= job_arrival j2 + job_deadline j2.
-
- Section Properties.
-
- (* EDF is reflexive. *)
- Lemma EDF_is_reflexive : JLFP_is_reflexive EDF.
- Proof.
- by intros j; apply leqnn.
- Qed.
-
- (* EDF is transitive. *)
- Lemma EDF_is_transitive : JLFP_is_transitive EDF.
- Proof.
- by intros y x z; apply leq_trans.
- Qed.
-
- (* EDF is total. *)
- Lemma EDF_is_total : JLFP_is_total arr_seq EDF.
- Proof.
- unfold EDF; intros x y ARRx ARRy.
- case (leqP (job_arrival x + job_deadline x)
- (job_arrival y + job_deadline y));
- [by rewrite orTb | by move/ltnW => ->].
- Qed.
-
- End Properties.
-
- End EDF.
-
- (* EDF in the presence of tasks. *)
- Section EDFwithTasks.
-
- Context {Task: eqType}.
- Variable task_deadline: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Notice that in the presence of tasks the relative dealine
- of a job is equal to the relative deadline of its task. *)
- Definition job_relative_dealine (j: Job) := task_deadline (job_task j).
-
- (* EDF respects sequential jobs.*)
- Lemma EDF_respects_sequential_jobs:
- JLFP_respects_sequential_jobs
- job_task job_arrival (EDF job_arrival job_relative_dealine).
- Proof.
- intros j1 j2 TSK ARR.
- move: TSK => /eqP TSK.
- unfold EDF, job_relative_dealine; rewrite TSK.
- by rewrite leq_add2r.
- Qed.
-
- End EDFwithTasks.
-
- End KnownJLFPPolicies.
-
- (* In this section, we define the notion of a possible interfering task. *)
- Section PossibleInterferingTasks.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Section FP.
-
- (* Assume an FP policy. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* Let tsk be the task to be analyzed ... *)
- Variable tsk: sporadic_task.
-
- (* ...and let tsk_other be another task. *)
- Variable tsk_other: sporadic_task.
-
- (* Under FP scheduling with constrained deadlines, tsk_other can only interfere
- with tsk if it is a different task with higher priority. *)
- Definition higher_priority_task :=
- higher_eq_priority tsk_other tsk &&
- (tsk_other != tsk).
-
- End FP.
-
- Section JLFP.
-
- (* Let tsk be the task to be analyzed ... *)
- Variable tsk: sporadic_task.
-
- (* ...and let tsk_other be another task. *)
- Variable tsk_other: sporadic_task.
-
- (* Under JLFP/JLDP scheduling with constrained deadlines, tsk_other can only interfere
- with tsk if it is a different task. *)
- Definition different_task := tsk_other != tsk.
-
- End JLFP.
-
- End PossibleInterferingTasks.
-
-End Priority.
\ No newline at end of file
diff --git a/classic/model/schedule/apa/affinity.v b/classic/model/schedule/apa/affinity.v
deleted file mode 100644
index 0ae5e1fbeefbb22bfc2f9e09ba868834aba3ee7f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/apa/affinity.v
+++ /dev/null
@@ -1,102 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Definition and properties about processor affinities. *)
-Module Affinity.
-
- Import ArrivalSequence ScheduleOfSporadicTask.
-
- Section AffinityDefs.
-
- Variable sporadic_task: eqType.
-
- (* Given the number of processors, ... *)
- Variable num_cpus: nat.
-
- (* ... let a processor affinity be a subset of these processors.
- Note: notation {set T} is just a list of type T with no duplicates. *)
- Definition affinity := {set (processor num_cpus)}.
-
- (* Next, we define a task affinity as the mapping from tasks to affinities. *)
- Definition task_affinity := sporadic_task -> affinity.
-
- End AffinityDefs.
-
- Section Properties.
-
- Context {sporadic_task: eqType}.
- Context {num_cpus: nat}.
-
- Section JobProperties.
-
- (* Assume that each task has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Then, we say that task tsk ...*)
- Variable tsk: sporadic_task.
-
- (* ... can execute on processor cpu ...*)
- Variable cpu: processor num_cpus.
-
- (* ... iff cpu is part of j's affinity. *)
- Definition can_execute_on := cpu \in alpha tsk.
-
- End JobProperties.
-
- Section ScheduleProperties.
-
- Context {Job: eqType}.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any schedule, ... *)
- Variable sched: schedule Job num_cpus.
-
- (* ... and some affinity alpha. *)
- Variable alpha: affinity num_cpus.
-
- (* We say that a task is executing on alpha at time t iff it is
- scheduled on some processor in that affinity. *)
- Definition task_scheduled_on_affinity (tsk: sporadic_task) (t: time) :=
- [exists cpu, (cpu \in alpha) && task_scheduled_on job_task sched tsk cpu t].
-
- End ScheduleProperties.
-
- Section Subset.
-
- (* Given two affinities alpha' and alpha, ...*)
- Variable alpha' alpha: affinity num_cpus.
-
- (* ... we say that alpha' is subaffinity of alpha iff
- alpha' is contained in alpha. *)
- Definition is_subaffinity := {subset alpha' <= alpha}.
-
- Section Lemmas.
-
- Hypothesis H_subaffinity: is_subaffinity.
-
- Lemma leq_subaffinity : #|alpha'| <= #|alpha|.
- Proof.
- assert (UNIQ: uniq (alpha)). by destruct (alpha).
- assert (UNIQ': uniq (alpha')). by destruct (alpha').
- move: (UNIQ) (UNIQ') => /card_uniqP -> /card_uniqP ->.
- by apply uniq_leq_size.
- Qed.
-
- End Lemmas.
-
- End Subset.
-
- Section IntersectingAffinities.
-
- (* We say that alpha and alpha' intersect iff there exists a processor
- that belongs to both affinities. *)
- Definition affinity_intersects (alpha alpha': affinity num_cpus) :=
- [exists cpu, (cpu \in alpha) && (cpu \in alpha')].
-
- End IntersectingAffinities.
-
- End Properties.
-
-End Affinity.
\ No newline at end of file
diff --git a/classic/model/schedule/apa/constrained_deadlines.v b/classic/model/schedule/apa/constrained_deadlines.v
deleted file mode 100644
index e201d732a98f4ddee3a37828f45b5670ecaee131..0000000000000000000000000000000000000000
--- a/classic/model/schedule/apa/constrained_deadlines.v
+++ /dev/null
@@ -1,293 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.interference prosa.classic.model.schedule.apa.affinity prosa.classic.model.schedule.apa.platform.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module ConstrainedDeadlines.
-
- Import Job SporadicTaskset ScheduleOfSporadicTask SporadicTaskset
- TaskArrival Interference Priority Affinity Platform.
-
- Section Lemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence ... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any schedule of this arrival sequence. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Assume that every task has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Assume all jobs have valid parameters, ...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* In this section we prove the absence of multiple jobs of the same
- task when constrained deadlines are assumed. *)
- Section NoMultipleJobs.
-
- (* Assume any work-conserving priority-based scheduler. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_work_conserving:
- apa_work_conserving job_arrival job_cost job_task arr_seq sched alpha.
- Hypothesis H_respects_JLDP_policy:
- respects_JLDP_policy_under_weak_APA job_arrival job_cost job_task arr_seq
- sched alpha higher_eq_priority.
-
- (* Consider task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all jobs come from the taskset. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Suppose that jobs are sequential, ...*)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- (* ... jobs only execute after they arrive, ... *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- (* ... and jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule satisfies the sporadic task model ...*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider a valid task tsk, ...*)
- Variable tsk: sporadic_task.
- Hypothesis H_valid_task: is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (*... whose job j ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (*... is backlogged at time t. *)
- Variable t: time.
- Hypothesis H_j_backlogged: backlogged job_arrival job_cost sched j t.
-
- (* Assume that any previous jobs of tsk have completed by the period. *)
- Hypothesis H_all_previous_jobs_completed :
- forall j_other tsk_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- job_arrival j_other + task_period tsk_other <= t ->
- completed job_cost sched j_other (job_arrival j_other + task_period (job_task j_other)).
-
- Let scheduled_task_other_than (tsk tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t && (tsk_other != tsk).
-
- (* Then, there can be at most one pending job of each task at time t. *)
- Lemma platform_at_most_one_pending_job_of_each_task :
- forall j1 j2,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- pending job_arrival job_cost sched j1 t ->
- pending job_arrival job_cost sched j2 t ->
- job_task j1 = job_task j2 ->
- j1 = j2.
- Proof.
- rename H_sporadic_tasks into SPO, H_all_previous_jobs_completed into PREV.
- intros j1 j2 ARR1 ARR2 PENDING1 PENDING2 SAMEtsk.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: PENDING1 PENDING2 => /andP [ARRIVED1 /negP NOTCOMP1] /andP [ARRIVED2 /negP NOTCOMP2].
- destruct (leqP (job_arrival j1) (job_arrival j2)) as [BEFORE1 | BEFORE2].
- {
- specialize (SPO j1 j2 DIFF ARR1 ARR2 SAMEtsk BEFORE1).
- assert (LEt: job_arrival j1 + task_period (job_task j1) <= t).
- {
- by apply leq_trans with (n := job_arrival j2); first by done.
- }
- exploit (PREV j1 (job_task j1)); try (by done).
- intros COMP1; apply NOTCOMP1.
- try ( by apply completion_monotonic with (t0 := job_arrival j1 + task_period (job_task j1)) ) ||
- by apply completion_monotonic with (t := job_arrival j1 + task_period (job_task j1)).
- }
- {
- apply ltnW in BEFORE2.
- exploit (SPO j2 j1); try (by done); [by red; ins; subst | intro SPO'].
- assert (LEt: job_arrival j2 + task_period (job_task j2) <= t).
- {
- by apply leq_trans with (n := job_arrival j1); first by done.
- }
- exploit (PREV j2 (job_task j2)); try (by done).
- intros COMP2; apply NOTCOMP2.
- try ( by apply completion_monotonic with (t0 := job_arrival j2 + task_period (job_task j2)) ) ||
- by apply completion_monotonic with (t := job_arrival j2 + task_period (job_task j2)).
- }
- Qed.
-
- End NoMultipleJobs.
-
- (* In this section we also prove the absence of multiple jobs of the same
- task when constrained deadlines are assumed, but in the specific case
- of fixed-priority scheduling. *)
- Section NoMultipleJobsFP.
-
- (* Assume any work-conserving priority-based scheduler. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
- Hypothesis H_work_conserving: apa_work_conserving job_arrival job_cost job_task
- arr_seq sched alpha.
- Hypothesis H_respects_JLDP_policy:
- respects_FP_policy_under_weak_APA job_arrival job_cost job_task arr_seq
- sched alpha higher_eq_priority.
-
- (* Consider any task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all jobs come from the taskset. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Suppose that jobs are sequential, ...*)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- (* ... jobs only execute after the jitter, ... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- (* ... and jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule satisfies the sporadic task model ...*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider a valid task tsk, ...*)
- Variable tsk: sporadic_task.
- Hypothesis H_valid_task: is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (*... whose job j ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Variable H_job_of_tsk: job_task j = tsk.
-
- (*... is backlogged at time t <= job_arrival j + task_period tsk. *)
- Variable t: time.
- Hypothesis H_j_backlogged: backlogged job_arrival job_cost sched j t.
- Hypothesis H_t_before_period: t < job_arrival j + task_period tsk.
-
- (* Recall the definition of a higher-priority task in affinity (alpha' tsk). *)
- Let hp_task_in alpha' := higher_priority_task_in alpha higher_eq_priority tsk alpha'.
-
- (* Assume that any jobs of higher-priority tasks complete by their period. *)
- Hypothesis H_all_previous_jobs_completed :
- forall j_other tsk_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- hp_task_in (alpha tsk) tsk_other ->
- completed job_cost sched j_other (job_arrival j_other + task_period tsk_other).
-
- (* Assume that any jobs of tsk prior to j complete by their period. *)
- Hypothesis H_all_previous_jobs_of_tsk_completed :
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + task_period tsk).
-
- Definition scheduled_task_with_higher_eq_priority (tsk tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- hp_task_in (alpha tsk) tsk_other.
-
- (* Then, there can be at most one pending job of higher-priority tasks at time t. *)
- Lemma platform_fp_no_multiple_jobs_of_interfering_tasks :
- forall j1 j2,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- pending job_arrival job_cost sched j1 t ->
- pending job_arrival job_cost sched j2 t ->
- job_task j1 = job_task j2 ->
- hp_task_in (alpha tsk) (job_task j1) ->
- j1 = j2.
- Proof.
- unfold sporadic_task_model in *.
- rename H_sporadic_tasks into SPO, H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_all_previous_jobs_completed into PREV.
- intros j1 j2 ARR1 ARR2 PENDING1 PENDING2 SAMEtsk INTERF.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: PENDING1 PENDING2 => /andP [ARRIVED1 /negP NOTCOMP1] /andP [ARRIVED2 /negP NOTCOMP2].
- destruct (leqP (job_arrival j1) (job_arrival j2)) as [BEFORE1 | BEFORE2].
- {
- specialize (SPO j1 j2 DIFF ARR1 ARR2 SAMEtsk BEFORE1).
- assert (LEt: job_arrival j1 + task_period (job_task j1) <= t).
- by apply leq_trans with (n := job_arrival j2).
- exploit (PREV j1 (job_task j1) ARR1); [by done | by apply INTERF | intros COMP1].
- apply NOTCOMP1.
- try ( by apply completion_monotonic with (t0 := job_arrival j1 + task_period (job_task j1)) ) ||
- by apply completion_monotonic with (t := job_arrival j1 + task_period (job_task j1)).
- }
- {
- apply ltnW in BEFORE2.
- exploit (SPO j2 j1); try (by done); [by red; ins; subst j2 | intro SPO'].
- assert (LEt: job_arrival j2 + task_period (job_task j2) <= t).
- by apply leq_trans with (n := job_arrival j1).
- exploit (PREV j2 (job_task j2) ARR2);
- [by done | by rewrite -SAMEtsk | intro COMP2 ].
- apply NOTCOMP2.
- try ( by apply completion_monotonic with (t0 := job_arrival j2 + task_period (job_task j2)) ) ||
- by apply completion_monotonic with (t := job_arrival j2 + task_period (job_task j2)).
- }
- Qed.
-
- (* Also, there can be at most one pending job of tsk at time t. *)
- Lemma platform_fp_no_multiple_jobs_of_tsk :
- forall j',
- arrives_in arr_seq j' ->
- pending job_arrival job_cost sched j' t ->
- job_task j' = tsk ->
- j' = j.
- Proof.
- unfold sporadic_task_model in *.
- rename H_sporadic_tasks into SPO,
- H_valid_task into PARAMS,
- H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_all_previous_jobs_completed into PREV,
- H_j_backlogged into BACK, H_job_of_tsk into JOBtsk.
- intros j' ARR' PENDING' SAMEtsk.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: BACK PENDING' => /andP [/andP [ARRIVED /negP NOTCOMP] NOTSCHED]
- /andP [ARRIVED' /negP NOTCOMP'].
- destruct (leqP (job_arrival j') (job_arrival j)) as [BEFORE | BEFORE'].
- {
- exploit (SPO j' j DIFF ARR' H_j_arrives); [by rewrite JOBtsk | by done | intro SPO'].
- assert (LEt: job_arrival j' + task_period tsk <= t).
- by apply leq_trans with (n := job_arrival j); first by rewrite -SAMEtsk.
- apply NOTCOMP'.
- (try ( apply completion_monotonic with (t0 := job_arrival j' + task_period tsk) ) ||
- apply completion_monotonic with (t := job_arrival j' + task_period tsk)); [by done |].
- apply PREVtsk; try (by done).
- apply leq_trans with (n := job_arrival j' + task_period tsk); last by rewrite -SAMEtsk.
- rewrite -addn1; apply leq_add; first by done.
- by unfold is_valid_sporadic_task in *; des.
- }
- {
- unfold has_arrived in *.
- rewrite leqNgt in ARRIVED'; move: ARRIVED' => /negP BUG; apply BUG.
- apply leq_trans with (n := job_arrival j + task_period tsk); first by done.
- by rewrite -JOBtsk; apply SPO; try (by done);
- [by red; ins; subst j' | by rewrite SAMEtsk | by apply ltnW].
- }
- Qed.
-
- End NoMultipleJobsFP.
-
- End Lemmas.
-
-End ConstrainedDeadlines.
diff --git a/classic/model/schedule/apa/interference.v b/classic/model/schedule/apa/interference.v
deleted file mode 100644
index 4413ecc86c7cc42d6e38f565a2b4c98e2f4f44ff..0000000000000000000000000000000000000000
--- a/classic/model/schedule/apa/interference.v
+++ /dev/null
@@ -1,272 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.affinity.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module Interference.
-
- Import Schedule ScheduleOfSporadicTask Priority Workload Affinity.
-
- (* In this section, we define the notion of a possible interfering task. *)
- Section PossibleInterferingTasks.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- (* Consider an APA platform with affinity alpha. *)
- Context {num_cpus: nat}.
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- Section FP.
-
- (* Assume an FP policy. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* Let tsk be the task to be analyzed ... *)
- Variable tsk: sporadic_task.
-
- (* ...assuming a subaffinity alpha'. *)
- Variable alpha': affinity num_cpus.
-
- (* Let tsk_other be another task. *)
- Variable tsk_other: sporadic_task.
-
- (* Under FP scheduling with constrained deadlines, tsk_other can only interfere
- with tsk if it is a different task with higher or equal priority and
- intersecting affinity. *)
- Definition higher_priority_task_in :=
- higher_eq_priority tsk_other tsk &&
- (tsk_other != tsk) &&
- affinity_intersects alpha' (alpha tsk_other).
-
- End FP.
-
- Section JLFP.
-
- (* Let tsk be the task to be analyzed ... *)
- Variable tsk: sporadic_task.
-
- (* ...assuming a subaffinity alpha'. *)
- Variable alpha': affinity num_cpus.
-
- (* Let tsk_other be another task. *)
- Variable tsk_other: sporadic_task.
-
- (* Under JLFP/JLDP scheduling with constrained deadlines, tsk_other can only interfere
- with tsk if it is a different task with intersecting affinity. *)
- Definition different_task_in :=
- (tsk_other != tsk) &&
- affinity_intersects alpha' (alpha tsk_other).
-
- End JLFP.
-
- End PossibleInterferingTasks.
-
- Section InterferenceDefs.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence...*)
- Context {arr_seq: arrival_sequence Job}.
-
- (* ... and any schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Assume that every job at any time has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Consider any job j that incurs interference. *)
- Variable j: Job.
-
- (* Recall the definition of backlogged (pending and not scheduled). *)
- Let job_is_backlogged (t: time) := backlogged job_arrival job_cost sched j t.
-
- (* First, we define total interference. *)
- Section TotalInterference.
-
- (* The total interference incurred by job j during [t1, t2) is the
- cumulative time in which j is backlogged in this interval. *)
- Definition total_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2) job_is_backlogged t.
-
- End TotalInterference.
-
- (* Next, we define job interference. *)
- Section JobInterference.
-
- (* Let job_other be a job that interferes with j. *)
- Variable job_other: Job.
-
- (* The interference caused by job_other during [t1, t2) is the cumulative
- time in which j is backlogged while job_other is scheduled. *)
- Definition job_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2)
- \sum_(cpu < num_cpus)
- (job_is_backlogged t &&
- can_execute_on alpha (job_task j) cpu &&
- scheduled_on sched job_other cpu t).
-
- End JobInterference.
-
- (* Next, we define task interference. *)
- Section TaskInterference.
-
- (* Consider any interfering task tsk_other. *)
- Variable tsk_other: sporadic_task.
-
- (* The interference caused by tsk during [t1, t2) is the cumulative time
- in which j is backlogged while tsk is scheduled. *)
- Definition task_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2)
- \sum_(cpu < num_cpus)
- (job_is_backlogged t &&
- can_execute_on alpha (job_task j) cpu &&
- task_scheduled_on job_task sched tsk_other cpu t).
-
- End TaskInterference.
-
- (* Next, we define an approximation of the total interference based on
- each per-task interference. *)
- Section TaskInterferenceJobList.
-
- Variable tsk_other: sporadic_task.
-
- Definition task_interference_joblist (t1 t2: time) :=
- \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_other)
- job_interference j t1 t2.
-
- End TaskInterferenceJobList.
-
- (* Now we prove some basic lemmas about interference. *)
- Section BasicLemmas.
-
- (* Total interference cannot be larger than the considered time window. *)
- Lemma total_interference_le_delta :
- forall t1 t2,
- total_interference t1 t2 <= t2 - t1.
- Proof.
- unfold total_interference; intros t1 t2.
- apply leq_trans with (n := \sum_(t1 <= t < t2) 1);
- first by apply leq_sum; ins; apply leq_b1.
- by rewrite big_const_nat iter_addn mul1n addn0 leqnn.
- Qed.
-
- (* Job interference is bounded by the service of the interfering job. *)
- Lemma job_interference_le_service :
- forall j_other t1 t2,
- job_interference j_other t1 t2 <= service_during sched j_other t1 t2.
- Proof.
- intros j_other t1 t2; unfold job_interference, service_during.
- apply leq_sum; intros t _.
- unfold service_at; rewrite [\sum_(_ < _ | scheduled_on _ _ _ _)_]big_mkcond.
- apply leq_sum; intros cpu _.
- destruct (job_is_backlogged t); [rewrite andTb | by rewrite andFb].
- destruct (can_execute_on alpha (job_task j) cpu); [rewrite andTb | by rewrite andFb].
- by destruct (scheduled_on sched j_other cpu t).
- Qed.
-
- (* Task interference is bounded by the workload of the interfering task. *)
- Lemma task_interference_le_workload :
- forall tsk t1 t2,
- task_interference tsk t1 t2 <= workload job_task sched tsk t1 t2.
- Proof.
- unfold task_interference, workload; intros tsk t1 t2.
- apply leq_sum; intros t _.
- apply leq_sum; intros cpu _.
- destruct (job_is_backlogged t); [rewrite andTb | by rewrite andFb].
- destruct (can_execute_on alpha (job_task j) cpu); [rewrite andTb | by rewrite andFb].
- unfold task_scheduled_on, service_of_task.
- by destruct (sched cpu t).
- Qed.
-
- End BasicLemmas.
-
- (* Now we prove some bounds on interference for sequential jobs. *)
- Section InterferenceNoParallelism.
-
- (* If jobs are sequential, ... *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* ... then the interference incurred by a job in an interval
- of length delta is at most delta. *)
- Lemma job_interference_le_delta :
- forall j_other t1 delta,
- job_interference j_other t1 (t1 + delta) <= delta.
- Proof.
- rename H_sequential_jobs into SEQ.
- unfold job_interference, sequential_jobs in *.
- intros j_other t1 delta.
- apply leq_trans with (n := \sum_(t1 <= t < t1 + delta) 1);
- last by rewrite big_const_nat iter_addn mul1n addn0 addKn leqnn.
- apply leq_sum; intros t _.
- destruct ([exists cpu, scheduled_on sched j_other cpu t]) eqn:EX.
- {
- move: EX => /existsP [cpu SCHED].
- rewrite (bigD1 cpu) // /=.
- rewrite big_mkcond (eq_bigr (fun x => 0)) /=;
- first by simpl_sum_const; rewrite leq_b1.
- intros cpu' _; des_if_goal; last by done.
- destruct (scheduled_on sched j_other cpu' t) eqn:SCHED'; last by rewrite andbF.
- move: SCHED SCHED' => /eqP SCHED /eqP SCHED'.
- by specialize (SEQ j_other t cpu cpu' SCHED SCHED'); rewrite SEQ in Heq.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP EX.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (EX cpu); apply negbTE in EX; rewrite EX andbF.
- }
- Qed.
-
- End InterferenceNoParallelism.
-
- (* Next, we show that the cumulative per-task interference bounds the total
- interference. *)
- Section BoundUsingPerTaskInterference.
-
- Lemma interference_le_interference_joblist :
- forall tsk t1 t2,
- task_interference tsk t1 t2 <= task_interference_joblist tsk t1 t2.
- Proof.
- intros tsk t1 t2.
- unfold task_interference, task_interference_joblist, job_interference, job_is_backlogged.
- rewrite [\sum_(_ <- _ sched _ _ | _) _]exchange_big /=.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => t /andP [LEt _].
- rewrite exchange_big /=.
- apply leq_sum; intros cpu _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- last by rewrite andFb (eq_bigr (fun x => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- rewrite andTb.
- destruct (task_scheduled_on job_task sched tsk cpu t) eqn:SCHED;
- [rewrite andbT | by rewrite andbF].
- unfold scheduled_on, task_scheduled_on in *.
- destruct (sched cpu t) as [j' |] eqn:SOME; last by done.
- rewrite big_mkcond /= (bigD1_seq j') /=; last by apply undup_uniq.
- {
- by rewrite SCHED eq_refl andbT leq_addr.
- }
- {
- unfold jobs_scheduled_between.
- rewrite mem_undup; apply mem_bigcat_nat with (j := t);
- first by done.
- apply mem_bigcat_ord with (j := cpu); first by apply ltn_ord.
- by unfold make_sequence; rewrite SOME mem_seq1 eq_refl.
- }
- Qed.
-
- End BoundUsingPerTaskInterference.
-
- End InterferenceDefs.
-
-End Interference.
\ No newline at end of file
diff --git a/classic/model/schedule/apa/interference_edf.v b/classic/model/schedule/apa/interference_edf.v
deleted file mode 100644
index b60a688f174ba06c6ef170d25ad639e4c5160f29..0000000000000000000000000000000000000000
--- a/classic/model/schedule/apa/interference_edf.v
+++ /dev/null
@@ -1,79 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.affinity prosa.classic.model.schedule.apa.interference
- prosa.classic.model.schedule.apa.platform.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module InterferenceEDF.
-
- Import Schedule Priority Platform Interference Priority Affinity.
-
- Section Lemmas.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Consider any schedule. *)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
-
- (* Assume that every job at any time has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- (* Assume that the schedule satisfies the global scheduling invariant
- for EDF, i.e., if any job of tsk is backlogged, every processor
- must be busy with jobs with no larger absolute deadline. *)
- Hypothesis H_scheduler_uses_EDF:
- respects_JLFP_policy_under_weak_APA job_arrival job_cost job_task arr_seq sched
- alpha (EDF job_arrival job_deadline).
-
- (* Under EDF scheduling, a job only causes interference if its deadline
- is not larger than the deadline of the analyzed job. *)
- Lemma interference_under_edf_implies_shorter_deadlines :
- forall j j' t1 t2,
- arrives_in arr_seq j' ->
- job_interference job_arrival job_cost job_task sched alpha j' j t1 t2 != 0 ->
- job_arrival j + job_deadline j <= job_arrival j' + job_deadline j'.
- Proof.
- rename H_scheduler_uses_EDF into PRIO.
- unfold respects_JLDP_policy_under_weak_APA in *.
- intros j j' t1 t2 ARR' INTERF.
- unfold job_interference in INTERF.
- destruct ([exists t': 'I_t2,
- [exists cpu: processor num_cpus,
- (t' >= t1) &&
- backlogged job_arrival job_cost sched j' t' &&
- can_execute_on alpha (job_task j') cpu &&
- scheduled_on sched j cpu t']]) eqn:EX.
- {
- move: EX => /existsP [t' /existsP [cpu /andP [/andP [/andP [LE BACK] CAN] SCHED]]].
- by specialize (PRIO j' j cpu t' ARR' BACK SCHED CAN).
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP ALL.
- rewrite big_nat_cond (eq_bigr (fun x => 0)) in INTERF;
- first by rewrite -big_nat_cond big_const_nat iter_addn mul0n addn0 eq_refl in INTERF.
- move => i /andP [/andP [GEi LTi] _].
- specialize (ALL (Ordinal LTi)).
- rewrite negb_exists in ALL.
- move: ALL => /forallP ALL.
- rewrite (eq_bigr (fun x => 0));
- first by rewrite big_const_ord iter_addn mul0n addn0.
- intros cpu _; specialize (ALL cpu); simpl in ALL.
- destruct (backlogged job_arrival job_cost sched j' i); last by rewrite andFb.
- rewrite GEi 2!andTb in ALL; rewrite andTb.
- by apply negbTE in ALL; rewrite ALL.
- }
- Qed.
-
- End Lemmas.
-
-End InterferenceEDF.
\ No newline at end of file
diff --git a/classic/model/schedule/apa/platform.v b/classic/model/schedule/apa/platform.v
deleted file mode 100644
index 6f617453dc191107c243278e61067b42dbb3f3db..0000000000000000000000000000000000000000
--- a/classic/model/schedule/apa/platform.v
+++ /dev/null
@@ -1,116 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.apa.interference prosa.classic.model.schedule.apa.affinity.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module Platform.
-
- Import Job SporadicTaskset ScheduleOfSporadicTask SporadicTaskset
- TaskArrival Interference Priority Affinity.
-
- Section Properties.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence ... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any schedule of this arrival sequence. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Assume that every task has a processor affinity alpha. *)
- Variable alpha: task_affinity sporadic_task num_cpus.
-
- Section Execution.
-
- (* A schedule is work-conserving iff when a job j is backlogged, all
- processors *on which j can be scheduled* are busy with other jobs. *)
- Definition apa_work_conserving :=
- forall j t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- forall cpu,
- can_execute_on alpha (job_task j) cpu ->
- exists j_other,
- scheduled_on sched j_other cpu t.
-
- (* In a schedule that respects affinities, a job is scheduled
- only if its affinity allows it. *)
- Definition respects_affinity :=
- forall j cpu t,
- scheduled_on sched j cpu t ->
- can_execute_on alpha (job_task j) cpu.
-
- End Execution.
-
- Section FP.
-
- (* An FP policy ...*)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ... is respected by a weak APA scheduler iff for any
- backlogged job j, if there is another job j_hp
- executing on j's affinity, then j_hp's task priority
- must be as high as j's task priority. *)
- Definition respects_FP_policy_under_weak_APA :=
- forall j j_hp cpu t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_on sched j_hp cpu t ->
- can_execute_on alpha (job_task j) cpu ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- Section JLFP.
-
- (* A JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ... is respected by a weak APA scheduler iff for
- any backlogged job j, if there is another job j_hp
- executing on j's affinity, then j_hp's priority
- must be as high as j's priority. *)
- Definition respects_JLFP_policy_under_weak_APA :=
- forall j j_hp cpu t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_on sched j_hp cpu t ->
- can_execute_on alpha (job_task j) cpu ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- Section JLDP.
-
- (* A JLFP/JLDP policy ...*)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* ... is respected by a weak APA scheduler iff at any time t,
- for any backlogged job j, if there is another job j_hp
- executing on j's affinity, then j_hp's priority must be
- as high as j's priority. *)
- Definition respects_JLDP_policy_under_weak_APA :=
- forall j j_hp cpu t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_on sched j_hp cpu t ->
- can_execute_on alpha (job_task j) cpu ->
- higher_eq_priority t j_hp j.
-
- End JLDP.
-
- End Properties.
-
-End Platform.
\ No newline at end of file
diff --git a/classic/model/schedule/global/basic/constrained_deadlines.v b/classic/model/schedule/global/basic/constrained_deadlines.v
deleted file mode 100644
index 6879906301527a6ed7820c4a75a1ba6b72df435f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/basic/constrained_deadlines.v
+++ /dev/null
@@ -1,450 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.interference
- prosa.classic.model.schedule.global.basic.platform.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module ConstrainedDeadlines.
-
- Import Job SporadicTaskset ScheduleOfSporadicTask SporadicTaskset
- TaskArrival Interference Priority Platform.
-
- Section Lemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence ... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any schedule of this arrival sequence. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Assume all jobs have valid parameters, ...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* In this section we prove the absence of multiple jobs of the same
- task when constrained deadlines are assumed. *)
- Section NoMultipleJobs.
-
- (* Assume any work-conserving priority-based scheduler. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_JLDP_policy:
- respects_JLDP_policy job_arrival job_cost arr_seq sched higher_eq_priority.
-
- (* Consider task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all jobs come from the taskset. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j -> job_task j \in ts.
-
- (* Suppose that jobs are sequential, ...*)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- (* ... jobs must arrive to execute, ... *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- (* ... and jobs do not execute after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Assume that the schedule satisfies the sporadic task model ...*)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider a valid task tsk, ...*)
- Variable tsk: sporadic_task.
- Hypothesis H_valid_task: is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (*... whose job j ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Variable H_job_of_tsk: job_task j = tsk.
-
- (*... is backlogged at time t. *)
- Variable t: time.
- Hypothesis H_j_backlogged: backlogged job_arrival job_cost sched j t.
-
- (* Assume that any previous jobs of tsk have completed by the period. *)
- Hypothesis H_all_previous_jobs_completed :
- forall j_other tsk_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- job_arrival j_other + task_period tsk_other <= t ->
- completed job_cost sched j_other (job_arrival j_other + task_period (job_task j_other)).
-
- Let scheduled_task_other_than (tsk tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t && (tsk_other != tsk).
-
- (* Then, there can be at most one pending job of each task at time t. *)
- Lemma platform_at_most_one_pending_job_of_each_task :
- forall j1 j2,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- pending job_arrival job_cost sched j1 t ->
- pending job_arrival job_cost sched j2 t ->
- job_task j1 = job_task j2 ->
- j1 = j2.
- Proof.
- rename H_sporadic_tasks into SPO, H_all_previous_jobs_completed into PREV.
- intros j1 j2 ARR1 ARR2 PENDING1 PENDING2 SAMEtsk.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: PENDING1 PENDING2 => /andP [ARRIVED1 /negP NOTCOMP1] /andP [ARRIVED2 /negP NOTCOMP2].
- destruct (leqP (job_arrival j1) (job_arrival j2)) as [BEFORE1 | BEFORE2].
- {
- specialize (SPO j1 j2 DIFF ARR1 ARR2 SAMEtsk BEFORE1).
- exploit (PREV j1 (job_task j1) ARR1);
- [by done | by apply leq_trans with (n := job_arrival j2) | intros COMP1].
- apply NOTCOMP1.
- ( try ( apply completion_monotonic with (t0 := job_arrival j1 + task_period (job_task j1)) ) ||
- apply completion_monotonic with (t := job_arrival j1 + task_period (job_task j1)));
- try (by done).
- by apply leq_trans with (n := job_arrival j2).
- }
- {
- apply ltnW in BEFORE2.
- exploit (SPO j2 j1); try (by done); [by red; ins; subst | intro SPO'].
- exploit (PREV j2 (job_task j2) ARR2);
- [by done | by apply leq_trans with (n := job_arrival j1) | intros COMP2].
- apply NOTCOMP2.
- ( try ( apply completion_monotonic with (t0 := job_arrival j2 + task_period (job_task j2)) ) ||
- apply completion_monotonic with (t := job_arrival j2 + task_period (job_task j2)));
- try (by done).
- by apply leq_trans with (n := job_arrival j1).
- }
- Qed.
-
- (* Therefore, all processors are busy with tasks other than tsk. *)
- Lemma platform_cpus_busy_with_interfering_tasks :
- count (scheduled_task_other_than tsk) ts = num_cpus.
- Proof.
- have UNIQ := platform_at_most_one_pending_job_of_each_task.
- rename H_all_jobs_from_taskset into FROMTS,
- H_sequential_jobs into SEQUENTIAL, H_work_conserving into WORK,
- H_respects_JLDP_policy into PRIO,
- H_j_backlogged into BACK, H_jobs_come_from_arrival_sequence into FROMarr,
- H_job_of_tsk into JOBtsk, H_valid_job_parameters into JOBPARAMS,
- H_valid_task into TASKPARAMS,
- H_all_previous_jobs_completed into PREV, H_completed_jobs_dont_execute into COMP,
- H_jobs_must_arrive_to_execute into ARRIVE.
- apply work_conserving_eq_work_conserving_count in WORK.
- unfold valid_sporadic_job, valid_realtime_job,
- respects_JLDP_policy, completed_jobs_dont_execute,
- sporadic_task_model, is_valid_sporadic_task,
- jobs_of_same_task_dont_execute_in_parallel,
- sequential_jobs in *.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- {
- apply leq_trans with (n := count (fun x => task_is_scheduled job_task sched x t) ts);
- first by apply sub_count; first by red; move => x /andP [SCHED _].
- unfold task_is_scheduled.
- apply count_exists; first by destruct ts.
- {
- intros cpu x1 x2 SCHED1 SCHED2.
- unfold task_scheduled_on in *.
- destruct (sched cpu t); last by done.
- move: SCHED1 SCHED2 => /eqP SCHED1 /eqP SCHED2.
- by rewrite -SCHED1 -SCHED2.
- }
- }
- {
- rewrite -(WORK j t) // -count_predT.
- apply leq_trans with (n := count (fun j => scheduled_task_other_than tsk (job_task j)) (jobs_scheduled_at sched t));
- last first.
- {
- rewrite -count_map.
- apply count_sub_uniqr; last first.
- {
- move => tsk' /mapP [j' INj' JOBtsk']; subst; apply FROMTS.
- by rewrite mem_scheduled_jobs_eq_scheduled in INj'; eauto 2.
- }
- rewrite map_inj_in_uniq; first by apply scheduled_jobs_uniq.
- red; intros j1 j2 SCHED1 SCHED2 SAMEtsk.
- rewrite 2!mem_scheduled_jobs_eq_scheduled in SCHED1 SCHED2.
- have ARRin1: arrives_in arr_seq j1 by apply (FROMarr j1 t).
- have ARRin2: arrives_in arr_seq j2 by apply (FROMarr j2 t).
- by apply UNIQ; try (by done); apply scheduled_implies_pending.
- }
- {
- apply sub_in_count; intros j' SCHED' _.
- rewrite mem_scheduled_jobs_eq_scheduled in SCHED'.
- unfold scheduled_task_other_than; apply/andP; split.
- {
- move: SCHED' => /existsP [cpu /eqP SCHED'].
- by apply/existsP; exists cpu; rewrite /task_scheduled_on SCHED' eq_refl.
- }
- {
- apply/eqP; red; intro SAMEtsk; symmetry in SAMEtsk.
- move: BACK => /andP [PENDING NOTSCHED].
- have ARRin': arrives_in arr_seq j' by apply (FROMarr j' t).
- exploit (UNIQ j j'); try (by done);
- [by apply scheduled_implies_pending | by rewrite -SAMEtsk |].
- by intro EQjob; subst; rewrite SCHED' in NOTSCHED.
- }
- }
- }
- Qed.
-
- End NoMultipleJobs.
-
- (* In this section we also prove the absence of multiple jobs of the same
- task when constrained deadlines are assumed, but in the specific case
- of fixed-priority scheduling. *)
- Section NoMultipleJobsFP.
-
- (* Assume any work-conserving priority-based scheduler. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_respects_JLDP_policy:
- respects_FP_policy job_arrival job_cost job_task arr_seq sched higher_eq_priority.
-
- (* Consider any task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all jobs come from the taskset. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j -> job_task j \in ts.
-
- (* Suppose that jobs are sequential, ...*)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- (* ... jobs must arrive to execute, ... *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
- (* ... and jobs do not execute after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Assume that jobs arrive sporadically. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider a valid task tsk, ...*)
- Variable tsk: sporadic_task.
- Hypothesis H_valid_task: is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (*... whose job j ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Variable H_job_of_tsk: job_task j = tsk.
-
- (*... is backlogged at time t <= job_arrival j + task_period tsk. *)
- Variable t: time.
- Hypothesis H_j_backlogged: backlogged job_arrival job_cost sched j t.
- Hypothesis H_t_before_period: t < job_arrival j + task_period tsk.
-
- (* Recall the definition of a higher-priority task (with respect to tsk). *)
- Let is_hp_task := higher_priority_task higher_eq_priority tsk.
-
- (* Assume that any jobs of higher-priority tasks complete by their period. *)
- Hypothesis H_all_previous_jobs_completed :
- forall j_other tsk_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- is_hp_task tsk_other ->
- completed job_cost sched j_other (job_arrival j_other + task_period tsk_other).
-
- (* Assume that any jobs of tsk prior to j complete by their period. *)
- Hypothesis H_all_previous_jobs_of_tsk_completed :
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + task_period tsk).
-
- Definition scheduled_task_with_higher_eq_priority (tsk tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- is_hp_task tsk_other.
-
- (* Then, there can be at most one pending job of higher-priority tasks at time t. *)
- Lemma platform_fp_no_multiple_jobs_of_interfering_tasks :
- forall j1 j2,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- pending job_arrival job_cost sched j1 t ->
- pending job_arrival job_cost sched j2 t ->
- job_task j1 = job_task j2 ->
- is_hp_task (job_task j1) ->
- j1 = j2.
- Proof.
- unfold sporadic_task_model in *.
- rename H_sporadic_tasks into SPO, H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_all_previous_jobs_completed into PREV.
- intros j1 j2 ARR1 ARR2 PENDING1 PENDING2 SAMEtsk INTERF.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: PENDING1 PENDING2 => /andP [ARRIVED1 /negP NOTCOMP1] /andP [ARRIVED2 /negP NOTCOMP2].
- destruct (leqP (job_arrival j1) (job_arrival j2)) as [BEFORE1 | BEFORE2].
- {
- specialize (SPO j1 j2 DIFF ARR1 ARR2 SAMEtsk BEFORE1).
- exploit (PREV j1 (job_task j1) ARR1); [by done | by apply INTERF | intros COMP1].
- apply NOTCOMP1.
- ( try ( apply completion_monotonic with (t0 := job_arrival j1 + task_period (job_task j1)) ) ||
- apply completion_monotonic with (t := job_arrival j1 + task_period (job_task j1)));
- try (by done).
- by apply leq_trans with (n := job_arrival j2).
- }
- {
- apply ltnW in BEFORE2.
- exploit (SPO j2 j1); try (by done); [by red; ins; subst j2 | intro SPO'].
- exploit (PREV j2 (job_task j2) ARR2);
- [by done | by rewrite -SAMEtsk | intro COMP2 ].
- apply NOTCOMP2.
- ( try ( apply completion_monotonic with (t0 := job_arrival j2 + task_period (job_task j2)) ) ||
- apply completion_monotonic with (t := job_arrival j2 + task_period (job_task j2)));
- try (by done).
- by apply leq_trans with (n := job_arrival j1).
- }
- Qed.
-
- (* Also, there can be at most one pending job of tsk at time t. *)
- Lemma platform_fp_no_multiple_jobs_of_tsk :
- forall j',
- arrives_in arr_seq j' ->
- pending job_arrival job_cost sched j' t ->
- job_task j' = tsk ->
- j' = j.
- Proof.
- unfold sporadic_task_model in *.
- rename H_sporadic_tasks into SPO,
- H_valid_task into PARAMS,
- H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_all_previous_jobs_completed into PREV,
- H_j_backlogged into BACK, H_job_of_tsk into JOBtsk.
- intros j' ARR' PENDING' SAMEtsk.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: BACK PENDING' => /andP [/andP [ARRIVED /negP NOTCOMP] NOTSCHED]
- /andP [ARRIVED' /negP NOTCOMP'].
- destruct (leqP (job_arrival j') (job_arrival j)) as [BEFORE | BEFORE'].
- {
- exploit (SPO j' j DIFF ARR' H_j_arrives); [by rewrite JOBtsk | by done | intro SPO'].
- apply NOTCOMP'.
- ( try ( apply completion_monotonic with (t0 := job_arrival j' + task_period tsk) ) ||
- apply completion_monotonic with (t := job_arrival j' + task_period tsk)); try (by done);
- first by apply leq_trans with (n := job_arrival j); [by rewrite -SAMEtsk | by done].
- {
- apply PREVtsk; try (by done).
- apply leq_trans with (n := job_arrival j' + task_period tsk); last by rewrite -SAMEtsk.
- rewrite -addn1; apply leq_add; first by done.
- by unfold is_valid_sporadic_task in *; des.
- }
- }
- {
- unfold has_arrived in *.
- rewrite leqNgt in ARRIVED'; move: ARRIVED' => /negP BUG; apply BUG.
- apply leq_trans with (n := job_arrival j + task_period tsk); first by done.
- by rewrite -JOBtsk; apply SPO; try (by done);
- [by red; ins; subst j' | by rewrite SAMEtsk | by apply ltnW].
- }
- Qed.
-
- (* Therefore, all processors are busy with tasks other than tsk. *)
- Lemma platform_fp_cpus_busy_with_interfering_tasks :
- count (scheduled_task_with_higher_eq_priority tsk) ts = num_cpus.
- Proof.
- have UNIQ := platform_fp_no_multiple_jobs_of_interfering_tasks.
- have UNIQ' := platform_fp_no_multiple_jobs_of_tsk.
- rename H_all_jobs_from_taskset into FROMTS, H_sequential_jobs into SEQUENTIAL,
- H_work_conserving into WORK, H_respects_JLDP_policy into PRIO,
- H_j_backlogged into BACK, H_job_of_tsk into JOBtsk,
- H_sporadic_tasks into SPO, H_valid_job_parameters into JOBPARAMS,
- H_valid_task into TASKPARAMS, H_all_previous_jobs_completed into PREV,
- H_completed_jobs_dont_execute into COMP, H_jobs_come_from_arrival_sequence into FROMarr,
- H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_jobs_must_arrive_to_execute into ARRIVE.
- apply work_conserving_eq_work_conserving_count in WORK.
- unfold valid_sporadic_job, valid_realtime_job,
- respects_FP_policy, respects_JLDP_policy, FP_to_JLDP,
- completed_jobs_dont_execute, sequential_jobs,
- sporadic_task_model, is_valid_sporadic_task,
- jobs_of_same_task_dont_execute_in_parallel,
- is_hp_task in *.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- {
- apply leq_trans with (n := count (fun x => task_is_scheduled job_task sched x t) ts);
- first by apply sub_count; red; move => x /andP [SCHED _].
- unfold task_is_scheduled.
- apply count_exists; first by destruct ts.
- {
- intros cpu x1 x2 SCHED1 SCHED2.
- unfold task_scheduled_on in *.
- destruct (sched cpu t); last by done.
- move: SCHED1 SCHED2 => /eqP SCHED1 /eqP SCHED2.
- by rewrite -SCHED1 -SCHED2.
- }
- }
- {
- rewrite -(WORK j t) // -count_predT.
- apply leq_trans with (n := count (fun j =>
- scheduled_task_with_higher_eq_priority tsk (job_task j)) (jobs_scheduled_at sched t));
- last first.
- {
- rewrite -count_map.
- apply leq_trans with (n := count predT [seq x <- (map (fun j => job_task j) (jobs_scheduled_at sched t)) | scheduled_task_with_higher_eq_priority tsk x]);
- first by rewrite count_filter; apply sub_count; red; ins.
- apply leq_trans with (n := count predT [seq x <- ts | scheduled_task_with_higher_eq_priority tsk x]);
- last by rewrite count_predT size_filter.
- apply count_sub_uniqr; last first.
- {
- red; intros tsk' IN'.
- rewrite mem_filter in IN'; move: IN' => /andP [SCHED IN'].
- rewrite mem_filter; apply/andP; split; first by done.
- move: IN' => /mapP [j' IN'] ->; apply FROMTS.
- by rewrite mem_scheduled_jobs_eq_scheduled in IN'; eauto 2.
- }
- {
- rewrite filter_map.
- rewrite map_inj_in_uniq; first by apply filter_uniq, scheduled_jobs_uniq.
- red; intros j1 j2 SCHED1 SCHED2 SAMEtsk.
- rewrite 2!mem_filter in SCHED1 SCHED2.
- move: SCHED1 SCHED2 => /andP [/andP [_ HP1] SCHED1] /andP [/andP [_ HP2] SCHED2].
- rewrite 2!mem_scheduled_jobs_eq_scheduled in SCHED1 SCHED2.
- have ARRin1: arrives_in arr_seq j1 by apply (FROMarr j1 t).
- have ARRIn2: arrives_in arr_seq j2 by apply (FROMarr j2 t).
- by apply UNIQ; try (by done); apply scheduled_implies_pending.
- }
- }
- {
- apply sub_in_count; intros j' SCHED' _.
- rewrite mem_scheduled_jobs_eq_scheduled in SCHED'.
- apply/andP; split.
- {
- move: SCHED' => /existsP [cpu /eqP SCHED'].
- by apply/existsP; exists cpu; rewrite /task_scheduled_on SCHED' eq_refl.
- }
- apply/andP; split; first by rewrite -JOBtsk; apply PRIO with (t := t).
- {
- apply/eqP; red; intro SAMEtsk.
- generalize SCHED'; intro PENDING'.
- have ARRin': arrives_in arr_seq j' by apply (FROMarr j' t).
- ( try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) in PENDING' ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := job_cost) in PENDING'); try (by done).
- specialize (UNIQ' j' ARRin' PENDING' SAMEtsk); subst j'.
- by move: BACK => /andP [_ NOTSCHED]; rewrite SCHED' in NOTSCHED.
- }
- }
- }
- Qed.
-
- End NoMultipleJobsFP.
-
- End Lemmas.
-
-End ConstrainedDeadlines.
diff --git a/classic/model/schedule/global/basic/interference.v b/classic/model/schedule/global/basic/interference.v
deleted file mode 100644
index 413a6635c3c05bb6d66a5c00f9b3a889fdbdd85c..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/basic/interference.v
+++ /dev/null
@@ -1,205 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module Interference.
-
- Import Schedule ScheduleOfSporadicTask Priority Workload.
-
- Section InterferenceDefs.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Assume any job arrival sequence...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Consider any job j that incurs interference. *)
- Variable j: Job.
-
- (* Recall the definition of backlogged (pending and not scheduled). *)
- Let job_is_backlogged (t: time) :=
- backlogged job_arrival job_cost sched j t.
-
- (* First, we define total interference. *)
- Section TotalInterference.
-
- (* The total interference incurred by job j during [t1, t2) is the
- cumulative time in which j is backlogged in this interval. *)
- Definition total_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2) job_is_backlogged t.
-
- End TotalInterference.
-
- (* Next, we define job interference. *)
- Section JobInterference.
-
- (* Let job_other be a job that interferes with j. *)
- Variable job_other: Job.
-
- (* The interference caused by job_other during [t1, t2) is the cumulative
- time in which j is backlogged while job_other is scheduled. *)
- Definition job_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2)
- \sum_(cpu < num_cpus)
- (job_is_backlogged t && scheduled_on sched job_other cpu t).
-
- End JobInterference.
-
- (* Next, we define task interference. *)
- Section TaskInterference.
-
- (* In order to define task interference, consider any interfering task tsk_other. *)
- Variable tsk_other: sporadic_task.
-
- (* The interference caused by tsk during [t1, t2) is the cumulative time
- in which j is backlogged while tsk is scheduled. *)
- Definition task_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2)
- \sum_(cpu < num_cpus)
- (job_is_backlogged t &&
- task_scheduled_on job_task sched tsk_other cpu t).
-
- End TaskInterference.
-
- (* Next, we define an approximation of the total interference based on
- each per-task interference. *)
- Section TaskInterferenceJobList.
-
- Variable tsk_other: sporadic_task.
-
- Definition task_interference_joblist (t1 t2: time) :=
- \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_other)
- job_interference j t1 t2.
-
- End TaskInterferenceJobList.
-
- (* Now we prove some basic lemmas about interference. *)
- Section BasicLemmas.
-
- (* First, we show that the total interference cannot be larger than the interval length. *)
- Lemma total_interference_le_delta :
- forall t1 t2,
- total_interference t1 t2 <= t2 - t1.
- Proof.
- unfold total_interference; intros t1 t2.
- apply leq_trans with (n := \sum_(t1 <= t < t2) 1);
- first by apply leq_sum; ins; apply leq_b1.
- by rewrite big_const_nat iter_addn mul1n addn0 leqnn.
- Qed.
-
- (* Next, we show that job interference is bounded by the service of the interfering job. *)
- Lemma job_interference_le_service :
- forall j_other t1 t2,
- job_interference j_other t1 t2 <= service_during sched j_other t1 t2.
- Proof.
- intros j_other t1 t2; unfold job_interference, service_during.
- apply leq_sum; intros t _.
- unfold service_at; rewrite [\sum_(_ < _ | scheduled_on _ _ _ _)_]big_mkcond.
- apply leq_sum; intros cpu _.
- destruct (job_is_backlogged t); [rewrite andTb | by rewrite andFb].
- by destruct (scheduled_on sched j_other cpu t).
- Qed.
-
- (* We also prove that task interference is bounded by the workload of the interfering task. *)
- Lemma task_interference_le_workload :
- forall tsk t1 t2,
- task_interference tsk t1 t2 <= workload job_task sched tsk t1 t2.
- Proof.
- unfold task_interference, workload; intros tsk t1 t2.
- apply leq_sum; intros t _.
- apply leq_sum; intros cpu _.
- destruct (job_is_backlogged t); [rewrite andTb | by rewrite andFb].
- unfold task_scheduled_on, service_of_task.
- by destruct (sched cpu t).
- Qed.
-
- End BasicLemmas.
-
- (* Now we prove some bounds on interference for sequential jobs. *)
- Section InterferenceSequentialJobs.
-
- (* If jobs are sequential, ... *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* ... then the interference incurred by a job in an interval
- of length delta is at most delta. *)
- Lemma job_interference_le_delta :
- forall j_other t1 delta,
- job_interference j_other t1 (t1 + delta) <= delta.
- Proof.
- rename H_sequential_jobs into SEQ.
- unfold job_interference, sequential_jobs in *.
- intros j_other t1 delta.
- apply leq_trans with (n := \sum_(t1 <= t < t1 + delta) 1);
- last by rewrite big_const_nat iter_addn mul1n addn0 addKn leqnn.
- apply leq_sum; intros t _.
- destruct ([exists cpu, scheduled_on sched j_other cpu t]) eqn:EX.
- {
- move: EX => /existsP [cpu SCHED].
- rewrite (bigD1 cpu) // /=.
- rewrite big_mkcond (eq_bigr (fun x => 0)) /=;
- first by simpl_sum_const; rewrite leq_b1.
- intros cpu' _; des_if_goal; last by done.
- destruct (scheduled_on sched j_other cpu' t) eqn:SCHED'; last by rewrite andbF.
- move: SCHED SCHED' => /eqP SCHED /eqP SCHED'.
- by specialize (SEQ j_other t cpu cpu' SCHED SCHED'); rewrite SEQ in Heq.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP EX.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (EX cpu); apply negbTE in EX; rewrite EX andbF.
- }
- Qed.
-
- End InterferenceSequentialJobs.
-
- (* Next, we show that the cumulative per-task interference bounds the total
- interference. *)
- Section BoundUsingPerJobInterference.
-
- Lemma interference_le_interference_joblist :
- forall tsk t1 t2,
- task_interference tsk t1 t2 <= task_interference_joblist tsk t1 t2.
- Proof.
- intros tsk t1 t2.
- unfold task_interference, task_interference_joblist, job_interference, job_is_backlogged.
- rewrite [\sum_(_ <- _ sched _ _ | _) _]exchange_big /=.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => t /andP [LEt _].
- rewrite exchange_big /=.
- apply leq_sum; intros cpu _.
- destruct (backlogged job_arrival job_cost sched j t) eqn:BACK;
- last by rewrite andFb (eq_bigr (fun x => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- rewrite andTb.
- destruct (task_scheduled_on job_task sched tsk cpu t) eqn:SCHED; last by done.
- unfold scheduled_on, task_scheduled_on in *.
- destruct (sched cpu t) as [j' |] eqn:SOME; last by done.
- rewrite big_mkcond /= (bigD1_seq j') /=; last by apply undup_uniq.
- {
- by rewrite SCHED eq_refl.
- }
- {
- unfold jobs_scheduled_between.
- rewrite mem_undup; apply mem_bigcat_nat with (j := t); first by done.
- apply mem_bigcat_ord with (j := cpu); first by apply ltn_ord.
- by unfold make_sequence; rewrite SOME mem_seq1 eq_refl.
- }
- Qed.
-
- End BoundUsingPerJobInterference.
-
- End InterferenceDefs.
-
-End Interference.
\ No newline at end of file
diff --git a/classic/model/schedule/global/basic/interference_edf.v b/classic/model/schedule/global/basic/interference_edf.v
deleted file mode 100644
index 37aecfa9aa38381e1e35f8b01e9268af241c931f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/basic/interference_edf.v
+++ /dev/null
@@ -1,72 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.interference
- prosa.classic.model.schedule.global.basic.platform.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module InterferenceEDF.
-
- Import Schedule Priority Platform Interference Priority.
-
- Section Lemmas.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
-
- (* Assume any job arrival sequence... *)
- Context {arr_seq: arrival_sequence Job}.
-
- (* Consider any schedule. *)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
-
- (* Assume that the schedule satisfies the global scheduling invariant
- for EDF, i.e., if any job of tsk is backlogged, every processor
- must be busy with jobs with no larger absolute deadline. *)
- Hypothesis H_scheduler_uses_EDF:
- respects_JLFP_policy job_arrival job_cost arr_seq sched (EDF job_arrival job_deadline).
-
- (* Under EDF scheduling, a job only causes interference if its deadline
- is not larger than the deadline of the analyzed job. *)
- Lemma interference_under_edf_implies_shorter_deadlines :
- forall j j' t1 t2,
- arrives_in arr_seq j ->
- arrives_in arr_seq j' ->
- job_interference job_arrival job_cost sched j' j t1 t2 != 0 ->
- job_arrival j + job_deadline j <= job_arrival j' + job_deadline j'.
- Proof.
- rename H_scheduler_uses_EDF into PRIO.
- intros j j' t1 t2 ARR1 ARR2 INTERF.
- unfold job_interference in INTERF.
- destruct ([exists t': 'I_t2,
- [exists cpu: processor num_cpus,
- (t' >= t1) &&
- backlogged job_arrival job_cost sched j' t' &&
- scheduled_on sched j cpu t']]) eqn:EX.
- {
- move: EX => /existsP [t' /existsP [cpu /andP [/andP [LE BACK] SCHED]]].
- apply PRIO with (t := t'); try (by done).
- by apply/existsP; exists cpu.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP ALL.
- rewrite big_nat_cond (eq_bigr (fun x => 0)) in INTERF;
- first by rewrite -big_nat_cond big_const_nat iter_addn mul0n addn0 eq_refl in INTERF.
- move => i /andP [/andP [GEi LTi] _].
- specialize (ALL (Ordinal LTi)).
- rewrite negb_exists in ALL.
- move: ALL => /forallP ALL.
- rewrite (eq_bigr (fun x => 0));
- first by rewrite big_const_ord iter_addn mul0n addn0.
- intros cpu _; specialize (ALL cpu); simpl in ALL.
- destruct (backlogged job_arrival job_cost sched j' i); last by rewrite andFb.
- rewrite GEi 2!andTb in ALL; rewrite andTb.
- by apply negbTE in ALL; rewrite ALL.
- }
- Qed.
-
- End Lemmas.
-
-End InterferenceEDF.
\ No newline at end of file
diff --git a/classic/model/schedule/global/basic/platform.v b/classic/model/schedule/global/basic/platform.v
deleted file mode 100644
index f0f7ee770fcca9190cbe529dddfcaae3c1b8a395..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/basic/platform.v
+++ /dev/null
@@ -1,190 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.basic.schedule prosa.classic.model.schedule.global.basic.interference.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module Platform.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask SporadicTaskset TaskArrival Interference Priority.
-
- Section Properties.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence ... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any schedule of this arrival sequence. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- Section Execution.
-
- (* A scheduler is work-conserving iff when a job j is backlogged,
- all processors are busy with other jobs. *)
- Definition work_conserving :=
- forall j t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- forall cpu, exists j_other,
- scheduled_on sched j_other cpu t.
-
- (* We also provide an alternative, equivalent definition of work-conserving
- based on counting the number of scheduled jobs. *)
- Definition work_conserving_count :=
- forall j t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- size (jobs_scheduled_at sched t) = num_cpus.
-
- End Execution.
-
- Section FP.
-
- (* An FP policy ...*)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ... is respected by the scheduler iff every scheduled
- job has higher (or same) priority than (as) a backlogged job. *)
- Definition respects_FP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled sched j_hp t ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- Section JLFP.
-
- (* A JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ... is respected by the scheduler iff at any time t,
- a scheduled job has higher (or same) priority than (as)
- a backlogged job. *)
- Definition respects_JLFP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled sched j_hp t ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- Section JLDP.
-
- (* A JLDP policy ...*)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* ... is respected by the scheduler iff at any time t,
- a scheduled job has higher (or same) priority than (as)
- a backlogged job. *)
- Definition respects_JLDP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled sched j_hp t ->
- higher_eq_priority t j_hp j.
-
- End JLDP.
-
- Section Lemmas.
-
- (* Assume all jobs have valid parameters, ...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* In this section, we prove that the two definitions of work-conserving are equivalent. *)
- Section EquivalentDefinitions.
-
- Lemma work_conserving_eq_work_conserving_count :
- work_conserving <-> work_conserving_count.
- Proof.
- unfold work_conserving, work_conserving_count; split.
- {
- intros EX j t ARRj BACK.
- specialize (EX j t ARRj BACK).
- apply eq_trans with (y := size (enum (processor num_cpus)));
- last by rewrite size_enum_ord.
- unfold jobs_scheduled_at.
- apply eq_trans with (y := size ((\cat_(cpu < num_cpus) map (fun x => Some x)
- (make_sequence (sched cpu t)))));
- first by rewrite -map_bigcat_ord size_map.
- apply eq_trans with (y := size (\cat_(cpu < num_cpus) [:: sched cpu t])).
- {
- f_equal; apply eq_bigr; intros cpu _.
- destruct (sched cpu t) eqn:SCHED; first by done.
- by specialize (EX cpu); des; move: EX => /eqP EX; rewrite EX in SCHED.
- }
- rewrite size_bigcat_ord.
- apply eq_trans with (y := \sum_(i < num_cpus) 1);
- last by rewrite big_const_ord iter_addn mul1n addn0 size_enum_ord.
- by apply eq_bigr.
- }
- {
- intros SIZE j t ARRj BACK cpu.
- specialize (SIZE j t ARRj BACK).
- destruct ([exists cpu, sched cpu t == None]) eqn:EX; last first.
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP ALL; specialize (ALL cpu).
- destruct (sched cpu t) eqn:SOME; last by done.
- by exists s; apply/eqP.
- }
- {
- move: EX => /existsP [cpu' /eqP EX].
- unfold jobs_scheduled_at in SIZE.
- move: SIZE => /eqP SIZE; rewrite -[size _ == _]negbK in SIZE.
- move: SIZE => /negP SIZE; exfalso; apply SIZE; clear SIZE.
- rewrite neq_ltn; apply/orP; left.
- rewrite size_bigcat_ord.
- rewrite -> big_mkord_ord with (x0 := 0).
- have MKORD := big_mkord (fun x => true); rewrite -MKORD.
- have CAT := big_cat_nat _ (fun x => true).
- rewrite -> CAT with (n := cpu'); [simpl | by done | by apply ltnW, ltn_ord].
- assert (DIFF: exists k, num_cpus = (cpu' + k).+1).
- {
- exists (num_cpus - cpu').-1.
- rewrite -addnS prednK; last by rewrite ltn_subRL addn0 ltn_ord.
- rewrite addnBA; last by apply ltnW, ltn_ord.
- by rewrite addnC -addnBA // subnn addn0.
- }
- des; rewrite {5}DIFF.
- rewrite big_nat_recl; last by apply leq_addr.
- apply leq_trans with (n := (\sum_(0 <= i < cpu') 1) + 1 + (\sum_(cpu' <= i < cpu' + k) 1));
- last first.
- {
- rewrite 2!big_const_nat 2!iter_addn 2!mul1n addn0 subn0.
- rewrite [cpu' + k]addnC -addnBA // subnn 2!addn0.
- by rewrite -addnA [1 + k]addnC addnA addn1 -DIFF.
- }
- {
- rewrite -addn1 addnC [_ + 1]addnC -addnA.
- apply leq_add; first by done.
- rewrite eq_fun_ord_to_nat; unfold make_sequence at 2; rewrite EX /= add0n.
- apply leq_add; apply leq_sum; ins; unfold fun_ord_to_nat; des_eqrefl; try done;
- by unfold make_sequence; desf.
- }
- }
- }
- Qed.
-
- End EquivalentDefinitions.
-
- End Lemmas.
-
- End Properties.
-
-End Platform.
\ No newline at end of file
diff --git a/classic/model/schedule/global/basic/schedule.v b/classic/model/schedule/global/basic/schedule.v
deleted file mode 100644
index 58cfba34e89819fada281d75738a6a137d3cf51e..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/basic/schedule.v
+++ /dev/null
@@ -1,613 +0,0 @@
-Require Import prosa.classic.util.all
- prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Definition, properties and lemmas about schedules. *)
-Module Schedule.
-
- Export ArrivalSequence.
-
- (* A processor is defined as a bounded natural number: [0, num_cpus). *)
- Definition processor (num_cpus: nat) := 'I_num_cpus.
-
- Section ScheduleDef.
-
- (* Consider any type of job. *)
- Variable Job: eqType.
-
- (* Given the number of processors... *)
- Variable num_cpus: nat.
-
- (* ... we define a schedule as a mapping such that each processor
- at each time contains either a job from the sequence or none. *)
- Definition schedule :=
- processor num_cpus -> time -> option Job.
-
- End ScheduleDef.
-
- (* Next, we define properties of jobs in a schedule. *)
- Section ScheduledJobs.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
-
- (* Given an arrival sequence, ... *)
- Context {arr_seq: arrival_sequence Job}.
-
- Variable job_cost: Job -> time. (* ... a job cost function, ... *)
-
- (* ... and the number of processors, ...*)
- Context {num_cpus: nat}.
-
- (* ... we define the following properties for job j in schedule sched. *)
- Variable sched: schedule Job num_cpus.
- Variable j: Job.
-
- (* A job j is scheduled on processor cpu at time t iff such a mapping exists. *)
- Definition scheduled_on (cpu: processor num_cpus) (t: time) :=
- sched cpu t == Some j.
-
- (* A job j is scheduled at time t iff there exists a cpu where it is mapped.*)
- Definition scheduled (t: time) :=
- [exists cpu, scheduled_on cpu t].
-
- (* A processor cpu is idle at time t if it doesn't contain any jobs. *)
- Definition is_idle (cpu: processor num_cpus) (t: time) :=
- sched cpu t = None.
-
- (* The instantaneous service of job j at time t is the number of cpus
- where it is scheduled on. Note that we use a sum to account for
- parallelism if required. *)
- Definition service_at (t: time) :=
- \sum_(cpu < num_cpus | scheduled_on cpu t) 1.
-
- (* The cumulative service received by job j during [0, t'). *)
- Definition service (t': time) := \sum_(0 <= t < t') service_at t.
-
- (* The cumulative service received by job j during [t1, t2). *)
- Definition service_during (t1 t2: time) := \sum_(t1 <= t < t2) service_at t.
-
- (* Job j has completed at time t if it received enough service. *)
- Definition completed (t: time) := service t >= job_cost j.
-
- (* Job j is pending at time t iff it has arrived but has not completed. *)
- Definition pending (t: time) := has_arrived job_arrival j t && ~~completed t.
-
- (* Job j is backlogged at time t iff it is pending and not scheduled. *)
- Definition backlogged (t: time) := pending t && ~~scheduled t.
-
- (* Job j is carry-in in interval [t1, t2) iff it arrives before t1 and is
- not complete at time t1 *)
- Definition carried_in (t1: time) := arrived_before job_arrival j t1 && ~~ completed t1.
-
- (* Job j is carry-out in interval [t1, t2) iff it arrives after t1 and is
- not complete at time t2 *)
- Definition carried_out (t1 t2: time) := arrived_before job_arrival j t2 && ~~ completed t2.
-
- (* The list of scheduled jobs at time t is the concatenation of the jobs
- scheduled on each processor. *)
- Definition jobs_scheduled_at (t: time) :=
- \cat_(cpu < num_cpus) make_sequence (sched cpu t).
-
- (* The list of jobs scheduled during the interval [t1, t2) is the
- the duplicate-free concatenation of the jobs scheduled at instant. *)
- Definition jobs_scheduled_between (t1 t2: time) :=
- undup (\cat_(t1 <= t < t2) jobs_scheduled_at t).
-
- End ScheduledJobs.
-
- (* In this section, we define properties of valid schedules. *)
- Section ValidSchedules.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any multiprocessor schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Next, we define whether job are sequential, ... *)
- Definition sequential_jobs :=
- forall j t cpu1 cpu2,
- sched cpu1 t = Some j -> sched cpu2 t = Some j -> cpu1 = cpu2.
-
- (* ... whether a job can only be scheduled if it has arrived, ... *)
- Definition jobs_must_arrive_to_execute :=
- forall j t,
- scheduled sched j t ->
- has_arrived job_arrival j t.
-
- (* ... whether a job can be scheduled after it completes. *)
- Definition completed_jobs_dont_execute :=
- forall j t, service sched j t <= job_cost j.
-
- (* We also define whether jobs come from some arrival sequence. *)
- Definition jobs_come_from_arrival_sequence (arr_seq: arrival_sequence Job) :=
- forall j t, scheduled sched j t -> arrives_in arr_seq j.
-
- End ValidSchedules.
-
- (* In this section, we prove some basic lemmas about a job. *)
- Section JobLemmas.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any multiprocessor schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Next, we prove some lemmas about the service received by a job j. *)
- Variable j: Job.
-
- Section Basic.
-
- (* At any time t, job j is not scheduled iff it doesn't get service. *)
- Lemma not_scheduled_no_service :
- forall t,
- ~~ scheduled sched j t = (service_at sched j t == 0).
- Proof.
- unfold scheduled, service_at, scheduled_on; intros t; apply/idP/idP.
- {
- intros NOTSCHED.
- rewrite negb_exists in NOTSCHED.
- move: NOTSCHED => /forallP NOTSCHED.
- rewrite big_seq_cond.
- rewrite -> eq_bigr with (F2 := fun i => 0);
- first by rewrite big_const_seq iter_addn mul0n addn0.
- move => cpu /andP [_ /eqP SCHED].
- by specialize (NOTSCHED cpu); rewrite SCHED eq_refl in NOTSCHED.
- }
- {
- intros NOSERV; rewrite big_mkcond sum_nat_eq0_nat filter_predT in NOSERV.
- move: NOSERV => /allP ALL.
- rewrite negb_exists; apply/forallP; intros cpu.
- exploit (ALL cpu); [by apply mem_index_enum | by desf].
- }
- Qed.
-
- (* If the cumulative service during a time interval is not zero, there
- must be a time t in this interval where the service is not 0, ... *)
- Lemma cumulative_service_implies_service :
- forall t1 t2,
- service_during sched j t1 t2 != 0 ->
- exists t,
- t1 <= t < t2 /\
- service_at sched j t != 0.
- Proof.
- intros t1 t2 NONZERO.
- destruct ([exists t: 'I_t2, (t >= t1) && (service_at sched j t != 0)]) eqn:EX.
- {
- move: EX => /existsP EX; destruct EX as [x EX]. move: EX => /andP [GE SERV].
- exists x; split; last by done.
- by apply/andP; split; [by done | apply ltn_ord].
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP EX.
- unfold service_during in NONZERO; rewrite big_nat_cond in NONZERO.
- rewrite (eq_bigr (fun x => 0)) in NONZERO;
- first by rewrite -big_nat_cond big_const_nat iter_addn mul0n addn0 in NONZERO.
- intros i; rewrite andbT; move => /andP [GT LT].
- specialize (EX (Ordinal LT)); simpl in EX.
- by rewrite GT andTb negbK in EX; apply/eqP.
- }
- Qed.
-
- (* ... and vice versa. *)
- Lemma service_implies_cumulative_service:
- forall t t1 t2,
- t1 <= t < t2 ->
- service_at sched j t != 0 ->
- service_during sched j t1 t2 != 0.
- Proof.
- intros t t1 t2 LE NONZERO.
- unfold service_during.
- rewrite (bigD1_seq t) /=;
- [| by rewrite mem_index_iota | by apply iota_uniq].
- rewrite -lt0n -addn1 addnC.
- by apply leq_add; first by rewrite lt0n.
- Qed.
-
- End Basic.
-
- Section SequentialJobs.
-
- (* If jobs are sequential, then... *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* ..., the service received by job j at any time t is at most 1, ... *)
- Lemma service_at_most_one :
- forall t, service_at sched j t <= 1.
- Proof.
- unfold service_at, sequential_jobs in *; ins.
- destruct (scheduled sched j t) eqn:SCHED; unfold scheduled in SCHED.
- {
- move: SCHED => /existsP [cpu SCHED]; des.
- rewrite -big_filter (bigD1_seq cpu);
- [simpl | | by have [e _ [UNIQ _ ] _] := big_enumP];
- last by rewrite mem_filter; apply/andP; split.
- rewrite -big_filter -filter_predI big_filter.
- rewrite -> eq_bigr with (F2 := fun cpu => 0);
- first by rewrite /= big_const_seq iter_addn mul0n 2!addn0.
- intro cpu'; move => /andP [/eqP NEQ /eqP SCHED'].
- exfalso; apply NEQ.
- by apply H_sequential_jobs with (j := j) (t := t); last by apply/eqP.
- }
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED.
- move: SCHED => /forallP SCHED.
- rewrite big_pred0; red; ins; apply negbTE, SCHED.
- }
- Qed.
-
- (* ..., which implies that the service receive during a interval
- of length delta is at most delta. *)
- Lemma cumulative_service_le_delta :
- forall t delta, service_during sched j t (t + delta) <= delta.
- Proof.
- unfold service_at, sequential_jobs in *; ins.
- generalize dependent t.
- induction delta.
- {
- ins; unfold service_during; rewrite addn0.
- by rewrite big_geq.
- }
- {
- unfold service_during; intro t.
- rewrite -addn1 addnA addn1 big_nat_recr; last by apply leq_addr.
- apply leq_add; first by apply IHdelta.
- by apply service_at_most_one.
- }
- Qed.
-
- End SequentialJobs.
-
- Section Completion.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs:
- completed_jobs_dont_execute job_cost sched.
-
- (* Then, after job j completes, it remains completed. *)
- Lemma completion_monotonic :
- forall t t',
- t <= t' ->
- completed job_cost sched j t ->
- completed job_cost sched j t'.
- Proof.
- unfold completed; move => t t' LE COMPt.
- apply leq_trans with (service sched j t); first by done.
- by rewrite /service /service_during [in X in _ <= X](@big_cat_nat _ _ _ t) //= leq_addr.
- Qed.
-
- (* A completed job cannot be scheduled. *)
- Lemma completed_implies_not_scheduled :
- forall t,
- completed job_cost sched j t ->
- ~~ scheduled sched j t.
- Proof.
- rename H_completed_jobs into COMP.
- unfold completed_jobs_dont_execute in *.
- intros t COMPLETED.
- apply/negP; red; intro SCHED.
- have BUG := COMP j t.+1.
- rewrite leqNgt in BUG; move: BUG => /negP BUG; apply: BUG.
- unfold service, service_during; rewrite big_nat_recr // /= -addn1.
- apply leq_add; first by done.
- by rewrite lt0n -not_scheduled_no_service negbK.
- Qed.
-
- (* The service received by job j in any interval is no larger than its cost. *)
- Lemma cumulative_service_le_job_cost :
- forall t t',
- service_during sched j t t' <= job_cost j.
- Proof.
- unfold service_during; rename H_completed_jobs into COMP; red in COMP; ins.
- destruct (t > t') eqn:GT.
- by rewrite big_geq // -ltnS; apply ltn_trans with (n := t); ins.
- apply leq_trans with
- (n := \sum_(0 <= t0 < t') service_at sched j t0);
- last by apply COMP.
- rewrite -> big_cat_nat with (m := 0) (n := t);
- [by apply leq_addl | by ins | by rewrite leqNgt negbT //].
- Qed.
-
- End Completion.
-
- Section Arrival.
-
- (* Assume that jobs must arrive to execute. *)
- Hypothesis H_jobs_must_arrive:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Then, job j does not receive service at any time t prior to its arrival. *)
- Lemma service_before_job_arrival_zero :
- forall t,
- t < job_arrival j ->
- service_at sched j t = 0.
- Proof.
- rename H_jobs_must_arrive into ARR; red in ARR; intros t LT.
- specialize (ARR j t).
- apply contra with (c := scheduled sched j t)
- (b := has_arrived job_arrival j t) in ARR;
- last by rewrite -ltnNge.
- apply/eqP; rewrite -leqn0; unfold service_at.
- rewrite big_pred0 //; red.
- intros cpu; apply negbTE.
- by move: ARR; rewrite negb_exists; move => /forallP ARR; apply ARR.
- Qed.
-
- (* The same applies for the cumulative service received by job j. *)
- Lemma cumulative_service_before_job_arrival_zero :
- forall t1 t2,
- t2 <= job_arrival j ->
- \sum_(t1 <= i < t2) service_at sched j i = 0.
- Proof.
- intros t1 t2 LE; apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := \sum_(t1 <= i < t2) 0);
- last by rewrite big_const_nat iter_addn mul0n addn0.
- rewrite big_nat_cond [\sum_(_ <= _ < _) 0]big_nat_cond.
- apply leq_sum; intro i; rewrite andbT; move => /andP LTi; des.
- rewrite service_before_job_arrival_zero; first by ins.
- by apply leq_trans with (n := t2); ins.
- Qed.
-
- (* Hence, you can ignore the service received by a job before its arrival time. *)
- Lemma service_before_arrival_eq_service_during :
- forall t0 t,
- t0 <= job_arrival j ->
- \sum_(t0 <= t < job_arrival j + t) service_at sched j t =
- \sum_(job_arrival j <= t < job_arrival j + t) service_at sched j t.
- Proof.
- intros t0 t LE; rewrite -> big_cat_nat with (n := job_arrival j);
- [| by ins | by apply leq_addr].
- by rewrite /= cumulative_service_before_job_arrival_zero; [rewrite add0n | apply leqnn].
- Qed.
-
- End Arrival.
-
- Section Pending.
-
- (* Assume that jobs must arrive to execute. *)
- Hypothesis H_jobs_must_arrive:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs:
- completed_jobs_dont_execute job_cost sched.
-
- (* Then, if job j is scheduled, it must be pending. *)
- Lemma scheduled_implies_pending:
- forall t,
- scheduled sched j t ->
- pending job_arrival job_cost sched j t.
- Proof.
- rename H_jobs_must_arrive into ARRIVE,
- H_completed_jobs into COMP.
- unfold jobs_must_arrive_to_execute, completed_jobs_dont_execute in *.
- intros t SCHED.
- unfold pending; apply/andP; split; first by apply ARRIVE.
- apply/negP; unfold not; intro COMPLETED.
- have BUG := COMP j t.+1.
- rewrite leqNgt in BUG; move: BUG => /negP BUG; apply BUG.
- unfold service; rewrite -addn1 big_nat_recr // /=.
- apply leq_add; first by done.
- rewrite lt0n; apply/eqP; red; move => /eqP NOSERV.
- rewrite -not_scheduled_no_service in NOSERV.
- by rewrite SCHED in NOSERV.
- Qed.
-
- End Pending.
-
- End JobLemmas.
-
- (* In this section, we prove some lemmas about the list of jobs
- scheduled at time t. *)
- Section ScheduledJobsLemmas.
-
- Context {Job: eqType}.
-
- (* Consider any multiprocessor schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- Section Membership.
-
- (* A job is in the list of scheduled jobs iff it is scheduled. *)
- Lemma mem_scheduled_jobs_eq_scheduled :
- forall j t,
- j \in jobs_scheduled_at sched t = scheduled sched j t.
- Proof.
- unfold jobs_scheduled_at, scheduled, scheduled_on.
- intros j t; apply/idP/idP.
- {
- intros IN.
- apply mem_bigcat_ord_exists in IN; des.
- apply/existsP; exists i.
- destruct (sched i t); last by done.
- by rewrite mem_seq1 in IN; move: IN => /eqP IN; subst.
- }
- {
- move => /existsP EX; destruct EX as [i SCHED].
- apply mem_bigcat_ord with (j := i); first by apply ltn_ord.
- by move: SCHED => /eqP SCHED; rewrite SCHED /= mem_seq1 eq_refl.
- }
- Qed.
-
- End Membership.
-
- Section Uniqueness.
-
- (* Suppose that jobs are sequential. *)
- Hypothesis H_sequential_jobs : sequential_jobs sched.
-
- (* Then, the list of jobs scheduled at any time t has no duplicates. *)
- Lemma scheduled_jobs_uniq :
- forall t,
- uniq (jobs_scheduled_at sched t).
- Proof.
- intros t; rename H_sequential_jobs into SEQUENTIAL.
- unfold sequential_jobs in SEQUENTIAL.
- clear -SEQUENTIAL.
- unfold jobs_scheduled_at.
- induction num_cpus; first by rewrite big_ord0.
- {
-
- rewrite big_ord_recr cat_uniq; apply/andP; split.
- {
- apply bigcat_ord_uniq;
- first by intro i; unfold make_sequence; desf.
- intros x i1 i2 IN1 IN2; unfold make_sequence in *.
- desf; move: Heq0 Heq => SOME1 SOME2.
- rewrite mem_seq1 in IN1; rewrite mem_seq1 in IN2.
- move: IN1 IN2 => /eqP IN1 /eqP IN2; subst x s0.
- specialize (SEQUENTIAL s t (widen_ord (leqnSn n) i1)
- (widen_ord (leqnSn n) i2) SOME1 SOME2).
- by inversion SEQUENTIAL; apply ord_inj.
- }
- apply/andP; split; last by unfold make_sequence; destruct (sched ord_max).
- {
- rewrite -all_predC; apply/allP; unfold predC; simpl.
- intros x INx.
- unfold make_sequence in INx.
- destruct (sched ord_max t) eqn:SCHED;
- last by rewrite in_nil in INx.
- apply/negP; unfold not; intro IN'.
- have EX := mem_bigcat_ord_exists _ x n.
- apply EX in IN'; des; clear EX.
- unfold make_sequence in IN'.
- desf; rename Heq into SCHEDi.
- rewrite mem_seq1 in INx; rewrite mem_seq1 in IN'.
- move: INx IN' => /eqP INx /eqP IN'; subst x s0.
- specialize (SEQUENTIAL s t ord_max (widen_ord (leqnSn n) i) SCHED SCHEDi).
- inversion SEQUENTIAL; destruct i as [i EQ]; simpl in *.
- clear SEQUENTIAL SCHEDi.
- by rewrite H0 ltnn in EQ.
- }
- }
- Qed.
-
- End Uniqueness.
-
- Section NumberOfJobs.
-
- (* The number of scheduled jobs is no larger than the number of cpus. *)
- Lemma num_scheduled_jobs_le_num_cpus :
- forall t,
- size (jobs_scheduled_at sched t) <= num_cpus.
- Proof.
- intros t.
- unfold jobs_scheduled_at.
- destruct num_cpus; first by rewrite big_ord0.
- apply leq_trans with (1*n.+1); last by rewrite mul1n.
- apply size_bigcat_ord_max.
- by ins; unfold make_sequence; desf.
- Qed.
-
- End NumberOfJobs.
-
- End ScheduledJobsLemmas.
-
-End Schedule.
-
-(* Specific properties of a schedule of sporadic jobs. *)
-Module ScheduleOfSporadicTask.
-
- Import SporadicTask Job.
- Export Schedule.
-
- Section ScheduledJobs.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any multiprocessor schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Given a task tsk, ...*)
- Variable tsk: sporadic_task.
-
- (* ..., we we can state that tsk is scheduled on cpu at time t as follows. *)
- Definition task_scheduled_on (cpu: processor num_cpus) (t: time) :=
- if (sched cpu t) is Some j then
- (job_task j == tsk)
- else false.
-
- (* Likewise, we can state that tsk is scheduled on some processor. *)
- Definition task_is_scheduled (t: time) :=
- [exists cpu, task_scheduled_on cpu t].
-
- (* We also define the list of jobs scheduled during [t1, t2). *)
- Definition jobs_of_task_scheduled_between (t1 t2: time) :=
- filter (fun j => job_task j == tsk)
- (jobs_scheduled_between sched t1 t2).
-
- End ScheduledJobs.
-
- Section ScheduleProperties.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any multiprocessor schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Next we define intra-task parallelism. *)
- Definition jobs_of_same_task_dont_execute_in_parallel :=
- forall j j' t,
- job_task j = job_task j' ->
- scheduled sched j t ->
- scheduled sched j' t ->
- j = j'.
-
- End ScheduleProperties.
-
- Section BasicLemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any valid schedule of sporadic tasks ...*)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* ...such that jobs do not execute after completion.*)
- Hypothesis jobs_dont_execute_after_completion :
- completed_jobs_dont_execute job_cost sched.
-
- (* Let tsk be any tsk...*)
- Variable tsk: sporadic_task.
-
- (* ...and let j be any valid job of tsk. *)
- Variable j: Job.
- Hypothesis H_job_of_task: job_task j = tsk.
- Hypothesis valid_job:
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Remember that for any job of tsk, service <= task_cost tsk *)
- Lemma cumulative_service_le_task_cost :
- forall t t',
- service_during sched j t t' <= task_cost tsk.
- Proof.
- rename valid_job into VALID; unfold valid_sporadic_job in *; ins; des.
- apply leq_trans with (n := job_cost j);
- last by rewrite -H_job_of_task; apply VALID0.
- by apply cumulative_service_le_job_cost.
- Qed.
-
- End BasicLemmas.
-
-End ScheduleOfSporadicTask.
diff --git a/classic/model/schedule/global/jitter/constrained_deadlines.v b/classic/model/schedule/global/jitter/constrained_deadlines.v
deleted file mode 100644
index 42f7772e40968fe257256c16850021cd63d8725f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/jitter/constrained_deadlines.v
+++ /dev/null
@@ -1,477 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.interference prosa.classic.model.schedule.global.jitter.platform.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module ConstrainedDeadlines.
-
- Import Job SporadicTaskset ScheduleOfSporadicTaskWithJitter SporadicTaskset
- TaskArrival Interference Priority Platform.
-
- Section Lemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Consider any job arrival sequence ... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any schedule of this arrival sequence. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* For simplicity, let's define some local names. *)
- Let job_is_pending := pending job_arrival job_cost job_jitter sched.
- Let job_is_backlogged := backlogged job_arrival job_cost job_jitter sched.
-
- (* Next, assume all jobs have valid parameters. *)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* In this section we prove the absence of multiple jobs of the same
- task when constrained deadlines are assumed. *)
- Section NoMultipleJobs.
-
- (* Assume any work-conserving priority-based scheduler. *)
- Variable higher_eq_priority: JLDP_policy Job.
- Hypothesis H_work_conserving:
- work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_respects_JLDP_policy:
- respects_JLDP_policy job_arrival job_cost job_jitter arr_seq sched higher_eq_priority.
-
- (* Consider task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all jobs come from the taskset. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
-
- (* Suppose that jobs are sequential, ...*)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- (* ... jobs only execute after the jitter, ... *)
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- (* ... and jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule satisfies the sporadic task model. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider a valid task tsk, ...*)
- Variable tsk: sporadic_task.
- Hypothesis H_valid_task: is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (*... whose job j ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (*... is backlogged at time t. *)
- Variable t: time.
- Hypothesis H_j_backlogged: job_is_backlogged j t.
-
- (* Assume that any previous jobs of tsk have completed by the period. *)
- Hypothesis H_all_previous_jobs_completed :
- forall j_other tsk_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- job_arrival j_other + task_period tsk_other <= t ->
- completed job_cost sched j_other (job_arrival j_other + task_period (job_task j_other)).
-
- Let scheduled_task_other_than (tsk tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t && (tsk_other != tsk).
-
- (* Then, there can be at most one pending job of each task at time t. *)
- Lemma platform_at_most_one_pending_job_of_each_task :
- forall j1 j2,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- job_is_pending j1 t ->
- job_is_pending j2 t ->
- job_task j1 = job_task j2 ->
- j1 = j2.
- Proof.
- rename H_sporadic_tasks into SPO, H_all_previous_jobs_completed into PREV.
- intros j1 j2 ARRin1 ARRin2 PENDING1 PENDING2 SAMEtsk.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: PENDING1 PENDING2 => /andP [ARRIVED1 /negP NOTCOMP1] /andP [ARRIVED2 /negP NOTCOMP2].
- unfold jitter_has_passed, actual_arrival in *.
- destruct (leqP (job_arrival j1) (job_arrival j2)) as [BEFORE1 | BEFORE2].
- {
- specialize (SPO j1 j2 DIFF ARRin1 ARRin2 SAMEtsk BEFORE1).
- assert (LEt: job_arrival j1 + task_period (job_task j1) <= t).
- {
- apply leq_trans with (n := job_arrival j2); first by done.
- by apply leq_trans with (n := job_arrival j2 + job_jitter j2); first by apply leq_addr.
- }
- exploit (PREV j1 (job_task j1)); try (by done).
- intros COMP1; apply NOTCOMP1.
- try ( by apply completion_monotonic with (t0 := job_arrival j1 + task_period (job_task j1)) ) ||
- by apply completion_monotonic with (t := job_arrival j1 + task_period (job_task j1)).
- }
- {
- apply ltnW in BEFORE2.
- exploit (SPO j2 j1); try (by done); [by red; ins; subst | intro SPO'].
- assert (LEt: job_arrival j2 + task_period (job_task j2) <= t).
- {
- apply leq_trans with (n := job_arrival j1); first by done.
- by apply leq_trans with (n := job_arrival j1 + job_jitter j1); first by apply leq_addr.
- }
- exploit (PREV j2 (job_task j2)); try (by done).
- intros COMP2; apply NOTCOMP2.
- try ( by apply completion_monotonic with (t0 := job_arrival j2 + task_period (job_task j2)) ) ||
- by apply completion_monotonic with (t := job_arrival j2 + task_period (job_task j2)).
- }
- Qed.
-
- (* Therefore, all processors are busy with tasks other than tsk. *)
- Lemma platform_cpus_busy_with_interfering_tasks :
- count (scheduled_task_other_than tsk) ts = num_cpus.
- Proof.
- have UNIQ := platform_at_most_one_pending_job_of_each_task.
- rename H_all_jobs_from_taskset into FROMTS, H_sequential_jobs into SEQUENTIAL,
- H_work_conserving into WORK, H_jobs_come_from_arrival_sequence into FROMarr,
- H_respects_JLDP_policy into PRIO, H_j_backlogged into BACK,
- H_job_of_tsk into JOBtsk, H_valid_job_parameters into JOBPARAMS,
- H_valid_task into TASKPARAMS, H_all_previous_jobs_completed into PREV,
- H_completed_jobs_dont_execute into COMP, H_jobs_execute_after_jitter into JITTER.
- apply work_conserving_eq_work_conserving_count in WORK.
- unfold valid_sporadic_job, valid_realtime_job,
- respects_JLDP_policy, completed_jobs_dont_execute,
- sporadic_task_model, is_valid_sporadic_task,
- jobs_of_same_task_dont_execute_in_parallel,
- sequential_jobs in *.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- {
- apply leq_trans with (n := count (fun x => task_is_scheduled job_task sched x t) ts);
- first by apply sub_count; first by red; move => x /andP [SCHED _].
- unfold task_is_scheduled.
- apply count_exists; first by destruct ts.
- {
- intros cpu x1 x2 SCHED1 SCHED2.
- destruct (sched cpu t); last by done.
- move: SCHED1 SCHED2 => /eqP SCHED1 /eqP SCHED2.
- by rewrite -SCHED1 -SCHED2.
- }
- }
- {
- rewrite -(WORK j t) // -count_predT.
- apply leq_trans with (n := count
- (fun j => scheduled_task_other_than tsk (job_task j))
- (jobs_scheduled_at sched t));
- last first.
- {
- rewrite -count_map.
- apply count_sub_uniqr; last first.
- {
- move => tsk' /mapP [j' INj' JOBtsk']; subst; apply FROMTS.
- by rewrite mem_scheduled_jobs_eq_scheduled in INj'; eauto 2.
- }
- rewrite map_inj_in_uniq; first by apply scheduled_jobs_uniq.
- red; intros j1 j2 SCHED1 SCHED2 SAMEtsk.
- rewrite 2!mem_scheduled_jobs_eq_scheduled in SCHED1 SCHED2.
- have ARRin1: arrives_in arr_seq j1 by apply (FROMarr j1 t).
- have ARRin2: arrives_in arr_seq j2 by apply (FROMarr j2 t).
- by apply UNIQ; try (by done); apply scheduled_implies_pending.
- }
- {
- apply sub_in_count; intros j' SCHED' _.
- rewrite mem_scheduled_jobs_eq_scheduled in SCHED'.
- unfold scheduled_task_other_than; apply/andP; split.
- {
- move: SCHED' => /existsP [cpu /eqP SCHED'].
- by apply/existsP; exists cpu; rewrite /task_scheduled_on SCHED' eq_refl.
- }
- {
- apply/eqP; red; intro SAMEtsk; symmetry in SAMEtsk.
- move: BACK => /andP [PENDING NOTSCHED].
- generalize SCHED'; intro PENDING'.
- have ARRin': arrives_in arr_seq j' by apply (FROMarr j' t).
- exploit (UNIQ j j'); try (by done);
- [by apply scheduled_implies_pending | by rewrite -SAMEtsk |].
- by intro EQjob; subst; rewrite SCHED' in NOTSCHED.
- }
- }
- }
- Qed.
-
- End NoMultipleJobs.
-
- (* In this section we also prove the absence of multiple jobs of the same
- task when constrained deadlines are assumed, but in the specific case
- of fixed-priority scheduling. *)
- Section NoMultipleJobsFP.
-
- (* Assume any work-conserving priority-based scheduler. *)
- Variable higher_eq_priority: FP_policy sporadic_task.
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_respects_JLDP_policy:
- respects_FP_policy job_arrival job_cost job_task job_jitter arr_seq sched higher_eq_priority.
-
- (* Consider any task set ts. *)
- Variable ts: taskset_of sporadic_task.
-
- (* Assume that all jobs come from the taskset. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j,
- arrives_in arr_seq j ->
- job_task j \in ts.
-
- (* Suppose that jobs are sequential, ...*)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
- (* ... jobs only execute after the jitter, ... *)
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- (* ... and jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule satisfies the sporadic task model. *)
- Hypothesis H_sporadic_tasks:
- sporadic_task_model task_period job_arrival job_task arr_seq.
-
- (* Consider a valid task tsk, ...*)
- Variable tsk: sporadic_task.
- Hypothesis H_valid_task: is_valid_sporadic_task task_cost task_period task_deadline tsk.
-
- (*... whose job j ... *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (*... is backlogged at time t <= job_arrival j + task_period tsk. *)
- Variable t: time.
- Hypothesis H_j_backlogged: job_is_backlogged j t.
- Hypothesis H_t_before_period: t < job_arrival j + task_period tsk.
-
- (* Recall the definition of a higher-priority task (with respect to tsk). *)
- Let is_hp_task := higher_priority_task higher_eq_priority tsk.
-
- (* Assume that any jobs of higher-priority tasks complete by their period. *)
- Hypothesis H_all_previous_jobs_completed :
- forall j_other tsk_other,
- arrives_in arr_seq j_other ->
- job_task j_other = tsk_other ->
- is_hp_task tsk_other ->
- completed job_cost sched j_other (job_arrival j_other + task_period tsk_other).
-
- (* Assume that any jobs of tsk prior to j complete by their period. *)
- Hypothesis H_all_previous_jobs_of_tsk_completed :
- forall j0,
- arrives_in arr_seq j0 ->
- job_task j0 = tsk ->
- job_arrival j0 < job_arrival j ->
- completed job_cost sched j0 (job_arrival j0 + task_period tsk).
-
- Definition scheduled_task_with_higher_eq_priority (tsk_other: sporadic_task) :=
- task_is_scheduled job_task sched tsk_other t &&
- is_hp_task tsk_other.
-
- (* Then, there can be at most one pending job of higher-priority tasks at time t. *)
- Lemma platform_fp_no_multiple_jobs_of_interfering_tasks :
- forall j1 j2,
- arrives_in arr_seq j1 ->
- arrives_in arr_seq j2 ->
- job_is_pending j1 t ->
- job_is_pending j2 t ->
- job_task j1 = job_task j2 ->
- is_hp_task (job_task j1) ->
- j1 = j2.
- Proof.
- unfold sporadic_task_model in *.
- rename H_sporadic_tasks into SPO, H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_all_previous_jobs_completed into PREV.
- intros j1 j2 ARRin1 ARRin2 PENDING1 PENDING2 SAMEtsk INTERF.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: PENDING1 PENDING2 => /andP [ARRIVED1 /negP NOTCOMP1] /andP [ARRIVED2 /negP NOTCOMP2].
- destruct (leqP (job_arrival j1) (job_arrival j2)) as [BEFORE1 | BEFORE2].
- {
- specialize (SPO j1 j2 DIFF ARRin1 ARRin2 SAMEtsk BEFORE1).
- assert (LEt: job_arrival j1 + task_period (job_task j1) <= t).
- {
- apply leq_trans with (n := job_arrival j2); first by done.
- by apply leq_trans with (n := job_arrival j2 + job_jitter j2); first by apply leq_addr.
- }
- exploit (PREV j1 (job_task j1) ARRin1); [by done | by apply INTERF | intros COMP1].
- apply NOTCOMP1.
- try ( by apply completion_monotonic with (t0 := job_arrival j1 + task_period (job_task j1)) ) ||
- by apply completion_monotonic with (t := job_arrival j1 + task_period (job_task j1)).
- }
- {
- apply ltnW in BEFORE2.
- feed (SPO j2 j1); first by red; ins; subst j2.
- feed (SPO ARRin2 ARRin1); first by rewrite SAMEtsk.
- feed SPO; first by done.
- assert (LEt: job_arrival j2 + task_period (job_task j2) <= t).
- {
- apply leq_trans with (n := job_arrival j1); first by done.
- by apply leq_trans with (n := job_arrival j1 + job_jitter j1); first by apply leq_addr.
- }
- exploit (PREV j2 (job_task j2) ARRin2);
- [by done | by rewrite -SAMEtsk | intro COMP2 ].
- apply NOTCOMP2.
- try ( by apply completion_monotonic with (t0 := job_arrival j2 + task_period (job_task j2)) ) ||
- by apply completion_monotonic with (t := job_arrival j2 + task_period (job_task j2)).
- }
- Qed.
-
- (* Also, there can be at most one pending job of tsk at time t. *)
- Lemma platform_fp_no_multiple_jobs_of_tsk :
- forall j',
- arrives_in arr_seq j' ->
- job_is_pending j' t ->
- job_task j' = tsk ->
- j' = j.
- Proof.
- unfold sporadic_task_model in *.
- rename H_sporadic_tasks into SPO,
- H_valid_task into PARAMS,
- H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_all_previous_jobs_completed into PREV,
- H_j_backlogged into BACK, H_job_of_tsk into JOBtsk.
- intros j' ARRin' PENDING' SAMEtsk.
- apply/eqP; rewrite -[_ == _]negbK; apply/negP; red; move => /eqP DIFF.
- move: BACK PENDING' => /andP [/andP [ARRIVED /negP NOTCOMP] NOTSCHED]
- /andP [ARRIVED' /negP NOTCOMP'].
- destruct (leqP (job_arrival j') (job_arrival j)) as [BEFORE | BEFORE'].
- {
- exploit (SPO j' j DIFF ARRin' H_j_arrives); [by rewrite JOBtsk | by done | intro SPO'].
- assert (LEt: job_arrival j' + task_period tsk <= t).
- {
- apply leq_trans with (n := job_arrival j); first by rewrite -SAMEtsk.
- by apply leq_trans with (n := job_arrival j + job_jitter j); first by apply leq_addr.
- }
- apply NOTCOMP'.
- try ( apply completion_monotonic with (t0 := job_arrival j' + task_period tsk); try (by done) ) ||
- apply completion_monotonic with (t := job_arrival j' + task_period tsk); try (by done).
- apply PREVtsk; try (by done).
- apply leq_trans with (n := job_arrival j' + task_period tsk); last by rewrite -SAMEtsk.
- rewrite -addn1; apply leq_add; first by done.
- by unfold is_valid_sporadic_task in *; des.
- }
- {
- unfold jitter_has_passed, actual_arrival in *.
- rewrite leqNgt in ARRIVED'; move: ARRIVED' => /negP BUG; apply BUG.
- apply leq_trans with (n := job_arrival j'); last by apply leq_addr.
- apply leq_trans with (n := job_arrival j + task_period tsk); first by done.
- by rewrite -JOBtsk; apply SPO; try (by done);
- [by red; ins; subst j' | by rewrite SAMEtsk | by apply ltnW].
- }
- Qed.
-
- (* Therefore, all processors are busy with tasks other than tsk. *)
- Lemma platform_fp_cpus_busy_with_interfering_tasks :
- count scheduled_task_with_higher_eq_priority ts = num_cpus.
- Proof.
- have UNIQ := platform_fp_no_multiple_jobs_of_interfering_tasks.
- have UNIQ' := platform_fp_no_multiple_jobs_of_tsk.
- rename H_all_jobs_from_taskset into FROMTS, H_sequential_jobs into SEQUENTIAL,
- H_work_conserving into WORK, H_respects_JLDP_policy into PRIO,
- H_j_backlogged into BACK, H_job_of_tsk into JOBtsk,
- H_sporadic_tasks into SPO, H_valid_job_parameters into JOBPARAMS,
- H_valid_task into TASKPARAMS, H_all_previous_jobs_completed into PREV,
- H_completed_jobs_dont_execute into COMP,
- H_jobs_come_from_arrival_sequence into FROMarr,
- H_all_previous_jobs_of_tsk_completed into PREVtsk,
- H_jobs_execute_after_jitter into JITTER.
- apply work_conserving_eq_work_conserving_count in WORK.
- unfold valid_sporadic_job, valid_realtime_job,
- respects_FP_policy, respects_JLDP_policy, FP_to_JLDP,
- completed_jobs_dont_execute, sequential_jobs,
- sporadic_task_model, is_valid_sporadic_task,
- jobs_of_same_task_dont_execute_in_parallel,
- is_hp_task in *.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- {
- apply leq_trans with (n := count (fun x => task_is_scheduled job_task sched x t) ts);
- first by apply sub_count; red; move => x /andP [SCHED _].
- unfold task_is_scheduled.
- apply count_exists; first by destruct ts.
- {
- intros cpu x1 x2 SCHED1 SCHED2.
- destruct (sched cpu t); last by done.
- move: SCHED1 SCHED2 => /eqP SCHED1 /eqP SCHED2.
- by rewrite -SCHED1 -SCHED2.
- }
- }
- {
- rewrite -(WORK j t) // -count_predT.
- apply leq_trans with (n := count (fun j =>
- scheduled_task_with_higher_eq_priority (job_task j)) (jobs_scheduled_at sched t));
- last first.
- {
- rewrite -count_map.
- apply leq_trans with (n := count predT
- [seq x <- (map (fun j => job_task j) (jobs_scheduled_at sched t))
- | scheduled_task_with_higher_eq_priority x]);
- first by rewrite count_filter; apply sub_count; red; ins.
- apply leq_trans with (n := count predT
- [seq x <- ts | scheduled_task_with_higher_eq_priority x]);
- last by rewrite count_predT size_filter.
- apply count_sub_uniqr; last first.
- {
- red; intros tsk' IN'.
- rewrite mem_filter in IN'; move: IN' => /andP [SCHED IN'].
- rewrite mem_filter; apply/andP; split; first by done.
- move: IN' => /mapP [j' IN'] ->; apply FROMTS.
- by rewrite mem_scheduled_jobs_eq_scheduled in IN'; eauto 2.
- }
- {
- rewrite filter_map.
- rewrite map_inj_in_uniq; first by apply filter_uniq, scheduled_jobs_uniq.
- red; intros j1 j2 SCHED1 SCHED2 SAMEtsk.
- rewrite 2!mem_filter in SCHED1 SCHED2.
- move: SCHED1 SCHED2 => /andP [/andP [_ HP1] SCHED1] /andP [/andP [_ HP2] SCHED2].
- rewrite 2!mem_scheduled_jobs_eq_scheduled in SCHED1 SCHED2.
- have ARRin1: arrives_in arr_seq j1 by apply (FROMarr j1 t).
- have ARRIn2: arrives_in arr_seq j2 by apply (FROMarr j2 t).
- by apply UNIQ; try (by done); apply scheduled_implies_pending.
- }
- }
- {
- apply sub_in_count; intros j' SCHED' _.
- rewrite mem_scheduled_jobs_eq_scheduled in SCHED'.
- apply/andP; split.
- {
- move: SCHED' => /existsP [cpu /eqP SCHED'].
- by apply/existsP; exists cpu; rewrite /task_scheduled_on SCHED' eq_refl.
- }
- apply/andP; split; first by rewrite -JOBtsk; apply PRIO with (t := t).
- {
- apply/eqP; red; intro SAMEtsk.
- generalize SCHED'; intro PENDING'.
- have ARRin': arrives_in arr_seq j' by apply (FROMarr j' t).
- try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) (job_jitter0 := job_jitter) in PENDING'; try (by done) ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := job_cost) (job_jitter := job_jitter) in PENDING'; try (by done).
- specialize (UNIQ' j' ARRin' PENDING' SAMEtsk); subst j'.
- by move: BACK => /andP [_ NOTSCHED]; rewrite SCHED' in NOTSCHED.
- }
- }
- }
- Qed.
-
- End NoMultipleJobsFP.
-
- End Lemmas.
-
-End ConstrainedDeadlines.
diff --git a/classic/model/schedule/global/jitter/interference.v b/classic/model/schedule/global/jitter/interference.v
deleted file mode 100644
index ea59c4a93b37c772c63653bccad4309b82c63979..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/jitter/interference.v
+++ /dev/null
@@ -1,214 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.schedule.global.workload.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Require prosa.classic.model.schedule.global.basic.interference.
-
-Module Interference.
-
- Import ScheduleOfSporadicTaskWithJitter Priority Workload.
-
- (* We import some of the basic definitions, but we need to re-define almost everything
- since the definition of backlogged (and thus the definition of interference)
- changes with jitter. *)
- Import prosa.classic.model.schedule.global.basic.interference.
- Export Interference.
-
- Section InterferenceDefs.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Consider any job arrival sequence...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any schedule of those jobs. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Consider any job j that incurs interference. *)
- Variable j: Job.
-
- (* Recall the definition of backlogged (pending and not scheduled). *)
- Let job_is_backlogged := backlogged job_arrival job_cost job_jitter sched j.
-
- (* First, we define total interference. *)
- Section TotalInterference.
-
- (* The total interference incurred by job j during [t1, t2) is the
- cumulative time in which j is backlogged in this interval. *)
- Definition total_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2) job_is_backlogged t.
-
- End TotalInterference.
-
- (* Next, we define job interference. *)
- Section JobInterference.
-
- (* Let job_other be a job that interferes with j. *)
- Variable job_other: Job.
-
- (* The interference caused by job_other during [t1, t2) is the cumulative
- time in which j is backlogged while job_other is scheduled. *)
- Definition job_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2)
- \sum_(cpu < num_cpus)
- (job_is_backlogged t &&
- scheduled_on sched job_other cpu t).
-
- End JobInterference.
-
- (* Next, we define task interference. *)
- Section TaskInterference.
-
- (* In order to define task interference, consider any interfering task tsk_other. *)
- Variable tsk_other: sporadic_task.
-
- (* The interference caused by tsk during [t1, t2) is the cumulative time
- in which j is backlogged while tsk is scheduled. *)
- Definition task_interference (t1 t2: time) :=
- \sum_(t1 <= t < t2)
- \sum_(cpu < num_cpus)
- (job_is_backlogged t &&
- task_scheduled_on job_task sched tsk_other cpu t).
-
- End TaskInterference.
-
- (* Next, we define an approximation of the total interference based on
- each per-task interference. *)
- Section TaskInterferenceJobList.
-
- Variable tsk_other: sporadic_task.
-
- Definition task_interference_joblist (t1 t2: time) :=
- \sum_(j <- jobs_scheduled_between sched t1 t2 | job_task j == tsk_other)
- job_interference j t1 t2.
-
- End TaskInterferenceJobList.
-
- (* Now we prove some basic lemmas about interference. *)
- Section BasicLemmas.
-
- (* First, we show that total interference cannot be larger than the interval length. *)
- Lemma total_interference_le_delta :
- forall t1 t2,
- total_interference t1 t2 <= t2 - t1.
- Proof.
- unfold total_interference; intros t1 t2.
- apply leq_trans with (n := \sum_(t1 <= t < t2) 1);
- first by apply leq_sum; ins; apply leq_b1.
- by rewrite big_const_nat iter_addn mul1n addn0 leqnn.
- Qed.
-
- (* Next, we prove that job interference is bounded by the service of the interfering job. *)
- Lemma job_interference_le_service :
- forall j_other t1 t2,
- job_interference j_other t1 t2 <= service_during sched j_other t1 t2.
- Proof.
- intros j_other t1 t2; unfold job_interference, service_during.
- apply leq_sum; intros t _.
- unfold service_at; rewrite [\sum_(_ < _ | scheduled_on _ _ _ _)_]big_mkcond.
- apply leq_sum; intros cpu _.
- destruct (job_is_backlogged t); [rewrite andTb | by rewrite andFb].
- by destruct (scheduled_on sched j_other cpu t).
- Qed.
-
- (* We also prove that task interference is bounded by the workload of the interfering task. *)
- Lemma task_interference_le_workload :
- forall tsk t1 t2,
- task_interference tsk t1 t2 <= workload job_task sched tsk t1 t2.
- Proof.
- unfold task_interference, workload; intros tsk t1 t2.
- apply leq_sum; intros t _.
- apply leq_sum; intros cpu _.
- destruct (job_is_backlogged t); [rewrite andTb | by rewrite andFb].
- unfold task_scheduled_on, service_of_task.
- by destruct (sched cpu t).
- Qed.
-
- End BasicLemmas.
-
- (* Now we prove some bounds on interference for sequential jobs. *)
- Section InterferenceSequentialJobs.
-
- (* If jobs are sequential, ... *)
- Hypothesis H_sequential_jobs: sequential_jobs sched.
-
- (* ... then the interference incurred by a job in an interval
- of length delta is at most delta. *)
- Lemma job_interference_le_delta :
- forall j_other t1 delta,
- job_interference j_other t1 (t1 + delta) <= delta.
- Proof.
- rename H_sequential_jobs into SEQ.
- unfold job_interference, sequential_jobs in *.
- intros j_other t1 delta.
- apply leq_trans with (n := \sum_(t1 <= t < t1 + delta) 1);
- last by rewrite big_const_nat iter_addn mul1n addn0 addKn leqnn.
- apply leq_sum; intros t _.
- destruct ([exists cpu, scheduled_on sched j_other cpu t]) eqn:EX.
- {
- move: EX => /existsP [cpu SCHED].
- rewrite (bigD1 cpu) // /=.
- rewrite big_mkcond (eq_bigr (fun x => 0)) /=;
- first by simpl_sum_const; rewrite leq_b1.
- intros cpu' _; des_if_goal; last by done.
- destruct (scheduled_on sched j_other cpu' t) eqn:SCHED'; last by rewrite andbF.
- move: SCHED SCHED' => /eqP SCHED /eqP SCHED'.
- by specialize (SEQ j_other t cpu cpu' SCHED SCHED'); rewrite SEQ in Heq.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP EX.
- rewrite (eq_bigr (fun x => 0)); first by simpl_sum_const.
- by intros cpu _; specialize (EX cpu); apply negbTE in EX; rewrite EX andbF.
- }
- Qed.
-
- End InterferenceSequentialJobs.
-
- (* Next, we show that the cumulative per-task interference bounds the total
- interference. *)
- Section BoundUsingPerJobInterference.
-
- Lemma interference_le_interference_joblist :
- forall tsk t1 t2,
- task_interference tsk t1 t2 <= task_interference_joblist tsk t1 t2.
- Proof.
- intros tsk t1 t2.
- unfold task_interference, task_interference_joblist, job_interference, job_is_backlogged.
- rewrite [\sum_(_ <- _ sched _ _ | _) _]exchange_big /=.
- rewrite big_nat_cond [\sum_(_ <= _ < _ | true) _]big_nat_cond.
- apply leq_sum; move => t /andP [LEt _].
- rewrite exchange_big /=.
- apply leq_sum; intros cpu _.
- destruct (backlogged job_arrival job_cost job_jitter sched j t) eqn:BACK;
- last by rewrite andFb (eq_bigr (fun x => 0));
- first by rewrite big_const_seq iter_addn mul0n addn0.
- rewrite andTb.
- destruct (task_scheduled_on job_task sched tsk cpu t) eqn:SCHED; last by done.
- unfold scheduled_on, task_scheduled_on in *.
- destruct (sched cpu t) as [j' |] eqn:SOME; last by done.
- rewrite big_mkcond /= (bigD1_seq j') /=; last by apply undup_uniq.
- {
- by rewrite SCHED eq_refl.
- }
- {
- unfold jobs_scheduled_between.
- rewrite mem_undup; apply mem_bigcat_nat with (j := t);
- first by done.
- apply mem_bigcat_ord with (j := cpu); first by apply ltn_ord.
- by unfold make_sequence; rewrite SOME mem_seq1 eq_refl.
- }
- Qed.
-
- End BoundUsingPerJobInterference.
-
- End InterferenceDefs.
-
-End Interference.
\ No newline at end of file
diff --git a/classic/model/schedule/global/jitter/interference_edf.v b/classic/model/schedule/global/jitter/interference_edf.v
deleted file mode 100644
index f74902fc81b581a4fb862c6438e83e5682fda04d..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/jitter/interference_edf.v
+++ /dev/null
@@ -1,76 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.jitter.job
- prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.interference
- prosa.classic.model.schedule.global.jitter.platform.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module InterferenceEDF.
-
- Import ScheduleWithJitter Priority Platform Interference Priority.
-
- Section Lemmas.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Consider any schedule. *)
- Variable num_cpus: nat.
- Variable sched: schedule Job num_cpus.
-
- (* Assume that the schedule satisfies the global scheduling invariant
- for EDF, i.e., if any job of tsk is backlogged, every processor
- must be busy with jobs with no larger absolute deadline. *)
- Hypothesis H_scheduler_uses_EDF:
- respects_JLFP_policy job_arrival job_cost job_jitter arr_seq sched
- (EDF job_arrival job_deadline).
-
- (* Under EDF scheduling, a job only causes interference if its deadline
- is not larger than the deadline of the analyzed job. *)
- Lemma interference_under_edf_implies_shorter_deadlines :
- forall j j' t1 t2,
- arrives_in arr_seq j ->
- arrives_in arr_seq j' ->
- job_interference job_arrival job_cost job_jitter sched j' j t1 t2 != 0 ->
- job_arrival j + job_deadline j <= job_arrival j' + job_deadline j'.
- Proof.
- rename H_scheduler_uses_EDF into PRIO.
- intros j j' t1 t2 ARR ARR' INTERF.
- unfold job_interference in INTERF.
- destruct ([exists t': 'I_t2,
- [exists cpu: processor num_cpus,
- (t' >= t1) &&
- backlogged job_arrival job_cost job_jitter sched j' t' &&
- scheduled_on sched j cpu t']]) eqn:EX.
- {
- move: EX => /existsP [t' /existsP [cpu /andP [/andP [LE BACK] SCHED]]].
- apply PRIO with (t := t'); try (by done).
- by apply/existsP; exists cpu.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP ALL.
- rewrite big_nat_cond (eq_bigr (fun x => 0)) in INTERF;
- first by rewrite -big_nat_cond big_const_nat iter_addn mul0n addn0 eq_refl in INTERF.
- move => i /andP [/andP [GEi LTi] _].
- specialize (ALL (Ordinal LTi)).
- rewrite negb_exists in ALL.
- move: ALL => /forallP ALL.
- rewrite (eq_bigr (fun x => 0));
- first by rewrite big_const_ord iter_addn mul0n addn0.
- intros cpu _; specialize (ALL cpu); simpl in ALL.
- destruct (backlogged job_arrival job_cost job_jitter sched j' i); last by rewrite andFb.
- rewrite GEi 2!andTb in ALL; rewrite andTb.
- by apply negbTE in ALL; rewrite ALL.
- }
- Qed.
-
- End Lemmas.
-
-End InterferenceEDF.
\ No newline at end of file
diff --git a/classic/model/schedule/global/jitter/job.v b/classic/model/schedule/global/jitter/job.v
deleted file mode 100644
index e93d8320f6e89ab7383b4e293b87f709295be0c2..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/jitter/job.v
+++ /dev/null
@@ -1,40 +0,0 @@
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task.
-From mathcomp Require Import ssrnat ssrbool eqtype.
-
-Require Export prosa.classic.model.arrival.basic.job.
-
-(* Properties of different types of job: *)
-Module JobWithJitter.
-
- Import Time.
- Export Job.
-
- (* 4) Job of sporadic task with jitter *)
- Section ValidSporadicTaskJobWithJitter.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
- Variable task_jitter: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- Variable j: Job.
-
- (* The job jitter cannot be larger than the task (maximum) jitter.*)
- Definition job_jitter_leq_task_jitter :=
- job_jitter j <= task_jitter (job_task j).
-
- Let j_is_valid_job :=
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- Definition valid_sporadic_job_with_jitter :=
- j_is_valid_job /\ job_jitter_leq_task_jitter.
-
- End ValidSporadicTaskJobWithJitter.
-
-End JobWithJitter.
\ No newline at end of file
diff --git a/classic/model/schedule/global/jitter/platform.v b/classic/model/schedule/global/jitter/platform.v
deleted file mode 100644
index 1ee46b15aac0102cadb614ef3f6c4d134ae0024d..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/jitter/platform.v
+++ /dev/null
@@ -1,197 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.schedule.global.jitter.schedule
- prosa.classic.model.schedule.global.jitter.interference.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module Platform.
-
- Import Job SporadicTaskset ScheduleOfSporadicTaskWithJitter SporadicTaskset TaskArrival Interference Priority.
-
- Section Properties.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
- Variable job_jitter: Job -> time.
-
- (* Assume any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Consider any schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* For simplicity, let's define local names. *)
- Let job_is_backlogged := backlogged job_arrival job_cost job_jitter sched.
-
- Section Execution.
-
- (* A scheduler is work-conserving iff when a job j is backlogged,
- all processors are busy with other jobs.
- Note: backlogged means that jitter has already passed. *)
- Definition work_conserving :=
- forall j t,
- arrives_in arr_seq j ->
- job_is_backlogged j t ->
- forall cpu, exists j_other,
- scheduled_on sched j_other cpu t.
-
- (* We also provide an alternative, equivalent definition of work-conserving
- based on counting the number of scheduled jobs. *)
- Definition work_conserving_count :=
- forall j t,
- arrives_in arr_seq j ->
- job_is_backlogged j t ->
- size (jobs_scheduled_at sched t) = num_cpus.
-
- End Execution.
-
- Section FP.
-
- (* An FP policy ...*)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ... is respected by the schedule iff every scheduled
- job has higher (or same) priority than (as) a backlogged job. *)
- Definition respects_FP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- job_is_backlogged j t ->
- scheduled sched j_hp t ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- Section JLFP.
-
- (* A JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ... is respected by the schedule iff at any time t,
- a scheduled job has higher (or same) priority than (as)
- a backlogged job. *)
- Definition respects_JLFP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- job_is_backlogged j t ->
- scheduled sched j_hp t ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- Section JLDP.
-
- (* A JLDP policy ...*)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* ... is respected by the schedule iff at any time t,
- a scheduled job has higher (or same) priority than (as)
- a backlogged job. *)
- Definition respects_JLDP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- job_is_backlogged j t ->
- scheduled sched j_hp t ->
- higher_eq_priority t j_hp j.
-
- End JLDP.
-
- Section Lemmas.
-
- (* Assume all jobs have valid parameters, ...*)
- Hypothesis H_valid_job_parameters:
- forall j,
- arrives_in arr_seq j ->
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* In this section, we prove that the two definitions of work-conserving are equivalent. *)
- Section EquivalentDefinitions.
-
- Lemma work_conserving_eq_work_conserving_count :
- work_conserving <-> work_conserving_count.
- Proof.
- unfold work_conserving, work_conserving_count; split.
- {
- intros EX j t ARRin BACK.
- specialize (EX j t ARRin BACK).
- apply eq_trans with (y := size (enum (processor num_cpus)));
- last by rewrite size_enum_ord.
- unfold jobs_scheduled_at.
- apply eq_trans with (y := size ((\cat_(cpu < num_cpus) map (fun x => Some x)
- (make_sequence (sched cpu t)))));
- first by rewrite -map_bigcat_ord size_map.
- apply eq_trans with (y := size (\cat_(cpu < num_cpus) [:: sched cpu t])).
- {
- f_equal; apply eq_bigr; intros cpu _.
- destruct (sched cpu t) eqn:SCHED; first by done.
- by specialize (EX cpu); des; move: EX => /eqP EX; rewrite EX in SCHED.
- }
- rewrite size_bigcat_ord.
- apply eq_trans with (y := \sum_(i < num_cpus) 1);
- last by rewrite big_const_ord iter_addn mul1n addn0 size_enum_ord.
- by apply eq_bigr.
- }
- {
- intros SIZE j t ARRin BACK cpu.
- specialize (SIZE j t ARRin BACK).
- destruct ([exists cpu, sched cpu t == None]) eqn:EX; last first.
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP ALL; specialize (ALL cpu).
- destruct (sched cpu t) as [j0|] eqn:SOME; last by done.
- by exists j0; apply/eqP.
- }
- {
- move: EX => /existsP [cpu' /eqP EX].
- unfold jobs_scheduled_at in SIZE.
- move: SIZE => /eqP SIZE; rewrite -[size _ == _]negbK in SIZE.
- move: SIZE => /negP SIZE; exfalso; apply SIZE; clear SIZE.
- rewrite neq_ltn; apply/orP; left.
- rewrite size_bigcat_ord.
- rewrite -> big_mkord_ord with (x0 := 0).
- have MKORD := big_mkord (fun x => true); rewrite -MKORD.
- have CAT := big_cat_nat _ (fun x => true).
- rewrite -> CAT with (n := cpu'); [simpl | by done | by apply ltnW, ltn_ord].
- assert (DIFF: exists k, num_cpus = (cpu' + k).+1).
- {
- exists (num_cpus - cpu').-1.
- rewrite -addnS prednK; last by rewrite ltn_subRL addn0 ltn_ord.
- rewrite addnBA; last by apply ltnW, ltn_ord.
- by rewrite addnC -addnBA // subnn addn0.
- }
- des; rewrite {5}DIFF.
- rewrite big_nat_recl; last by apply leq_addr.
- apply leq_trans with (n := (\sum_(0 <= i < cpu') 1) + 1 +
- (\sum_(cpu' <= i < cpu' + k) 1));
- last first.
- {
- rewrite 2!big_const_nat 2!iter_addn 2!mul1n addn0 subn0.
- rewrite [cpu' + k]addnC -addnBA // subnn 2!addn0.
- by rewrite -addnA [1 + k]addnC addnA addn1 -DIFF.
- }
- {
- rewrite -addn1 addnC [_ + 1]addnC -addnA.
- apply leq_add; first by done.
- rewrite eq_fun_ord_to_nat; unfold make_sequence at 2; rewrite EX /= add0n.
- apply leq_add; apply leq_sum; ins; unfold fun_ord_to_nat; des_eqrefl; try done;
- by unfold make_sequence; desf.
- }
- }
- }
- Qed.
-
- End EquivalentDefinitions.
-
- End Lemmas.
-
- End Properties.
-
-End Platform.
\ No newline at end of file
diff --git a/classic/model/schedule/global/jitter/schedule.v b/classic/model/schedule/global/jitter/schedule.v
deleted file mode 100644
index bac78654bd64809878e183e18c8b8c53d260851d..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/jitter/schedule.v
+++ /dev/null
@@ -1,251 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.schedule.global.jitter.job prosa.classic.model.arrival.basic.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Require prosa.classic.model.schedule.global.basic.schedule.
-
-(* Definition, properties and lemmas about schedules. *)
-Module ScheduleWithJitter.
-
- (* We import the original schedule module and redefine whatever is required. *)
- Export prosa.classic.model.schedule.global.basic.schedule.
- Export ArrivalSequence Schedule.
-
- (* We need to redefine the properties of a job that depend on the arrival time. *)
- Section ArrivalDependentProperties.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any schedule of these jobs. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* In this section we define properties of a job in the schedule. *)
- Section JobProperties.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* We define the actual arrival of job j as the time when the jitter ends. *)
- Definition actual_arrival := job_arrival j + job_jitter j.
-
- (* Next, we define whether job j's jitter has passed by time t... *)
- Definition jitter_has_passed (t: time) := actual_arrival <= t.
-
- (* ...and whether job j actually arrived before time t. *)
- Definition actual_arrival_before (t: time) := actual_arrival < t.
-
- (* We say that job j is pending at time t iff the jitter has passed but j has not completed. *)
- Definition pending (t: time) := jitter_has_passed t && ~~ completed job_cost sched j t.
-
- (* We say that job j is backlogged at time t iff it is pending and not scheduled. *)
- Definition backlogged (t: time) := pending t && ~~ scheduled sched j t.
-
- End JobProperties.
-
- Section ScheduleProperties.
-
- (* In a valid schedule, a job can only be scheduled after the jitter has passed. *)
- Definition jobs_execute_after_jitter :=
- forall j t,
- scheduled sched j t -> jitter_has_passed j t.
-
- End ScheduleProperties.
-
- Section BasicLemmas.
-
- (* Assume that jobs can only execute after the jitter. *)
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter.
-
- Section Pending.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs:
- completed_jobs_dont_execute job_cost sched.
-
- (* Then, if job j is scheduled, it must be pending. *)
- Lemma scheduled_implies_pending:
- forall j t,
- scheduled sched j t ->
- pending j t.
- Proof.
- rename H_jobs_execute_after_jitter into JITTER,
- H_completed_jobs into COMP.
- unfold jobs_execute_after_jitter, completed_jobs_dont_execute in *.
- intros j t SCHED.
- unfold pending; apply/andP; split; first by apply JITTER.
- apply/negP; unfold not; intro COMPLETED.
- have BUG := COMP j t.+1.
- rewrite leqNgt in BUG; move: BUG => /negP BUG; apply BUG.
- unfold service; rewrite -addn1 big_nat_recr // /=.
- apply leq_add; first by done.
- rewrite lt0n; apply/eqP; red; move => /eqP NOSERV.
- rewrite -not_scheduled_no_service in NOSERV.
- by rewrite SCHED in NOSERV.
- Qed.
-
- End Pending.
-
- Section Service.
-
- (* First, we prove that if a job cannot execute before the jitter has passed,
- then it cannot execute before its arrival time. *)
- Lemma arrival_before_jitter :
- jobs_must_arrive_to_execute job_arrival sched.
- Proof.
- unfold jobs_execute_after_jitter, jobs_must_arrive_to_execute.
- intros j t SCHED; unfold ArrivalSequence.has_arrived.
- rewrite -(leq_add2r (job_jitter j)).
- by apply leq_trans with (n := t);
- [by apply H_jobs_execute_after_jitter | by apply leq_addr].
- Qed.
-
- (* Next, we show that the service received before the jitter is zero. *)
- Lemma service_before_jitter_zero :
- forall j t,
- t < job_arrival j + job_jitter j ->
- service_at sched j t = 0.
- Proof.
- rename H_jobs_execute_after_jitter into AFTER; intros j t LT.
- apply/eqP; rewrite -not_scheduled_no_service; apply/negP; red; intro SCHED.
- by apply AFTER, (leq_trans LT) in SCHED; rewrite ltnn in SCHED.
- Qed.
-
- (* The same applies to the cumulative service. *)
- Lemma cumulative_service_before_jitter_zero :
- forall j t1 t2,
- t2 <= job_arrival j + job_jitter j ->
- \sum_(t1 <= t < t2) service_at sched j t = 0.
- Proof.
- intros j t1 t2 LE.
- apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := \sum_(t1 <= t < t2) 0);
- last by rewrite big_const_nat iter_addn mul0n addn0.
- rewrite big_nat_cond [\sum_(_ <= _ < _)_]big_nat_cond.
- apply leq_sum; move => t /andP [/andP [_ LT] _].
- rewrite leqn0; apply/eqP; apply service_before_jitter_zero.
- by apply (leq_trans LT).
- Qed.
-
- End Service.
-
- End BasicLemmas.
-
- End ArrivalDependentProperties.
-
-End ScheduleWithJitter.
-
-(* Specific properties of a schedule of sporadic jobs. *)
-Module ScheduleOfSporadicTaskWithJitter.
-
- Import SporadicTask Job.
- Export ScheduleWithJitter.
-
- Section ScheduledJobs.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any multiprocessor schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Given a task tsk, ...*)
- Variable tsk: sporadic_task.
-
- (* ..., we can state that tsk is scheduled on cpu at time t as follows. *)
- Definition task_scheduled_on (cpu: processor num_cpus) (t: time) :=
- if (sched cpu t) is Some j then
- (job_task j == tsk)
- else false.
-
- (* Likewise, we can state that tsk is scheduled on some processor. *)
- Definition task_is_scheduled (t: time) :=
- [exists cpu, task_scheduled_on cpu t].
-
- (* We also define the list of jobs scheduled during [t1, t2). *)
- Definition jobs_of_task_scheduled_between (t1 t2: time) :=
- filter (fun j => job_task j == tsk)
- (jobs_scheduled_between sched t1 t2).
-
- End ScheduledJobs.
-
- Section ScheduleProperties.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any schedule. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Next we define intra-task parallelism. *)
- Definition jobs_of_same_task_dont_execute_in_parallel :=
- forall j j' t,
- job_task j = job_task j' ->
- scheduled sched j t ->
- scheduled sched j' t ->
- j = j'.
-
- End ScheduleProperties.
-
- Section BasicLemmas.
-
- (* Assume the job cost and task are known. *)
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any schedule of these jobs. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Assume that jobs do not execute after completion.*)
- Hypothesis jobs_dont_execute_after_completion :
- completed_jobs_dont_execute job_cost sched.
-
- (* Let tsk be any task...*)
- Variable tsk: sporadic_task.
-
- (* ...and let j be any valid job of this task. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_task: job_task j = tsk.
- Hypothesis valid_job:
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* Then, we can prove that the service received by j is no larger than the cost
- of its task. *)
- Lemma cumulative_service_le_task_cost :
- forall t t',
- service_during sched j t t' <= task_cost tsk.
- Proof.
- rename valid_job into VALID; unfold valid_sporadic_job in *; ins; des.
- apply leq_trans with (n := job_cost j);
- last by rewrite -H_job_of_task; apply VALID0.
- by apply cumulative_service_le_job_cost.
- Qed.
-
- End BasicLemmas.
-
-End ScheduleOfSporadicTaskWithJitter.
\ No newline at end of file
diff --git a/classic/model/schedule/global/response_time.v b/classic/model/schedule/global/response_time.v
deleted file mode 100644
index ea252320a726a359788159a898c5f04a814d16ad..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/response_time.v
+++ /dev/null
@@ -1,135 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Definition of response-time bound and some simple lemmas. *)
-Module ResponseTime.
-
- Import Schedule SporadicTaskset TaskArrival.
-
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any multiprocessor schedule of these jobs. *)
- Context {num_cpus : nat}.
- Variable sched: schedule Job num_cpus.
-
- (* For simplicity, let's define some local names.*)
- Let job_has_completed_by := completed job_cost sched.
-
- Section Definitions.
-
- (* Given a task tsk...*)
- Variable tsk: sporadic_task.
-
- (* ... we say that R is a response-time bound of tsk in this schedule ... *)
- Variable R: time.
-
- (* ... iff any job j of tsk in this arrival sequence has completed by (job_arrival j + R). *)
- Definition is_response_time_bound_of_task :=
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_has_completed_by j (job_arrival j + R).
-
- End Definitions.
-
- Section BasicLemmas.
-
- (* Assume that jobs dont execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- Section SpecificJob.
-
- (* Then, for any job j ...*)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
-
- (* ...with response-time bound R in this schedule, ... *)
- Variable R: time.
- Hypothesis response_time_bound:
- job_has_completed_by j (job_arrival j + R).
-
- (* ...the service received by j at any time t' after its response time is 0. *)
- Lemma service_after_job_rt_zero :
- forall t',
- t' >= job_arrival j + R ->
- service_at sched j t' = 0.
- Proof.
- rename response_time_bound into RT,
- H_completed_jobs_dont_execute into EXEC; ins.
- unfold is_response_time_bound_of_task, completed,
- completed_jobs_dont_execute in *.
- apply/eqP; rewrite -leqn0.
- eapply completion_monotonic in RT; eauto 2.
- apply completed_implies_not_scheduled in RT; eauto 2.
- by move: RT; rewrite not_scheduled_no_service; move => /eqP RT; rewrite RT.
- Qed.
-
- (* The same applies for the cumulative service of job j. *)
- Lemma cumulative_service_after_job_rt_zero :
- forall t' t'',
- t' >= job_arrival j + R ->
- \sum_(t' <= t < t'') service_at sched j t = 0.
- Proof.
- ins; apply/eqP; rewrite -leqn0.
- rewrite big_nat_cond; rewrite -> eq_bigr with (F2 := fun i => 0);
- first by rewrite big_const_seq iter_addn mul0n addn0 leqnn.
- intro i; rewrite andbT; move => /andP [LE _].
- by rewrite service_after_job_rt_zero;
- [by ins | by apply leq_trans with (n := t')].
- Qed.
-
- End SpecificJob.
-
- Section AllJobs.
-
- (* Consider any task tsk ...*)
- Variable tsk: sporadic_task.
-
- (* ... for which a response-time bound R is known. *)
- Variable R: time.
- Hypothesis response_time_bound:
- is_response_time_bound_of_task tsk R.
-
- (* Then, for any job j of this task, ...*)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_task: job_task j = tsk.
-
- (* ...the service received by job j at any time t' after the response time is 0. *)
- Lemma service_after_task_rt_zero :
- forall t',
- t' >= job_arrival j + R ->
- service_at sched j t' = 0.
- Proof.
- by ins; apply service_after_job_rt_zero with (R := R); [apply response_time_bound |].
- Qed.
-
- (* The same applies for the cumulative service of job j. *)
- Lemma cumulative_service_after_task_rt_zero :
- forall t' t'',
- t' >= job_arrival j + R ->
- \sum_(t' <= t < t'') service_at sched j t = 0.
- Proof.
- by ins; apply cumulative_service_after_job_rt_zero with (R := R);
- first by apply response_time_bound.
- Qed.
-
- End AllJobs.
-
- End BasicLemmas.
-
- End ResponseTimeBound.
-
-End ResponseTime.
\ No newline at end of file
diff --git a/classic/model/schedule/global/schedulability.v b/classic/model/schedule/global/schedulability.v
deleted file mode 100644
index 8fc637009c574fa8574b72f6a1fdc3b3a48634bf..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/schedulability.v
+++ /dev/null
@@ -1,172 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect eqtype ssrbool ssrnat seq bigop.
-
-(* Definitions of deadline miss. *)
-Module Schedulability.
-
- Import Schedule SporadicTaskset Job.
-
- Section SchedulableDefs.
-
- Context {sporadic_task: eqType}.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any multiprocessor schedule of these jobs. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- Section ScheduleOfJobs.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* We say that job j misses no deadline in sched if it completed by its absolute deadline. *)
- Definition job_misses_no_deadline :=
- completed job_cost sched j (job_arrival j + job_deadline j).
-
- End ScheduleOfJobs.
-
- Section ScheduleOfTasks.
-
- (* Consider any task tsk. *)
- Variable tsk: sporadic_task.
-
- (* Task tsk doesn't miss its deadline iff all of its jobs don't miss their deadline. *)
- Definition task_misses_no_deadline :=
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_misses_no_deadline j.
-
- (* Task tsk doesn't miss its deadline before time t' iff all of its jobs don't miss
- their deadline by that time. *)
- Definition task_misses_no_deadline_before (t': time) :=
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_arrival j + job_deadline j < t' ->
- job_misses_no_deadline j.
-
- End ScheduleOfTasks.
-
- End SchedulableDefs.
-
- Section BasicLemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any schedule of these jobs... *)
- Context {num_cpus : nat}.
- Variable sched: schedule Job num_cpus.
-
- (* ... where jobs dont execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- Section SpecificJob.
-
- (* Then, for any job j ...*)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
-
- (* ...that doesn't miss a deadline in this schedule, ... *)
- Hypothesis no_deadline_miss:
- job_misses_no_deadline job_arrival job_cost job_deadline sched j.
-
- (* the service received by j at any time t' after its deadline is 0. *)
- Lemma service_after_job_deadline_zero :
- forall t',
- t' >= job_arrival j + job_deadline j ->
- service_at sched j t' = 0.
- Proof.
- intros t' LE.
- rename no_deadline_miss into RT,
- H_completed_jobs_dont_execute into EXEC.
- unfold job_misses_no_deadline, completed, completed_jobs_dont_execute in *.
- apply/eqP; rewrite -leqn0.
- eapply completion_monotonic in RT; eauto 2.
- apply completed_implies_not_scheduled in RT; eauto 2.
- by move: RT; rewrite not_scheduled_no_service; move => /eqP RT; rewrite RT.
- Qed.
-
- (* The same applies for the cumulative service of job j. *)
- Lemma cumulative_service_after_job_deadline_zero :
- forall t' t'',
- t' >= job_arrival j + job_deadline j ->
- \sum_(t' <= t < t'') service_at sched j t = 0.
- Proof.
- ins; apply/eqP; rewrite -leqn0.
- rewrite big_nat_cond; rewrite -> eq_bigr with (F2 := fun i => 0);
- first by rewrite big_const_seq iter_addn mul0n addn0 leqnn.
- intro i; rewrite andbT; move => /andP [LE _].
- by rewrite service_after_job_deadline_zero;
- [by ins | by apply leq_trans with (n := t')].
- Qed.
-
- End SpecificJob.
-
- Section AllJobs.
-
- (* Consider any task tsk ...*)
- Variable tsk: sporadic_task.
-
- (* ... that doesn't miss any deadline. *)
- Hypothesis no_deadline_misses:
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched tsk.
-
- (* Then, for any valid job j of this task, ...*)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_task: job_task j = tsk.
- Hypothesis H_valid_job:
- valid_sporadic_job task_cost task_deadline job_cost job_deadline job_task j.
-
- (* the service received by job j at any time t' after the deadline is 0. *)
- Lemma service_after_task_deadline_zero :
- forall t',
- t' >= job_arrival j + task_deadline tsk ->
- service_at sched j t' = 0.
- Proof.
- rename H_valid_job into PARAMS; unfold valid_sporadic_job in *; des; intros t'.
- rewrite -H_job_of_task -PARAMS1.
- by apply service_after_job_deadline_zero, no_deadline_misses.
- Qed.
-
- (* The same applies for the cumulative service of job j. *)
- Lemma cumulative_service_after_task_deadline_zero :
- forall t' t'',
- t' >= job_arrival j + task_deadline tsk ->
- \sum_(t' <= t < t'') service_at sched j t = 0.
- Proof.
- rename H_valid_job into PARAMS; unfold valid_sporadic_job in *; des; intros t' t''.
- rewrite -H_job_of_task -PARAMS1.
- by apply cumulative_service_after_job_deadline_zero, no_deadline_misses.
- Qed.
-
- End AllJobs.
-
- End BasicLemmas.
-
-End Schedulability.
\ No newline at end of file
diff --git a/classic/model/schedule/global/transformation/construction.v b/classic/model/schedule/global/transformation/construction.v
deleted file mode 100644
index 5f04cb67b366db8c7b543f1c863bc328f8981a2f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/transformation/construction.v
+++ /dev/null
@@ -1,151 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path finfun.
-
-Module ScheduleConstruction.
-
- Import ArrivalSequence Schedule.
-
- (* In this section, we construct a schedule recursively by augmenting prefixes. *)
- Section ConstructionFromPrefixes.
-
- Context {Job: eqType}.
-
- (* Let arr_seq be any arrival sequence.*)
- Variable arr_seq: arrival_sequence Job.
-
- (* Let num_cpus denote the number of processors. *)
- Variable num_cpus: nat.
-
- (* Assume we are given a function that takes an existing schedule prefix [0, t)
- and returns what should be scheduled at time t on each processor. *)
- Variable build_schedule:
- schedule Job num_cpus -> schedule Job num_cpus.
-
- (* Then, starting from a base schedule, ... *)
- Variable base_sched: schedule Job num_cpus.
-
- (* ...we can update individual times using the build_schedule function, ... *)
- Definition update_schedule (prev_sched: schedule Job num_cpus)
- (t_next: time) : schedule Job num_cpus :=
- fun (cpu: processor num_cpus) t =>
- if t == t_next then
- build_schedule prev_sched cpu t
- else prev_sched cpu t.
-
- (* ...which recursively generates schedule prefixes up to time t_max. *)
- Fixpoint schedule_prefix (t_max: time) : schedule Job num_cpus :=
- if t_max is t_prev.+1 then
- update_schedule (schedule_prefix t_prev) t_prev.+1
- else
- update_schedule base_sched 0.
-
- (* Based on the schedule prefixes, we construct a complete schedule. *)
- Definition build_schedule_from_prefixes := fun cpu t => schedule_prefix t cpu t.
-
- (* In this section, we prove some lemmas about the construction. *)
- Section Lemmas.
-
- (* Let sched be the generated schedule. *)
- Let sched := build_schedule_from_prefixes.
-
- (* First, we show that the scheduler preserves its prefixes. *)
- Lemma prefix_construction_same_prefix:
- forall t t_max cpu,
- t <= t_max ->
- schedule_prefix t_max cpu t = sched cpu t.
- Proof.
- intros t t_max cpu LEt.
- induction t_max;
- first by rewrite leqn0 in LEt; move: LEt => /eqP EQ; subst.
- rewrite leq_eqVlt in LEt.
- move: LEt => /orP [/eqP EQ | LESS]; first by subst.
- {
- feed IHt_max; first by done.
- unfold schedule_prefix, update_schedule at 1.
- assert (FALSE: t == t_max.+1 = false).
- {
- by apply negbTE; rewrite neq_ltn LESS orTb.
- } rewrite FALSE.
- by rewrite -IHt_max.
- }
- Qed.
-
- Section ServiceDependent.
-
- (* If the generation function only depends on the service
- received by jobs during the schedule prefix, ...*)
- Hypothesis H_depends_only_on_service:
- forall sched1 sched2 cpu t,
- (forall j, service sched1 j t = service sched2 j t) ->
- build_schedule sched1 cpu t = build_schedule sched2 cpu t.
-
- (* ...then we can prove that the final schedule, at any time t,
- is exactly the result of the construction function. *)
- Lemma service_dependent_schedule_construction:
- forall cpu t,
- sched cpu t = build_schedule sched cpu t.
- Proof.
- intros cpu t.
- feed (prefix_construction_same_prefix t t cpu); [by done | intros EQ].
- rewrite -{}EQ.
- induction t as [t IH] using strong_ind.
- destruct t.
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_service.
- by intros j; rewrite /service /service_during big_geq // big_geq //.
- }
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_service.
- intros j; rewrite /service /service_during.
- rewrite big_nat_recr //= big_nat_recr //=; f_equal.
- apply eq_big_nat; move => i /= LT.
- rewrite /service_at.
- apply eq_bigl; intros cpu'; rewrite /scheduled_on.
- by rewrite prefix_construction_same_prefix; last by apply ltnW.
- }
- Qed.
-
- End ServiceDependent.
-
- Section PrefixDependent.
-
- (* If the generation function only depends on the schedule prefix, ... *)
- Hypothesis H_depends_only_on_prefix:
- forall (sched1 sched2: schedule Job num_cpus) cpu t,
- (forall t0 cpu, t0 < t -> sched1 cpu t0 = sched2 cpu t0) ->
- build_schedule sched1 cpu t = build_schedule sched2 cpu t.
-
- (* ...then we can prove that the final schedule, at any time t,
- is exactly the result of the construction function. *)
- Lemma prefix_dependent_schedule_construction:
- forall cpu t, sched cpu t = build_schedule sched cpu t.
- Proof.
- intros cpu t.
- feed (prefix_construction_same_prefix t t cpu); [by done | intros EQ].
- rewrite -{}EQ.
- induction t using strong_ind.
- destruct t.
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_prefix.
- by intros t; rewrite ltn0.
- }
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_prefix.
- intros t0 cpu0 LT.
- by rewrite prefix_construction_same_prefix.
- }
- Qed.
-
- End PrefixDependent.
-
- End Lemmas.
-
- End ConstructionFromPrefixes.
-
-End ScheduleConstruction.
\ No newline at end of file
diff --git a/classic/model/schedule/global/workload.v b/classic/model/schedule/global/workload.v
deleted file mode 100644
index 4541b087122e49c3851b6300ad8cdb8a04b5a258..0000000000000000000000000000000000000000
--- a/classic/model/schedule/global/workload.v
+++ /dev/null
@@ -1,97 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.global.schedulability prosa.classic.model.schedule.global.response_time.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq div fintype bigop path.
-
-Module Workload.
-
- Import Job SporadicTaskset Schedule ScheduleOfSporadicTask TaskArrival ResponseTime Schedulability.
-
- (* Let's define the workload. *)
- Section WorkloadDef.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any schedule of these jobs. *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Let tsk be any task. *)
- Variable tsk: sporadic_task.
-
- (* First, we define a function that returns the amount of service
- received by this task in a particular processor. *)
- Definition service_of_task (cpu: processor num_cpus)
- (scheduled_job: option Job) : time :=
- if scheduled_job is Some j' then
- (job_task j' == tsk)
- else 0.
-
- (* Next, workload is defined as the service received by jobs of
- the task in the interval [t1,t2). *)
- Definition workload (t1 t2: time) :=
- \sum_(t1 <= t < t2)
- \sum_(cpu < num_cpus)
- service_of_task cpu (sched cpu t).
-
- (* Now, we define workload by summing up the cumulative service
- during [t1,t2) of the scheduled jobs, but only those spawned
- by the task that we care about. *)
- Definition workload_joblist (t1 t2: time) :=
- \sum_(j <- jobs_of_task_scheduled_between job_task sched tsk t1 t2)
- service_during sched j t1 t2.
-
- (* Next, we show that the two definitions are equivalent. *)
- Lemma workload_eq_workload_joblist :
- forall t1 t2,
- workload t1 t2 = workload_joblist t1 t2.
- Proof.
- intros t1 t2; unfold workload, workload_joblist, service_during.
- rewrite big_filter [\sum_(j <- jobs_scheduled_between _ _ _ | _) _]exchange_big /=.
- apply eq_big_nat; unfold service_at; intros t LEt.
- rewrite [\sum_(i <- jobs_scheduled_between _ _ _ | _) _](eq_bigr (fun i =>
- \sum_(cpu < num_cpus) (sched cpu t == Some i)));
- last by ins; rewrite big_mkcond; apply eq_bigr; ins; rewrite mulnbl.
- rewrite exchange_big /=; apply eq_bigr.
- intros cpu LEcpu; rewrite -big_filter.
- destruct (sched cpu t) as [j|] eqn:SCHED; simpl;
- last by rewrite big_const_seq iter_addn mul0n addn0.
- destruct (job_task j == tsk) eqn:EQtsk;
- try rewrite mul1n; try rewrite mul0n.
- {
- rewrite -> bigD1_seq with (j := j); last by rewrite filter_undup undup_uniq.
- {
- rewrite -> eq_bigr with (F2 := fun i => 0); last first.
- {
- intros i DIFF.
- apply/eqP; rewrite eqb0; apply/eqP; case => SAME; subst.
- by rewrite eq_refl in DIFF.
- }
- by rewrite /= big_const_seq iter_addn mul0n 2!addn0 eq_refl.
- }
- {
- rewrite mem_filter; apply/andP; split; first by ins.
- rewrite mem_undup.
- apply mem_bigcat_nat with (j := t); first by ins.
- apply mem_bigcat_ord with (j := cpu); first by apply ltn_ord.
- by rewrite SCHED inE; apply/eqP.
- }
- }
- {
- rewrite big_filter; rewrite -> eq_bigr with (F2 := fun i => 0);
- first by rewrite big_const_seq iter_addn mul0n addn0.
- intros i EQtsk2; destruct (Some j == Some i) eqn:SOME; last by done.
- move: SOME => /eqP SOME; inversion SOME; subst.
- by rewrite EQtsk2 in EQtsk.
- }
- Qed.
-
- End WorkloadDef.
-
-End Workload.
\ No newline at end of file
diff --git a/classic/model/schedule/partitioned/schedulability.v b/classic/model/schedule/partitioned/schedulability.v
deleted file mode 100644
index e9cd35bce5cfc809d8bcdfd1262bf0a5c9ab2551..0000000000000000000000000000000000000000
--- a/classic/model/schedule/partitioned/schedulability.v
+++ /dev/null
@@ -1,132 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require Import prosa.classic.model.schedule.partitioned.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Require prosa.classic.model.schedule.uni.schedule.
-
-Module PartitionSchedulability.
-
- Module uni_sched := prosa.classic.model.schedule.uni.schedulability.Schedulability.
- Import ArrivalSequence Partitioned Schedule Schedulability.
-
- Section PartitionedAsUniprocessor.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence that is to be scheduled. *)
- Variable arr_seq: arrival_sequence Job.
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* Assume that all jobs in the arrival sequence come from a task set ts. *)
- Variable ts: list Task.
- Hypothesis H_all_jobs_from_ts:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Also assume that every task is assigned to a processor, ... *)
- Variable assigned_cpu: Task -> processor num_cpus.
-
- (* ...forming a partitioned schedule. *)
- Hypothesis H_partitioned: partitioned_schedule job_task sched ts assigned_cpu.
-
- (* Next, we related total service with per-processor service received by each job. *)
- Section SameService.
-
- (* Consider the partition where each job is assigned to. *)
- Let partition_of j := assigned_cpu (job_task j).
-
- (* Let j be any job. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
-
- (* We prove that the service received by job j (on the multiprocessor)
- is the same as the service received by job j in its partition. *)
- Lemma same_per_processor_service :
- forall t1 t2,
- service_during sched j t1 t2 =
- uni.service_during (sched (partition_of j)) j t1 t2.
- Proof.
- intros t1 t2.
- unfold partitioned_schedule, task_local_to_processor,
- job_local_to_processor, service_during, service_at,
- uni.service_during, uni.service_at,
- uni.scheduled_at, scheduled_on, partition_of in *.
- rename H_partitioned into PART, H_all_jobs_from_ts into FROMTS.
- apply eq_bigr; intros t _.
- unfold uni.service_at, uni.scheduled_at.
- feed (PART (job_task j)); first by apply FROMTS.
- feed (PART j); first by done.
- specialize (PART t).
- destruct (scheduled sched j t) eqn:SCHED; last first.
- {
- apply negbT in SCHED; rewrite negb_exists in SCHED.
- move: SCHED => /forallP SCHED.
- have SCHEDcpu := SCHED (assigned_cpu (job_task j)); apply negbTE in SCHEDcpu.
- unfold scheduled_on in *; rewrite SCHEDcpu.
- rewrite big1; first by done.
- move => cpu /eqP SCHED'.
- by specialize (SCHED cpu); rewrite SCHED' eq_refl in SCHED.
- }
- {
- move: SCHED => /existsP [cpu SCHED].
- rewrite (bigD1 cpu) /=; last by done.
- have SAME := PART cpu SCHED; rewrite -SAME.
- unfold scheduled_on in *; rewrite SCHED.
- rewrite add1n; apply/eqP; rewrite eqSS; apply/eqP.
- rewrite big1; first by done.
- move => cpu' /andP [SCHED' NEQ].
- have SAME' := (PART cpu' SCHED'); subst cpu cpu'.
- by rewrite eq_refl in NEQ.
- }
- Qed.
-
- End SameService.
-
- Section Schedulability.
-
- (* Recall the definitions of schedulability on a uniprocessor and on
- a multiprocessor. *)
- Let schedulable_on tsk cpu :=
- uni_sched.task_misses_no_deadline job_arrival job_cost job_deadline job_task
- arr_seq (sched cpu) tsk.
- Let schedulable :=
- task_misses_no_deadline job_arrival job_cost job_deadline job_task arr_seq sched.
-
-
- (* Here we prove that if every task is schedulable in their assigned processors, ...*)
- Hypothesis H_locally_schedulable:
- forall tsk,
- tsk \in ts -> schedulable_on tsk (assigned_cpu tsk).
-
- (* ...then every task is schedulable at the level of the multiprocessor system. *)
- Lemma schedulable_at_system_level:
- forall tsk,
- tsk \in ts -> schedulable tsk.
- Proof.
- have SAME := same_per_processor_service.
- unfold partitioned_schedule, task_local_to_processor,
- job_local_to_processor, schedulable, schedulable_on,
- task_misses_no_deadline, job_misses_no_deadline,
- completed, uni_sched.task_misses_no_deadline,
- uni_sched.job_misses_no_deadline, uni.completed_by in *.
- rename H_locally_schedulable into SCHED,
- H_partitioned into PART.
- intros tsk IN j ARRj JOBtsk.
- specialize (SCHED tsk IN j ARRj JOBtsk).
- unfold service, uni.service, service_during, uni.service_during in *.
- by rewrite SAME // JOBtsk.
- Qed.
-
- End Schedulability.
-
- End PartitionedAsUniprocessor.
-
-End PartitionSchedulability.
\ No newline at end of file
diff --git a/classic/model/schedule/partitioned/schedule.v b/classic/model/schedule/partitioned/schedule.v
deleted file mode 100644
index 817fdd1b083b8836d26a51743366689b2ac6f7d7..0000000000000000000000000000000000000000
--- a/classic/model/schedule/partitioned/schedule.v
+++ /dev/null
@@ -1,129 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.global.schedulability.
-Require Import prosa.classic.model.schedule.global.basic.schedule.
-Require prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.schedulability.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module Partitioned.
-
- Module uni := prosa.classic.model.schedule.uni.schedule.UniprocessorSchedule.
- Module uni_sched := prosa.classic.model.schedule.uni.schedulability.Schedulability.
- Import SporadicTaskset Schedule Schedulability.
- Export Time.
-
- Section PartitionedDefs.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Given any multiprocessor schedule of these jobs, ... *)
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- (* ... we define a notion of "partitioned scheduling" (= no migrations) on
- a per-job, per-task, and finally whole-schedule level. *)
-
- Section NoJobMigration.
-
- (* A job is "partitioned" iff it never migrates, i.e., it
- * executes on the same processor whenever it is scheduled. *)
-
- (* So any job j... *)
- Variable j: Job.
-
- (* ... never migrates iff the following holds: ... *)
- Definition never_migrates :=
- (* ...for any point in time t... *)
- forall t,
- (* ...and any processor cpu... *)
- forall cpu,
- (* ... if job j is scheduled at time t on processor cpu... *)
- scheduled_on sched j cpu t ->
- (* ...then at any other time... *)
- forall t',
- (* ...if the same job is scheduled, it must be scheduled on
- * the same processor. *)
- forall cpu',
- scheduled_on sched j cpu' t' -> cpu' = cpu.
-
- (* Furthermore, we say that the job is assigned to processor assigned_cpu
- * if it executes only on that processor. *)
- Variable assigned_cpu : processor num_cpus.
- Definition job_local_to_processor :=
- forall t, forall cpu,
- scheduled_on sched j cpu t -> cpu = assigned_cpu.
-
- End NoJobMigration.
-
- (* Having defined a notiont of 'partitioned' for individual jobs, let us
- * now turn to tasks. *)
-
- Section NoTaskMigration.
-
- (* Given any task tsk in ts, ... *)
- Variable tsk: Task.
-
- (* ...we say that tsk is assigned to processor assigned_cpu ... *)
- Variable assigned_cpu : processor num_cpus.
-
- (* ...iff every job of tsk executes exclusively on assigned_cpu. *)
- Definition task_local_to_processor :=
- forall j,
- job_task j = tsk ->
- job_local_to_processor j assigned_cpu.
-
- End NoTaskMigration.
-
- (* Finally, a schedule is fully partitioned iff every task is assigned
- to some processor. *)
- Section PartitionedSchedule.
-
- (* Consider a task set ts to be scheduled. *)
- Variable ts: list Task.
-
- (* Given an assignment from every task in ts to a processor, ...*)
- Variable assigned_cpu: Task -> processor num_cpus.
-
- (* ...we say that a schedule is partitioned iff every task is local
- to the corresponding processor. *)
- Definition partitioned_schedule :=
- forall tsk,
- tsk \in ts ->
- task_local_to_processor tsk (assigned_cpu tsk).
-
- End PartitionedSchedule.
-
- End PartitionedDefs.
-
- Section SimpleProperties.
-
- Context {Job: eqType}.
-
- Context {num_cpus: nat}.
- Variable sched: schedule Job num_cpus.
-
- Section NoJobMigrationLemmas.
-
- Variable j: Job.
-
- Lemma local_jobs_dont_migrate:
- forall cpu,
- job_local_to_processor sched j cpu -> never_migrates sched j.
- Proof.
- rewrite /job_local_to_processor /never_migrates
- => cpu H_is_local t cpu' H_sched_at_t t' cpu'' H_sched_at_t'.
- apply H_is_local in H_sched_at_t.
- apply H_is_local in H_sched_at_t'.
- by rewrite H_sched_at_t H_sched_at_t'.
- Qed.
-
- End NoJobMigrationLemmas.
-
- End SimpleProperties.
-
-End Partitioned.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/basic/platform.v b/classic/model/schedule/uni/basic/platform.v
deleted file mode 100644
index 959fd1047abd51b567d2e21b1de92f0cf7527eee..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/basic/platform.v
+++ /dev/null
@@ -1,188 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module Platform.
-
- Import Job SporadicTaskset UniprocessorSchedule Priority.
-
- (* In this section, we define properties of the processor platform. *)
- Section Properties.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* First, we define properties related to execution. *)
- Section Execution.
-
- (* We say that a scheduler is work-conserving iff whenever a job j
- is backlogged, the processor is always busy with another job. *)
- Definition work_conserving :=
- forall j t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- exists j_other, scheduled_at sched j_other t.
-
- End Execution.
-
- (* Next, we define properties related to FP scheduling. *)
- Section FP.
-
- (* We say that an FP policy...*)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ...is respected by the schedule iff a scheduled task has
- higher (or same) priority than (as) any backlogged task. *)
- Definition respects_FP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- (* Next, we define properties related to JLFP policies. *)
- Section JLFP.
-
- (* We say that a JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ... is respected by the scheduler iff a scheduled job has
- higher (or same) priority than (as) any backlogged job. *)
- Definition respects_JLFP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- (* Next, we define properties related to JLDP policies. *)
- Section JLDP.
-
- (* We say that a JLFP/JLDP policy ...*)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* ... is respected by the scheduler iff at any time t, a scheduled job
- has higher (or same) priority than (as) any backlogged job. *)
- Definition respects_JLDP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority t j_hp j.
-
- End JLDP.
-
- End Properties.
-
- (* In this section, we prove some lemmas about the processor platform. *)
- Section Lemmas.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_backlogged_at := backlogged job_arrival job_cost sched.
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_completed_by := completed_by job_cost sched.
-
- (* First we prove that if a job is never backlogged, then it doesn't take longer
- than its actual cost to complete. *)
- Section JobNeverBacklogged.
-
- (* Assume that jobs only execute after they arrive and no longer
- than their execution costs. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule is work-conserving. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* Let j be any job... *)
- Variable j: Job.
-
- (* ...that j is never backlogged during its execution. *)
- Hypothesis H_j_is_never_backlogged:
- forall t,
- job_arrival j <= t < job_arrival j + job_cost j ->
- ~ job_backlogged_at j t.
-
- (* Then, any response-time bound no smaller than the job cost is safe. *)
- Lemma job_never_backlogged_response_time_holds:
- forall R,
- R >= job_cost j ->
- job_completed_by j (job_arrival j + R).
- Proof.
- rename H_j_is_never_backlogged into NEVER,
- H_work_conserving into WORK.
- intros R GECOST.
- rewrite /job_completed_by /completed_by /service /service_during.
- rewrite (ignore_service_before_arrival job_arrival);
- [ | by done | by done | by apply leq_addr].
- apply leq_trans with (n := \sum_(job_arrival j <= t < job_arrival j + job_cost j) 1);
- first by simpl_sum_const; rewrite addKn leqnn.
- apply leq_trans with (n := \sum_(job_arrival j <= t < job_arrival j + job_cost j)
- service_at sched j t);
- last by apply extend_sum; rewrite // leq_add2l.
- apply leq_sum_nat; move => t /andP [GEt LTt] _.
- rewrite lt0n eqb0; apply/negP; intro NOTSCHED.
- have BACK := NEVER t; feed BACK.
- {
- apply/andP; split; first by done.
- by apply leq_trans with (n := job_arrival j + job_cost j);
- [by done | by rewrite leq_add2l].
- }
- apply BACK; apply/andP; split; last by done.
- apply/andP; split; first by done.
- rewrite -ltnNge.
- rewrite /service /service_during.
- rewrite -> big_cat_nat with (n := job_arrival j);
- [simpl | by done | by done].
- rewrite (cumulative_service_before_job_arrival_zero job_arrival);
- [rewrite add0n | by done | by apply leqnn].
- apply leq_ltn_trans with (n := \sum_(job_arrival j <= i < t) 1);
- first by apply leq_sum; ins; apply leq_b1.
- simpl_sum_const; rewrite -(ltn_add2r 1).
- rewrite [job_cost j + 1]addn1 ltnS.
- by rewrite addnBAC // leq_subLR addn1.
- Qed.
-
- End JobNeverBacklogged.
-
- End Lemmas.
-
-End Platform.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/basic/platform_tdma.v b/classic/model/schedule/uni/basic/platform_tdma.v
deleted file mode 100644
index 3d9bc313732867cbaeb2db17b81a08559e135c9f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/basic/platform_tdma.v
+++ /dev/null
@@ -1,66 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task
- prosa.classic.model.arrival.basic.job prosa.classic.model.priority
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.policy_tdma.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module Platform_TDMA.
-
- Import Job UniprocessorSchedule div.
- Export PolicyTDMA.
-
- (* In this section, we define properties of the processor platform for TDMA. *)
- Section Properties.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ..., any uniprocessor... *)
- Variable sched: schedule Job.
-
- (* ... and any sporadic task set. *)
- Variable ts: {set sporadic_task}.
-
- (* Consider any TDMA slot assignment... *)
- Variable time_slot: TDMA_slot sporadic_task.
-
- (* ... and any slot order. *)
- Variable slot_order: TDMA_slot_order sporadic_task.
-
- (* In order to characterize a TDMA policy, we first define whether a job is executing its TDMA slot at time t. *)
- Let job_in_time_slot (job:Job) (t:instant):=
- Task_in_time_slot ts slot_order (job_task job) time_slot t.
-
- (* We say that a TDMA policy is respected by the schedule iff
- 1. when a job is scheduled at time t, then the corresponding task
- is also in its own time slot... *)
- Definition sched_implies_in_slot j t:=
- (scheduled_at sched j t -> job_in_time_slot j t).
-
- (* 2. when a job is backlogged at time t,the corresponding task
- isn't in its own time slot or another previous job of the same task is scheduled *)
- Definition backlogged_implies_not_in_slot_or_other_job_sched j t:=
- (backlogged job_arrival job_cost sched j t ->
- ~ job_in_time_slot j t \/
- (exists j_other, arrives_in arr_seq j_other/\
- job_arrival j_other < job_arrival j/\
- job_task j = job_task j_other/\
- scheduled_at sched j_other t)).
-
- Definition Respects_TDMA_policy:=
- forall (j:Job) (t:time),
- arrives_in arr_seq j ->
- sched_implies_in_slot j t /\ backlogged_implies_not_in_slot_or_other_job_sched j t.
-
- End Properties.
-
-End Platform_TDMA.
diff --git a/classic/model/schedule/uni/end_time.v b/classic/model/schedule/uni/end_time.v
deleted file mode 100644
index 482dce9b7b79a964be1384e3afe6d59677b6b0b7..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/end_time.v
+++ /dev/null
@@ -1,309 +0,0 @@
-Require Import Arith Nat.
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task
- prosa.classic.model.arrival.basic.job
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Set Bullet Behavior "Strict Subproofs".
-
-Module end_time.
- Import UniprocessorSchedule Job ResponseTime.
-
- Section Task.
- Context {task: eqType}.
- Variable task_cost: task -> time.
- Variable task_period: task -> time.
- Variable task_deadline: task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_task: Job -> task.
-
- (* instant option, to be used in end_time_option *)
- Inductive diagnosis_option : Set :=
- | OK : instant -> diagnosis_option
- | Failure : instant -> diagnosis_option.
-
- Section Job_end_time_Def.
-
- (* Jobs will be scheduled on an uniprocessor *)
- Variable sched: schedule Job.
-
- (* Consider any job *)
- Variable job:Job.
-
- (* Recall the definition of scheduled_at for testing wether this job can
- be scheduled at time t *)
- Let job_scheduled_at t:= scheduled_at sched job t = true.
-
- (* We define the function calculating the job's end time.
- It takes three arguments:
- t : job arrival [instant]
- c : job cost [duration]
- wf: an extra parameter that allows to realize a well-founded fixpoint
- with the type [nat]. It is supposed big enough to return the actual end time.
- Otherwise (i.e., it reaches 0), the function returns Failure t *)
- Fixpoint end_time_option (t:instant) (c:duration) (wf:nat):=
- match c with
- | 0 => OK t
- | S c'=> match wf with
- | 0 => Failure t
- | S wf'=> if scheduled_at sched job t then end_time_option (S t) c' wf'
- else end_time_option (S t) c wf'
- end
- end.
-
- (* We define an end time predicate with three arguments:
- the job arrival [instant], the job cost [duration] and
- the job end time [instant]. Its three constructors
- correspond to the cases:
- - cost = 0 and job has ended
- - cost > 0 and job cannot be scheduled at instant t
- - cost > 0 and job can be scheduled at instant t
- *)
- Inductive end_time_predicate : instant-> duration->instant->Prop:=
- |C0_: forall t, end_time_predicate t 0 t
-
- |S_C_not_sched: forall t c e,
- ~job_scheduled_at t->
- end_time_predicate (S t) (S c) e->
- end_time_predicate t (S c) e
-
- |S_C_sched: forall t c e,
- job_scheduled_at t->
- end_time_predicate (S t) c e->
- end_time_predicate t (S c) e.
-
- (* The predicate completes_at specifies the instant a job ends
- according to its arrival and cost *)
- Definition completes_at (t:instant):=
- end_time_predicate (job_arrival job) (job_cost job) t.
-
- End Job_end_time_Def.
-
- Section Lemmas.
-
- (* Consider any job *)
- Variable job:Job.
-
- (* ... and and uniprocessor schedule this job*)
- Variable sched: schedule Job.
-
- (* ... where jobs do not execute before their arrival times nor after completion *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- Hypothesis H_valid_job:
- valid_realtime_job job_cost job_deadline job.
-
- (* Recall the function end_time_option*)
- Let job_end_time_function:= end_time_option sched job.
-
- (* Recall the end time predicate*)
- Let job_end_time_p:= end_time_predicate sched job.
-
- (* Recall the definition of completes_at*)
- Let job_completes_at := completes_at sched job.
-
- (* Recall the definition of scheduled_at for testing wether this job can
- be scheduled at time t.*)
- Let job_scheduled_at t:= scheduled_at sched job t = true.
-
- (* Then, the job_end_time_function (if it terminates successfully) returns
- the same result as the job_end_time_p predicate *)
- (* function -> predicate *)
- Theorem end_time_function_predicat_equivalence:
- forall e wf t c,
- job_end_time_function t c wf = OK e ->
- job_end_time_p t c e.
- Proof.
- induction wf as [| wf' IHwf']; intros t c; simpl.
- - destruct c; intros H; inversion H .
- apply C0_.
- - intros IHSwf. case Hcases:(scheduled_at sched job t); destruct c.
- + inversion IHSwf. apply C0_.
- + rewrite Hcases in IHSwf. apply IHwf' in IHSwf. apply S_C_sched with (c:=c)(e:=e).
- apply Hcases. apply IHSwf.
- + inversion IHSwf. apply C0_.
- + rewrite Hcases in IHSwf. apply IHwf' in IHSwf. apply S_C_not_sched with (c:=c)(e:=e).
- * rewrite Hcases. done.
- * apply IHSwf.
- Qed.
-
- (* The end time given by the predicate job_end_time_p is the same as
- the result returned by the function job_end_time_function (provided
- wf is large enough) *)
- Theorem end_time_predicat_function_equivalence:
- forall t c e ,
- job_end_time_p t c e ->
- exists wf, job_end_time_function t c wf = OK e.
- Proof.
- intros.
- induction H as [t|t c e Hcase1 Hpre [wf Hwf] |t c e Hcase2 Hpre [wf Hwf]].
- - exists 1. done.
- - exists (1+wf).
- case Csa:(scheduled_at sched job t).
- + done.
- + simpl. rewrite Csa. apply Hwf.
- - exists (1+wf). simpl.
- rewrite Hcase2. apply Hwf.
- Qed.
-
- (* If we consider a time t where the job is not scheduled, then
- the end_time_predicate returns the same end time starting from t or t+1 *)
- Lemma end_time_predicate_not_sched:
- forall t c e,
- ~(job_scheduled_at t) ->
- end_time_predicate sched job t c.+1 e ->
- end_time_predicate sched job t.+1 c.+1 e.
- Proof.
- intros* Hcase1 Hpre.
- induction t as [| t' IHt'];
- inversion Hpre; try apply H2; done.
- Qed.
-
- (* If we consider a time t where the job is scheduled, then the end_time_predicate
- returns the same end time starting from t with a cost c+1 than from t+1 with a cost c*)
- Lemma end_time_predicate_sched:
- forall t c e,
- job_scheduled_at t ->
- end_time_predicate sched job t c.+1 e ->
- end_time_predicate sched job t.+1 c e.
- Proof.
- intros* Hcase2 Hpre.
- induction t as [| t' IHt'];
- inversion Hpre; try apply H2; done.
- Qed.
-
- (* Assume that the job end time is job_end *)
- Variable job_end: instant.
-
- (* Recall the definition of completed_by defined in
- model/schedule/uni/schedule.v *)
- Let job_completed_by:=
- completed_by job_cost sched.
-
- (* Recall the definition of service_during defined in
- model/schedule/uni/schedule.v *)
- Let job_service_during:=
- service_during sched job.
-
- (* then the job arrival is less than or equal to job end time *)
- Lemma arrival_le_end:
- forall t c e, job_end_time_p t c e -> t <= e.
- Proof.
- intros* G.
- induction G as [t|t c e Hcase1 Hpre |t c e Hcase2 Hpre]; lia.
- Qed.
-
- (* the sum of job arrival and job cost is less than or equal to
- job end time*)
- Lemma arrival_add_cost_le_end:
- forall t c e,
- job_end_time_p t c e ->
- t+c<=e.
- Proof.
- intros* h1.
- induction h1 as [t|t c e Hcase1 Hpre |t c e Hcase2 Hpre]; lia.
- Qed.
-
- (* The servive received between the job arrival
- and the job end is equal to the job cost*)
- Lemma service_eq_cost_at_end_time:
- job_completes_at job_end ->
- job_service_during (job_arrival job) job_end = job_cost job.
- Proof.
- intros job_cmplted.
- induction job_cmplted as [t|t c e Hcase1 Hpre |t c e Hcase2 Hpre];
- unfold job_service_during, service_during in *.
- - by rewrite big_geq.
- - apply arrival_le_end in Hpre.
- rewrite big_ltn // IHHpre /service_at.
- case cases:(scheduled_at sched job t); try easy; done.
- - apply arrival_le_end in Hpre.
- rewrite big_ltn // IHHpre /service_at.
- rewrite Hcase2 //.
- Qed.
-
- (* A job is completed by job end time*)
- Lemma completed_by_end_time:
- job_completes_at job_end ->
- job_completed_by job job_end.
- Proof.
- intro job_cmplted.
- unfold job_completed_by, completed_by, service, service_during.
- rewrite (ignore_service_before_arrival job_arrival sched ) //.
- - apply service_eq_cost_at_end_time in job_cmplted.
- by rewrite -job_cmplted.
- - by apply arrival_le_end in job_cmplted.
- Qed.
-
- (* The job end time is positive *)
- Corollary end_time_positive:
- job_completes_at job_end -> job_end > 0.
- Proof.
- intro h1.
- assert (H_slot: job_cost job > 0) by (apply H_valid_job).
- apply completed_by_end_time in h1.
- unfold job_completed_by, completed_by, service, service_during in h1.
- destruct job_end; trivial.
- rewrite big_geq // in h1.
- lia.
- Qed.
-
- (* The service received between job arrival and the previous instant
- of job end time is exactly job cost-1*)
- Lemma job_uncompletes_at_end_time_sub_1:
- job_completes_at job_end ->
- job_service_during (job_arrival job) (job_end .-1) = (job_cost job) .-1.
- Proof.
- intros job_cmplted.
- induction job_cmplted as [t|t c e Hcase1 Hpre |t c e Hcase2 Hpre];
- unfold job_service_during, service_during in*.
- - apply big_geq, leq_pred.
- - apply arrival_add_cost_le_end, leq_sub2r with (p:=1) in Hpre.
- rewrite subn1 addnS //= addSn subn1 in Hpre.
- apply leq_ltn_trans with (m:=t) in Hpre; try (apply leq_addr).
- rewrite big_ltn // IHHpre /service_at /service_during.
- case C:(scheduled_at sched job t);done.
- - destruct c.
- + inversion Hpre. apply big_geq. lia.
- + apply arrival_add_cost_le_end, leq_sub2r with (p:=1) in Hpre.
- rewrite subn1 addnS //= addSn subn1 in Hpre.
- apply leq_ltn_trans with (m:=t) in Hpre; try (apply leq_addr).
- rewrite big_ltn // /service_at / service_during IHHpre Hcase2 //.
- Qed.
-
- (* At any instant from the job arrival and before the job end time,
- job cannot be finished; the service received is always less than job cost*)
- Lemma job_uncompleted_before_end_time:
- job_completes_at job_end ->
- forall t', job_arrival job <= t' /\ t'<= job_end.-1 ->
- job_service_during (job_arrival job) t' < job_cost job.
- Proof.
- intros job_cmplted t' [ht1 ht2].
- assert (H_slot: job_cost job > 0) by (apply H_valid_job).
- apply leq_ltn_trans with (n:= (job_cost job).-1); last lia.
- rewrite -job_uncompletes_at_end_time_sub_1 // /job_service_during /service_during.
- assert (H_lt: exists delta, t' + delta = job_end.-1).
- - move/leP:ht2 => ht2.
- apply Nat.le_exists_sub in ht2.
- destruct ht2 as [p [ht21 ht22]]. exists p. lia.
- - destruct H_lt as [delta ht']. rewrite -ht'.
- replace (\sum_(job_arrival job <= t < t' + delta) service_at sched job t)
- with (addn_monoid(\big[addn_monoid/0]_(job_arrival job <= i < t') service_at sched job i)
- (\big[addn_monoid/0]_(t' <= i < t'+delta) service_at sched job i)); simpl; try lia.
- symmetry. apply big_cat_nat; lia.
- Qed.
-
- End Lemmas.
-
- End Task.
-
-End end_time.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/jitter/busy_interval.v b/classic/model/schedule/uni/jitter/busy_interval.v
deleted file mode 100644
index 913a8964f913628e95f934f631bd9c4150e0f94e..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/jitter/busy_interval.v
+++ /dev/null
@@ -1,723 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.service prosa.classic.model.schedule.uni.workload.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule prosa.classic.model.schedule.uni.jitter.platform.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we provide definitions and lemmas about busy intervals
- and their relation with response times. *)
-Module BusyInterval.
-
- Import Job UniprocessorScheduleWithJitter Priority Platform
- Service Workload TaskArrival.
-
- (* In this section, we define the notion of a busy interval. *)
- Section Defs.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent arrival times... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Consider any JLFP policy. *)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* Let j be any job to be analyzed. *)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
-
- (* For simplicity, let's define some local names. *)
- Let job_pending_at := pending job_arrival job_cost job_jitter sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
- Let actual_job_arrival := actual_arrival job_arrival job_jitter.
- Let actual_job_arrival_between := actual_arrival_between job_arrival job_jitter.
-
- (* We say that t is a quiet time for j iff every higher-priority job that
- has an actual arrival time (with jitter) before t has completed by that time. *)
- Definition quiet_time (t: time) :=
- forall j_hp,
- arrives_in arr_seq j_hp ->
- higher_eq_priority j_hp j ->
- actual_arrival_before job_arrival job_jitter j_hp t ->
- job_completed_by j_hp t.
-
- (* Based on the definition of quiet time, we say that interval
- [t1, t_busy) is a (potentially unbounded) busy-interval prefix
- iff the interval starts with a quiet time and remains non-quiet. *)
- Definition busy_interval_prefix (t1 t_busy: time) :=
- t1 < t_busy /\
- quiet_time t1 /\
- (forall t, t1 < t < t_busy -> ~ quiet_time t).
-
- (* Next, we say that an interval [t1, t2) is a busy interval iff
- [t1, t2) is a busy-interval prefix and t2 is a quiet time. *)
- Definition busy_interval (t1 t2: time) :=
- busy_interval_prefix t1 t2 /\
- quiet_time t2.
-
- (* Now we prove some lemmas about busy intervals. *)
- Section Lemmas.
-
- (* Recall the list of jobs with actual arrival time (including jitter) in the
- interval [t1, t2). *)
- Let actual_arrivals t1 t2 := actual_arrivals_between job_arrival job_jitter arr_seq t1 t2.
-
- (* We begin by proving basic lemmas about the arrival and
- completion of jobs that are pending during a busy interval. *)
- Section BasicLemmas.
-
- (* Assume that the priority relation is reflexive. *)
- Hypothesis H_priority_is_reflexive: JLFP_is_reflexive higher_eq_priority.
-
- (* Consider any busy interval [t1, t2)... *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval: busy_interval t1 t2.
-
- (* ...and assume that job j is pending during this busy interval. *)
- Variable t: time.
- Hypothesis H_during_interval: t1 <= t < t2.
- Hypothesis H_job_is_pending: job_pending_at j t.
-
- (* First, we prove that job j completes by the end of the busy interval. *)
- Section CompletesDuringBusyInterval.
-
- Lemma job_completes_within_busy_interval:
- job_completed_by j t2.
- Proof.
- rename H_priority_is_reflexive into REFL, H_busy_interval into BUSY,
- H_during_interval into INT, H_job_is_pending into PEND.
- move: BUSY => [_ QUIET].
- move: INT => /andP [_ LT2].
- apply QUIET; [by done | by apply REFL |].
- apply leq_ltn_trans with (n := t); last by done.
- by move: PEND => /andP [ARR _].
- Qed.
-
- End CompletesDuringBusyInterval.
-
- (* Next, we prove that the actual arrival of job j cannot have occurred before the busy interval. *)
- Section ArrivesDuringBusyInterval.
-
- (* Assume that jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Then, we prove that job j's actual arrival (with jitter) occurs no earlier than t1. *)
- Lemma job_arrives_within_busy_interval:
- t1 <= actual_job_arrival j.
- Proof.
- rename H_priority_is_reflexive into REFL, H_busy_interval into BUSY,
- H_during_interval into INT, H_job_is_pending into PEND.
- apply contraT; rewrite -ltnNge; intro LT1.
- move: BUSY => [[_ [QUIET _]] _].
- move: PEND => /andP [_ /negP NOTCOMP].
- move: INT => /andP [LE _].
- exfalso; apply NOTCOMP.
- try ( apply completion_monotonic with (t0 := t1); try (by done) ) ||
- apply completion_monotonic with (t := t1); try (by done).
- by apply QUIET; [by done | by apply REFL |].
- Qed.
-
- End ArrivesDuringBusyInterval.
-
- End BasicLemmas.
-
- (* In this section, we prove that during a busy interval there
- always exists a pending job. *)
- Section ExistsPendingJob.
-
- (* Assume that jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Let [t1, t2] be any interval where time t1 is quiet and
- time t2 is not quiet. *)
- Variable t1 t2: time.
- Hypothesis H_interval: t1 <= t2.
- Hypothesis H_quiet: quiet_time t1.
- Hypothesis H_not_quiet: ~ quiet_time t2.
-
- (* Then, we prove that there exists a job pending at time t2
- that has higher or equal priority (with respect ot tsk). *)
- Lemma not_quiet_implies_exists_pending_job:
- exists j_hp,
- arrives_in arr_seq j_hp /\
- actual_job_arrival_between j_hp t1 t2 /\
- higher_eq_priority j_hp j /\
- ~ job_completed_by j_hp t2.
- Proof.
- rename H_quiet into QUIET, H_not_quiet into NOTQUIET.
- destruct (has (fun j_hp => (~~ job_completed_by j_hp t2) && higher_eq_priority j_hp j)
- (actual_arrivals t1 t2)) eqn:COMP.
- {
- move: COMP => /hasP [j_hp ARR /andP [NOTCOMP HP]].
- rewrite /actual_arrivals in ARR; have ARRin := ARR.
- apply in_actual_arrivals_between_implies_arrived in ARRin.
- apply in_actual_arrivals_implies_arrived_between in ARR.
- by exists j_hp; repeat split; last by apply/negP.
- }
- {
- apply negbT in COMP; rewrite -all_predC in COMP.
- move: COMP => /allP COMP.
- exfalso; apply NOTQUIET; intros j_hp IN HP ARR.
- destruct (ltnP (actual_job_arrival j_hp) t1) as [BEFORE | AFTER];
- first by specialize (QUIET j_hp IN HP BEFORE); apply completion_monotonic with (t := t1).
- feed (COMP j_hp).
- by apply arrived_between_implies_in_actual_arrivals; last by apply/andP; split.
- by rewrite /= HP andbT negbK in COMP.
- }
- Qed.
-
- End ExistsPendingJob.
-
- (* In this section, we prove that during a busy interval the
- processor is never idle. *)
- Section ProcessorAlwaysBusy.
-
- (* Assume that the schedule is work-conserving and that jobs do
- not execute before the jitter has passed nor after completion. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
-
- (* Consider any interval [t1, t2] such that t1 < t2 and t1 is the only quiet time. *)
- Variable t1 t2: time.
- Hypothesis H_strictly_larger: t1 < t2.
- Hypothesis H_quiet: quiet_time t1.
- Hypothesis H_not_quiet: forall t, t1 < t <= t2 -> ~ quiet_time t.
-
- (* We prove that at every time t in [t1, t2], the processor is not idle. *)
- Lemma not_quiet_implies_not_idle:
- forall t,
- t1 <= t <= t2 ->
- ~ is_idle sched t.
- Proof.
- unfold total_service_during, work_conserving in *.
- rename H_not_quiet into NOTQUIET, H_work_conserving into WORK.
- move => t /andP [GEt LEt] /eqP IDLE.
- rewrite leq_eqVlt in GEt; move: GEt => /orP [/eqP EQUAL | LARGER].
- {
- subst t.
- feed (NOTQUIET t1.+1); first by apply/andP; split.
- apply NOTQUIET.
- intros j_hp IN HP ARR.
- apply completion_monotonic with (t := t1); [by done |].
- apply contraT; intro NOTCOMP.
- destruct (scheduled_at sched j_hp t1) eqn:SCHEDhp;
- first by move: SCHEDhp => /eqP SCHEDhp; rewrite IDLE in SCHEDhp.
- apply negbT in SCHEDhp.
- feed (WORK j_hp t1 IN); first by repeat (apply/andP; split).
- move: WORK => [j_other /eqP SCHEDother].
- by rewrite IDLE in SCHEDother.
- }
- {
- feed (NOTQUIET t); first by apply/andP; split.
- apply NOTQUIET; clear NOTQUIET.
- intros j_hp IN HP ARR.
- apply contraT; intros NOTCOMP.
- destruct (scheduled_at sched j_hp t) eqn:SCHEDhp;
- first by move: SCHEDhp => /eqP SCHEDhp; rewrite IDLE in SCHEDhp.
- apply negbT in SCHEDhp.
- feed (WORK j_hp t IN);
- first by repeat (apply/andP; split); first by apply ltnW.
- move: WORK => [j_other /eqP SCHEDother].
- by rewrite IDLE in SCHEDother.
- }
- Qed.
-
- (* In fact, we can infer a stronger property. *)
- Section OnlyHigherOrEqualPriority.
-
- (* If the JLFP policy is transitive and is respected by the schedule, ...*)
- Hypothesis H_priority_is_transitive: JLFP_is_transitive higher_eq_priority.
- Hypothesis H_respects_policy:
- respects_JLFP_policy job_arrival job_cost job_jitter arr_seq sched higher_eq_priority.
-
- (* ... then the processor is always busy with a job of higher or equal priority
- and actual arrival time in the interval. *)
- Lemma not_quiet_implies_exists_scheduled_hp_job:
- forall t,
- t1 <= t < t2 ->
- exists j_hp,
- actual_job_arrival_between j_hp t1 t2 /\
- higher_eq_priority j_hp j /\
- job_scheduled_at j_hp t.
- Proof.
- have NOTIDLE := not_quiet_implies_not_idle.
- unfold is_idle, FP_is_transitive, transitive in *.
- rename H_not_quiet into NOTQUIET, H_quiet into QUIET, H_priority_is_transitive into TRANS,
- H_work_conserving into WORK, H_respects_policy into PRIO,
- H_jobs_come_from_arrival_sequence into FROM.
- move => t /andP [GEt LEt].
- feed (NOTIDLE t); first by apply/andP; split; last by apply ltnW.
- destruct (sched t) as [j_hp|] eqn:SCHED; [clear NOTIDLE | by exfalso; apply NOTIDLE].
- move: SCHED => /eqP SCHED.
- exists j_hp.
- have HP: higher_eq_priority j_hp j.
- {
- apply contraT; move => /negP NOTHP; exfalso.
- feed (NOTQUIET t.+1); first by apply/andP; split.
- apply NOTQUIET.
- unfold quiet_time in *; intros j_hp' IN HP ARR.
- apply contraT; move => /negP NOTCOMP'; exfalso.
- have BACK: backlogged job_arrival job_cost job_jitter sched j_hp' t.
- {
- apply/andP; split; last first.
- {
- apply/negP; intro SCHED'.
- apply only_one_job_scheduled with (j1 := j_hp) in SCHED'; last by done.
- by subst; rewrite HP in NOTHP.
- }
- apply/andP; split; first by done.
- apply/negP; intro COMP; apply NOTCOMP'.
- try ( by apply completion_monotonic with (t0 := t) ) ||
- by apply completion_monotonic with (t := t).
- }
- feed (PRIO j_hp' j_hp t IN BACK); first by done.
- by apply NOTHP, TRANS with (y := j_hp').
- }
- repeat split; [| by done | by done].
- {
- move: (SCHED) => PENDING.
- try ( apply scheduled_implies_pending with (job_arrival0 := job_arrival)
- (job_cost0 := job_cost) (job_jitter0 := job_jitter) in PENDING; try (by done) ) ||
- apply scheduled_implies_pending with (job_arrival := job_arrival)
- (job_cost := job_cost) (job_jitter := job_jitter) in PENDING; try (by done).
- apply/andP; split;
- last by apply leq_ltn_trans with (n := t); first by move: PENDING => /andP [ARR _].
- apply contraT; rewrite -ltnNge; intro LT; exfalso.
- feed (QUIET j_hp); first by eapply FROM, SCHED.
- specialize (QUIET HP LT).
- try ( have COMP: job_completed_by j_hp t by apply completion_monotonic with (t0 := t1) ) ||
- have COMP: job_completed_by j_hp t by apply completion_monotonic with (t := t1).
- apply completed_implies_not_scheduled in COMP; last by done.
- by move: COMP => /negP COMP; apply COMP.
- }
- Qed.
-
- End OnlyHigherOrEqualPriority.
-
- End ProcessorAlwaysBusy.
-
- (* In this section, we show that the length of any busy interval
- is bounded, as long as there is enough supply to accomodate
- the workload of tasks with higher or equal priority. *)
- Section BoundingBusyInterval.
-
- (* Assume that there are no duplicate job arrivals... *)
- Hypothesis H_arrival_sequence_is_a_set:
- arrival_sequence_is_a_set arr_seq.
-
- (* ...and that jobs do not execute before the jitter has passed nor after completion. *)
- Hypothesis H_jobs_execute_after_jitter:
- jobs_execute_after_jitter job_arrival job_jitter sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Also assume a work-conserving FP schedule, ... *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost job_jitter arr_seq sched.
- Hypothesis H_respects_policy:
- respects_JLFP_policy job_arrival job_cost job_jitter arr_seq sched higher_eq_priority.
-
- (* ...in which the priority relation is reflexive and transitive. *)
- Hypothesis H_priority_is_reflexive: JLFP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLFP_is_transitive higher_eq_priority.
-
- (* Next, we recall the notion of workload of all jobs with actual arrival time
- in a given interval [t1, t2) that have higher-or-equal priority than the
- job j being analyzed. *)
- Let actual_hp_workload t1 t2 :=
- workload_of_higher_or_equal_priority_jobs job_cost (actual_arrivals t1 t2)
- higher_eq_priority j.
-
- (* With regard to the jobs with higher-or-equal priority that have actual
- arrival time in a given interval [t1, t2), we also recall the service
- received by these jobs in the same interval [t1, t2). *)
- Let actual_hp_service t1 t2 :=
- service_of_higher_or_equal_priority_jobs sched (actual_arrivals t1 t2)
- higher_eq_priority j t1 t2.
-
- (* Now we begin the proof. First, we show that the busy interval is bounded. *)
- Section BoundingBusyInterval.
-
- (* Suppose that job j is pending at time t_busy. *)
- Variable t_busy: time.
- Hypothesis H_j_is_pending: job_pending_at j t_busy.
-
- (* First, we show that there must exist a busy interval prefix. *)
- Section LowerBound.
-
- (* Since job j is pending, there exists a (potentially unbounded)
- busy interval that starts prior to the actual arrival time of j. *)
- Lemma exists_busy_interval_prefix:
- exists t1,
- busy_interval_prefix t1 t_busy.+1 /\
- t1 <= actual_job_arrival j <= t_busy.
- Proof.
- rename H_j_is_pending into PEND, H_respects_policy into PRIO,
- H_work_conserving into WORK, H_priority_is_reflexive into REFL,
- H_from_arrival_sequence into FROM.
- unfold busy_interval_prefix.
- set dec_quiet :=
- fun t => all (fun j_hp =>
- higher_eq_priority j_hp j ==> (completed_by job_cost sched j_hp t))
- (actual_arrivals_before job_arrival job_jitter arr_seq t).
- destruct ([exists t:'I_t_busy.+1, dec_quiet t]) eqn:EX.
- {
- set last := \max_(t < t_busy.+1 | dec_quiet t) t.
- move: EX => /existsP [t EX].
- have PRED: dec_quiet last by apply (bigmax_pred t_busy.+1 dec_quiet t).
- have QUIET: quiet_time last.
- {
- move: PRED => /allP PRED.
- intros j_hp IN HP ARR.
- feed (PRED j_hp).
- by apply arrived_between_implies_in_actual_arrivals; try (apply/andP; split).
- by rewrite HP implyTb in PRED.
- }
- exists last.
- split; last first.
- {
- apply/andP; split; last by move: PEND => /andP [ARR _].
- apply contraT; rewrite -ltnNge; intros BEFORE.
- feed (QUIET j FROM); first by apply REFL.
- specialize (QUIET BEFORE).
- move: PEND => /andP [_ NOTCOMP].
- apply completion_monotonic with (t' := t_busy) in QUIET;
- first by rewrite QUIET in NOTCOMP.
- by apply bigmax_ltn_ord with (i0 := t).
- }
- split; first by apply bigmax_ltn_ord with (i0 := t).
- split; first by done.
- {
- move => t0 /andP [GTlast LTbusy] QUIET0.
- have PRED0: dec_quiet t0.
- {
- apply/allP; intros j_hp ARR; apply/implyP; intros HP.
- apply QUIET0; [| by done |].
- - by eapply in_actual_arrivals_before_implies_arrived; eauto 1.
- - by eapply in_actual_arrivals_implies_arrived_before; eauto 1.
- }
- have BUG: t0 <= last.
- {
- have LE := @leq_bigmax_cond _ (fun (x: 'I_t_busy.+1) => dec_quiet x)
- (fun x => x) (Ordinal LTbusy) PRED0.
- by apply LE.
- }
- apply leq_trans with (p := last) in GTlast; last by done.
- by rewrite ltnn in GTlast.
- }
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP ALL.
- exists 0; split;
- last by apply/andP; split; last by move: PEND => /andP [ARR _].
- split; first by done.
- split; first by intros j_hp _ _ ARR; rewrite /actual_arrival_before ltn0 in ARR.
- move => t /andP [GE LT].
- specialize (ALL (Ordinal LT)); move: ALL => /negP ALL.
- intros QUIET; apply ALL; simpl.
- apply/allP; intros j_hp ARR; apply/implyP; intros HP.
- apply QUIET; [| by done |].
- - by eapply in_actual_arrivals_before_implies_arrived; eauto 1.
- - by eapply in_actual_arrivals_implies_arrived_before; eauto 1.
- }
- Qed.
-
- End LowerBound.
-
- (* Next we prove that, if there is a point where the requested workload
- is upper-bounded by the supply, then the busy interval eventually ends. *)
- Section UpperBound.
-
- (* Consider any busy interval that starts at time t1 <= actual_job_arrival j. *)
- Variable t1: time.
- Hypothesis H_is_busy_prefix: busy_interval_prefix t1 t_busy.+1.
- Hypothesis H_busy_prefix_contains_arrival: actual_job_arrival j >= t1.
-
- (* Next, assume that for some delta > 0, the requested workload
- at time (t1 + delta) is bounded by delta (i.e., the supply). *)
- Variable delta: time.
- Hypothesis H_delta_positive: delta > 0.
- Hypothesis H_workload_is_bounded: actual_hp_workload t1 (t1 + delta) <= delta.
-
- (* If there exists a quiet time by time (t1 + delta), it trivially follows that
- the busy interval is bounded.
- Thus, let's consider first the harder case where there is no quiet time,
- which turns out to be impossible. *)
- Section CannotBeBusyForSoLong.
-
- (* Assume that there is no quiet time in the interval (t1, t1 + delta]. *)
- Hypothesis H_no_quiet_time:
- forall t, t1 < t <= t1 + delta -> ~ quiet_time t.
-
- (* Since the interval is always non-quiet, the processor is always busy
- with tasks of higher-or-equal priority, i.e., the service done by
- jobs with actual arrival time in [t1, t1 + delta) equals delta. *)
- Lemma busy_interval_has_uninterrupted_service:
- actual_hp_service t1 (t1 + delta) = delta.
- Proof.
- rename H_is_busy_prefix into PREFIX.
- have EXISTS := not_quiet_implies_exists_scheduled_hp_job.
- feed_n 3 EXISTS; try (by done).
- apply eq_trans with (y := \sum_(t1 <= t < t1 + delta) 1);
- last by simpl_sum_const; rewrite addKn.
- unfold actual_hp_service, service_of_higher_or_equal_priority_jobs, service_of_jobs.
- rewrite exchange_big /=.
- apply eq_big_nat; move => t /andP [GEt LTt].
- move: PREFIX => [_ [QUIET _]].
- have EX: exists j_hp : Job,
- actual_job_arrival_between j_hp t1 (t1 + delta) /\
- higher_eq_priority j_hp j /\
- scheduled_at sched j_hp t.
- {
- apply EXISTS with (t1 := t1) (t2 := t1 + delta); try (by done);
- last by apply/andP; split.
- by rewrite -addn1; apply leq_add.
- } clear EXISTS.
- move: EX => [j_hp [/andP [GE LT] [HP SCHED]]].
- rewrite big_mkcond (bigD1_seq j_hp) /=; last by apply actual_arrivals_uniq.
- {
- rewrite HP big1; first by rewrite /service_at SCHED addn0.
- intros j' NEQ; destruct (higher_eq_priority j' j); last by done.
- apply/eqP; rewrite eqb0; apply/negP; move => SCHED'.
- move: NEQ => /eqP NEQ; apply NEQ.
- try ( by apply only_one_job_scheduled with (sched0 := sched) (t0 := t) ) ||
- by apply only_one_job_scheduled with (sched := sched) (t := t).
- }
- {
- apply H_jobs_come_from_arrival_sequence in SCHED.
- apply arrived_between_implies_in_actual_arrivals; [by done | by done |].
- by apply/andP; split.
- }
- Qed.
-
- (* Moreover, the fact that the interval is not quiet also implies
- that there's more workload requested than service received. *)
- Lemma busy_interval_too_much_workload:
- actual_hp_workload t1 (t1 + delta) > actual_hp_service t1 (t1 + delta).
- Proof.
- have PEND := not_quiet_implies_exists_pending_job.
- rename H_no_quiet_time into NOTQUIET,
- H_is_busy_prefix into PREFIX, H_respects_policy into PRIO.
- set l := actual_arrivals_between job_arrival job_jitter arr_seq t1 (t1 + delta).
- set hep := higher_eq_priority.
- unfold actual_hp_service, service_of_higher_or_equal_priority_jobs, service_of_jobs,
- actual_hp_workload, workload_of_higher_or_equal_priority_jobs, workload_of_jobs.
- fold actual_arrivals l hep.
- move: (PREFIX) => [_ [QUIET _]].
- move: (NOTQUIET) => NOTQUIET'.
- feed (NOTQUIET' (t1 + delta));
- first by apply/andP; split;
- first by rewrite -addn1; apply leq_add.
- feed (PEND t1 (t1 + delta)); first by apply leq_addr.
- specialize (PEND QUIET NOTQUIET').
- move: PEND => [j0 [ARR0 [/andP [GE0 LT0] [HP0 NOTCOMP0]]]].
- have IN0: j0 \in l.
- by apply arrived_between_implies_in_actual_arrivals; last by apply/andP; split.
- have UNIQ: uniq l by eapply actual_arrivals_uniq; eauto 1.
- rewrite big_mkcond [\sum_(_ <- _ | hep _ _)_]big_mkcond.
- rewrite (bigD1_seq j0); [simpl | by done | by done].
- rewrite (bigD1_seq j0); [simpl | by done | by done].
- rewrite /hep HP0.
- rewrite -add1n addnA [1 + _]addnC addn1.
- apply leq_add; last first.
- {
- apply leq_sum; intros j1 NEQ.
- destruct (higher_eq_priority j1 j); last by done.
- by apply cumulative_service_le_job_cost.
- }
-
- unfold service_during.
- rewrite (ignore_service_before_jitter job_arrival job_jitter) //;
- last by apply/andP; split; last by apply ltnW.
- ( try ( rewrite <- ignore_service_before_jitter with (t2:=0)) ||
- rewrite <- ignore_service_before_jitter with (t1:=0)); rewrite //; [|by apply ltnW].
- by rewrite ltnNge; apply/negP.
- Qed.
-
- (* Using the two lemmas above, we infer that the workload is larger than the
- interval length. However, this contradicts the assumption H_workload_is_bounded. *)
- Corollary busy_interval_workload_larger_than_interval:
- actual_hp_workload t1 (t1 + delta) > delta.
- Proof.
- rewrite -{1}busy_interval_has_uninterrupted_service.
- by apply busy_interval_too_much_workload.
- Qed.
-
- End CannotBeBusyForSoLong.
-
- (* Since the interval cannot remain busy for so long, we prove that
- the busy interval finishes at some point t2 <= t1 + delta. *)
- Lemma busy_interval_is_bounded:
- exists t2,
- t2 <= t1 + delta /\
- busy_interval t1 t2.
- Proof.
- have TOOMUCH := busy_interval_workload_larger_than_interval.
- have BOUNDED := H_workload_is_bounded.
- rename H_is_busy_prefix into PREFIX.
-
- set dec_quiet :=
- fun t => all (fun j_hp =>
- higher_eq_priority j_hp j ==> (completed_by job_cost sched j_hp t))
- (actual_arrivals_before job_arrival job_jitter arr_seq t).
-
- destruct ([exists t2:'I_(t1 + delta).+1, (t2 > t1) && dec_quiet t2]) eqn:EX.
- {
- have EX': exists (t2: nat), ((t1 < t2 <= t1 + delta) && dec_quiet t2).
- {
- move: EX => /existsP [t2 /andP [LE QUIET]].
- exists t2; apply/andP; split; last by done.
- by apply/andP; split; last by rewrite -ltnS; apply ltn_ord.
- }
- have MIN := ex_minnP EX'.
- move: MIN => [t2 /andP [/andP [GT LE] QUIET] MIN]; clear EX EX'.
- exists t2; split; first by done.
- split; last first.
- {
- intros j_hp IN HP ARR.
- move: QUIET => /allP QUIET.
- feed (QUIET j_hp);
- first by eapply arrived_between_implies_in_actual_arrivals; eauto 1.
- by move: QUIET => /implyP QUIET; apply QUIET.
- }
- split; first by done.
- split; first by move: PREFIX => [_ [QUIET1 _]].
- move => t /andP [GT1 LT2] BUG.
- feed (MIN t).
- {
- apply/andP; split;
- first by apply/andP; split;
- last by apply leq_trans with (n := t2); [by apply ltnW |].
- apply/allP; intros j_hp ARR; apply/implyP; intro HP.
- apply BUG; [| by done |].
- - by eapply in_actual_arrivals_before_implies_arrived, ARR.
- - by eapply in_actual_arrivals_implies_arrived_before, ARR.
- }
- by apply leq_ltn_trans with (p := t2) in MIN; first by rewrite ltnn in MIN.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP ALL'.
- have ALL: forall t, t1 < t <= t1 + delta -> ~ quiet_time t.
- {
- move => t /andP [GTt LEt] QUIET.
- rewrite -ltnS in LEt.
- specialize (ALL' (Ordinal LEt)); rewrite negb_and /= GTt orFb in ALL'.
- move: ALL' => /negP ALL'; apply ALL'; clear ALL'.
- apply/allP; intros j_hp ARR; apply/implyP; intro HP.
- apply QUIET; [| by done |].
- - by eapply in_actual_arrivals_before_implies_arrived, ARR.
- - by eapply in_actual_arrivals_implies_arrived_before, ARR.
- } exfalso; clear ALL'.
- specialize (TOOMUCH ALL).
- by have BUG := leq_trans TOOMUCH BOUNDED; rewrite ltnn in BUG.
- }
- Qed.
-
- End UpperBound.
-
- End BoundingBusyInterval.
-
- (* In this section, we show that from a workload bound we can infer
- the existence of a busy interval. *)
- Section BusyIntervalFromWorkloadBound.
-
- (* Assume that for some delta > 0, the requested workload at
- time (t1 + delta) is bounded by delta (i.e., the supply). *)
- Variable delta: time.
- Hypothesis H_delta_positive: delta > 0.
- Hypothesis H_workload_is_bounded:
- forall t, actual_hp_workload t (t + delta) <= delta.
-
- (* Next, we assume that job j has positive cost, from which we can
- infer that there always is a time in which j is pending. *)
- Hypothesis H_positive_cost: job_cost j > 0.
-
- (* Therefore there must exists a busy interval [t1, t2) that
- contains the actual arrival time of job j. *)
- Corollary exists_busy_interval:
- exists t1 t2,
- t1 <= actual_job_arrival j < t2 /\
- t2 <= t1 + delta /\
- busy_interval t1 t2.
- Proof.
- have PREFIX := exists_busy_interval_prefix.
- rename H_workload_is_bounded into WORK.
- feed (PREFIX (actual_job_arrival j)).
- {
- apply/andP; split; first by apply leqnn.
- rewrite /completed_by /service /service_during.
- rewrite (cumulative_service_before_jitter_is_zero job_arrival job_jitter) //.
- by rewrite -ltnNge.
- }
- move: PREFIX => [t1 [PREFIX /andP [GE1 GEarr]]].
- have BOUNDED := busy_interval_is_bounded (actual_job_arrival j) t1 PREFIX delta.
- feed_n 2 BOUNDED; [by done | by apply WORK | ].
- move: BOUNDED => [t2 [GE2 BUSY]].
- exists t1, t2; split.
- { apply/andP; split; first by done.
- apply contraT; rewrite -leqNgt; intro BUG.
- move: BUSY PREFIX => [[LE12 _] QUIET] [_ [_ NOTQUIET]].
- feed (NOTQUIET t2); first by apply/andP; split.
- by exfalso; apply NOTQUIET.
- }
- by split.
- Qed.
-
- End BusyIntervalFromWorkloadBound.
-
- (* If we know that the workload is bounded, we can also use the
- busy interval to infer a response-time bound. *)
- Section ResponseTimeBoundFromBusyInterval.
-
- (* Assume that for some delta > 0, the requested workload
- at time (t1 + delta) is bounded by delta (i.e., the supply). *)
- Variable delta: time.
- Hypothesis H_delta_positive: delta > 0.
- Hypothesis H_workload_is_bounded:
- forall t,
- actual_hp_workload t (t + delta) <= delta.
-
- (* Then, job j must complete by (actual_job_arrival j + delta). *)
- Lemma busy_interval_bounds_response_time:
- job_completed_by j (actual_job_arrival j + delta).
- Proof.
- have BUSY := exists_busy_interval delta.
- move: (posnP (job_cost j)) => [Z|POS].
- { by rewrite /job_completed_by /completed_by Z. }
- feed_n 3 BUSY; try (by done).
- move: BUSY => [t1 [t2 [/andP [GE1 LT2] [GE2 BUSY]]]].
- apply completion_monotonic with (t := t2); try (by done);
- first by apply leq_trans with (n := t1 + delta); [| by rewrite leq_add2r].
- apply job_completes_within_busy_interval with (t1 := t1) (t := actual_job_arrival j);
- try (by done); first by apply/andP; split.
- apply/andP; split; first by apply leqnn.
- rewrite /completed_by /service /service_during.
- rewrite (cumulative_service_before_jitter_is_zero job_arrival job_jitter) //.
- by rewrite -ltnNge.
- Qed.
-
- End ResponseTimeBoundFromBusyInterval.
-
- End BoundingBusyInterval.
-
- End Lemmas.
-
- End Defs.
-
-End BusyInterval.
diff --git a/classic/model/schedule/uni/jitter/platform.v b/classic/model/schedule/uni/jitter/platform.v
deleted file mode 100644
index 5e1cf378c25003b68caddf738a4a937ccc6e9676..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/jitter/platform.v
+++ /dev/null
@@ -1,99 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(* In this file, we define properties about the platform in jitter-aware schedules. *)
-Module Platform.
-
- Import Job SporadicTaskset UniprocessorScheduleWithJitter Priority.
-
- Section Properties.
-
- Context {sporadic_task: eqType}.
- Variable task_cost: sporadic_task -> time.
- Variable task_period: sporadic_task -> time.
- Variable task_deadline: sporadic_task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
- Variable job_jitter: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any jitter-aware uniprocessor schedule. *)
- Variable arr_seq: arrival_sequence Job.
- Variable sched: schedule Job.
-
- (* First, we define properties related to execution. *)
- Section Execution.
-
- (* We say that a scheduler is work-conserving iff whenever a job j
- is backlogged, the processor is always busy with another job.
- (Note that the definition of backlogged depends on the jitter.) *)
- Definition work_conserving :=
- forall j t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- exists j_other, scheduled_at sched j_other t.
-
- End Execution.
-
- (* Next, we define properties related to FP scheduling. *)
- Section FP.
-
- (* We say that an FP policy...*)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ...is respected by the schedule iff a scheduled task has
- higher (or same) priority than (as) any backlogged task.
- (Note that the definition of backlogged depends on the jitter.) *)
- Definition respects_FP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- (* Next, we define properties related to JLFP policies. *)
- Section JLFP.
-
- (* We say that a JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ... is respected by the scheduler iff a scheduled job has
- higher (or same) priority than (as) any backlogged job.
- (Note that the definition of backlogged depends on the jitter.) *)
- Definition respects_JLFP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- (* Next, we define properties related to JLDP policies. *)
- Section JLDP.
-
- (* We say that a JLFP/JLDP policy ...*)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* ... is respected by the scheduler iff at any time t, a scheduled job
- has higher (or same) priority than (as) any backlogged job.
- (Note that the definition of backlogged depends on the jitter.) *)
- Definition respects_JLDP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost job_jitter sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority t j_hp j.
-
- End JLDP.
-
- End Properties.
-
-End Platform.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/jitter/schedule.v b/classic/model/schedule/uni/jitter/schedule.v
deleted file mode 100644
index e8700e0c1991713fdc65e1ba2f7c2545fbde563f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/jitter/schedule.v
+++ /dev/null
@@ -1,169 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.arrival.jitter.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we prove additional definitions and lemmas about jitter-aware schedules. *)
-Module UniprocessorScheduleWithJitter.
-
- (* To formalize jitter, we import the original uniprocessor schedule and
- redefine some of the properties. *)
- Export ArrivalSequenceWithJitter UniprocessorSchedule.
-
- (* In this section we redefine properties that depend on the arrival time. *)
- Section RedefiningProperties.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Consider any uniprocessor schedule. *)
- Variable arr_seq: arrival_sequence Job.
- Variable sched: schedule Job.
-
- (* First, we redefine some job properties. *)
- Section JobProperties.
-
- (* Let j be any job in the arrival sequence. *)
- Variable j: Job.
-
- (* Then, we say that job j is pending at time t iff the jitter has passed but
- j has not completed by time t. *)
- Definition pending (t: time) :=
- jitter_has_passed job_arrival job_jitter j t && ~~ completed_by job_cost sched j t.
-
- (* Finally, we say that job j is backlogged at time t iff it is pending and not scheduled. *)
- Definition backlogged (t: time) :=
- pending t && ~~ scheduled_at sched j t.
-
- End JobProperties.
-
- (* Next, we define properties of a valid jitter-aware schedule. *)
- Section ValidSchedules.
-
- (* In any jitter-aware schedule, a job can only be scheduled after
- the jitter has passed. *)
- Definition jobs_execute_after_jitter :=
- forall j t,
- scheduled_at sched j t -> jitter_has_passed job_arrival job_jitter j t.
-
- End ValidSchedules.
-
- (* In this section, we prove some basic lemmas about jitter-aware schedules. *)
- Section Lemmas.
-
- (* For simplicity, let's define some local names. *)
- Let has_actually_arrived := jitter_has_passed job_arrival job_jitter.
- Let actual_job_arrival := actual_arrival job_arrival job_jitter.
-
- (* We begin by proving properties related to job arrivals. *)
- Section Arrival.
-
- (* Assume that jobs only execute after the jitter has passed. *)
- Hypothesis H_jobs_execute_after_jitter: jobs_execute_after_jitter.
-
- (* First, we show that every job in the schedule only executes after its arrival time. *)
- Lemma jobs_with_jitter_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
- Proof.
- intros j t SCHED.
- apply leq_trans with (n := actual_arrival job_arrival job_jitter j);
- first by apply leq_addr.
- by apply H_jobs_execute_after_jitter.
- Qed.
-
- (* Now, let j be any job. *)
- Variable j: Job.
-
- (* First, we show that if the jitter has passed, then the job must have arrived. *)
- Lemma jitter_has_passed_implies_arrived:
- forall t,
- has_actually_arrived j t ->
- has_arrived job_arrival j t.
- Proof.
- by intros t PASS; apply: leq_trans PASS; apply leq_addr.
- Qed.
-
- (* Now we prove that job j does not receive service at any time t before
- its actual arrival time. *)
- Lemma service_before_jitter_is_zero :
- forall t,
- t < actual_job_arrival j ->
- service_at sched j t = 0.
- Proof.
- rename H_jobs_execute_after_jitter into ARR; red in ARR; intros t LT.
- specialize (ARR j t).
- apply contra with (c := scheduled_at sched j t)
- (b := jitter_has_passed job_arrival job_jitter j t) in ARR;
- last by rewrite -ltnNge.
- by apply/eqP; rewrite eqb0.
- Qed.
-
- (* Note that the same property applies to the cumulative service. *)
- Lemma cumulative_service_before_jitter_is_zero :
- forall t1 t2,
- t2 <= actual_job_arrival j ->
- \sum_(t1 <= i < t2) service_at sched j i = 0.
- Proof.
- intros t1 t2 LE; apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := \sum_(t1 <= i < t2) 0);
- last by rewrite big_const_nat iter_addn mul0n addn0.
- rewrite big_nat_cond [\sum_(_ <= _ < _) 0]big_nat_cond.
- apply leq_sum; intro i; rewrite andbT; move => /andP LTi; des.
- rewrite service_before_jitter_is_zero; first by ins.
- by apply leq_trans with (n := t2); ins.
- Qed.
-
- (* Hence, one can ignore the service received by a job before the jitter. *)
- Lemma ignore_service_before_jitter:
- forall t1 t2,
- t1 <= actual_job_arrival j <= t2 ->
- \sum_(t1 <= t < t2) service_at sched j t =
- \sum_(actual_job_arrival j <= t < t2) service_at sched j t.
- Proof.
- move => t1 t2 /andP [LE1 GE2].
- rewrite -> big_cat_nat with (n := actual_job_arrival j); try (by done).
- by rewrite /= cumulative_service_before_jitter_is_zero; [rewrite add0n | apply leqnn].
- Qed.
-
- End Arrival.
-
- (* In this section, we prove properties about pending jobs. *)
- Section Pending.
-
- (* Assume that jobs only execute after the jitter has passed... *)
- Hypothesis H_jobs_execute_after_jitter: jobs_execute_after_jitter.
-
- (* ...and that completed jobs do not execute. *)
- Hypothesis H_completed_jobs:
- completed_jobs_dont_execute job_cost sched.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* First, we show that if job j is scheduled, then it must be pending. *)
- Lemma scheduled_implies_pending:
- forall t,
- scheduled_at sched j t -> pending j t.
- Proof.
- rename H_jobs_execute_after_jitter into ARR,
- H_completed_jobs into COMP.
- unfold jobs_must_arrive_to_execute, completed_jobs_dont_execute in *.
- intros t SCHED.
- unfold pending; apply/andP; split; first by apply ARR.
- apply/negP; unfold not; intro COMPLETED.
- have BUG := COMP j t.+1.
- rewrite leqNgt in BUG; move: BUG => /negP BUG; apply BUG.
- unfold service, service_during; rewrite -addn1 big_nat_recr // /=.
- by apply leq_add; last rewrite /service_at SCHED.
- Qed.
-
- End Pending.
-
- End Lemmas.
-
- End RedefiningProperties.
-
-End UniprocessorScheduleWithJitter.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/jitter/valid_schedule.v b/classic/model/schedule/uni/jitter/valid_schedule.v
deleted file mode 100644
index 0404f1482bd45935ac2fd1f28cd09d328618949e..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/jitter/valid_schedule.v
+++ /dev/null
@@ -1,66 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.jitter.schedule
- prosa.classic.model.schedule.uni.jitter.platform.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we construct a predicate that defines a valid jitter-aware schedule
- of a given task set. *)
-Module ValidJitterAwareSchedule.
-
- Import UniprocessorScheduleWithJitter Priority Platform.
-
- (** Basic Setup & Setting*)
- Section DefiningValidSchedule.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume any given job-level policy. *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (** Definition of the Jitter-Aware Schedule *)
-
- (* Consider any job cost and job jitter functions. *)
- Variable job_cost: Job -> time.
- Variable job_jitter: Job -> time.
-
- (* Let sched be any schedule. *)
- Variable sched: schedule Job.
-
- (* For sched to denote a valid jitter-aware schedule of ts, the following properties must hold. *)
-
- (* 1) All scheduled jobs must come from the arrival sequence. *)
- Let H1_jobs_come_from_arrival_sequence := jobs_come_from_arrival_sequence sched arr_seq.
-
- (* 2) Jobs only execute after the jitter has passed. *)
- Let H2_jobs_execute_after_jitter := jobs_execute_after_jitter job_arrival job_jitter sched.
-
- (* 3) Jobs do not execute for longer than their costs. *)
- Let H3_completed_jobs_dont_execute := completed_jobs_dont_execute job_cost sched.
-
- (* 4) The schedule is work-conserving. *)
- Let H4_work_conserving := work_conserving job_arrival job_cost job_jitter arr_seq sched.
-
- (* 5) The schedule respects task priorities. *)
- Let H5_respects_priority :=
- respects_JLDP_policy job_arrival job_cost job_jitter arr_seq sched higher_eq_priority.
-
- (* All these properties can be combined into the following predicate. *)
- Definition valid_jitter_aware_schedule :=
- H1_jobs_come_from_arrival_sequence /\
- H2_jobs_execute_after_jitter /\
- H3_completed_jobs_dont_execute /\
- H4_work_conserving /\
- H5_respects_priority.
-
- End DefiningValidSchedule.
-
-End ValidJitterAwareSchedule.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/limited/abstract_RTA/abstract_rta.v b/classic/model/schedule/uni/limited/abstract_RTA/abstract_rta.v
deleted file mode 100644
index 6da35e3635ce2862adc7703184df914e74955e96..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/abstract_RTA/abstract_rta.v
+++ /dev/null
@@ -1,457 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.abstract_RTA.definitions
- prosa.classic.model.schedule.uni.limited.abstract_RTA.sufficient_condition_for_lock_in_service
- prosa.classic.model.schedule.uni.limited.abstract_RTA.reduction_of_search_space.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Abstract Response-Time Analysis *)
-(** In this module, we propose the general framework for response-time analysis (RTA)
- of uniprocessor scheduling of real-time tasks with arbitrary arrival models. *)
-Module AbstractRTA.
-
- Import Job UniprocessorSchedule Service ResponseTime AbstractRTADefinitions
- AbstractRTALockInService AbstractRTAReduction.
-
- (* In this section we prove that the maximum among the solutions of the response-time bound
- recurrence is a response time bound for tsk. Note that in this section we do not rely on
- any hypotheses about job sequentiality. *)
- Section Abstract_RTA.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the job costs are no larger than the task costs. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Consider a task set ts... *)
- Variable ts: list Task.
-
- (* ... and a task tsk of ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Consider proper job lock-in service and task lock-in service functions, i.e... *)
- Variable job_lock_in_service: Job -> time.
- Variable task_lock_in_service: Task -> time.
-
- (* ...we assume that for all jobs in the arrival sequence the lock-in service is
- (1) positive, (2) no bigger than the costs of the corresponding jobs, and
- (3) a job becomes nonpreemptive after it reaches its lock-in service... *)
- Hypothesis H_proper_job_lock_in_service:
- proper_job_lock_in_service job_cost arr_seq sched job_lock_in_service.
-
- (* ...and that [task_lock_in_service tsk] is (1) no bigger than tsk's cost, (2) for any
- job of task tsk job_lock_in_service is bounded by task_lock_in_service. *)
- Hypothesis H_proper_task_lock_in_service:
- proper_task_lock_in_service
- task_cost job_task arr_seq job_lock_in_service task_lock_in_service tsk.
-
- (* Let's define some local names for clarity. *)
- Let work_conserving := work_conserving job_arrival job_cost job_task arr_seq sched tsk.
- Let busy_intervals_are_bounded_by := busy_intervals_are_bounded_by job_arrival job_cost job_task arr_seq sched tsk.
- Let job_interference_is_bounded_by := job_interference_is_bounded_by job_arrival job_cost job_task arr_seq sched tsk.
-
- (* Assume we are provided with abstract functions for interference and interfering workload. *)
- Variable interference: Job -> time -> bool.
- Variable interfering_workload: Job -> time -> time.
-
- (* We assume that the scheduler is work-conserving. *)
- Hypothesis H_work_conserving: work_conserving interference interfering_workload.
-
- (* For simplicity, let's define some local names. *)
- Let cumul_interference := cumul_interference interference.
- Let cumul_interfering_workload := cumul_interfering_workload interfering_workload.
- Let busy_interval := busy_interval job_arrival job_cost sched interference interfering_workload.
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- (* Let L be a constant which bounds any busy interval of task tsk. *)
- Variable L: time.
- Hypothesis H_busy_interval_exists: busy_intervals_are_bounded_by interference interfering_workload L.
-
- (* Next, assume that interference_bound_function is a bound on
- the interference incurred by jobs of task tsk. *)
- Variable interference_bound_function: Task -> time -> time -> time.
- Hypothesis H_job_interference_is_bounded:
- job_interference_is_bounded_by interference interfering_workload interference_bound_function.
-
- (* For simplicity, let's define a local name for the search space. *)
- Let is_in_search_space A := is_in_search_space tsk L interference_bound_function A.
-
- (* Consider any value R that upper-bounds the solution of each response-time recurrence,
- i.e., for any relative arrival time A in the search space, there exists a corresponding
- solution F such that F + (task_cost tsk - task_lock_in_service tsk) <= R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = task_lock_in_service tsk + interference_bound_function tsk A (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
-
- (* In this section we show a detailed proof of the main theorem
- that establishes that R is a response-time bound of task tsk. *)
- Section ProofOfTheorem.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* Assume we have a busy interval [t1, t2) of job j that is bounded by L. *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval: busy_interval j t1 t2.
-
- (* Let's define A as a relative arrival time of job j (with respect to time t1). *)
- Let A := job_arrival j - t1.
-
- (* In order to prove that R is a response-time bound of job j, we use hypothesis H_R_is_maximum.
- Note that the relative arrival time (A) is not necessarily from the search space. However,
- earlier we have proven that for any A there exists another A_sp from the search space that
- shares the same IBF value. Moreover, we've also shown that there exists an F_sp such that
- F_sp is a solution of the response time recurrence for parameter A_sp. Thus, despite the
- fact that the relative arrival time may not lie in the search space, we can still use
- the assumption H_R_is_maximum. *)
-
- (* More formally, consider any A_sp and F_sp such that:.. *)
- Variable A_sp F_sp: time.
- (* (a) A_sp is less than or equal to A... *)
- Hypothesis H_A_gt_Asp: A_sp <= A.
- (* (b) interference_bound_function(A, x) is equal to interference_bound_function(A_sp, x) for all x less than L... *)
- Hypothesis H_equivalent:
- are_equivalent_at_values_less_than (interference_bound_function tsk A) (interference_bound_function tsk A_sp) L.
- (* (c) A_sp is in the search space, ... *)
- Hypothesis H_Asp_is_in_search_space: is_in_search_space A_sp.
- (* (d) A_sp + F_sp is a solution of the response time reccurence... *)
- Hypothesis H_fixpoint:
- A_sp + F_sp = task_lock_in_service tsk + interference_bound_function tsk A_sp (A_sp + F_sp).
- (* (e) and finally, F_sp + (task_last - ε) is no greater than R. *)
- Hypothesis H_R_gt_Fsp: F_sp + (task_cost tsk - task_lock_in_service tsk) <= R.
-
- (* In this section, we consider the case where the solution is so large that the value of [t1 + A_sp + F_sp] goes
- beyond the busy interval. Although this case may be impossible in some scenarios, it can be easily proven,
- since any job that completes by the end of the busy interval remains completed. *)
- Section FixpointOutsideBusyInterval.
-
- (* By assumption, suppose that t2 is less than or equal to [t1 + A_sp + F_sp]. *)
- Hypothesis H_big_fixpoint_solution: t2 <= t1 + (A_sp + F_sp).
-
- (* Then we prove that (job_arrival j + R) is no less than t2. *)
- Lemma t2_le_arrival_plus_R:
- t2 <= job_arrival j + R.
- Proof.
- move: H_busy_interval => [[/andP [GT LT] [QT1 NTQ]] QT2].
- apply leq_trans with (t1 + (A_sp + F_sp)); first by done.
- apply leq_trans with (t1 + A + F_sp).
- { by rewrite !addnA leq_add2r leq_add2l. }
- rewrite /A subnKC; last by done.
- rewrite leq_add2l.
- apply leq_trans with (F_sp + (task_cost tsk - task_lock_in_service tsk)); last by done.
- by rewrite leq_addr.
- Qed.
-
- (* But since we know that the job is completed by the end of its busy interval,
- we can show that job j is completed by (job arrival j + R) *)
- Lemma job_completed_by_arrival_plus_R_1:
- completed_by job_cost sched j (job_arrival j + R).
- Proof.
- move: H_busy_interval => [[/andP [GT LT] [QT1 NTQ]] QT2].
- apply completion_monotonic with t2; try done.
- apply t2_le_arrival_plus_R.
- eapply job_completes_within_busy_interval; eauto 2.
- Qed.
-
- End FixpointOutsideBusyInterval.
-
- (* In this section, we consider the complementary case where [t1 + A_sp + F_sp] lies inside the busy interval. *)
- Section FixpointInsideBusyInterval.
-
- (* So, assume that [t1 + A_sp + F_sp] is less than t2. *)
- Hypothesis H_small_fixpoint_solution: t1 + (A_sp + F_sp) < t2.
-
- (* Next, let's consider two other cases: *)
- (* CASE 1: the value of the fixpoint is no less than the relative arrival time of job j. *)
- Section FixpointIsNoLessThanArrival.
-
- (* Suppose that [A_sp + F_sp] is no less than relative arrival of job j. *)
- Hypothesis H_fixpoint_is_no_less_than_relative_arrival_of_j: A <= A_sp + F_sp.
-
- (* Using lemma "solution_for_A_exists" we can find a solution for response time recurrence for A. *)
- Lemma solution_for_A_exists':
- exists F,
- A_sp + F_sp = A + F /\
- F <= F_sp /\
- A + F = task_lock_in_service tsk + interference_bound_function tsk A (A + F).
- Proof.
- move: (solution_for_A_exists
- tsk L (fun tsk A R => task_lock_in_service tsk + interference_bound_function tsk A R) A_sp F_sp) => Lemma1.
- feed_n 2 Lemma1; try done.
- { move: (H_busy_interval_exists j H_j_arrives H_job_of_tsk H_job_cost_positive) => [t1' [t2' [_ [BOUND BUSY]]]].
- have EQ:= busy_interval_is_unique _ _ _ _ _ _ _ _ _ _ H_busy_interval BUSY. destruct EQ as [EQ1 EQ2].
- subst t1' t2'; clear BUSY.
- by rewrite -(ltn_add2l t1); apply leq_trans with t2. }
- specialize (Lemma1 A).
- feed_n 2 Lemma1; try done.
- - by apply/andP; split.
- - by intros x H; apply/eqP; rewrite eqn_add2l H_equivalent.
- Qed.
-
- (* To prove this lemma, we introduce two temporal notions of the last nonpreemptive region of job j
- and an execution optimism. We use these notions only inside this proof, so we don't define them
- explicitly. Let the last nonpreemptive region of job j (last) be the difference between the cost
- of the job and the j's lock-in service (i.e. [job_cost j - job_lock_in_service j]). We know that
- after j has reached its lock-in service, it will additionally be executed [last] units of time.
- And let execution optimism (optimism) be the difference between the tsk's lock-in service
- and the j's lock-in service (i.e. [task_lock_in_service - job_lock_in_service]). And optimism is
- how much earlier job j has received its lock-in service than it could at worst. From lemma
- j_receives_at_least_lock_in_service we know that service of j by time [t1 + (A + F) - optimism]
- is no less than [lock_in_service j]. Hence, job j is completed by time [t1 + (A + F) - optimism + last]
- which is smaller than [job_arrival j + R]. *)
- Lemma job_completed_by_arrival_plus_R_2:
- completed_by job_cost sched j (job_arrival j + R).
- Proof.
- move: H_proper_job_lock_in_service => [PRJ1 [PRJ2 PRJ3]].
- move: H_proper_task_lock_in_service => [PRT1 PRT2].
- have AUTO1: forall m n, n <= n + m; first by intros; rewrite leq_addr.
- set (job_cost j - job_lock_in_service j) as job_last.
- set (task_lock_in_service tsk - job_lock_in_service j) as optimism.
- move: (H_busy_interval) => [[NEQ [QT1 NTQ]] QT2].
- move: (NEQ) => /andP [GT LT].
- move: solution_for_A_exists' => [F [EQSUM [F2LEF1 FIX2]]].
- apply/negP; intros CONTRc.
- have Fact1: A <= interference_bound_function tsk A (A + F).
- { apply leq_trans with
- (AbstractRTADefinitions.cumul_interference interference j t1 (t1 + (A+F))).
- { unfold AbstractRTADefinitions.cumul_interference.
- apply leq_trans with
- (\sum_(t1 <= t < t1 + A) interference j t); last first.
- { rewrite [in X in _ <= X](@big_cat_nat _ _ _ (t1 + A)) //=; last by rewrite addnA. }
- { rewrite -{1}[A](sum_of_ones t1).
- rewrite [in X in X <= _]big_nat_cond [in X in _ <= X]big_nat_cond.
- rewrite leq_sum //.
- move => t /andP [/andP [NEQ1 NEQ2] _].
- rewrite lt0b.
- unfold work_conserving in H_work_conserving.
- move: (H_work_conserving j t1 t2 t) => CONS.
- feed_n 5 CONS; try done.
- { apply/andP; split; first by done.
- apply leq_trans with (t1 + A); first by done.
- by rewrite /A subnKC // ltnW.
- }
- move: CONS => [CONS1 _].
- apply/negP; intros CONTR.
- move: (CONS1 CONTR) => SCHED; clear CONS1 CONTR.
- apply H_jobs_must_arrive_to_execute in SCHED.
- move: NEQ2; rewrite ltnNge; move => /negP NEQ2; apply: NEQ2.
- by rewrite subnKC. }
- }
- { apply H_job_interference_is_bounded with t2; try done.
- - by rewrite -EQSUM.
- - apply/negP; intros CONTR; apply: CONTRc.
- apply completion_monotonic with (t1 + (A + F)); try done.
- rewrite !addnA subnKC // leq_add2l.
- apply leq_trans with F_sp; first by done.
- by apply leq_trans with (F_sp + (task_cost tsk - task_lock_in_service tsk)).
- }
- }
- have FleTLIN: task_lock_in_service tsk <= F.
- { have Fact: forall a b c d, a + b = c + d -> b <= d -> a >= c.
- { clear; intros ? ? ? ? EQ NEQ.
- have Fact: exists k, d = b + k.
- { by exists (d - b); rewrite subnKC. }
- move: Fact => [k EQk].
- subst d; clear NEQ.
- move: EQ; rewrite [b+k]addnC addnA; move => /eqP; rewrite eqn_add2r; move => /eqP EQ.
- by subst a; rewrite leq_addr.
- }
- by rewrite {1}addnC in FIX2; apply Fact in FIX2.
- }
- have NotTooOptimistic: optimism <= F.
- { apply leq_trans with (task_lock_in_service tsk); last by done.
- by rewrite /optimism leq_subr.
- }
- have NEQf: optimism <= F_sp.
- { by apply leq_trans with F. }
- have NEQ1: task_lock_in_service tsk <= F_sp.
- { by apply leq_trans with F. }
- have CNEQ: t1 + (A + F - optimism) + job_last <= job_arrival j + R.
- { apply leq_trans with (job_arrival j + (F - optimism) + job_last).
- { rewrite leq_add2r addnBA; last by (apply leq_trans with F; [done | rewrite leq_addl]).
- by rewrite /A !addnA subnKC // addnBA. }
- { rewrite -addnA leq_add2l.
- apply leq_trans with (F_sp - optimism + job_last ); first by rewrite leq_add2r leq_sub2r.
- apply leq_trans with (F_sp + (task_cost tsk - task_lock_in_service tsk)); last by done.
- rewrite /optimism subnBA; last by apply PRT2.
- rewrite -addnBAC //.
- rewrite /job_last.
- rewrite addnBA; last by auto.
- rewrite -addnBAC; last by rewrite leq_addl.
- rewrite -addnBA // subnn addn0.
- rewrite addnBA; last by auto.
- rewrite addnBAC; last by done.
- rewrite leq_sub2r // leq_add2l.
- by rewrite -H_job_of_tsk; apply H_job_cost_le_task_cost.
- }
- }
- apply CONTRc.
- apply completion_monotonic with
- (t1 + ((A + F) - optimism) + job_last); try done.
- apply negbNE; apply/negP; intros NCOMPL.
- have ESERV :=
- j_receives_at_least_lock_in_service
- job_arrival job_cost
- job_task arr_seq sched tsk
- interference interfering_workload
- _ j _ _ _ t1 t2 _ (job_lock_in_service j) _ ((A + F) - optimism).
- feed_n 7 ESERV; eauto 2.
- { rewrite {2}FIX2.
- rewrite /AbstractRTADefinitions.cumul_interference.
- rewrite -[in X in _ <= X]addnBAC; last by rewrite leq_subr.
- rewrite {2}/optimism.
- rewrite subKn; last by auto.
- rewrite leq_add2l.
- apply leq_trans with (cumul_interference j t1 (t1 + (A + F))).
- { rewrite /cumul_interference /AbstractRTADefinitions.cumul_interference;
- rewrite [in X in _ <= X](@big_cat_nat _ _ _ (t1 + (A + F - optimism))) //=.
- by rewrite leq_add2l leq_subr. }
- { apply H_job_interference_is_bounded with t2; try done.
- - by rewrite -EQSUM.
- - apply/negP; intros CONTR; apply: CONTRc.
- apply completion_monotonic with (t1 + (A + F)); try done.
- rewrite addnA subnKC // leq_add2l.
- apply leq_trans with F_sp; first by done.
- by apply leq_trans with (F_sp + (task_cost tsk - task_lock_in_service tsk)).
- }
- }
- move: NCOMPL => /negP NCOMPL; apply: NCOMPL.
- by eapply job_completes_after_reaching_lock_in_service; eauto.
- Qed.
-
- End FixpointIsNoLessThanArrival.
-
- (* CASE 2: the value of the fixpoint is less than the relative arrival time of
- job j (which turns out to be impossible, i.e. the solution of the responce-time
- recurrense is always equal to or greater than the relative arrival time). *)
- Section FixpointCannotBeSmallerThanArrival.
-
- (* Assume that [A_sp + F_sp] is less than A. *)
- Hypothesis H_fixpoint_is_less_that_relative_arrival_of_j: A_sp + F_sp < A.
-
- (* Note that the relative arrival time of job j is less than L. *)
- Lemma relative_arrival_is_bounded: A < L.
- Proof.
- rewrite /A.
- move: (H_busy_interval_exists j H_j_arrives H_job_of_tsk H_job_cost_positive) => [t1' [t2' [_ [BOUND BUSY]]]].
- have EQ:= busy_interval_is_unique _ _ _ _ _ _ _ _ _ _ H_busy_interval BUSY. destruct EQ as [EQ1 EQ2].
- subst t1' t2'; clear BUSY.
- apply leq_trans with (t2 - t1); last by rewrite leq_subLR.
- move: (H_busy_interval)=> [[/andP [H1 H3] [_ _]] _].
- by apply ltn_sub2r; first apply leq_ltn_trans with (job_arrival j).
- Qed.
-
- (* We can use [j_receives_at_least_lock_in_service] to prove that the service
- received by j by time [t1 + (A_sp + F_sp)] is no less than lock_in_service. *)
- Lemma service_of_job_ge_lock_in_service:
- service sched j (t1 + (A_sp + F_sp)) >= job_lock_in_service j.
- Proof.
- move: H_proper_job_lock_in_service => [PRJ1 [PRJ2 PRJ3]].
- move: H_proper_task_lock_in_service => [PRT1 PRT2].
- move: (H_busy_interval) => [[NEQ [QT1 NTQ]] QT2].
- move: (NEQ) => /andP [GT LT].
- move: (H_job_interference_is_bounded t1 t2 (A_sp + F_sp) j) => IB.
- feed_n 5 IB; try done.
- { apply/negP; intros COMPL.
- apply completion_monotonic with (t' := t1 + A) in COMPL; try done; last first.
- { by rewrite leq_add2l; apply ltnW. }
- { rewrite /A subnKC in COMPL; last by done.
- move: COMPL; rewrite /completed_by leqNgt; move => /negP COMPL; apply: COMPL.
- rewrite /service (service_during_cat _ _ (job_arrival j)); last by apply/andP; split.
- rewrite /service_during (cumulative_service_before_job_arrival_zero job_arrival) // add0n.
- by rewrite big_geq //.
- }
- }
- rewrite -/A in IB.
- have ALTT := relative_arrival_is_bounded.
- simpl in IB; rewrite H_equivalent in IB; last by apply ltn_trans with A.
- have ESERV := j_receives_at_least_lock_in_service
- job_arrival job_cost
- job_task arr_seq sched tsk
- interference interfering_workload _ j _ _ _ t1 t2 _ (job_lock_in_service j) _ (A_sp + F_sp).
- feed_n 7 ESERV; eauto 2.
- by rewrite {2}H_fixpoint leq_add //; eapply PRT2.
- Qed.
-
- (* However, this is a contradiction. Since job j has not yet arrived, its
- service it equal to 0. However, lock_in_service is always positive. *)
- Lemma relative_arrival_time_is_no_less_than_fixpoint:
- False.
- Proof.
- move: H_proper_job_lock_in_service => [PRJ1 [PRJ2 PRJ3]].
- move: H_proper_task_lock_in_service => [PRT1 PRT2].
- move: (H_busy_interval) => [[NEQ [QT1 NTQ]] QT2].
- move: (NEQ) => /andP [GT LT].
- have ESERV := service_of_job_ge_lock_in_service.
- move: ESERV; rewrite leqNgt; move => /negP ESERV; apply: ESERV.
- rewrite /service /service_during (cumulative_service_before_job_arrival_zero job_arrival); auto.
- rewrite -[X in _ <= X](@subnKC t1); last by done.
- by rewrite -/A leq_add2l ltnW.
- Qed.
-
- End FixpointCannotBeSmallerThanArrival.
-
- End FixpointInsideBusyInterval.
-
- End ProofOfTheorem.
-
- (* Using the lemmas above, we prove that R is a response-time bound. *)
- Theorem uniprocessor_response_time_bound:
- response_time_bounded_by tsk R.
- Proof.
- intros j ARR JOBtsk.
- move: (posnP (job_cost j)) => [ZERO|POS].
- { by rewrite /is_response_time_bound_of_job /completed_by ZERO. }
- move: (H_busy_interval_exists j ARR JOBtsk POS) => [t1 [t2 [NEQ [H2 BUSY]]]].
- move: (NEQ) (BUSY)=> /andP [GE LT] [_ QTt2].
- have A2LTL := relative_arrival_is_bounded _ ARR JOBtsk POS _ _ BUSY.
- set (A2 := job_arrival j - t1) in *.
- move: (representative_exists tsk _ interference_bound_function _ A2LTL) => [A1 [ALEA2 [EQΦ INSP]]].
- move: (H_R_is_maximum _ INSP) => [F1 [FIX1 LE1]].
- destruct (t1 + (A1 + F1) >= t2) eqn:BIG.
- - eapply job_completed_by_arrival_plus_R_1; eauto 2.
- - apply negbT in BIG; rewrite -ltnNge in BIG.
- destruct (A2 <= A1 + F1) eqn:BOUND.
- + eapply job_completed_by_arrival_plus_R_2; eauto 2.
- + apply negbT in BOUND; rewrite -ltnNge in BOUND.
- exfalso; eapply relative_arrival_time_is_no_less_than_fixpoint; eauto 2.
- Qed.
-
- End Abstract_RTA.
-
-End AbstractRTA.
diff --git a/classic/model/schedule/uni/limited/abstract_RTA/abstract_seq_rta.v b/classic/model/schedule/uni/limited/abstract_RTA/abstract_seq_rta.v
deleted file mode 100644
index 03a10ffd39988a010fa0df177f19e96a3ea0c46a..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/abstract_RTA/abstract_seq_rta.v
+++ /dev/null
@@ -1,641 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time
- prosa.classic.model.schedule.uni.schedule_of_task.
-Require Import prosa.classic.model.schedule.uni.limited.rbf
- prosa.classic.model.schedule.uni.limited.schedule.
-Require Import prosa.classic.model.arrival.curves.bounds.
-Require Import prosa.classic.analysis.uni.arrival_curves.workload_bound.
-Require Import prosa.classic.model.schedule.uni.limited.abstract_RTA.definitions
- prosa.classic.model.schedule.uni.limited.abstract_RTA.sufficient_condition_for_lock_in_service
- prosa.classic.model.schedule.uni.limited.abstract_RTA.reduction_of_search_space
- prosa.classic.model.schedule.uni.limited.abstract_RTA.abstract_rta.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Abstract Response-Time Analysis with sequential jobs *)
-(** In this module we propose the general framework for response-time analysis (RTA)
- of uniprocessor scheduling of real-time tasks with arbitrary arrival models
- and sequential jobs. *)
-Module AbstractSeqRTA.
-
- Import Job ArrivalCurves TaskArrival ScheduleOfTask UniprocessorSchedule Workload
- Service ResponseTime MaxArrivalsWorkloadBound
- AbstractRTADefinitions AbstractRTALockInService AbstractRTAReduction AbstractRTA.
-
- (* In this section we prove that the maximum among the solutions of
- the response-time bound recurrence for some set of parameters
- is a response-time bound for tsk. Note that in this section we _do_
- rely on the hypothesis about job sequentiality. This allows us to
- provide a more precise response-time bound function, since jobs of
- the same task will be executed strictly in the order they arrive. *)
- Section Sequential_Abstract_RTA.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence... *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the job costs are no larger than the task costs. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* For simplicity, let's define some local names. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_completed_by := completed_by job_cost sched.
- Let arrivals_between := jobs_arrived_between arr_seq.
- Let task_scheduled_at := task_scheduled_at job_task sched.
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- (* Consider an arbitrary task set. *)
- Variable ts: list Task.
-
- (* In addition, assume that all jobs come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Let max_arrivals be a family of proper arrival curves, i.e., for any task tsk in ts
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is a monotonic function
- that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_family_of_proper_arrival_curves:
- family_of_proper_arrival_curves job_task arr_seq max_arrivals ts.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Consider proper job lock-in service and task lock-in functions, i.e... *)
- Variable job_lock_in_service: Job -> time.
- Variable task_lock_in_service: Task -> time.
-
- (* ...we assume that for all jobs in the arrival sequence the lock-in service is
- (1) positive, (2) no bigger than costs of the corresponding jobs, and (3) a job
- becomes nonpreemptive after it reaches its lock-in service... *)
- Hypothesis H_proper_job_lock_in_service:
- proper_job_lock_in_service job_cost arr_seq sched job_lock_in_service.
-
- (* ...and that [task_lock_in_service tsk] is (1) no bigger than tsk's cost, (2) for any
- job of task tsk job_lock_in_service is bounded by task_lock_in_service. *)
- Hypothesis H_proper_task_lock_in_service:
- proper_task_lock_in_service
- task_cost job_task arr_seq job_lock_in_service task_lock_in_service tsk.
-
- (* Assume we are provided with abstract functions for interference and interfering workload. *)
- Variable interference: Job -> time -> bool.
- Variable interfering_workload: Job -> time -> time.
-
- (* Let's define some local names for clarity. *)
- Let task_rbf := task_request_bound_function task_cost max_arrivals tsk.
- Let work_conserving := work_conserving job_arrival job_cost job_task arr_seq sched tsk.
- Let busy_intervals_are_bounded_by := busy_intervals_are_bounded_by job_arrival job_cost job_task arr_seq sched tsk.
- Let job_interference_is_bounded_by := job_interference_is_bounded_by job_arrival job_cost job_task arr_seq sched tsk.
- Let busy_interval := busy_interval job_arrival job_cost sched interference interfering_workload.
- Let task_workload_between := task_workload_between job_cost job_task arr_seq tsk.
- Let arrivals_of_task_before := arrivals_of_task_before job_task arr_seq.
- Let task_service_between := task_service_between job_task arr_seq sched tsk.
-
- (* In this section, we introduce a few new definitions to make it easier to
- express the new bound of the worst-case execution time. *)
- Section Definitions.
-
- (* When assuming sequential jobs, we can introduce an additional hypothesis that
- ensures that the values of interference and workload remain consistent. It states
- that any of tsk's job, that arrived before the busy interval, should be
- completed by the beginning of the busy interval. *)
- Definition interference_and_workload_consistent_with_sequential_jobs :=
- forall j t1 t2,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_cost j > 0 ->
- busy_interval j t1 t2 ->
- task_workload_between 0 t1 = task_service_between 0 t1.
-
- (* Next we introduce the notion of task interference. Intuitively, task tsk incurs interference
- when some of the jobs of task tsk incur interference. As a result, tsk cannot make any progress.
-
- More formally, task tsk experiences interference at a time instant time t, if at time t
- task tsk is not scheduled and there exists a job of tsk that (1) experiences interference and
- (2) has arrived before some time instant [upper_bound].
-
- It is important to note two subtle points: according to our semantics of the interference function,
- jobs from the same task can cause interference to each other. In the definition of interference of
- a task we want to avoid such situations. That is why we use the term [~~ task_scheduled_at tsk t].
-
- Moreover, in order to make the definition constructive, we introduce an upper
- bound on the arrival time of jobs from task tsk. As a result, we need to consider only a finite
- number of jobs. For the function to produce the correct values it is enough to specify
- a sufficiently large upper_bound. Usually as upper_bound one can use the end
- of the corresponding busy interval. *)
- Definition task_interference_received_before (tsk: Task) (upper_bound: time) (t: time) :=
- (~~ task_scheduled_at tsk t)
- && has (fun j => interference j t) (arrivals_of_task_before tsk upper_bound).
-
- (* Next we define the cumulative task interference. *)
- Definition cumul_task_interference tsk upper_bound t1 t2 :=
- \sum_(t1 <= t < t2) task_interference_received_before tsk upper_bound t.
-
- (* We say that task interference is bounded by task_interference_bound_function (tIBF)
- iff for any job j of task tsk cumulative _task_ interference within the interval
- [t1, t1 + R) is bounded by function tIBF(tsk, A, R).
- Note that this definition is almost the same as the definition of job_interference_is_bounded_by
- from the non-nesessary-sequential case. However, in this case we ignore the
- interference that comes from jobs from the same task. *)
- Definition task_interference_is_bounded_by (task_interference_bound_function: Task -> time -> time -> time) :=
- forall j R t1 t2,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- t1 + R < t2 ->
- ~~ job_completed_by j (t1 + R) ->
- busy_interval j t1 t2 ->
- let offset := job_arrival j - t1 in
- cumul_task_interference tsk t2 t1 (t1 + R) <= task_interference_bound_function tsk offset R.
-
- End Definitions.
-
- (* In this section, we prove that the maximum among the solutions of the
- response-time bound recurrence is a response-time bound for tsk. *)
- Section ResponseTimeBound.
-
- (* For simplicity, let's define some local names. *)
- Let cumul_interference := cumul_interference interference.
- Let cumul_workload := cumul_interfering_workload interfering_workload.
- Let cumul_task_interference := cumul_task_interference tsk.
-
- (* We assume that the schedule is work-conserving. *)
- Hypothesis H_work_conserving: work_conserving interference interfering_workload.
-
- (* Unlike the previous theorem [uniprocessor_response_time_bound], we assume
- that (1) jobs are sequential, moreover (2) functions interference and
- interfering_workload are consistent with the hypothesis of sequential jobs. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
- Hypothesis H_interference_and_workload_consistent_with_sequential_jobs:
- interference_and_workload_consistent_with_sequential_jobs.
-
- (* Assume we have a constant L which bounds the busy interval of any of tsk's jobs. *)
- Variable L: time.
- Hypothesis H_busy_interval_exists: busy_intervals_are_bounded_by interference interfering_workload L.
-
- (* Next, we assume that task_interference_bound_function is a bound on interference incurred by the task. *)
- Variable task_interference_bound_function: Task -> time -> time -> time.
- Hypothesis H_task_interference_is_bounded: task_interference_is_bounded_by task_interference_bound_function.
-
- (* Given any job j of task tsk that arrives exactly A units after the beginning of the busy
- interval, the bound on the total interference incurred by j within an interval of length Δ
- is no greater than [task_rbf (A + ε) - task_cost tsk + task's IBF Δ]. Note that in case of
- sequential jobs the bound consists of two parts: (1) the part that bounds the interference
- received from other jobs of task tsk -- [task_rbf (A + ε) - task_cost tsk] and (2) any other
- interferece that is bounded by task_IBF(tsk, A, Δ). *)
- Let total_interference_bound tsk A Δ :=
- task_rbf (A + ε) - task_cost tsk + task_interference_bound_function tsk A Δ.
-
- (* Note that since we consider the modified interference bound function, the search space has
- also changed. One can see that the new search space is guaranteed to include any A for which
- [task_rbf (A) ≠task_rbf (A + ε)], since this implies the fact that
- [total_interference_bound (tsk, A, Δ) ≠total_interference_bound (tsk, A + ε, Δ)]. *)
- Let is_in_search_space_seq := is_in_search_space tsk L total_interference_bound.
-
- (* Consider any value R, and assume that for any relative arrival time A from the search
- space there is a solution F of the response-time recurrence that is bounded by R. In
- contrast to the formula in "non-sequential" Abstract RTA, assuming that jobs are
- sequential leads to a more precise response-time bound. Now we can explicitly express
- the interference caused by other jobs of the task under consideration.
-
- To understand the right part of the fixpoint in the equation it is helpful to note
- that the bound on the total interference (bound_of_total_interference) is equal to
- [task_rbf (A + ε) - task_cost tsk + tIBF tsk A Δ]. Besides, a job must receive
- enough service to become non-preemptive [task_lock_in_service tsk]. The sum of
- these two quantities is exactly the right-hand side of the equation. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum_seq:
- forall A,
- is_in_search_space_seq A ->
- exists F,
- A + F = (task_rbf (A + ε) - (task_cost tsk - task_lock_in_service tsk))
- + task_interference_bound_function tsk A (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
-
- (* In this section we prove a few simple lemmas about the completion of jobs from the task
- considering the busy interval of the job under consideration. *)
- Section CompletionOfJobsFromSameTask.
-
- (* Consider any two jobs j1 j2 of tsk. *)
- Variable j1 j2: Job.
- Hypothesis H_j1_arrives: arrives_in arr_seq j1.
- Hypothesis H_j2_arrives: arrives_in arr_seq j2.
- Hypothesis H_j1_from_tsk: job_task j1 = tsk.
- Hypothesis H_j2_from_tsk: job_task j2 = tsk.
- Hypothesis H_j1_cost_positive: job_cost_positive job_cost j1.
-
- (* Consider the busy interval [t1, t2) of job j1. *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval: busy_interval j1 t1 t2.
-
- (* We prove that if a job from task tsk arrived before the beginning of the busy
- interval, then it must be completed before the beginning of the busy interval *)
- Lemma completed_before_beginning_of_busy_interval:
- job_arrival j2 < t1 ->
- completed_by job_cost sched j2 t1.
- Proof.
- move => JA; move: (H_j2_from_tsk) => /eqP TSK2eq.
- move: (posnP (job_cost j2)) => [ZERO|POS].
- { by rewrite /is_response_time_bound_of_job /completed_by ZERO. }
- move: (H_interference_and_workload_consistent_with_sequential_jobs
- j1 t1 t2 H_j1_arrives H_j1_from_tsk H_j1_cost_positive H_busy_interval) => SWEQ.
- eapply all_jobs_have_completed_equiv_workload_eq_service
- with (j := j2) in SWEQ; eauto 2; try done.
- by apply arrived_between_implies_in_arrivals with job_arrival.
- Qed.
-
- (* Next we prove that if a job is pending after the beginning
- of the busy interval [t1, t2) then it arrives after t1 . *)
- Lemma arrives_after_beginning_of_busy_interval:
- forall t,
- t1 <= t ->
- job_pending_at j2 t ->
- arrived_between job_arrival j2 t1 t.+1.
- Proof.
- intros t GE PEND.
- rewrite /arrived_between; apply/andP; split; last first.
- { by move: PEND => /andP [ARR _]; rewrite ltnS. }
- rewrite leqNgt; apply/negP; intros LT.
- move: (H_busy_interval) => [[/andP [AFR1 AFR2] [QT _]] _].
- have L12 := completed_before_beginning_of_busy_interval.
- feed L12; try done.
- apply completion_monotonic with (t' := t) in L12; try done.
- by move: PEND => /andP [_ /negP H2].
- Qed.
-
- End CompletionOfJobsFromSameTask.
-
- (* Since we are going to use the [uniprocessor_response_time_bound] theorem to prove
- the theorem of this section, we have to show that all the hypotheses are satisfied.
- Namely, we need to show that hypotheses [H_sequential_jobs, H_i_w_are_task_consistent
- and H_task_interference_is_bounded_by] imply [H_job_interference_is_bounded], and the
- fact that [H_R_is_maximum_seq] implies [H_R_is_maximum]. *)
-
- (* In this section we show that there exists a bound for cumulative interference for any
- job of task tsk, i.e., the hypothesis H_job_interference_is_bounded holds. *)
- Section BoundOfCumulativeJobInterference.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* Consider the busy interval [t1, t2) of job j. *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval: busy_interval j t1 t2.
-
- (* Let's define A as a relative arrival time of job j (with respect to time t1). *)
- Let A := job_arrival j - t1.
-
- (* Consider an arbitrary time x... *)
- Variable x: time.
- (* ...such that (t1 + x) is inside the busy interval... *)
- Hypothesis H_inside_busy_interval: t1 + x < t2.
- (* ... and job j is not completed by time (t1 + x). *)
- Hypothesis H_job_j_is_not_completed: ~~ job_completed_by j (t1 + x).
-
- (* We start by proving that the cumulative interference incurred by job j is bounded by the sum of
- the task workload on the interval [t1, t1 + A] and the cumulative interference of j's task. *)
- Lemma bound_for_cumulative_job_interference_actual:
- cumul_interference j t1 (t1 + x) <=
- (task_workload_between t1 (t1 + A + ε) - job_cost j) + cumul_task_interference t2 t1 (t1 + x).
- Proof.
- set (y := t1 + x) in *.
- have IN: j \in arrivals_between t1 (t1 + A + ε).
- { eapply arrived_between_implies_in_arrivals; eauto 2.
- move: (H_busy_interval) => [[/andP [GE _] [_ _]] _].
- by apply/andP; split; last rewrite /A subnKC // addn1.
- }
- have Fact1:
- task_service_of_jobs_received_in job_task arr_seq sched tsk t1 (t1 + A + ε) t1 y
- - service_during sched j t1 y <=
- task_workload_between t1 (t1 + A + ε) - job_cost j.
- { rewrite /task_workload /task_service_of_jobs_received_in /service_of_jobs /workload_of_jobs.
- rewrite (big_rem j) ?[X in _ <= X - _](big_rem j) //=.
- rewrite H_job_of_tsk eq_refl.
- rewrite addnC -addnBA; last by done.
- rewrite [X in _ <= X - _]addnC -addnBA; last by done.
- rewrite !subnn !addn0.
- by apply service_of_jobs_le_workload.
- }
- apply leq_trans with (
- task_service_of_jobs_received_in job_task arr_seq sched tsk t1 (t1+A+ε) t1 y
- - service_during sched j t1 y
- + cumul_task_interference t2 t1 y); [clear Fact1 | by rewrite leq_add2r].
- rewrite /cumul_interference /cumul_interference
- /task_service_of_jobs_received_in /service_of_jobs /service_during exchange_big //=
- /cumul_task_interference /Sequential_Abstract_RTA.cumul_task_interference.
- rewrite -(leq_add2r (\sum_(t1 <= t < y) service_at sched j t)).
- rewrite [X in _ <= X]addnC addnA subnKC; last first.
- { by rewrite exchange_big //= (big_rem j) //= H_job_of_tsk eq_refl leq_addr. }
- rewrite -big_split -big_split //=.
- rewrite big_nat_cond [X in _ <= X]big_nat_cond leq_sum //; move => t /andP [NEQ _].
- have Fact1:
- service_at sched j t <= \sum_(i0 <- arrivals_between t1 (t1 + A + ε) | job_task i0 == tsk) service_at sched i0 t.
- { by rewrite (big_rem j) // H_job_of_tsk eq_refl leq_addr. }
- unfold task_scheduled_at, ScheduleOfTask.task_scheduled_at.
- case SCHEDt: (sched t) => [s | ]; last first.
- { rewrite {1}/service_at {1}/scheduled_at SCHEDt; simpl; rewrite addn0.
- case INT: (interference j t); last by done.
- apply leq_trans with (task_interference_received_before tsk t2 t); last by rewrite leq_addl.
- rewrite lt0b.
- rewrite /task_interference_received_before /task_scheduled_at /ScheduleOfTask.task_scheduled_at SCHEDt; simpl.
- apply/hasP; exists j; last by done.
- rewrite /arrivals_of_task_before mem_filter; apply/andP; split.
- - by rewrite /is_job_of_task H_job_of_tsk.
- - move: (H_busy_interval) => [[/andP [_ LT] [_ _]] _].
- by eapply arrived_between_implies_in_arrivals; eauto.
- }
- have ARRs: arrives_in arr_seq s.
- { by apply H_jobs_come_from_arrival_sequence with t; apply/eqP. }
- case TSK: (job_task s == tsk); last first.
- { have ZERO: service_at sched j t = 0.
- { rewrite /service_at /scheduled_at SCHEDt.
- apply/eqP; rewrite eqb0; apply/negP.
- intros FALSE; move: FALSE => /eqP FALSE; inversion FALSE; subst s.
- by move: TSK => /eqP TSK; apply TSK.
- }
- rewrite ZERO; clear ZERO.
- have ZERO: \sum_(i <- arrivals_between t1 (t1 + A + ε) | job_task i == tsk) service_at sched i t = 0.
- { rewrite /service_at /scheduled_at SCHEDt.
- apply big1; move => k /eqP TSK2.
- apply/eqP; rewrite eqb0; apply/negP.
- intros FALSE; move: FALSE => /eqP FALSE; inversion FALSE; subst s.
- by move: TSK => /eqP TSK; apply TSK.
- }
- rewrite ZERO; clear ZERO.
- rewrite addn0 add0n.
- rewrite /task_interference_received_before /task_scheduled_at /ScheduleOfTask.task_scheduled_at.
- rewrite SCHEDt TSK; simpl.
- case INT: (interference j t); last by done.
- rewrite lt0b.
- apply/hasP; exists j; last by done.
- rewrite /arrivals_of_task_before mem_filter; apply/andP; split.
- - by rewrite /is_job_of_task H_job_of_tsk.
- - move: (H_busy_interval) => [[/andP [_ LT] [_ _]] _].
- by eapply arrived_between_implies_in_arrivals; eauto.
- }
- { rewrite /task_interference_received_before /task_scheduled_at /ScheduleOfTask.task_scheduled_at SCHEDt TSK.
- simpl; rewrite addn0.
- case EQ: (j == s).
- { move: EQ => /eqP EQ; subst s.
- move: (H_work_conserving j t1 t2 t H_j_arrives H_job_of_tsk H_job_cost_positive H_busy_interval) => WORK.
- feed WORK.
- { by move: NEQ => /andP [NEQ1 NEQ2]; apply/andP; split; last apply ltn_trans with y. }
- move: WORK => [_ ZIJT].
- feed ZIJT; first by rewrite /scheduled_at SCHEDt.
- move: ZIJT => /negP /eqP; rewrite eqb_negLR; simpl; move => /eqP ZIJT.
- rewrite ZIJT; simpl; rewrite add0n.
- by done.
- }
- { have NSCHED: scheduled_at sched j t = false.
- { apply/negP; intros SCHED.
- move: SCHEDt => /eqP SCHEDt.
- move: (only_one_job_scheduled sched j s t SCHED SCHEDt) => EQjs.
- by rewrite EQjs eq_refl in EQ.
- }
- rewrite /service_at NSCHED.
- have IJT: interference j t = true.
- { have NEQT: t1 <= t < t2.
- { move: NEQ => /andP [NEQ1 NEQ2].
- apply/andP; split; first by done.
- by apply ltn_trans with y.
- }
- move: (H_work_conserving j t1 t2 t H_j_arrives H_job_of_tsk H_job_cost_positive H_busy_interval NEQT) => [Hn _].
- apply/negPn/negP; intros CONTR; move: CONTR => /negP CONTR.
- by apply Hn in CONTR; rewrite NSCHED in CONTR.
- }
- rewrite IJT; clear IJT.
- simpl. rewrite addn0.
- rewrite big_mkcond sum_nat_gt0 filter_predT; apply/hasP.
- exists s.
- { intros. have ARR:= arrives_after_beginning_of_busy_interval j s _ _ _ _ _ t1 t2 _ t.
- feed_n 8 ARR; try done.
- { by move: TSK => /eqP TSK; rewrite TSK. }
- { by move: NEQ => /andP [T1 T2]. }
- { by move: SCHEDt => /eqP SCHEDt; apply scheduled_implies_pending. }
- case ARRNEQ: (job_arrival s <= job_arrival j).
- { move: ARR => /andP [Ð Ð _].
- unfold arrivals_between in *.
- eapply arrived_between_implies_in_arrivals; eauto 2.
- apply/andP; split; first by done.
- rewrite /A subnKC.
- rewrite addn1 ltnS. by done.
- by move: (H_busy_interval) => [[/andP [BUS _] _] _].
- }
- { exfalso.
- apply negbT in ARRNEQ; rewrite -ltnNge in ARRNEQ.
- move: (H_sequential_jobs j s t) => CONTR.
- feed_n 3 CONTR; try done.
- { by rewrite -H_job_of_tsk in TSK; rewrite eq_sym. }
- { by move: SCHEDt => /eqP SCHEDt. }
- move: H_job_j_is_not_completed => /negP H; apply: H.
- apply completion_monotonic with t; try done.
- apply ltnW.
- by move: NEQ => /andP [_ NEQ].
- }
- }
- { move: TSK => /eqP TSK.
- by rewrite TSK eq_refl /service_at /scheduled_at SCHEDt eq_refl.
- }
- }
- }
- Qed.
-
- (* However, in order to obtain a more convenient bound of the cumulative interference,
- we need to abandon the actual workload in favor of a bound which depends on task parameters only.
- So, we show that actual workload of the task excluding workload of any job j is no greater than
- bound of workload excluding the cost of job j's task. *)
- Lemma task_rbf_excl_tsk_bounds_task_workload_excl_j:
- task_workload_between t1 (t1 + A + ε) - job_cost j <= task_rbf (A + ε) - task_cost tsk.
- Proof.
- unfold cost_of_jobs_from_arrival_sequence_le_task_cost, job_cost_le_task_cost in *.
- move: H_j_arrives H_job_of_tsk => ARR TSK.
- move: (H_busy_interval) => [[/andP [JAGET1 JALTT2] _] _].
- apply leq_trans with (
- task_cost tsk *
- num_arrivals_of_task job_task arr_seq tsk t1 (t1 + A + ε) - task_cost tsk); last first.
- { rewrite leq_sub2r //.
- rewrite leq_mul2l; apply/orP; right.
- rewrite -addnA -{2}[(A+1)](addKn t1).
- move: (H_family_of_proper_arrival_curves tsk H_tsk_in_ts) => [ARRB T].
- by apply ARRB; last rewrite leq_addr.
- }
- { have Fact6: j \in arrivals_between (t1 + A) (t1 + A + ε).
- { apply (arrived_between_implies_in_arrivals job_arrival); try(done).
- apply/andP; split; rewrite /A subnKC //.
- by rewrite addn1 ltnSn //.
- }
- have Fact1: num_arrivals_of_task job_task arr_seq tsk (t1 + A) (t1 + A + ε) >= 1.
- { rewrite /num_arrivals_of_task /arrivals_of_task_between.
- rewrite size_filter -has_count; apply/hasP.
- by exists j; last rewrite /is_job_of_task TSK.
- }
- have Fact2: job_cost j <= task_workload_between (t1 + A) (t1 + A + ε).
- { rewrite /task_workload_between /Workload.task_workload_between /task_workload
- /workload_of_jobs /arrivals_between (big_rem j) //=.
- by rewrite TSK eq_refl leq_addr.
- }
- have Fact3: 0 < task_cost tsk.
- { apply leq_trans with (job_cost j); [ |rewrite -H_job_of_tsk]; auto. }
- have Fact4: j \in jobs_arriving_at arr_seq (t1 + A).
- { move: ARR => [t ARR]; rewrite subnKC //.
- by feed (H_arrival_times_are_consistent j t); try (subst t).
- }
- rewrite (@num_arrivals_of_task_cat _ _ _ _ _ (t1 + A)); last by apply/andP; split; rewrite leq_addr //.
- rewrite mulnDr.
- have Step1:
- task_workload_between t1 (t1 + A + ε) = task_workload_between t1 (t1 + A) + task_workload_between (t1 + A) (t1 + A + ε).
- { by apply workload_of_jobs_cat; apply/andP; split; rewrite leq_addr. }
- rewrite Step1; clear Step1.
- rewrite -!addnBA; first last.
- { by apply leq_trans with (job_cost j). }
- { apply leq_trans with (task_cost tsk); first by done.
- by rewrite -{1}[task_cost tsk]muln1 leq_mul2l; apply/orP; right. }
- rewrite leq_add; first by done.
- { rewrite // /num_arrivals_of_task -sum1_size big_distrr /= big_filter.
- rewrite /task_workload_between /Workload.task_workload_between /task_workload /workload_of_jobs.
- rewrite /is_job_of_task -TSK muln1.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- by rewrite -EQ; apply in_arrivals_implies_arrived in IN0; auto.
- }
- { unfold task_workload_between, Workload.task_workload_between,
- task_workload, workload_of_jobs, arrivals_between, jobs_arrived_between.
- rewrite {1}addn1 big_nat1.
- rewrite /num_arrivals_of_task /arrivals_of_task_between /jobs_arrived_between addn1 big_nat1.
- rewrite (big_rem j) //= TSK !eq_refl; simpl.
- rewrite addnC -addnBA; last by done.
- rewrite subnn addn0.
- rewrite (filter_size_rem j); [ | by done | by rewrite /is_job_of_task TSK].
- rewrite mulnDr mulnC muln1 -addnBA; last by done.
- rewrite subnn addn0.
- rewrite mulnC.
- apply sum_majorant_constant.
- move => j' ARR' /eqP TSK2.
- unfold job_cost_le_task_cost in *.
- have ARR2: arrives_in arr_seq j'.
- { by exists (t1 + A); apply rem_in in ARR'. }
- by rewrite -TSK2; auto.
- }
- }
- Qed.
-
- (* Now we can use two lemmas above to get the following bound: *)
- Lemma bound_for_cumulative_job_interference:
- cumul_interference j t1 (t1 + x)
- <= (task_rbf (A + ε) - task_cost tsk) + cumul_task_interference t2 t1 (t1 + x).
- Proof.
- set (y := t1 + x) in *.
- have IN: j \in arrivals_between t1 (t1 + A + ε).
- { eapply arrived_between_implies_in_arrivals; eauto 2.
- move: (H_busy_interval) => [[/andP [GE _] _] _].
- by apply/andP; split; last rewrite /A subnKC // addn1.
- }
- apply leq_trans with (task_workload_between t1 (t1+A+ε) - job_cost j + cumul_task_interference t2 t1 y).
- - by apply bound_for_cumulative_job_interference_actual.
- - rewrite leq_add2r.
- eapply task_rbf_excl_tsk_bounds_task_workload_excl_j; eauto 2.
- Qed.
-
- End BoundOfCumulativeJobInterference.
-
- (* In this section, we prove that [H_R_is_maximum_seq] implies [H_R_is_maximum]. *)
- Section MaxInSeqHypothesisImpMaxInNonseqHypothesis.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* For simplicity, let's define a local name for the search space. *)
- Let is_in_search_space A :=
- is_in_search_space tsk L total_interference_bound A.
-
- (* We prove that [H_R_is_maximum] holds. *)
- Lemma max_in_seq_hypothesis_implies_max_in_nonseq_hypothesis:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = task_lock_in_service tsk +
- (task_rbf (A + ε) - task_cost tsk + task_interference_bound_function tsk A (A + F)) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
- Proof.
- move: H_proper_job_lock_in_service => [PRJ1 [PRJ2 PRJ3]].
- move: H_proper_task_lock_in_service => [PRT1 PRT2].
- intros A INSP.
- clear H_sequential_jobs H_interference_and_workload_consistent_with_sequential_jobs.
- move: (H_R_is_maximum_seq _ INSP) => [F [FIX LE]].
- exists F; split; last by done.
- rewrite {1}FIX.
- apply/eqP.
- rewrite addnA eqn_add2r.
- rewrite addnBA; last first.
- { apply leq_trans with (task_rbf 1).
- eapply rbf.RBF.task_rbf_1_ge_task_cost; eauto 2.
- eapply rbf.RBF.task_rbf_monotone; eauto 2.
- by rewrite addn1. }
- by rewrite subnBA; auto; rewrite addnC.
- Qed.
-
- End MaxInSeqHypothesisImpMaxInNonseqHypothesis.
-
- (* Finally, we apply the [uniprocessor_response_time_bound] theorem, and using the
- lemmas above, we prove that all the requirements are satisfied. So, R is a response
- time bound. *)
- Theorem uniprocessor_response_time_bound_seq:
- response_time_bounded_by tsk R.
- Proof.
- intros j ARR TSK.
- try ( eapply uniprocessor_response_time_bound with
- (interference_bound_function := fun tsk A R => task_rbf (A + ε) - task_cost tsk + task_interference_bound_function tsk A R)
- (interfering_workload0 := interfering_workload); eauto 2 ) ||
- eapply uniprocessor_response_time_bound with
- (interference_bound_function := fun tsk A R => task_rbf (A + ε) - task_cost tsk + task_interference_bound_function tsk A R)
- (interfering_workload := interfering_workload); eauto 2.
- { clear ARR TSK H_R_is_maximum_seq R j.
- intros t1 t2 R j BUSY NEQ ARR TSK COMPL.
- move: (posnP (job_cost j)) => [ZERO|POS].
- { exfalso.
- move: COMPL => /negP COMPL; apply: COMPL.
- by rewrite /is_response_time_bound_of_job /completed_by ZERO.
- }
- set (A := job_arrival j - t1) in *.
- apply leq_trans with
- (task_rbf (A + ε) - task_cost tsk + cumul_task_interference t2 t1 (t1 + R)).
- - by eapply bound_for_cumulative_job_interference; eauto 2.
- - by rewrite leq_add2l; apply H_task_interference_is_bounded.
- }
- { by eapply max_in_seq_hypothesis_implies_max_in_nonseq_hypothesis; eauto. }
- Qed.
-
- End ResponseTimeBound.
-
- End Sequential_Abstract_RTA.
-
-End AbstractSeqRTA.
diff --git a/classic/model/schedule/uni/limited/abstract_RTA/definitions.v b/classic/model/schedule/uni/limited/abstract_RTA/definitions.v
deleted file mode 100644
index 628c6021bb8592dc55535affd9780a82d61ffd48..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/abstract_RTA/definitions.v
+++ /dev/null
@@ -1,224 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.uni.schedule.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Definitions for Abstract Response-Time Analysis *)
-(** In this module, we propose a set of definitions for the general framework for response-time analysis (RTA)
- of uniprocessor scheduling of real-time tasks with arbitrary arrival models. *)
-Module AbstractRTADefinitions.
-
- Import Job UniprocessorSchedule.
-
- (* In this section, we introduce all the abstract notions required by the analysis. *)
- Section Definitions.
-
- Context {Task: eqType}.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ... and any uniprocessor schedule of this arrival sequence. *)
- Variable sched: schedule Job.
-
- (* Let tsk be any task that is to be analyzed *)
- Variable tsk: Task.
-
- (* For simplicity, let's define some local names. *)
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
-
- (* Recall that a job j is pending_earlier_and_at a time instant t iff job
- j arrived before time t and is still not completed by time t. *)
- Let job_pending_earlier_and_at := pending_earlier_and_at job_arrival job_cost sched.
-
- (* We are going to introduce two main variables of the analysis:
- (a) interference, and (b) interfering workload. *)
-
- (** a) Interference *)
- (* Execution of a job may be postponed by the environment and/or the system due to different
- factors (preemption by higher-priority jobs, jitter, black-out periods in hierarchical
- scheduling, lack of budget, etc.), which we call interference.
-
- Besides, note that even the n’th activation of a task can suffer from interference at
- the beggining of its busy interval (despite the fact that this job hasn’t even arrived
- at that moment!). Thus, it makes more sense (at least for the current busy-interval
- analysis) to think about interference of a job as any interference within the
- corresponding busy interval, and not after release of the job.
-
- Based on that, assume a predicate that expresses whether a job j under consideration
- incurs interference at a given time t (in the context of the schedule under consideration).
- This will be used later to upper-bound job j's response time. Note that a concrete
- realization of the function may depend on the schedule, but here we do not require this
- for the sake of simplicity and generality. *)
- Variable interference: Job -> time -> bool.
-
- (** b) Interfering Workload *)
- (* In addition to interference, the analysis assumes that at any time t, we know an upper
- bound on the potential cumulative interference that can be incurred in the future by any
- job (i.e., the total remaining potential delays). Based on that, assume a function
- interfering_workload that indicates for any job j, at any time t, the amount of potential
- interference for job j that is introduced into the system at time t. This function will be
- later used to upper-bound the length of the busy window of a job.
- One example of workload function is the "total cost of jobs that arrive at time t and
- have higher-or-equal priority than job j". In some task models, this function expresses
- the amount of the potential interference on job j that "arrives" in the system at time t. *)
- Variable interfering_workload: Job -> time -> time.
-
- (* In order to bound the response time of a job, we must to consider the cumulative
- interference and cumulative interfering workload. *)
- Definition cumul_interference j t1 t2 := \sum_(t1 <= t < t2) interference j t.
- Definition cumul_interfering_workload j t1 t2 := \sum_(t1 <= t < t2) interfering_workload j t.
-
- (** Definition of Busy Interval *)
- (* Further analysis will be based on the notion of a busy interval. The overall idea of the
- busy interval is to take into account the workload that cause a job under consideration to
- incur interference. In this section, we provide a definition of an abstract busy interval. *)
- Section BusyInterval.
-
- (* We say that time instant t is a quiet time for job j iff two conditions hold.
- First, the cumulative interference at time t must be equal to the cumulative
- interfering workload, to indicate that the potential interference seen so far
- has been fully "consumed" (i.e., there is no more higher-priority work or other
- kinds of delay pending). Second, job j cannot be pending at any time earlier
- than t _and_ at time instant t (i.e., either it was pending earlier but is no
- longer pending now, or it was previously not pending and may or may not be
- released now), to ensure that the busy window captures the execution of job j. *)
- Definition quiet_time (j: Job) (t: time) :=
- cumul_interference j 0 t = cumul_interfering_workload j 0 t /\
- ~~ job_pending_earlier_and_at j t.
-
- (* Based on the definition of quiet time, we say that interval [t1, t2) is
- a (potentially unbounded) busy-interval prefix w.r.t. job j iff the
- interval (a) contains the arrival of job j, (b) starts with a quiet
- time and (c) remains non-quiet. *)
- Definition busy_interval_prefix (j: Job) (t1 t2: time) :=
- t1 <= job_arrival j < t2 /\
- quiet_time j t1 /\
- (forall t, t1 < t < t2 -> ~ quiet_time j t).
-
- (* Next, we say that an interval [t1, t2) is a busy interval iff
- [t1, t2) is a busy-interval prefix and t2 is a quiet time. *)
- Definition busy_interval (j: Job) (t1 t2: time) :=
- busy_interval_prefix j t1 t2 /\
- quiet_time j t2.
-
- (* Note that the busy interval, if it exists, is unique. *)
- Lemma busy_interval_is_unique:
- forall j t1 t2 t1' t2',
- busy_interval j t1 t2 ->
- busy_interval j t1' t2' ->
- t1 = t1' /\ t2 = t2'.
- Proof.
- intros ? ? ? ? ? BUSY BUSY'.
- have EQ: t1 = t1'.
- { apply/eqP.
- apply/negPn/negP; intros CONTR.
- move: BUSY => [[IN [QT1 NQ]] _].
- move: BUSY' => [[IN' [QT1' NQ']] _].
- move: CONTR; rewrite neq_ltn; move => /orP [LT|GT].
- { apply NQ with t1'; try done; clear NQ.
- apply/andP; split; first by done.
- move: IN IN' => /andP [_ T1] /andP [T2 _].
- by apply leq_ltn_trans with (job_arrival j).
- }
- { apply NQ' with t1; try done; clear NQ'.
- apply/andP; split; first by done.
- move: IN IN' => /andP [T1 _] /andP [_ T2].
- by apply leq_ltn_trans with (job_arrival j).
- }
- }
- subst t1'.
- have EQ: t2 = t2'.
- { apply/eqP.
- apply/negPn/negP; intros CONTR.
- move: BUSY => [[IN [_ NQ]] QT2].
- move: BUSY' => [[IN' [_ NQ']] QT2'].
- move: CONTR; rewrite neq_ltn; move => /orP [LT|GT].
- { apply NQ' with t2; try done; clear NQ'.
- apply/andP; split; last by done.
- move: IN IN' => /andP [_ T1] /andP [T2 _].
- by apply leq_ltn_trans with (job_arrival j).
- }
- { apply NQ with t2'; try done; clear NQ.
- apply/andP; split; last by done.
- move: IN IN' => /andP [T1 _] /andP [_ T2].
- by apply leq_ltn_trans with (job_arrival j).
- }
- }
- subst t2'.
- by done.
- Qed.
-
- End BusyInterval.
-
- (* In this section, we introduce some assumptions about the
- busy interval that are fundamental for the analysis. *)
- Section BusyIntervalProperties.
-
- (* We say that a schedule is "work_conserving" iff for any job j from task tsk and
- at any time t within a busy interval, there are only two options:
- either (a) interference(j, t) holds or (b) job j is scheduled at time t. *)
- Definition work_conserving :=
- forall j t1 t2 t,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_cost j > 0 ->
- busy_interval j t1 t2 ->
- t1 <= t < t2 ->
- ~ interference j t <-> job_scheduled_at j t.
-
- (* Next, we say that busy intervals of task tsk are bounded by L iff, for any job j of task
- tsk, there exists a busy interval with length at most L. Note that the existence of such a
- bounded busy interval is not guaranteed if the schedule is overloaded with work.
- Therefore, in the later concrete analyses, we will have to introduce an additional
- condition that prevents overload. *)
- Definition busy_intervals_are_bounded_by L :=
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_cost j > 0 ->
- exists t1 t2,
- t1 <= job_arrival j < t2 /\
- t2 <= t1 + L /\
- busy_interval j t1 t2.
-
- (* Although we have defined the notion of cumulative interference of a job, it is still hard to be
- used in a response-time analysis because of the variability of job parameters. To address this
- issue, we define the notion of an interference bound. Note that according to the definition of
- a work conserving schedule, interference does _not_ include execution of a job itself. Therefore,
- an interference bound is not obliged to take into account the execution of this job. We say that
- the job interference is bounded by an interference_bound_function (IBF) iff for any job j of
- task tsk the cumulative interference incurred by j in the subinterval [t1, t1 + delta) of busy
- interval [t1, t2) does not exceed interference_bound_function(tsk, A, delta), where A is a
- relative arrival time of job j (with respect to time t1).
- Let's examine this definition in more detail. First, the IBF bounds the interference only
- within the interval [t1, t1 + delta) (see a.1, a.2 below). Second, the IBF bounds the
- interference only until the job is completed, after which the function can behave
- arbitrarily (see b). And finally, the IBF function might depend not only on the length
- of the interval, but also on the relative arrival time of job j (see c).
- While (a.1), (a.2) and (b) are useful for discarding excessive cases, (c) adds
- flexibility to the IBF, which is important, for instance, when analyzing EDF scheduling. *)
- Definition job_interference_is_bounded_by (interference_bound_function: Task -> time -> time -> time) :=
- forall t1 t2 delta j,
- busy_interval j t1 t2 -> (* (a.1) *)
- t1 + delta < t2 -> (* (a.2) *)
- arrives_in arr_seq j ->
- job_task j = tsk ->
- ~~ job_completed_by j (t1 + delta) -> (* (b) *)
- let offset := job_arrival j - t1 in
- cumul_interference j t1 (t1 + delta) <= interference_bound_function tsk offset delta (* (c) *).
-
- End BusyIntervalProperties.
-
- End Definitions.
-
-End AbstractRTADefinitions.
-
-
\ No newline at end of file
diff --git a/classic/model/schedule/uni/limited/abstract_RTA/reduction_of_search_space.v b/classic/model/schedule/uni/limited/abstract_RTA/reduction_of_search_space.v
deleted file mode 100644
index df6228d24cb6d6a49dd654456881743d2cf7a1da..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/abstract_RTA/reduction_of_search_space.v
+++ /dev/null
@@ -1,172 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.uni.schedule.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Reduction of the serach space for Abstract RTA *)
-(** In this module, we prove that in order to calculate the worst-case response time
- it is sufficient to consider only values of A that lie in the search space defined below. *)
-
-Module AbstractRTAReduction.
-
- Import UniprocessorSchedule.
-
- (* The response-time analysis we are presenting in this series of documents is based on searching
- over all possible values of A, the relative arrival time of the job respective to the beginning
- of the busy interval. However, to obtain a practically useful response-time bound, we need to
- constrain the search space of values of A. In this section, we define an approach to
- reduce the search space. *)
- Section SearchSpace.
-
- Context {Task: eqType}.
-
- (* First, we provide a constructive notion of equivalent functions. *)
- Section EquivalentFunctions.
-
- (* Consider an arbitrary type T... *)
- Context {T: eqType}.
-
- (* ...and two function from nat to T. *)
- Variables f1 f2: nat -> T.
-
- (* Let B be an arbitrary constant. *)
- Variable B: nat.
-
- (* Then we say that f1 and f2 are equivalent at values less than B iff
- for any natural number x less than B [f1 x] is equal to [f2 x]. *)
- Definition are_equivalent_at_values_less_than :=
- forall x, x < B -> f1 x = f2 x.
-
- (* And vice versa, we say that f1 and f2 are not equivalent at values
- less than B iff there exists a natural number x less than B such
- that [f1 x] is not equal to [f2 x]. *)
- Definition are_not_equivalent_at_values_less_than :=
- exists x, x < B /\ f1 x <> f2 x.
-
- End EquivalentFunctions.
-
- (* Let tsk be any task that is to be analyzed *)
- Variable tsk: Task.
-
- (* To ensure that the analysis procedure terminates, we assume an upper bound B on
- the values of A that must be checked. The existence of B follows from the assumption
- that the system is not overloaded (i.e., it has bounded utilization). *)
- Variable B: time.
-
- (* Instead of searching for the maximum interference of each individual job, we
- assume a per-task interference bound function [IBF(tsk, A, x)] that is parameterized
- by the relative arrival time A of a potential job (see abstract_RTA.definitions.v file). *)
- Variable interference_bound_function: Task -> time -> time -> time.
-
- (* Recall the definition of ε, which defines the neighborhood of a point in the timeline.
- Note that epsilon = 1 under discrete time. *)
- (* To ensure that the search converges more quickly, we only check values of A in the interval
- [0, B) for which the interference bound function changes, i.e., every point x in which
- interference_bound_function (A - ε, x) is not equal to interference_bound_function (A, x). *)
- Definition is_in_search_space A :=
- A = 0 \/
- 0 < A < B /\ are_not_equivalent_at_values_less_than
- (interference_bound_function tsk (A - ε)) (interference_bound_function tsk A) B.
-
- (* In this section we prove that for every A there exists a smaller A_sp
- in the search space such that interference_bound_function(A_sp,x) is
- equal to interference_bound_function(A, x). *)
- Section ExistenceOfRepresentative.
-
- (* Let A be any constant less than B. *)
- Variable A: time.
- Hypothesis H_A_less_than_B: A < B.
-
- (* We prove that there exists a constant A_sp such that:
- (a) A_sp is no greater than A, (b) interference_bound_function(A_sp, x) is
- equal to interference_bound_function(A, x) and (c) A_sp is in the search space.
- In other words, either A is already inside the search space, or we can go
- to the "left" until we reach A_sp, which will be inside the search space. *)
- Lemma representative_exists:
- exists A_sp,
- A_sp <= A /\
- are_equivalent_at_values_less_than (interference_bound_function tsk A)
- (interference_bound_function tsk A_sp) B /\
- is_in_search_space A_sp.
- Proof.
- induction A as [|n].
- - exists 0; repeat split.
- by rewrite /is_in_search_space; left.
- - have ALT:
- all (fun t => interference_bound_function tsk n t == interference_bound_function tsk n.+1 t) (iota 0 B)
- \/ has (fun t => interference_bound_function tsk n t != interference_bound_function tsk n.+1 t) (iota 0 B).
- { apply/orP.
- rewrite -[_ || _]Bool.negb_involutive Bool.negb_orb.
- apply/negP; intros CONTR.
- move: CONTR => /andP [NALL /negP NHAS]; apply: NHAS.
- by rewrite -has_predC /predC in NALL.
- }
- feed IHn; first by apply ltn_trans with n.+1.
- move: IHn => [ASP [NEQ [EQ SP]]].
- move: ALT => [/allP ALT| /hasP ALT].
- { exists ASP; repeat split; try done.
- { by apply leq_trans with n. }
- { intros x LT.
- move: (ALT x) => T. feed T; first by rewrite mem_iota; apply/andP; split.
- move: T => /eqP T.
- by rewrite -T EQ.
- }
- }
- { exists n.+1; repeat split; try done.
- rewrite /is_in_search_space; right.
- split; first by apply/andP; split.
- move: ALT => [y IN N].
- exists y.
- move: IN; rewrite mem_iota add0n. move => /andP [_ LT].
- split; first by done.
- rewrite subn1 -pred_Sn.
- intros CONTR; move: N => /negP N; apply: N.
- by rewrite CONTR.
- }
- Qed.
-
- End ExistenceOfRepresentative.
-
- (* In this section we prove that any solution of the response-time recurrence for
- a given point A_sp in the search space also gives a solution for any point
- A that shares the same interference bound. *)
- Section FixpointSolutionForAnotherA.
-
- (* Suppose A_sp + F_sp is a "small" solution (i.e. less than B) of the response-time recurrence. *)
- Variables A_sp F_sp: time.
- Hypothesis H_less_than: A_sp + F_sp < B.
- Hypothesis H_fixpoint: A_sp + F_sp = interference_bound_function tsk A_sp (A_sp + F_sp).
-
- (* Next, let A be any point such that: (a) A_sp <= A <= A_sp + F_sp and
- (b) interference_bound_function(A, x) is equal to
- interference_bound_function(A_sp, x) for all x less than B. *)
- Variable A: time.
- Hypothesis H_bounds_for_A: A_sp <= A <= A_sp + F_sp.
- Hypothesis H_equivalent:
- are_equivalent_at_values_less_than
- (interference_bound_function tsk A)
- (interference_bound_function tsk A_sp) B.
-
- (* We prove that there exists a consant F such that [A + F] is equal to [A_sp + F_sp]
- and [A + F] is a solution for the response-time recurrence for A. *)
- Lemma solution_for_A_exists:
- exists F,
- A_sp + F_sp = A + F /\
- F <= F_sp /\
- A + F = interference_bound_function tsk A (A + F).
- Proof.
- move: H_bounds_for_A => /andP [NEQ1 NEQ2].
- set (X := A_sp + F_sp) in *.
- exists (X - A); split; last split.
- - by rewrite subnKC.
- - by rewrite leq_subLR /X leq_add2r.
- - by rewrite subnKC // H_equivalent.
- Qed.
-
- End FixpointSolutionForAnotherA.
-
- End SearchSpace.
-
-End AbstractRTAReduction.
-
diff --git a/classic/model/schedule/uni/limited/abstract_RTA/sufficient_condition_for_lock_in_service.v b/classic/model/schedule/uni/limited/abstract_RTA/sufficient_condition_for_lock_in_service.v
deleted file mode 100644
index b431715d74244fbad239c3feb9072f3de662e6a6..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/abstract_RTA/sufficient_condition_for_lock_in_service.v
+++ /dev/null
@@ -1,242 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.abstract_RTA.definitions.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Lock-in service of a job *)
-(** In this module, we provide a sufficient condition under which a job
- receives enough service to become nonpreemptive. *)
-Module AbstractRTALockInService.
-
- Import Job UniprocessorSchedule Service AbstractRTADefinitions.
-
- (* Previously we defined the notion of lock-in service (see limited.schedule.v file).
- Lock-in service is the amount of service after which a job cannot be preempted until
- its completion. In this section we prove that if cumulative interference inside a
- busy interval is bounded by a certain constant then a job executes long enough to
- reach its lock-in service and become nonpreemptive. *)
- Section LockInService.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence. *)
- Variable sched: schedule Job.
-
- (* Assume that the job costs are no larger than the task costs. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Let tsk be any task that is to be analyzed. *)
- Variable tsk: Task.
-
- (* Assume we are provided with abstract functions for interference and interfering workload. *)
- Variable interference: Job -> time -> bool.
- Variable interfering_workload: Job -> time -> time.
-
- (* For simplicity, let's define some local names. *)
- Let work_conserving := work_conserving job_arrival job_cost job_task arr_seq sched tsk.
- Let cumul_interference := cumul_interference interference.
- Let cumul_interfering_workload := cumul_interfering_workload interfering_workload.
- Let busy_interval := busy_interval job_arrival job_cost sched interference interfering_workload.
-
- (* We assume that the schedule is work-conserving. *)
- Hypothesis H_work_conserving: work_conserving interference interfering_workload.
-
- (* Let j be any job of task tsk with positive job cost. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* Next, consider any busy interval [t1, t2) of job j. *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval: busy_interval j t1 t2.
-
- (* First, we prove that job j completes by the end of the busy interval.
- Note that the busy interval contains the execution of job j, in addition
- time instant t2 is a quiet time. Thus by the definition of a quiet time
- the job should be completed before time t2. *)
- Lemma job_completes_within_busy_interval:
- completed_by job_cost sched j t2.
- Proof.
- move: (H_busy_interval) => [[/andP [_ LT] [_ _]] [_ QT2]].
- unfold pending, has_arrived in QT2.
- move: QT2; rewrite /pending negb_and; move => /orP [QT2|QT2].
- { by move: QT2 => /negP QT2; exfalso; apply QT2, ltnW. }
- by rewrite Bool.negb_involutive in QT2.
- Qed.
-
- (* In this section we show that the cumulative interference is a complement to
- the total time where job j is scheduled inside the busy interval. *)
- Section InterferenceIsComplement.
-
- (* Consider any subinterval [t, t + delta) inside the busy interval [t1, t2). *)
- Variable t delta: time.
- Hypothesis H_greater_than_or_equal: t1 <= t.
- Hypothesis H_less_or_equal: t + delta <= t2.
-
- (* We prove that sum of cumulative service and cumulative interference
- in the interval [t, t + delta) is equal to delta. *)
- Lemma interference_is_complement_to_schedule:
- service_during sched j t (t + delta) + cumul_interference j t (t + delta) = delta.
- Proof.
- rewrite /service_during /cumul_interference.
- rewrite -big_split //=.
- rewrite -{2}(sum_of_ones t delta).
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- - rewrite [X in X <= _]big_nat_cond [X in _ <= X]big_nat_cond.
- apply leq_sum; move => x /andP [/andP [GE2 LT2] _ ].
- case IJX: (interference j x); last by rewrite addn0 /service_at; case scheduled_at.
- rewrite addn1 ltnNge; apply/negP; intros CONTR.
- specialize (H_work_conserving j t1 t2 x).
- feed_n 5 H_work_conserving; try done.
- { apply/andP; split.
- apply leq_trans with t; try done.
- apply leq_trans with (t + delta); try done.
- }
- move: H_work_conserving => [H1 H2].
- feed H2. rewrite lt0b in CONTR. by done.
- by rewrite IJX in H2.
- - rewrite [X in X <= _]big_nat_cond [X in _ <= X]big_nat_cond.
- apply leq_sum; move => x /andP [/andP [GE2 LT2] _ ].
- case IJX: (interference j x); first by rewrite addn1.
- rewrite addn0.
- specialize (H_work_conserving j t1 t2 x); feed_n 5 H_work_conserving; try done.
- { apply/andP; split.
- apply leq_trans with t; try done.
- apply leq_trans with (t + delta); try done. }
- move: H_work_conserving => [H1 H2].
- feed H1; first by rewrite IJX.
- by rewrite lt0b.
- Qed.
-
- End InterferenceIsComplement.
-
- (* In this section, we prove a sufficient condition under which job j receives enough service. *)
- Section InterferenceBoundedImpliesEnoughService.
-
- (* Let progress_of_job be the desired service of job j. *)
- Variable progress_of_job: time.
- Hypothesis H_progress_le_job_cost: progress_of_job <= job_cost j.
-
- (* Assume that for some delta, the sum of desired progress and cumulative
- interference is bounded by delta (i.e., the supply). *)
- Variable delta: time.
- Hypothesis H_total_workload_is_bounded:
- progress_of_job + cumul_interference j t1 (t1 + delta) <= delta.
-
- (* Then, it must be the case that the job has received no less service than progress_of_job. *)
- Theorem j_receives_at_least_lock_in_service:
- service sched j (t1 + delta) >= progress_of_job.
- Proof.
- case NEQ: (t1 + delta <= t2); last first.
- { intros.
- have L8 := job_completes_within_busy_interval.
- apply leq_trans with (job_cost j); first by done.
- rewrite /service.
- rewrite (service_during_cat _ _ t2).
- apply leq_trans with (service_during sched j 0 t2); [by done | by rewrite leq_addr].
- by apply/andP; split; last (apply negbT in NEQ; apply ltnW; rewrite ltnNge).
- }
- { move: H_total_workload_is_bounded => BOUND.
- rewrite addnC in BOUND; apply leq_subRL_impl in BOUND.
- apply leq_trans with (delta - cumul_interference j t1 (t1 + delta)); first by done.
- apply leq_trans with (service_during sched j t1 (t1 + delta)).
- { rewrite -{1}[delta](interference_is_complement_to_schedule t1) //.
- rewrite -addnBA // subnn addn0 //.
- }
- { unfold service.
- rewrite [X in _ <= X](service_during_cat _ _ t1).
- rewrite leq_addl //.
- by apply/andP; split; last rewrite leq_addr.
- }
- }
- Qed.
-
- End InterferenceBoundedImpliesEnoughService.
-
- (* In this section we prove a simple lemma about completion of
- a job after is reaches lock-in service. *)
- Section CompletionOfJobAfterLockInService.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Consider a proper job lock-in service function, i.e... *)
- Variable job_lock_in_service: Job -> time.
-
- (* ...(1) for any job j the lock-in service of job j is positive... *)
- Hypothesis H_lock_in_service_positive:
- job_lock_in_service_positive job_cost arr_seq job_lock_in_service.
-
- (* ...(2) it also less-than-or-equal to the job_cost... *)
- Hypothesis H_lock_in_service_le_job_cost:
- job_lock_in_service_le_job_cost job_cost arr_seq job_lock_in_service.
-
- (* ..., and (3) we assume that the scheduler respects the notion of the lock-in service. *)
- Hypothesis H_job_nonpreemptive_after_lock_in_service:
- job_nonpreemptive_after_lock_in_service job_cost arr_seq sched job_lock_in_service.
-
- (* Then, job j must complete in [job_cost j - job_lock_in_service j] time
- units after it reaches lock-in service. *)
- Lemma job_completes_after_reaching_lock_in_service:
- forall t,
- job_lock_in_service j <= service sched j t ->
- completed_by job_cost sched j (t + (job_cost j - job_lock_in_service j)).
- Proof.
- move => t ES.
- set (job_cost j - job_lock_in_service j) as job_last.
- move: (H_job_nonpreemptive_after_lock_in_service j t) => LSNP.
- apply negbNE; apply/negP; intros CONTR.
- have SCHED: forall t', t <= t' <= t + job_last -> scheduled_at sched j t'.
- { move => t' /andP [GE LT].
- rewrite -[t'](@subnKC t) //.
- apply LSNP; [ by apply H_j_arrives | by rewrite leq_addr | by done | ].
- rewrite subnKC //.
- apply/negP; intros COMPL.
- move: CONTR => /negP Temp; apply: Temp.
- try ( apply completion_monotonic with (t0 := t'); try done ) ||
- apply completion_monotonic with (t := t'); try done.
- }
- have SERV: job_last + 1 <= \sum_(t <= t' < t + (job_last + 1)) service_at sched j t'.
- { rewrite -{1}[job_last + 1]addn0 -{2}(subnn t) addnBA // addnC.
- rewrite -{1}[_+_-_]addn0 -[_+_-_]mul1n -iter_addn -big_const_nat.
- rewrite big_nat_cond [in X in _ <= X]big_nat_cond.
- rewrite leq_sum //.
- move => t' /andP [NEQ _].
- rewrite /service_at lt0b.
- apply SCHED.
- by rewrite addn1 addnS ltnS in NEQ.
- }
- move: (H_completed_jobs_dont_execute j (t + job_last.+1)).
- rewrite /completed_jobs_dont_execute.
- rewrite leqNgt; move => /negP T; apply: T.
- rewrite /service (service_during_cat _ _ t); last by (apply/andP; split; last rewrite leq_addr).
- apply leq_trans with (
- job_lock_in_service j + service_during sched j t (t + job_last.+1));
- last by rewrite leq_add2r.
- apply leq_trans with (job_lock_in_service j + job_last.+1); last by rewrite leq_add2l /service_during -addn1.
- by rewrite addnS ltnS subnKC; eauto 2.
- Qed.
-
- End CompletionOfJobAfterLockInService.
-
- End LockInService.
-
-End AbstractRTALockInService.
diff --git a/classic/model/schedule/uni/limited/busy_interval.v b/classic/model/schedule/uni/limited/busy_interval.v
deleted file mode 100644
index 23dada58986d6cb9ec13391f23f518a68ddb5912..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/busy_interval.v
+++ /dev/null
@@ -1,1219 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task
- prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.priority
- prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.schedule.uni.limited.platform.definitions.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(** * Busy Interval for JLFP-models *)
-(** In this module we define the notion of busy intervals for uniprocessor for JLFP schedulers. *)
-Module BusyIntervalJLFP.
-
- Import Job Priority UniprocessorSchedule LimitedPreemptionPlatform Service Workload TaskArrival.
-
- Section Definitions.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent arrival times... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Assume a given JLFP policy. *)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_remaining_cost j t := remaining_cost job_cost sched j t.
- Let arrivals_between := jobs_arrived_between arr_seq.
-
- (* In this section, we define the notion of a busy interval. *)
- Section BusyInterval.
-
- (* Consider an arbitrary task tsk. *)
- Variable tsk: Task.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
- Hypothesis H_job_task: job_task j = tsk.
-
- (* We say that t is a quiet time for j iff every higher-priority job from
- the arrival sequence that arrived before t has completed by that time. *)
- Definition quiet_time (t: time) :=
- forall j_hp,
- arrives_in arr_seq j_hp ->
- higher_eq_priority j_hp j ->
- arrived_before job_arrival j_hp t ->
- job_completed_by j_hp t.
-
- (* Based on the definition of quiet time, we say that interval
- [t1, t_busy) is a (potentially unbounded) busy-interval prefix
- iff the interval starts with a quiet time where a higher or equal
- priority job is released and remains non-quiet. We also require
- job j to be release in the interval. *)
- Definition busy_interval_prefix (t1 t_busy: time) :=
- t1 < t_busy /\
- quiet_time t1 /\
- (forall t, t1 < t < t_busy -> ~ quiet_time t) /\
- t1 <= job_arrival j < t_busy.
-
- (* Next, we say that an interval [t1, t2) is a busy interval iff
- [t1, t2) is a busy-interval prefix and t2 is a quiet time. *)
- Definition busy_interval (t1 t2: time) :=
- busy_interval_prefix t1 t2 /\
- quiet_time t2.
-
- End BusyInterval.
-
- (* In this section, we define a notion of bounded priority inversion experienced by a job. *)
- Section JobPriorityInversionBound.
-
- (* Consider an arbitrary task tsk. *)
- Variable tsk: Task.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
- Hypothesis H_job_task: job_task j = tsk.
-
- (* We say that the job incurs priority inversion if it has higher priority than the scheduled
- job. Note that this definition implicitly assumes that the scheduler is work-conserving in
- the sense of the definition given in prosa.classic.model.schedule.uni.basic.platform. Therefore, it
- cannot be applied to models with jitter or self-suspensions. *)
- Definition is_priority_inversion t :=
- if sched t is Some jlp then
- ~~ higher_eq_priority jlp j
- else false.
-
- (* Then we compute the cumulative priority inversion incurred by
- a job within some time interval [t1, t2). *)
- Definition cumulative_priority_inversion t1 t2 :=
- \sum_(t1 <= t < t2) is_priority_inversion t.
-
- (* We say that priority inversion of job j is bounded by a constant B iff cumulative
- priority inversion within any busy inverval prefix is bounded by B. *)
- Definition priority_inversion_of_job_is_bounded_by (B: time) :=
- forall (t1 t2: time),
- busy_interval_prefix j t1 t2 ->
- cumulative_priority_inversion t1 t2 <= B.
-
- End JobPriorityInversionBound.
-
- (* In this section, we define a notion of the bounded priority inversion for task. *)
- Section TaskPriorityInversionBound.
-
- (* Consider an arbitrary task tsk. *)
- Variable tsk: Task.
-
- (* We say that task tsk has bounded priority inversion if all
- its jobs have bounded cumulative priority inversion. *)
- Definition priority_inversion_is_bounded_by (B: time) :=
- forall (j: Job),
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_cost j > 0 ->
- priority_inversion_of_job_is_bounded_by j B.
-
- End TaskPriorityInversionBound.
-
- (* In this section we define the computational
- version of the notion of quiet time. *)
- Section DecidableQuietTime.
-
- (* We say that t is a quiet time for j iff every higher-priority job from
- the arrival sequence that arrived before t has completed by that time. *)
- Definition quiet_time_dec (j : Job) (t : time) :=
- all
- (fun j_hp => higher_eq_priority j_hp j ==> (completed_by job_cost sched j_hp t))
- (jobs_arrived_before arr_seq t).
-
- (* We also show that the computational and propositional definitions are equivalent. *)
- Lemma quiet_time_P :
- forall j t, reflect (quiet_time j t) (quiet_time_dec j t).
- Proof.
- intros; apply/introP.
- { intros QT s ARRs HPs BEFs.
- move: QT => /allP QT.
- specialize (QT s); feed QT.
- eapply arrived_between_implies_in_arrivals; eauto 2.
- by move: QT => /implyP Q; apply Q in HPs.
- }
- { move => /negP DEC; intros QT; apply: DEC.
- apply/allP; intros s ARRs.
- apply/implyP; intros HPs.
- apply QT; try done.
- - by apply in_arrivals_implies_arrived in ARRs.
- - eapply in_arrivals_implies_arrived_between in ARRs; eauto 2.
- by move: ARRs => /andP [_ HP].
- }
- Qed.
-
- End DecidableQuietTime.
-
- (* Now we prove some lemmas about busy intervals. *)
- Section Lemmas.
-
- (* Consider an arbitrary task tsk. *)
- Variable tsk: Task.
-
- (* Consider an arbitrary job j. *)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
- Hypothesis H_job_task: job_task j = tsk.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* Recall the list of jobs that arrive in any interval. *)
- Let quiet_time t1 := quiet_time j t1.
- Let busy_interval_prefix t1 t2 := busy_interval_prefix j t1 t2.
- Let busy_interval t1 t2 := busy_interval j t1 t2.
- Let is_priority_inversion_bounded_by K := priority_inversion_of_job_is_bounded_by j K.
-
- (* We begin by proving a basic lemma about completion of the job within its busy interval. *)
- Section BasicLemma.
-
- (* Assume that the priority relation is reflexive. *)
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
-
- (* Consider any busy interval [t1, t2) of job j. *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval: busy_interval t1 t2.
-
- (* We prove that job j completes by the end of the busy interval. *)
- Lemma job_completes_within_busy_interval:
- job_completed_by j t2.
- Proof.
- rename H_priority_is_reflexive into REFL, H_busy_interval into BUSY.
- move: BUSY => [[_ [_ [_ /andP [_ ARR]]]] QUIET].
- by apply QUIET.
- Qed.
-
- End BasicLemma.
-
- (* In this section, we prove that during a busy interval there
- always exists a pending job. *)
- Section ExistsPendingJob.
-
- (* Assume that jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Let [t1, t2] be any interval where time t1 is quiet and time t2 is not quiet. *)
- Variable t1 t2: time.
- Hypothesis H_interval: t1 <= t2.
- Hypothesis H_quiet: quiet_time t1.
- Hypothesis H_not_quiet: ~ quiet_time t2.
-
- (* Then, we prove that there is a job pending at time t2
- that has higher or equal priority (with respect of tsk). *)
- Lemma not_quiet_implies_exists_pending_job:
- exists j_hp,
- arrives_in arr_seq j_hp /\
- arrived_between job_arrival j_hp t1 t2 /\
- higher_eq_priority j_hp j /\
- ~ job_completed_by j_hp t2.
- Proof.
- rename H_quiet into QUIET, H_not_quiet into NOTQUIET.
- destruct (has (fun j_hp => (~~ job_completed_by j_hp t2) && higher_eq_priority j_hp j)
- (arrivals_between t1 t2)) eqn:COMP.
- {
- move: COMP => /hasP [j_hp ARR /andP [NOTCOMP HP]].
- move: (ARR) => INarr.
- ( try ( apply in_arrivals_implies_arrived_between with (job_arrival0 := job_arrival) in ARR ) ||
- apply in_arrivals_implies_arrived_between with (job_arrival := job_arrival) in ARR);
- last by done.
- apply in_arrivals_implies_arrived in INarr.
- by exists j_hp; repeat split; last by apply/negP.
- }
- {
- apply negbT in COMP; rewrite -all_predC in COMP.
- move: COMP => /allP COMP.
- exfalso; apply NOTQUIET; intros j_hp IN HP ARR.
- destruct (ltnP (job_arrival j_hp) t1) as [BEFORE | AFTER];
- first by specialize (QUIET j_hp IN HP BEFORE); apply completion_monotonic with (t := t1).
- feed (COMP j_hp).
- by eapply arrived_between_implies_in_arrivals; eauto 1; apply/andP; split.
- by rewrite /= HP andbT negbK in COMP.
- }
- Qed.
-
- End ExistsPendingJob.
-
- (* In this section, we prove that during a busy interval the
- processor is never idle. *)
- Section ProcessorAlwaysBusy.
-
- (* Assume that the schedule is work-conserving and that jobs do
- not execute before their arrival nor after completion. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
-
- (* Next, we assume that the priority relation is reflexive and transitive. *)
- Hypothesis H_priority_is_reflexive: JLFP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLFP_is_transitive higher_eq_priority.
-
- (* Consider any busy interval prefix [t1, t2). *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval_prefix: busy_interval_prefix t1 t2.
-
- (* We prove that if the processot is idle at a time instant t, then
- the next time instant [t+1] will be a quiet time. *)
- Lemma idle_time_implies_quiet_time_at_the_next_time_instant:
- forall t,
- is_idle sched t ->
- quiet_time t.+1.
- Proof.
- intros t IDLE jhp ARR HP AB.
- apply negbNE; apply/negP; intros NCOMP.
- rewrite /arrived_before ltnS in AB.
- move:(H_work_conserving _ t ARR) => WC.
- feed WC.
- { apply/andP; split; first (apply/andP; split).
- - by done.
- - apply/negP; intros COMP.
- move: NCOMP => /negP NCOMP; apply: NCOMP.
- by apply completion_monotonic with t.
- - move: IDLE => /eqP IDLE.
- by rewrite /scheduled_at IDLE.
- }
- move: IDLE WC => /eqP IDLE [jo /eqP SCHED].
- by rewrite IDLE in SCHED.
- Qed.
-
- (* Next, we prove that at any time instant t within the busy interval there exists a job
- jhp such that (1) job jhp is pending at time t and (2) job jhp has higher-or-equal
- priority than task tsk. *)
- Lemma pending_hp_job_exists:
- forall t,
- t1 <= t < t2 ->
- exists jhp,
- arrives_in arr_seq jhp /\
- job_pending_at jhp t /\
- higher_eq_priority jhp j.
- Proof.
- move => t /andP [GE LT].
- move: (ltngtP t1.+1 t2) => [GT|CONTR|EQ].
- { move: (H_busy_interval_prefix) => [_ [QT [NQT _]]].
- have EX:
- exists (hps: seq Job),
- forall jhp,
- jhp \in hps <-> arrives_in arr_seq jhp /\ job_pending_at jhp t
- /\ higher_eq_priority jhp j.
- { exists (filter
- (fun jo => (job_pending_at jo t) && (higher_eq_priority jo j))
- (jobs_arrived_between arr_seq 0 t.+1)).
- intros; split; intros.
- { move: H; rewrite mem_filter; move => /andP [/andP [PEN HP] IN].
- repeat split; try done.
- by eapply in_arrivals_implies_arrived; eauto 2.
- }
- { move: H => [ARR [PEN HP]].
- rewrite mem_filter.
- apply/andP; split; first (apply/andP; split); try done.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival); try done ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival); try done.
- apply/andP; split; first by done.
- rewrite ltnS.
- by move: PEN => /andP [T _].
- }
- }
- move: EX => [hps SE].
- case FL: (hps) => [ | jhp jhps].
- { subst hps.
- exfalso.
- move: GE; rewrite leq_eqVlt; move => /orP [/eqP EQ| GE].
- { subst t.
- apply NQT with t1.+1; first by apply/andP; split.
- intros jhp ARR HP ARRB.
- apply negbNE; apply/negP; intros NCOMP.
- move: (SE jhp) => [_ SE2].
- feed SE2. repeat split; try done; first apply/andP; split; try done.
- apply/negP; intros COMLP.
- move: NCOMP => /negP NCOMP; apply: NCOMP.
- by apply completion_monotonic with t1.
- by done.
- }
- { apply NQT with t; first by apply/andP; split.
- intros jhp ARR HP ARRB.
- apply negbNE; apply/negP; intros NCOMP.
- move: (SE jhp) => [_ SE2].
- feed SE2. repeat split; try done.
- - by apply/andP; split; first apply ltnW.
- by done.
- }
- }
- { exists jhp.
- specialize (SE jhp).
- move: SE => [SE1 _].
- feed SE1; first by rewrite FL in_cons; apply/orP; left.
- by done.
- }
- }
- { exfalso.
- rewrite ltnS in CONTR.
- move: (leq_ltn_trans GE LT) => NEQ.
- by move: CONTR; rewrite leqNgt; move => /negP CONTR; apply: CONTR.
- }
- { subst t2; rewrite ltnS in LT.
- have EQ: t1 = t; first by apply/eqP; rewrite eqn_leq; apply/andP; split.
- subst t1; clear GE LT.
- move: (H_busy_interval_prefix) => [_ [QTt [_ REL]]].
- exists j; repeat split.
- - by done.
- - move: REL; rewrite ltnS -eqn_leq eq_sym; move => /eqP REL.
- rewrite -REL.
- by eapply UniprocessorSchedule.job_pending_at_arrival; eauto 2.
- - by apply H_priority_is_reflexive.
- }
- Qed.
-
- (* We prove that at any time instant t within [t1, t2) the processor is not idle. *)
- Lemma not_quiet_implies_not_idle:
- forall t,
- t1 <= t < t2 ->
- ~ is_idle sched t.
- Proof.
- intros t NEQ IDLE.
- move: (pending_hp_job_exists _ NEQ) => [jhp [ARR [PEND HP]]].
- unfold work_conserving, platform.Platform.work_conserving in *.
- feed (H_work_conserving _ t ARR).
- apply/andP; split; first by done.
- move: IDLE => /eqP IDLE. unfold scheduled_at. rewrite IDLE. by done.
- move: (H_work_conserving) => [jo SCHED].
- move: IDLE SCHED => /eqP IDLE /eqP SCHED.
- by rewrite SCHED in IDLE.
- Qed.
-
- End ProcessorAlwaysBusy.
-
- (* In section we prove a few auxiliary lemmas about quiet time and service. *)
- Section QuietTimeAndServiceOfJobs.
-
- (* Assume that there are no duplicate job arrivals... *)
- Hypothesis H_arrival_sequence_is_a_set:
- arrival_sequence_is_a_set arr_seq.
-
- (* ...and that jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* We also assume that the schedule is work-conserving. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* Let t1 be a quiet time. *)
- Variable t1: time.
- Hypothesis H_quiet_time: quiet_time t1.
-
- (* Assume that there is no quiet time in the interval (t1, t1 + Δ]. *)
- Variable Δ: time.
- Hypothesis H_no_quiet_time: forall t, t1 < t <= t1 + Δ -> ~ quiet_time t.
-
- (* For clarity, we introduce a notion of the total service of jobs released in
- time interval [t_beg, t_end) during the time interval [t1, t1 + Δ). *)
- Let service_received_by_hep_jobs_released_during t_beg t_end :=
- service_of_higher_or_equal_priority_jobs
- sched (arrivals_between t_beg t_end) higher_eq_priority j t1 (t1 + Δ).
-
- (* We prove that jobs with higher-than-or-equal priority that
- released before time instant t1 receive no service after
- time instant t1. *)
- Lemma hep_jobs_receive_no_service_before_quiet_time:
- service_received_by_hep_jobs_released_during t1 (t1 + Δ) =
- service_received_by_hep_jobs_released_during 0 (t1 + Δ).
- Proof.
- intros.
- rewrite /service_received_by_hep_jobs_released_during
- /service_of_higher_or_equal_priority_jobs
- /service_of_jobs /arrivals_between.
- rewrite [in X in _ = X](job_arrived_between_cat _ _ t1);
- [ | | rewrite leq_addr]; try done.
- rewrite big_cat //=.
- rewrite -{1}[\sum_(j <- jobs_arrived_between _ _ (t1 + Δ) | _)
- service_during sched j t1 (t1 + Δ)]add0n.
- apply/eqP. rewrite eqn_add2r eq_sym exchange_big //=.
- rewrite big1_seq //.
- move => t' /andP [_ NEQ]; rewrite mem_iota in NEQ.
- rewrite big1_seq //.
- move => jhp /andP [HP ARR].
- apply/eqP; rewrite eqb0.
- eapply completed_implies_not_scheduled with job_cost; first by done.
- apply completion_monotonic with t1; [ move: NEQ => /andP [T1 _] | ]; try done.
- apply H_quiet_time; try done.
- - by eapply in_arrivals_implies_arrived; eauto 2.
- - by eapply in_arrivals_implies_arrived_before; eauto 2.
- Qed.
-
- (* Next we prove that the total service within a "non-quiet"
- time interval [t1, t1 + Δ) is exactly Δ. *)
- Lemma no_idle_time_within_non_quiet_time_interval:
- service_of_jobs sched (arrivals_between 0 (t1 + Δ)) predT t1 (t1 + Δ) = Δ.
- Proof.
- intros; unfold service_of_jobs, service_of_higher_or_equal_priority_jobs.
- rewrite -{3}[Δ](sum_of_ones t1) exchange_big //=.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- { rewrite leq_sum //; move => t' _; eapply service_of_jobs_le_1; eauto. }
- { rewrite [in X in X <= _]big_nat_cond [in X in _ <= X]big_nat_cond //=; rewrite leq_sum //.
- move => t' /andP [/andP [LT GT] _].
- rewrite sum_nat_gt0 filter_predT; apply/hasP.
- case SCHED: (sched t') => [j1 | ]; last first.
- { exfalso.
- move: LT; rewrite leq_eqVlt; move => /orP [/eqP EQ|LT].
- { subst t'.
- feed (H_no_quiet_time t1.+1); first by apply/andP; split.
- move: SCHED => /eqP SCHED.
- apply: H_no_quiet_time.
- by apply idle_time_implies_quiet_time_at_the_next_time_instant.
- }
- { feed (H_no_quiet_time t'); first by apply/andP; split; last rewrite ltnW.
- apply: H_no_quiet_time.
- intros j_hp IN HP ARR.
- apply contraT; intros NOTCOMP.
- destruct (scheduled_at sched j_hp t') eqn:SCHEDhp;
- first by move: SCHEDhp => /eqP SCHEDhp; rewrite SCHED in SCHEDhp.
- apply negbT in SCHEDhp.
- feed (H_work_conserving j_hp t' IN);
- first by repeat (apply/andP; split); first by apply ltnW.
- move: H_work_conserving => [j_other /eqP SCHEDother].
- by rewrite SCHED in SCHEDother.
- }
- }
- { exists j1.
- - apply arrived_between_implies_in_arrivals with job_arrival; try done.
- apply H_jobs_come_from_arrival_sequence with t'.
- rewrite /scheduled_at SCHED; by done.
- apply/andP; split; first by done.
- move: SCHED => /eqP SCHED; apply H_jobs_must_arrive_to_execute in SCHED.
- by apply leq_ltn_trans with t'.
- - by rewrite /service_at /scheduled_at SCHED lt0b. }
- }
- Qed.
-
- End QuietTimeAndServiceOfJobs.
-
- (* In this section, we show that the length of any busy interval
- is bounded, as long as there is enough supply to accomodate
- the workload of tasks with higher or equal priority. *)
- Section BoundingBusyInterval.
-
- (* Assume that there are no duplicate job arrivals... *)
- Hypothesis H_arrival_sequence_is_a_set:
- arrival_sequence_is_a_set arr_seq.
-
- (* ...and that jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Also assume a work-conserving JLFP schedule, ... *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* ...in which the priority relation is reflexive and transitive. *)
- Hypothesis H_priority_is_reflexive: JLFP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLFP_is_transitive higher_eq_priority.
-
-
- (* Next, we recall the notion of workload of all jobs released in a given interval
- [t1, t2) that have higher-or-equal priority w.r.t the job j being analyzed. *)
- Let hp_workload t1 t2 :=
- workload_of_higher_or_equal_priority_jobs
- job_cost (arrivals_between t1 t2) higher_eq_priority j.
-
- (* With regard to the jobs with higher-or-equal priority that are released
- in a given interval [t1, t2), we also recall the service received by these
- jobs in the same interval [t1, t2). *)
- Let hp_service t1 t2 :=
- service_of_higher_or_equal_priority_jobs
- sched (arrivals_between t1 t2) higher_eq_priority j t1 t2.
-
- (* Now we begin the proof. First, we show that the busy interval is bounded. *)
- Section BoundingBusyInterval.
-
- (* Suppose that job j is pending at time t_busy. *)
- Variable t_busy: time.
- Hypothesis H_j_is_pending: job_pending_at j t_busy.
-
- (* First, we show that there must exist a busy interval prefix. *)
- Section LowerBound.
-
- (* Since job j is pending, there is a (potentially unbounded)
- busy interval that starts no later than with the arrival of j. *)
- Lemma exists_busy_interval_prefix:
- exists t1,
- busy_interval_prefix t1 t_busy.+1 /\
- t1 <= job_arrival j <= t_busy.
- Proof.
- move: (H_from_arrival_sequence) => FROM.
- rename H_j_is_pending into PEND,
- H_work_conserving into WORK, H_priority_is_reflexive into REFL.
- unfold busy_interval_prefix.
- destruct ([exists t:'I_t_busy.+1, quiet_time_dec j t]) eqn:EX.
- { set last := \max_(t < t_busy.+1 | quiet_time_dec j t) t.
- move: EX => /existsP [t EX].
- have PRED: quiet_time_dec j last by apply (bigmax_pred t_busy.+1 (quiet_time_dec j) t).
- have QUIET: quiet_time last.
- { move: PRED => /allP PRED.
- intros j_hp IN HP ARR.
- feed (PRED j_hp).
- { by eapply arrived_between_implies_in_arrivals; eauto. }
- by rewrite HP implyTb in PRED.
- }
- exists last.
- have JAIN: last <= job_arrival j <= t_busy.
- { apply/andP; split; last by move: PEND => /andP [ARR _].
- apply contraT; rewrite -ltnNge; intros BEFORE.
- feed (QUIET j FROM); first by apply REFL.
- specialize (QUIET BEFORE).
- move: PEND => /andP [_ NOTCOMP].
- apply completion_monotonic with (t' := t_busy) in QUIET;
- [by rewrite QUIET in NOTCOMP |].
- by apply bigmax_ltn_ord with (i0 := t).
- }
- repeat split; try done.
- - by apply bigmax_ltn_ord with (i0 := t).
- - move => t0 /andP [GTlast LTbusy] QUIET0.
- have PRED0: quiet_time_dec j t0.
- { apply/allP; intros j_hp ARR; apply/implyP; intros HP.
- apply QUIET0.
- - by eapply in_arrivals_implies_arrived; eauto.
- - by done.
- - by eapply in_arrivals_implies_arrived_before; eauto.
- }
- have BUG: t0 <= last.
- { intros.
- have LE := @leq_bigmax_cond _ (fun (x: 'I_t_busy.+1) => quiet_time_dec j x) (fun x => x) (Ordinal LTbusy) PRED0.
- by apply LE.
- }
- apply leq_trans with (p := last) in GTlast; last by done.
- by rewrite ltnn in GTlast.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP ALL.
- exists 0; split;
- last by apply/andP; split; last by move: PEND => /andP [ARR _].
- split. by done.
- split; first by intros j_hp _ _ ARR; rewrite /arrived_before ltn0 in ARR.
- split.
- move => t /andP [GE LT].
- specialize (ALL (Ordinal LT)); move: ALL => /negP ALL.
- intros QUIET; apply ALL; simpl.
- apply/allP; intros j_hp ARR; apply/implyP; intros HP.
- apply QUIET.
- - by eapply in_arrivals_implies_arrived; eauto.
- - by done.
- - by eapply in_arrivals_implies_arrived_before; eauto.
- apply/andP; split; first by done.
- by move: PEND => /andP [ARR _].
- }
- Qed.
-
- End LowerBound.
-
- (* Next we prove that, if there is a point where the requested workload
- is upper-bounded by the supply, then the busy interval eventually ends. *)
- Section UpperBound.
-
- (* Consider any busy interval prefix of job j. *)
- Variable t1: time.
- Hypothesis H_is_busy_prefix: busy_interval_prefix t1 t_busy.+1.
-
- (* Let priority_inversion_bound be a constant which bounds
- length of a priority inversion. *)
- Variable priority_inversion_bound: time.
- Hypothesis H_priority_inversion_is_bounded:
- is_priority_inversion_bounded_by priority_inversion_bound.
-
- (* Next, assume that for some positive delta, the sum of requested workload
- at time [t1 + delta] and constant priority_inversion_bound is bounded by
- delta (i.e., the supply). *)
- Variable delta: time.
- Hypothesis H_delta_positive: delta > 0.
- Hypothesis H_workload_is_bounded:
- priority_inversion_bound + hp_workload t1 (t1 + delta) <= delta.
-
- (* If there is a quiet time by time (t1 + delta), it trivially follows that
- the busy interval is bounded.
- Thus, let's consider first the harder case where there is no quiet time,
- which turns out to be impossible. *)
- Section CannotBeBusyForSoLong.
-
- (* Assume that there is no quiet time in the interval (t1, t1 + delta]. *)
- Hypothesis H_no_quiet_time:
- forall t, t1 < t <= t1 + delta -> ~ quiet_time t.
-
- (* Since the interval is always non-quiet, the processor is always busy
- with tasks of higher-or-equal priority or some lower priority job which was scheduled,
- i.e., the sum of service done by jobs with actual arrival time in [t1, t1 + delta)
- and priority inversion equals delta. *)
- Lemma busy_interval_has_uninterrupted_service:
- delta <= priority_inversion_bound + hp_service t1 (t1 + delta).
- Proof.
- move: H_is_busy_prefix => [H_strictly_larger [H_quiet [_ EXj]]].
- destruct (delta <= priority_inversion_bound) eqn:KLEΔ.
- { by apply leq_trans with priority_inversion_bound; last rewrite leq_addr. }
- apply negbT in KLEΔ; rewrite -ltnNge in KLEΔ.
- apply leq_trans with (cumulative_priority_inversion j t1 (t1 + delta) + hp_service t1 (t1 + delta)).
- { rewrite /hp_service hep_jobs_receive_no_service_before_quiet_time //.
- rewrite /service_of_higher_or_equal_priority_jobs /service_of_jobs sum_pred_diff.
- rewrite addnBA; last first.
- { by rewrite big_mkcond //= leq_sum //; intros j' _; case (higher_eq_priority j' j). }
- rewrite addnC -addnBA.
- { intros. have H := no_idle_time_within_non_quiet_time_interval; unfold service_of_jobs in H.
- by rewrite H // leq_addr.
- }
- { rewrite /cumulative_priority_inversion /is_priority_inversion exchange_big //=.
- apply leq_sum_seq; move => t II _.
- rewrite mem_index_iota in II; move: II => /andP [GEi LEt].
- case SCHED: (sched t) => [j1 | ]; simpl; first last.
- { by rewrite leqn0 big1_seq; last (move => j1 _; rewrite /service_at /scheduled_at SCHED). }
- { case PRIO1: (higher_eq_priority j1 j); simpl; first last.
- - by eapply service_of_jobs_le_1; eauto 2.
- - rewrite leqn0 big1_seq; first by done.
- move => j2 /andP [PRIO2 ARRj2].
- rewrite /service_at /scheduled_at SCHED.
- case EQ: (j1 == j2).
- + by move: EQ => /eqP EQ; subst j2; rewrite PRIO1 in PRIO2.
- + apply/eqP; rewrite eqb0; apply/negP; intros CONTR; move: CONTR => /eqP CONTR.
- by inversion CONTR; clear CONTR; subst j2; rewrite PRIO1 in PRIO2. } } }
- { rewrite leq_add2r.
- destruct (t1 + delta <= t_busy.+1) eqn:NEQ; [ | apply negbT in NEQ; rewrite -ltnNge in NEQ].
- - apply leq_trans with (cumulative_priority_inversion j t1 t_busy.+1); last eauto 2.
- by rewrite [X in _ <= X](@big_cat_nat _ _ _ (t1 + delta)) //=; rewrite leq_addr.
- - apply H_priority_inversion_is_bounded; repeat split; try done.
- + by rewrite -addn1 leq_add2l.
- + move => t' /andP [LT GT]; apply H_no_quiet_time.
- by apply/andP; split; [ | rewrite ltnW ].
- + move: EXj => /andP [T1 T2].
- by apply/andP; split; [done | apply ltn_trans with (t_busy.+1)].
- }
- Qed.
-
- (* Moreover, the fact that the interval is not quiet also implies
- that there's more workload requested than service received. *)
- Lemma busy_interval_too_much_workload:
- hp_workload t1 (t1 + delta) > hp_service t1 (t1 + delta).
- Proof.
- have PEND := not_quiet_implies_exists_pending_job.
- rename H_no_quiet_time into NOTQUIET,
- H_is_busy_prefix into PREFIX.
- set l := jobs_arrived_between arr_seq t1 (t1 + delta).
- set hep := higher_eq_priority.
- unfold hp_service, service_of_higher_or_equal_priority_jobs, service_of_jobs,
- hp_workload, workload_of_higher_or_equal_priority_jobs, workload_of_jobs.
- fold arrivals_between l hep.
- move: (PREFIX) => [_ [QUIET _]].
- move: (NOTQUIET) => NOTQUIET'.
- feed (NOTQUIET' (t1 + delta)).
- { by apply/andP; split; first
- by rewrite -addn1 leq_add2l.
- }
- feed (PEND t1 (t1 + delta)); first by apply leq_addr.
- specialize (PEND QUIET NOTQUIET').
- move: PEND => [j0 [ARR0 [/andP [GE0 LT0] [HP0 NOTCOMP0]]]].
- have IN0: j0 \in l.
- { by eapply arrived_between_implies_in_arrivals; eauto 1; apply/andP; split. }
- have UNIQ: uniq l by eapply arrivals_uniq; eauto 1.
- rewrite big_mkcond [\sum_(_ <- _ | _ _ _)_]big_mkcond //=.
- rewrite (bigD1_seq j0); [simpl | by done | by done].
- rewrite (bigD1_seq j0); [simpl | by done | by done].
- rewrite /hep HP0.
- rewrite -add1n addnA [1 + _]addnC addn1.
- apply leq_add; last first.
- {
- apply leq_sum; intros j1 NEQ.
- destruct (higher_eq_priority j1 j); last by done.
- by apply cumulative_service_le_job_cost.
- }
- unfold service_during.
- rewrite (ignore_service_before_arrival job_arrival); rewrite //; [| by apply ltnW].
- ( try ( rewrite <- ignore_service_before_arrival with (t2:=0)) || rewrite <- ignore_service_before_arrival with (t1:=0)); rewrite //; [|by apply ltnW].
- by rewrite ltnNge; apply/negP.
- Qed.
-
- (* Using the two lemmas above, we infer that the workload is larger than the
- interval length. However, this contradicts the assumption H_workload_is_bounded. *)
- Corollary busy_interval_workload_larger_than_interval:
- priority_inversion_bound + hp_workload t1 (t1 + delta) > delta.
- Proof.
- apply leq_ltn_trans with (priority_inversion_bound + hp_service t1 (t1 + delta)).
- apply busy_interval_has_uninterrupted_service.
- rewrite ltn_add2l.
- apply busy_interval_too_much_workload.
- Qed.
-
- End CannotBeBusyForSoLong.
-
- (* Since the interval cannot remain busy for so long, we prove that
- the busy interval finishes at some point t2 <= t1 + delta. *)
- Lemma busy_interval_is_bounded:
- exists t2,
- t2 <= t1 + delta /\
- busy_interval t1 t2.
- Proof.
- have TOOMUCH := busy_interval_workload_larger_than_interval.
- have BOUNDED := H_workload_is_bounded.
- rename H_is_busy_prefix into PREFIX.
- destruct ([exists t2:'I_(t1 + delta).+1, (t2 > t1) && quiet_time_dec j t2]) eqn:EX.
- { have EX': exists (t2: nat), ((t1 < t2 <= t1 + delta) && quiet_time_dec j t2).
- { move: EX => /existsP [t2 /andP [LE QUIET]].
- exists t2; apply/andP; split; last by done.
- by apply/andP; split; last by rewrite -ltnS; apply ltn_ord.
- }
- have MIN := ex_minnP EX'.
- move: MIN => [t2 /andP [/andP [GT LE] QUIET] MIN]; clear EX EX'.
- exists t2; split; first by done.
- split; last first.
- {
- intros j_hp IN HP ARR.
- move: QUIET => /allP QUIET.
- feed (QUIET j_hp);
- first by eapply arrived_between_implies_in_arrivals; last by apply ARR.
- by move: QUIET => /implyP QUIET; apply QUIET.
- }
- split; first by done.
- split; first by move: PREFIX => [_ [QUIET1 _]].
- split.
- move => t /andP [GT1 LT2] BUG.
- feed (MIN t).
- {
- apply/andP; split;
- first by apply/andP; split;
- last by apply leq_trans with (n := t2); [by apply ltnW |].
- apply/allP; intros j_hp ARR; apply/implyP; intro HP.
- apply BUG.
- - by eapply in_arrivals_implies_arrived, ARR.
- - by done.
- - by eapply in_arrivals_implies_arrived_before, ARR.
- }
- by apply leq_ltn_trans with (p := t2) in MIN; first by rewrite ltnn in MIN.
- {
- move: PREFIX => [LT [QT [NQ IN]]].
- have NEQ: t_busy < t2.
- {
- rewrite ltnNge; apply/negP; intros CONTR.
- feed (NQ t2); first by apply/andP; split; last rewrite ltnS.
- apply NQ.
- unfold quiet_time_dec in *.
- intros jhp ARR HP AB.
- move: QUIET => /allP QUIET.
- feed (QUIET jhp).
- eapply arrived_between_implies_in_arrivals; eauto 2.
- by move: QUIET => /implyP QUIET; apply QUIET.
- }
- move: IN => /andP [IN1 IN2].
- apply/andP; split; first by done.
- apply leq_ltn_trans with t_busy.
- rewrite -ltnS; by done.
- by done.
- }
- }
- {
- apply negbT in EX; rewrite negb_exists in EX; move: EX => /forallP ALL'.
- have ALL: forall t, t1 < t <= t1 + delta -> ~ quiet_time t.
- {
- move => t /andP [GTt LEt] QUIET.
- rewrite -ltnS in LEt.
- specialize (ALL' (Ordinal LEt)); rewrite negb_and /= GTt orFb in ALL'.
- move: ALL' => /negP ALL'; apply ALL'; clear ALL'.
- apply/allP; intros j_hp ARR; apply/implyP; intro HP.
- apply QUIET.
- - by eapply in_arrivals_implies_arrived, ARR.
- - by done.
- - by eapply in_arrivals_implies_arrived_before, ARR.
- } exfalso; clear ALL'.
- specialize (TOOMUCH ALL).
- by have BUG := leq_trans TOOMUCH BOUNDED;
- rewrite ltnn in BUG.
- }
- Qed.
-
- End UpperBound.
-
- End BoundingBusyInterval.
-
- (* In this section, we show that from a workload bound we can infer
- the existence of a busy interval. *)
- Section BusyIntervalFromWorkloadBound.
-
- (* Let priority_inversion_bound be a constant that bounds the length of a priority inversion. *)
- Variable priority_inversion_bound: time.
- Hypothesis H_priority_inversion_is_bounded:
- is_priority_inversion_bounded_by priority_inversion_bound.
-
- (* Assume that for some positive delta, the sum of requested workload at
- time (t1 + delta) and priority inversion is bounded by delta (i.e., the supply). *)
- Variable delta: time.
- Hypothesis H_delta_positive: delta > 0.
- Hypothesis H_workload_is_bounded:
- forall t, priority_inversion_bound + hp_workload t (t + delta) <= delta.
-
- (* Next, we assume that job j has positive cost, from which we can
- infer that there is a time in which j is pending. *)
- Hypothesis H_positive_cost: job_cost j > 0.
-
- (* Therefore there must exists a busy interval [t1, t2) that
- contains the arrival time of j. *)
- Corollary exists_busy_interval:
- exists t1 t2,
- t1 <= job_arrival j < t2 /\
- t2 <= t1 + delta /\
- busy_interval t1 t2.
- Proof.
- have PREFIX := exists_busy_interval_prefix.
- move: (H_workload_is_bounded) => WORK.
- feed (PREFIX (job_arrival j)).
- { apply/andP; split; first by apply leqnn.
- rewrite /completed_by /service /service_during.
- rewrite (ignore_service_before_arrival job_arrival) //.
- rewrite big_geq; last by apply leqnn.
- by rewrite -ltnNge.
- }
- move: PREFIX => [t1 [PREFIX /andP [GE1 GEarr]]].
- have BOUNDED := busy_interval_is_bounded
- (job_arrival j) t1 _ priority_inversion_bound _ delta .
- feed_n 4 BOUNDED; try done.
- move: BOUNDED => [t2 [GE2 BUSY]].
- exists t1, t2; split.
- {
- apply/andP; split; first by done.
- apply contraT; rewrite -leqNgt; intro BUG.
- move: BUSY PREFIX => [[LE12 _] QUIET] [_ [_ [NOTQUIET _]]].
- feed (NOTQUIET t2); first by apply/andP; split.
- by exfalso; apply NOTQUIET.
- }
- by split.
- Qed.
-
- End BusyIntervalFromWorkloadBound.
-
- (* If we know that the workload is bounded, we can also use the
- busy interval to infer a response-time bound. *)
- Section ResponseTimeBoundFromBusyInterval.
-
- (* Let priority_inversion_bound be a constant that bounds the length of a priority inversion. *)
- Variable priority_inversion_bound: time.
- Hypothesis H_priority_inversion_is_bounded:
- is_priority_inversion_bounded_by priority_inversion_bound.
-
- (* Assume that for some positive delta, the sum of requested workload at
- time (t1 + delta) and priority inversion is bounded by delta (i.e., the supply). *)
- Variable delta: time.
- Hypothesis H_delta_positive: delta > 0.
- Hypothesis H_workload_is_bounded:
- forall t, priority_inversion_bound + hp_workload t (t + delta) <= delta.
-
- (* Then, job j must complete by (job_arrival j + delta). *)
- Lemma busy_interval_bounds_response_time:
- job_completed_by j (job_arrival j + delta).
- Proof.
- have BUSY := exists_busy_interval priority_inversion_bound _ delta.
- move: (posnP (job_cost j)) => [ZERO|POS].
- { by rewrite /job_completed_by /completed_by ZERO. }
- feed_n 4 BUSY; try by done.
- move: BUSY => [t1 [t2 [/andP [GE1 LT2] [GE2 BUSY]]]].
- apply completion_monotonic with (t := t2); try (by done);
- first by apply leq_trans with (n := t1 + delta); [| by rewrite leq_add2r].
- apply job_completes_within_busy_interval with (t1 := t1); try by done.
- Qed.
-
- End ResponseTimeBoundFromBusyInterval.
-
- End BoundingBusyInterval.
-
- End Lemmas.
-
- (* In this section, we derive an alternative condition for the existence of
- a busy interval. The new condition requires the total workload (instead
- of the high-priority workload) generated by the task set to be bounded. *)
- Section NonOverloadedProcessor.
-
- (* The processor has no carry-in at time t iff every job (regardless of priority)
- from the arrival sequence released before t has completed by that time. *)
- Definition no_carry_in (t: time) :=
- forall j_o,
- arrives_in arr_seq j_o ->
- arrived_before job_arrival j_o t ->
- job_completed_by j_o t.
-
- (* The fact that there is no carry-in at time instant t
- trivially implies that t is a quiet time. *)
- Lemma no_carry_in_implies_quiet_time :
- forall j t,
- no_carry_in t ->
- quiet_time j t.
- Proof.
- by intros j t FQT j_hp ARR HP BEF; apply FQT.
- Qed.
-
- (* Assume that there are no duplicate job arrivals. *)
- Hypothesis H_arrival_sequence_is_a_set:
- arrival_sequence_is_a_set arr_seq.
-
- (* We also assume that the schedule is work-conserving and that jobs
- do not execute before their arrival nor after completion. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
-
- (* Next we show that an idle time implies no carry in at this time instant. *)
- Lemma idle_instant_implies_no_carry_in_at_t :
- forall t,
- is_idle sched t ->
- no_carry_in t.
- Proof.
- intros ? IDLE j ARR HA.
- apply/negPn/negP; intros NCOMPL.
- move: IDLE => /eqP IDLE.
- move: (H_work_conserving j t ARR) => NIDLE.
- feed NIDLE.
- { apply/andP; split; last first.
- { by rewrite /scheduled_at IDLE. }
- { by apply/andP; split; [apply ltnW | done]. }
- }
- move: NIDLE => [j' SCHED].
- by rewrite /scheduled_at IDLE in SCHED.
- Qed.
-
- (* Moreover, an idle time implies no carry in at the next time instant. *)
- Lemma idle_instant_implies_no_carry_in_at_t_pl_1 :
- forall t,
- is_idle sched t ->
- no_carry_in t.+1.
- Proof.
- intros ? IDLE j ARR HA.
- apply/negPn/negP; intros NCOMPL.
- move: IDLE => /eqP IDLE.
- move: (H_work_conserving j t ARR) => NIDLE.
- feed NIDLE.
- { apply/andP; split; last first.
- { by rewrite /scheduled_at IDLE. }
- { apply/andP; split; first by done.
- move: NCOMPL => /negP NC1; apply/negP; intros NC2; apply: NC1.
- by apply completion_monotonic with t.
- }
- }
- move: NIDLE => [j' SCHED].
- by rewrite /scheduled_at IDLE in SCHED.
- Qed.
-
- (* Let the priority relation be reflexive. *)
- Hypothesis H_priority_is_reflexive: JLFP_is_reflexive higher_eq_priority.
-
- (* Next, we recall the notion of workload of all jobs released in a given interval [t1, t2)... *)
- Let total_workload t1 t2 :=
- workload_of_jobs job_cost (arrivals_between t1 t2) predT.
-
- (* ... and total service of jobs within some time interval [t1, t2). *)
- Let total_service t1 t2 :=
- service_of_jobs sched (arrivals_between 0 t2) predT t1 t2.
-
- (* Assume that for some positive Δ, the sum of requested workload
- at time (t + Δ) is bounded by delta (i.e., the supply).
- Note that this assumption bounds the total workload of
- jobs released in a time interval [t, t + Δ) regardless of
- their priorities. *)
- Variable Δ: time.
- Hypothesis H_delta_positive: Δ > 0.
- Hypothesis H_workload_is_bounded: forall t, total_workload t (t + Δ) <= Δ.
-
- (* Next we prove that since for any time instant t there is a point where
- the total workload is upper-bounded by the supply the processor encounters
- no carry-in instants at least every Δ time units. *)
- Section ProcessorIsNotTooBusy.
-
- (* We start by proving that the processor has no carry-in at
- the beginning (i.e., has no carry-in at time instant 0). *)
- Lemma no_carry_in_at_the_beginning :
- no_carry_in 0.
- Proof.
- intros s ARR AB; exfalso.
- by rewrite /arrived_before ltn0 in AB.
- Qed.
-
- (* In this section, we prove that for any time instant t there
- exists another time instant t' ∈ (t, t + Δ] such that the
- processor has no carry-in at time t'. *)
- Section ProcessorIsNotTooBusyInduction.
-
- (* Consider an arbitrary time instant t... *)
- Variable t: time.
-
- (* ...such that the processor has no carry-in at time t. *)
- Hypothesis H_no_carry_in: no_carry_in t.
-
- (* First, recall that the total service is bounded by the total workload. Therefore
- the total service of jobs in the interval [t, t + Δ) is bounded by Δ. *)
- Lemma total_service_is_bounded_by_Δ :
- total_service t (t + Δ) <= Δ.
- Proof.
- unfold total_service.
- rewrite -{3}[Δ]addn0 -{2}(subnn t) addnBA // [in X in _ <= X]addnC.
- apply service_of_jobs_le_delta.
- by eapply arrivals_uniq; eauto 2.
- Qed.
-
- (* Next we consider two cases:
- (1) The case when the total service is strictly less than Δ,
- (2) And when the total service is equal to Δ. *)
-
- (* In the first case, we use the pigeonhole principle to conclude
- that there is an idle time instant; which in turn implies existence
- of a time instant with no carry-in. *)
- Lemma low_total_service_implies_existence_of_time_with_no_carry_in :
- total_service t (t + Δ) < Δ ->
- exists δ, δ < Δ /\ no_carry_in (t.+1 + δ).
- Proof.
- unfold total_service; intros LT.
- rewrite -{3}[Δ]addn0 -{2}(subnn t) addnBA // [Δ + t]addnC in LT.
- eapply low_service_implies_existence_of_idle_time in LT; eauto; [ | by rewrite leq_addr].
- move: LT => [t_idle [/andP [LEt GTe] IDLE]].
- move: LEt; rewrite leq_eqVlt; move => /orP [/eqP EQ|LT].
- { exists 0; split; first done.
- rewrite addn0; subst t_idle.
- intros s ARR BEF.
- apply idle_instant_implies_no_carry_in_at_t_pl_1 in IDLE; try done.
- by apply IDLE.
- }
- have EX: exists γ, t_idle = t + γ.
- { by exists (t_idle - t); rewrite subnKC // ltnW. }
- move: EX => [γ EQ]; subst t_idle; rewrite ltn_add2l in GTe.
- rewrite -{1}[t]addn0 ltn_add2l in LT.
- exists (γ.-1); split.
- - apply leq_trans with γ. by rewrite prednK. by rewrite ltnW.
- - rewrite -subn1 -addn1 -addnA subnKC //.
- intros s ARR BEF.
- by apply idle_instant_implies_no_carry_in_at_t.
- Qed.
-
- (* In the second case, the total service within the time interval [t, t + Δ) is equal to Δ.
- On the other hand, we know that the total workload is lower-bounded by the total service
- and upper-bounded by Δ. Therefore, the total workload is equal to total service this
- implies completion of all jobs by time [t + Δ] and hence no carry-in at time [t + Δ]. *)
- Lemma completion_of_all_jobs_implies_no_carry_in :
- total_service t (t + Δ) = Δ ->
- no_carry_in (t + Δ).
- Proof.
- unfold total_service; intros EQserv.
- move: (H_workload_is_bounded t); move => WORK.
- have EQ: total_workload 0 (t + Δ) = service_of_jobs sched (arrivals_between 0 (t + Δ)) predT 0 (t + Δ).
- { intros.
- have COMPL := all_jobs_have_completed_impl_workload_eq_service
- job_arrival job_cost arr_seq _ sched _ _ predT 0 t t.
- feed_n 4 COMPL; try done.
- { intros; apply H_no_carry_in.
- - eapply in_arrivals_implies_arrived; eauto 2.
- - eapply in_arrivals_implies_arrived_between in H; eauto 2.
- by move: H => /andP [_ H].
- }
- apply/eqP; rewrite eqn_leq; apply/andP; split; last by apply service_of_jobs_le_workload.
- rewrite /total_workload (workload_of_jobs_cat job_cost arr_seq (t)); last first.
- apply/andP; split; [by done | by rewrite leq_addr].
- rewrite (service_of_jobs_cat_scheduling_interval job_arrival _ _ _ _ _ _ _ t); try done; first last.
- { by apply/andP; split; [by done | by rewrite leq_addr]. }
- rewrite COMPL -addnA leq_add2l.
- rewrite -service_of_jobs_cat_arrival_interval; last first.
- apply/andP; split; [by done| by rewrite leq_addr].
- rewrite EQserv.
- by apply H_workload_is_bounded.
- }
- intros s ARR BEF.
- eapply workload_eq_service_impl_all_jobs_have_completed; eauto 2; try done.
- by eapply arrived_between_implies_in_arrivals; eauto 2.
- Qed.
-
- End ProcessorIsNotTooBusyInduction.
-
- (* Finally, we show that any interval of length Δ contains a time instant with no carry-in. *)
- Lemma processor_is_not_too_busy :
- forall t, exists δ, δ < Δ /\ no_carry_in (t + δ).
- Proof.
- induction t.
- { by exists 0; split; [ | rewrite addn0; apply no_carry_in_at_the_beginning]. }
- { move: IHt => [δ [LE FQT]].
- move: (posnP δ) => [Z|POS]; last first.
- { exists (δ.-1); split.
- - by apply leq_trans with δ; [rewrite prednK | apply ltnW].
- - by rewrite -subn1 -addn1 -addnA subnKC //.
- } subst δ; rewrite addn0 in FQT; clear LE.
- move: (total_service_is_bounded_by_Δ t); rewrite leq_eqVlt; move => /orP [/eqP EQ | LT].
- - exists (Δ.-1); split.
- + by rewrite prednK.
- + by rewrite addSn -subn1 -addn1 -addnA subnK; first apply completion_of_all_jobs_implies_no_carry_in.
- - by apply low_total_service_implies_existence_of_time_with_no_carry_in.
- }
- Qed.
-
- End ProcessorIsNotTooBusy.
-
- (* Consider an arbitrary job j with positive cost. *)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* We show that there must exists a busy interval [t1, t2) that
- contains the arrival time of j. *)
- Corollary exists_busy_interval_from_total_workload_bound :
- exists t1 t2,
- t1 <= job_arrival j < t2 /\
- t2 <= t1 + Δ /\
- busy_interval j t1 t2.
- Proof.
- have PREFIX := exists_busy_interval_prefix j _ _ (job_arrival j).
- feed_n 3 PREFIX; try done.
- { apply/andP; split; first by apply leqnn.
- rewrite /completed_by /service /service_during.
- rewrite (ignore_service_before_arrival job_arrival) //.
- rewrite big_geq; last by apply leqnn.
- move: H_job_cost_positive; rewrite /job_cost_positive; move => POS.
- by rewrite -ltnNge.
- } move: PREFIX => [t1 [PREFIX /andP [GE1 _]]].
- exists t1; move: (processor_is_not_too_busy t1.+1) => [δ [LE QT]].
- apply no_carry_in_implies_quiet_time with (j := j) in QT.
- have EX: exists t2, ((t1 < t2 <= t1.+1 + δ) && quiet_time_dec j t2).
- { exists (t1.+1 + δ); apply/andP; split.
- - by apply/andP; split; first rewrite addSn ltnS leq_addr.
- - by apply/quiet_time_P. }
- move: (ex_minnP EX) => [t2 /andP [/andP [GTt2 LEt2] QUIET] MIN]; clear EX.
- have NEQ: t1 <= job_arrival j < t2.
- { apply/andP; split; first by done.
- rewrite ltnNge; apply/negP; intros CONTR.
- move: (PREFIX) => [_ [_ [NQT _]]].
- move: (NQT t2); clear NQT; move => NQT.
- feed NQT; first by (apply/andP; split; [|rewrite ltnS]).
- by apply: NQT; apply/quiet_time_P.
- }
- exists t2; split; last split; first by done.
- { apply leq_trans with (t1.+1 + δ); [by done | by rewrite addSn ltn_add2l]. }
- { move: PREFIX => [_ [QTt1 [NQT _]]]; repeat split; try done.
- - move => t /andP [GEt LTt] QTt.
- feed (MIN t).
- { apply/andP; split.
- + by apply/andP; split; last (apply leq_trans with t2; [apply ltnW | ]).
- + by apply/quiet_time_P.
- }
- by move: LTt; rewrite ltnNge; move => /negP LTt; apply: LTt.
- - by apply/quiet_time_P.
- }
- Qed.
-
- End NonOverloadedProcessor.
-
- End Definitions.
-
-End BusyIntervalJLFP.
diff --git a/classic/model/schedule/uni/limited/edf/nonpr_reg/concrete_models/response_time_bound.v b/classic/model/schedule/uni/limited/edf/nonpr_reg/concrete_models/response_time_bound.v
deleted file mode 100644
index e8904850ce1830d68f945229fe29f9b484b2364f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/edf/nonpr_reg/concrete_models/response_time_bound.v
+++ /dev/null
@@ -1,654 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.edf.response_time_bound
- prosa.classic.model.schedule.uni.limited.edf.nonpr_reg.response_time_bound
- prosa.classic.model.schedule.uni.limited.rbf.
-Require Import prosa.classic.model.arrival.curves.bounds
- prosa.classic.analysis.uni.arrival_curves.workload_bound.
-Require Import prosa.classic.model.schedule.uni.nonpreemptive.schedule
- prosa.classic.model.schedule.uni.limited.platform.limited
- prosa.classic.model.schedule.uni.limited.platform.preemptive
- prosa.classic.model.schedule.uni.limited.platform.nonpreemptive.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * RTA for concrete models *)
-(** In this module we prove the RTA theorems for (1) fully preemptive EDF model,
- (2) fully nonpreemptive EDF model, (3) EDF with fixed premption points, and
- (4) EDF with floating nonpreemptive regions. *)
-Module RTAforConcreteModels.
-
- Import Job ArrivalCurves TaskArrival Priority UniprocessorSchedule Workload Service
- ResponseTime MaxArrivalsWorkloadBound LimitedPreemptionPlatform ModelWithLimitedPreemptions
- RTAforEDFwithBoundedNonpreemptiveSegmentsWithArrivalCurves NonpreemptiveSchedule
- FullyNonPreemptivePlatform FullyPreemptivePlatform AbstractRTAforEDFwithArrivalCurves.
-
- Section Analysis.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_deadline: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* For clarity, let's denote the relative deadline of a task as D. *)
- Let D tsk := task_deadline tsk.
-
- (* The relative deadline of a job is equal to the deadline of the corresponding task. *)
- Let job_relative_deadline j := D (job_task j).
-
- (* Consider the EDF policy that indicates a higher-or-equal priority relation. *)
- Let higher_eq_priority: JLFP_policy Job := EDF job_arrival job_relative_deadline.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Consider an arbitrary task set ts. *)
- Variable ts: list Task.
-
- (* Assume that all jobs come from the task set... *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...and the cost of a job cannot be larger than the task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Let max_arrivals be a family of proper arrival curves, i.e., for any task tsk in ts
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is a monotonic function
- that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_family_of_proper_arrival_curves:
- family_of_proper_arrival_curves job_task arr_seq max_arrivals ts.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Next, consider any uniprocessor schedule... *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume we have sequential jobs, i.e, jobs from the same
- task execute in the order of their arrival. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
-
- (* Next, we assume that the schedule is a work-conserving schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* Let's define some local names for clarity. *)
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let task_rbf_changes_at A := task_rbf_changes_at task_cost max_arrivals tsk A.
- Let bound_on_total_hep_workload_changes_at :=
- bound_on_total_hep_workload_changes_at task_cost task_deadline ts max_arrivals tsk.
-
- (* We introduce the abbreviation "rbf" for the task request bound function,
- which is defined as [task_cost(T) × max_arrivals(T,Δ)] for a task T. *)
- Let rbf := task_request_bound_function task_cost max_arrivals.
-
- (* Next, we introduce task_rbf as an abbreviation
- for the task request bound function of task tsk. *)
- Let task_rbf := rbf tsk.
-
- (* Using the sum of individual request bound functions, we define the request bound
- function of all tasks (total request bound function). *)
- Let total_rbf := total_request_bound_function task_cost max_arrivals ts.
-
- (* Next, we define an upper bound on interfering workload received from jobs
- of other tasks with higher-than-or-equal priority. *)
- Let bound_on_total_hep_workload A Δ :=
- \sum_(tsk_o <- ts | tsk_o != tsk)
- rbf tsk_o (minn ((A + ε) + D tsk - D tsk_o) Δ).
-
- (** * RTA for fully preemptive EDF model *)
- (** In this section we prove the RTA theorem for the fully preemptive EDF model *)
- Section RTAforFullyPreemptiveEDFModelwithArrivalCurves.
-
- (* First, we assume that the schedule respects the JLFP policy
- under a model with fixed preemption points. *)
- Hypothesis H_respects_policy:
- respects_JLFP_policy_at_preemption_point
- job_arrival job_cost arr_seq sched
- can_be_preempted_for_fully_preemptive_model higher_eq_priority.
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = total_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A :=
- (A < L) && (task_rbf_changes_at A || bound_on_total_hep_workload_changes_at A).
-
- (* Consider any value R, and assume that for any given arrival offset A in the search space,
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = task_rbf (A + ε) + bound_on_total_hep_workload A (A + F) /\
- F <= R.
-
- (* Now, we can leverage the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model of fully preemptive scheduling. *)
- Theorem uniprocessor_response_time_bound_fully_preemptive_edf:
- response_time_bounded_by tsk R.
- Proof.
- have BLOCK: RTAforEDFwithBoundedNonpreemptiveSegmentsWithArrivalCurves.blocking_bound
- (fun _ => ε) D ts tsk = 0.
- { by rewrite /RTAforEDFwithBoundedNonpreemptiveSegmentsWithArrivalCurves.blocking_bound
- subnn big1_eq. }
- eapply uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments with
- (task_max_nps := fun _ => ε)
- (can_be_preempted := fun j prog => true)
- (task_lock_in_service := fun tsk => task_cost tsk)
- (job_lock_in_service := fun j => job_cost j)
- (job_max_nps := fun j => ε); eauto 2; try done.
- - by eapply fully_preemptive_model_is_model_with_bounded_nonpreemptive_regions.
- - repeat split; try done.
- intros ? ? ? ARR; move => LE COMPL /negP NCOMPL.
- exfalso; apply: NCOMPL.
- apply completion_monotonic with t; try done.
- - repeat split; try done.
- rewrite /task_lock_in_service_le_task_cost. by done.
- unfold task_lock_in_service_bounds_job_lock_in_service.
- by intros ? ARR TSK; rewrite -TSK; apply H_job_cost_le_task_cost.
- - move => A /andP [LT NEQ].
- specialize (H_R_is_maximum A); feed H_R_is_maximum.
- { by apply/andP; split. }
- move: H_R_is_maximum => [F [FIX BOUND]].
- exists F; split.
- + by rewrite BLOCK add0n subnn subn0.
- + by rewrite subnn addn0.
- Qed.
-
- End RTAforFullyPreemptiveEDFModelwithArrivalCurves.
-
- (** * RTA for fully nonpreemptive EDF model *)
- (** In this section we prove the RTA theorem for the fully nonpreemptive EDF model. *)
- Section RTAforFullyNonPreemptiveEDFModelwithArrivalCurves.
-
- (* First, we assume that the schedule is nonpreemptive. *)
- Hypothesis H_nonpreemptive_sched: is_nonpreemptive_schedule job_cost sched.
-
- (* Next, we assume that the schedule respects the JLFP policy
- under a model with fixed preemption points. *)
- Hypothesis H_respects_policy:
- respects_JLFP_policy_at_preemption_point
- job_arrival job_cost arr_seq sched
- (can_be_preempted_for_fully_nonpreemptive_model job_cost) higher_eq_priority.
-
- (* We also define a bound for the priority inversion caused by jobs with lower priority. *)
- Let blocking_bound :=
- \max_(tsk_other <- ts | (tsk_other != tsk) && (D tsk_other > D tsk))
- (task_cost tsk_other - ε).
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = total_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A :=
- (A < L) && (task_rbf_changes_at A || bound_on_total_hep_workload_changes_at A).
-
- (* Consider any value R, and assume that for any given arrival offset A in the search space,
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound + (task_rbf (A + ε) - (task_cost tsk - ε))
- + bound_on_total_hep_workload A (A + F) /\
- F + (task_cost tsk - ε) <= R.
-
- (* Now, we can leverage the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model of fully nonpreemptive scheduling. *)
- Theorem uniprocessor_response_time_bound_fully_nonpreemptive_edf:
- response_time_bounded_by tsk R.
- Proof.
- move: (posnP (task_cost tsk)) => [ZERO|POS].
- { intros j ARR TSK.
- have ZEROj: job_cost j = 0.
- { move: (H_job_cost_le_task_cost j ARR) => NEQ.
- rewrite /job_cost_le_task_cost TSK ZERO in NEQ.
- by apply/eqP; rewrite -leqn0.
- }
- by rewrite /is_response_time_bound_of_job /completed_by ZEROj.
- }
- try ( eapply uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments with
- (job_max_nps := fun j => job_cost j)
- (task_max_nps := fun tsk => task_cost tsk)
- (job_lock_in_service := fun j => ε)
- (task_lock_in_service := fun tsk => ε)
- (L0 := L); eauto 2 ) ||
- eapply uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments with
- (job_max_nps := fun j => job_cost j)
- (task_max_nps := fun tsk => task_cost tsk)
- (job_lock_in_service := fun j => ε)
- (task_lock_in_service := fun tsk => ε)
- (L := L); eauto 2.
- - by eapply fully_nonpreemptive_model_is_correct; eauto 2.
- - eapply fully_nonpreemptive_model_is_model_with_bounded_nonpreemptive_regions; eauto 2.
- - repeat split; try done.
- - intros j t t' ARR LE SERV NCOMPL.
- rewrite /service in SERV; apply incremental_service_during in SERV.
- move: SERV => [t_first [/andP [_ H1] [H2 H3]]].
- apply H_nonpreemptive_sched with t_first; try done.
- by apply leq_trans with t; first apply ltnW.
- - repeat split; try done.
- Qed.
-
- End RTAforFullyNonPreemptiveEDFModelwithArrivalCurves.
-
- (** * RTA for EDF with fixed premption points *)
- (** In this module we prove a general RTA theorem for EDF-schedulers with fixed preemption points *)
- Section RTAforFixedPreemptionPointsModelwithArrivalCurves.
-
- (* First, let's assume we have the model with fixed preemption points.
- I.e., each task is divided into a number of nonpreemptive segments
- separated by statically predefined preemption points. *)
- Variable job_preemption_points: Job -> seq time.
- Variable task_preemption_points: Task -> seq time.
- Hypothesis H_model_with_fixed_preemption_points:
- fixed_preemption_points_model
- task_cost job_cost job_task arr_seq
- job_preemption_points task_preemption_points ts.
-
- (* Assume that the schedule is a uniprocessor schedule with limited preemptions... *)
- Hypothesis H_schedule_with_limited_preemptions:
- is_schedule_with_limited_preemptions arr_seq job_preemption_points sched.
-
- (* ... that respects the JLFP policy under a model with fixed preemption points. *)
- Hypothesis H_respects_policy:
- respects_JLFP_policy_at_preemption_point
- job_arrival job_cost arr_seq sched
- (can_be_preempted_for_model_with_limited_preemptions job_preemption_points) higher_eq_priority.
-
- (* We also have a set of functions that map job or task
- to its max or last nonpreemptive segment. *)
- Let job_max_nps := job_max_nps job_preemption_points.
- Let job_last_nps := job_last_nps job_preemption_points.
- Let task_max_nps := task_max_nps task_preemption_points.
- Let task_last_nps := task_last_nps task_preemption_points.
-
- (* We define a bound for the priority inversion caused by jobs with lower priority. *)
- Let blocking_bound :=
- \max_(tsk_other <- ts | (tsk_other != tsk) && (D tsk_other > D tsk))
- (task_max_nps tsk_other - ε).
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = total_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A :=
- (A < L) && (task_rbf_changes_at A || bound_on_total_hep_workload_changes_at A).
-
- (* Consider any value R, and assume that for any given arrival offset A in the search space,
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound
- + (task_rbf (A + ε) - (task_last_nps tsk - ε))
- + bound_on_total_hep_workload A (A + F) /\
- F + (task_last_nps tsk - ε) <= R.
-
- (* Now, we can leverage the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model of fixed preemption points. *)
- Theorem uniprocessor_response_time_bound_edf_with_fixed_preemption_points:
- response_time_bounded_by tsk R.
- Proof.
- move: (H_model_with_fixed_preemption_points) => [MLP [BEG [END [INCR [HYP1 [HYP2 HYP3]]]]]].
- move: (MLP) => [EMPTj [LSMj [BEGj [ENDj HH]]]].
- move: (posnP (task_cost tsk)) => [ZERO|POSt].
- { intros j ARR TSK.
- move: (H_job_cost_le_task_cost _ ARR) => POSt.
- move: POSt; rewrite /job_cost_le_task_cost TSK ZERO leqn0; move => /eqP Z.
- by rewrite /is_response_time_bound_of_job /completed_by Z.
- }
- have Fact2: 1 < size (task_preemption_points tsk).
- { have Fact2: 0 < size (task_preemption_points tsk).
- { apply/negPn/negP; rewrite -eqn0Ngt; intros CONTR; move: CONTR => /eqP CONTR.
- move: (END _ H_tsk_in_ts) => EQ.
- move: EQ; rewrite /last0 -nth_last nth_default; last by rewrite CONTR.
- by intros; rewrite -EQ in POSt.
- }
- have EQ: 2 = size [::0; task_cost tsk]; first by done.
- rewrite EQ; clear EQ.
- apply subseq_leq_size.
- rewrite !cons_uniq.
- { apply/andP; split.
- rewrite in_cons negb_or; apply/andP; split; last by done.
- rewrite neq_ltn; apply/orP; left; eauto 2.
- apply/andP; split; by done. }
- intros t EQ; move: EQ; rewrite !in_cons.
- move => /orP [/eqP EQ| /orP [/eqP EQ|EQ]]; last by done.
- { rewrite EQ; clear EQ.
- move: (BEG _ H_tsk_in_ts) => EQ.
- rewrite -EQ; clear EQ.
- rewrite /first0 -nth0.
- apply/(nthP 0).
- exists 0; by done.
- }
- { rewrite EQ; clear EQ.
- move: (END _ H_tsk_in_ts) => EQ.
- rewrite -EQ; clear EQ.
- rewrite /last0 -nth_last.
- apply/(nthP 0).
- exists ((size (task_preemption_points tsk)).-1); last by done.
- by rewrite -(leq_add2r 1) !addn1 prednK //.
- }
- }
- try ( eapply uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => (task_cost tsk - (task_last_nps tsk - ε)))
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L0 := L)(job_cost0 := job_cost) (task_max_nps0 := task_max_nps)
- ; eauto 2 ) ||
- eapply uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => (task_cost tsk - (task_last_nps tsk - ε)))
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L := L)(job_cost := job_cost) (task_max_nps := task_max_nps)
- ; eauto 2.
- { by apply model_with_fixed_preemption_points_is_correct. }
- { eapply model_with_fixed_preemption_points_is_model_with_bounded_nonpreemptive_regions; eauto 2.
- intros j ARR.
- unfold ModelWithLimitedPreemptions.job_max_nps, task_max_nps, lengths_of_segments.
- apply max_of_dominating_seq.
- intros. apply HYP2.
- by done.
- }
- { split; last split.
- { intros j ARR POS.
- rewrite subn_gt0.
- rewrite subn1 -(leq_add2r 1) !addn1 prednK; last first.
- apply LSMj; try done.
- rewrite /job_last_nps /ModelWithLimitedPreemptions.job_last_nps
- ltnS /last0 -nth_last function_of_distances_is_correct.
- apply leq_trans with (job_max_nps j);
- first by apply distance_between_neighboring_elements_le_max_distance_in_seq.
- rewrite -ENDj; last by done.
- by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- { by intros j ARR; rewrite leq_subLR leq_addl. }
- { intros ? ? ? ARR LE LS NCOMPL.
- rewrite subnBA in LS; last first.
- apply LSMj; try done.
- { rewrite lt0n; apply/negP; intros Z; move: Z => /eqP Z.
- by move: NCOMPL; rewrite /completed_by -ltnNge Z ltn0; move => LT.
- }
- have EQ: exists Δ, t' = t + Δ.
- { exists (t' - t); rewrite subnKC; by done. }
- move: EQ => [Δ EQ]; subst t'; clear LE.
- rewrite -addnBAC in LS.
- rewrite addn1 in LS.
- apply H_schedule_with_limited_preemptions; first by done.
- rewrite /can_be_preempted_for_model_with_limited_preemptions; apply/negP.
- intros CONTR.
- move: NCOMPL; rewrite /completed_by -ltnNge; move => SERV.
- have NEQ: job_cost j - job_last_nps j < service sched j (t + Δ).
- { apply leq_trans with (service sched j t); first by done.
- rewrite /service /service_during [in X in _ <= X](@big_cat_nat _ _ _ t) //=.
- rewrite leq_addr //.
- rewrite leq_addr //.
- }
- clear LS.
- rewrite -ENDj in NEQ, SERV; last by done.
- rewrite last_seq_minus_last_distance_seq in NEQ; last by eauto 2.
- rewrite /last0 -nth_last in SERV.
- have EQ := antidensity_of_nondecreasing_seq.
- specialize (EQ (job_preemption_points j) (service sched j (t + Δ)) (size (job_preemption_points j)).-2).
- rewrite CONTR in EQ.
- feed_n 2 EQ; first by eauto 2.
- {
- apply/andP; split; first by done.
- rewrite prednK; first by done.
- rewrite -(leq_add2r 1) !addn1 prednK.
- try ( eapply number_of_preemption_points_at_least_two with (job_cost0 := job_cost); eauto 2 ) ||
- eapply number_of_preemption_points_at_least_two with (job_cost := job_cost); eauto 2.
- try ( eapply list_of_preemption_point_is_not_empty with (job_cost0 := job_cost); eauto 2 ) ||
- eapply list_of_preemption_point_is_not_empty with (job_cost := job_cost); eauto 2.
- }
- by done.
- rewrite -ENDj; last by done.
- apply leq_trans with (job_max_nps j).
- - by apply last_of_seq_le_max_of_seq.
- - by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- }
- {
- split.
- - by rewrite /task_lock_in_service_le_task_cost leq_subLR leq_addl.
- - intros j ARR TSK.
- move: (posnP (job_cost j)) => [ZERO | POS].
- { by rewrite ZERO. }
- unfold task_last_nps.
- rewrite !subnBA; first last.
- apply LSMj; try done.
- rewrite /ModelWithLimitedPreemptions.task_last_nps /last0 -nth_last.
- apply HYP3.
- by done.
- rewrite -(ltn_add2r 1) !addn1 prednK //.
- move: (Fact2) => Fact3.
- rewrite size_of_seq_of_distances // addn1 ltnS // in Fact2.
- rewrite -addnBAC -?[in X in _ <= X]addnBAC; first last.
- { apply leq_trans with (job_max_nps j).
- - by apply last_of_seq_le_max_of_seq.
- - by rewrite -ENDj //; apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- { apply leq_trans with (task_max_nps tsk).
- - by apply last_of_seq_le_max_of_seq.
- - by rewrite -END //; apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- rewrite -ENDj; last eauto 2.
- rewrite -END; last eauto 2.
- rewrite !last_seq_minus_last_distance_seq.
- have EQ: size (job_preemption_points j) = size (task_preemption_points tsk).
- { rewrite -TSK.
- by apply HYP1.
- }
- rewrite EQ; clear EQ.
- rewrite leq_add2r.
- apply domination_of_distances_implies_domination_of_seq; try done; eauto 2.
- rewrite BEG // BEGj //.
- try ( eapply number_of_preemption_points_at_least_two with (job_cost0 := job_cost); eauto 2 ) ||
- eapply number_of_preemption_points_at_least_two with (job_cost := job_cost); eauto 2.
- rewrite -TSK; apply HYP1; try done.
- intros. rewrite -TSK; eauto 2.
- eauto 2.
- eauto 2.
- }
- { rewrite subKn; first by done.
- rewrite /task_last_nps -(leq_add2r 1) subn1 !addn1 prednK; last first.
- { rewrite /ModelWithLimitedPreemptions.task_last_nps /last0 -nth_last.
- apply HYP3; try by done.
- rewrite -(ltn_add2r 1) !addn1 prednK //.
- move: (Fact2) => Fact3.
- by rewrite size_of_seq_of_distances // addn1 ltnS // in Fact2.
- }
- { apply leq_trans with (task_max_nps tsk).
- - by apply last_of_seq_le_max_of_seq.
- - rewrite -END; last by done.
- apply ltnW; rewrite ltnS; try done.
- by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- }
- Qed.
-
- End RTAforFixedPreemptionPointsModelwithArrivalCurves.
-
- (** * RTA for EDF with floating nonpreemptive regions *)
- (** In this module we prove a general RTA theorem for EDF-schedulers with floating nonpreemptive regions *)
- Section RTAforModelWithFloatingNonpreemptiveRegionsWithArrivalCurves.
-
- (* First, assume we have model with floating nonpreemptive regions.
- I.e., for each task only the length of the maximal nonpreemptive
- segment is known. *)
- Variable job_preemption_points: Job -> seq time.
- Variable task_max_nps: Task -> time.
- Hypothesis H_task_model_with_floating_nonpreemptive_regions:
- model_with_floating_nonpreemptive_regions
- job_cost job_task arr_seq job_preemption_points task_max_nps.
-
- (* Assume that the schedule is a uniprocessor schedule with limited preemptions... *)
- Hypothesis H_schedule_with_limited_preemptions:
- is_schedule_with_limited_preemptions arr_seq job_preemption_points sched.
-
- (* ... that respects the JLFP policy under a model with floating nonpreemptive regions. *)
- Hypothesis H_respects_policy:
- respects_JLFP_policy_at_preemption_point
- job_arrival job_cost arr_seq sched
- (can_be_preempted_for_model_with_limited_preemptions job_preemption_points) higher_eq_priority.
-
- (* We also have two functions that map job to its max or last nonpreemptive segment. *)
- Let job_max_nps := job_max_nps job_preemption_points.
- Let job_last_nps := job_last_nps job_preemption_points.
-
- (* We define a bound for the priority inversion caused by jobs with lower priority. *)
- Definition blocking_bound :=
- \max_(tsk_other <- ts | (tsk_other != tsk) && (D tsk_other > D tsk))
- (task_max_nps tsk_other - ε).
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = total_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A :=
- (A < L) && (task_rbf_changes_at A || bound_on_total_hep_workload_changes_at A).
-
- (* Consider any value R, and assume that for any given arrival offset A in the search space,
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound + task_rbf (A + ε) + bound_on_total_hep_workload A (A + F) /\
- F <= R.
-
- (* Now, we can leverage the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model with floating nonpreemptive regions. *)
- Theorem uniprocessor_response_time_bound_edf_with_floating_nonpreemptive_regions:
- response_time_bounded_by tsk R.
- Proof.
- move: (H_task_model_with_floating_nonpreemptive_regions) => [LIMJ JMLETM].
- move: (LIMJ) => [ZERO [LSMj [BEG [END HH]]]].
- ( try ( eapply uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => task_cost tsk)
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L0 := L) (job_max_nps0 := job_max_nps)
- (job_cost0 := job_cost ) ) ||
- eapply uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => task_cost tsk)
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L := L) (job_max_nps := job_max_nps)
- (job_cost := job_cost ) )
- ; eauto 2.
- { by apply model_with_fixed_preemption_points_is_correct. }
- { by eapply model_with_fixed_preemption_points_is_model_with_bounded_nonpreemptive_regions; eauto 2. }
- { split; last split.
- { intros j ARR POS.
- rewrite subn_gt0.
- rewrite subn1 -(leq_add2r 1) !addn1 prednK; last first.
- apply LSMj; try done.
- rewrite /job_last_nps /ModelWithLimitedPreemptions.job_last_nps
- ltnS /last0 -nth_last function_of_distances_is_correct.
- apply leq_trans with (job_max_nps j); first by apply distance_between_neighboring_elements_le_max_distance_in_seq.
- rewrite -END; last by done.
- by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- { by intros j ARR; rewrite leq_subLR leq_addl. }
- { intros ? ? ? ARR LE LS NCOMPL.
- rewrite subnBA in LS; last first.
- apply LSMj; try done.
- { rewrite lt0n; apply/negP; intros Z; move: Z => /eqP Z.
- by move: NCOMPL; rewrite /completed_by -ltnNge Z ltn0.
- }
- have EQ: exists Δ, t' = t + Δ.
- { exists (t' - t); rewrite subnKC; by done. }
- move: EQ => [Δ EQ]; subst t'; clear LE.
- rewrite -addnBAC in LS.
- rewrite addn1 in LS.
- apply H_schedule_with_limited_preemptions; first by done.
- rewrite /can_be_preempted_for_model_with_limited_preemptions; apply/negP.
- intros CONTR.
- move: NCOMPL; rewrite /completed_by -ltnNge; move => SERV.
- have NEQ: job_cost j - (job_last_nps j) < service sched j (t + Δ).
- { apply leq_trans with (service sched j t); first by done.
- rewrite /service /service_during [in X in _ <= X](@big_cat_nat _ _ _ t) //=.
- rewrite leq_addr //.
- rewrite leq_addr //.
- }
- clear LS.
- rewrite -END in NEQ, SERV; last by done.
- rewrite last_seq_minus_last_distance_seq in NEQ.
- rewrite /last0 -nth_last in SERV.
- have EQ := antidensity_of_nondecreasing_seq.
- specialize (EQ (job_preemption_points j) (service sched j (t + Δ)) (size (job_preemption_points j)).-2).
- rewrite CONTR in EQ.
- feed_n 2 EQ; first by eauto 2.
- {
- apply/andP; split; first by done.
- rewrite prednK; first by done.
- rewrite -(leq_add2r 1) !addn1 prednK.
- try ( eapply number_of_preemption_points_at_least_two with (job_cost0 := job_cost); eauto 2 ) ||
- eapply number_of_preemption_points_at_least_two with (job_cost := job_cost); eauto 2.
- try ( eapply list_of_preemption_point_is_not_empty with (job_cost0 := job_cost); eauto 2 ) ||
- eapply list_of_preemption_point_is_not_empty with (job_cost := job_cost); eauto 2.
- }
- by done.
- eauto 2.
- rewrite -END; last by done.
- apply leq_trans with (job_max_nps j).
- - by apply last_of_seq_le_max_of_seq.
- - by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- }
- {
- split.
- - by rewrite /task_lock_in_service_le_task_cost.
- - intros j ARR TSK.
- apply leq_trans with (job_cost j); first by rewrite leq_subr.
- by rewrite -TSK; eauto 2.
- }
- {
- rewrite subnn.
- intros.
- apply H_R_is_maximum in H.
- move: H => [F [EQ LE]].
- exists F.
- by rewrite subn0 addn0; split.
- }
- Qed.
-
- End RTAforModelWithFloatingNonpreemptiveRegionsWithArrivalCurves.
-
- End Analysis.
-
-End RTAforConcreteModels.
diff --git a/classic/model/schedule/uni/limited/edf/nonpr_reg/response_time_bound.v b/classic/model/schedule/uni/limited/edf/nonpr_reg/response_time_bound.v
deleted file mode 100644
index 0cdc3e9f19495372ce804f13f57e5f2caf6744c3..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/edf/nonpr_reg/response_time_bound.v
+++ /dev/null
@@ -1,343 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.limited.platform.definitions
- prosa.classic.model.schedule.uni.limited.platform.priority_inversion_is_bounded
- prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.busy_interval
- prosa.classic.model.schedule.uni.limited.edf.response_time_bound
- prosa.classic.model.schedule.uni.limited.rbf.
-Require Import prosa.classic.model.arrival.curves.bounds.
-Require Import prosa.classic.analysis.uni.arrival_curves.workload_bound.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * RTA for EDF-schedulers with bounded nonpreemprive segments *)
-(** In this module we prove a general RTA theorem for EDF-schedulers. *)
-Module RTAforEDFwithBoundedNonpreemptiveSegmentsWithArrivalCurves.
-
- Import Job ArrivalCurves TaskArrival Priority UniprocessorSchedule Workload Service
- ResponseTime MaxArrivalsWorkloadBound LimitedPreemptionPlatform RBF
- AbstractRTAforEDFwithArrivalCurves BusyIntervalJLFP PriorityInversionIsBounded.
-
- Section Analysis.
-
- Context {Task: eqType}.
- Variable task_max_nps task_cost: Task -> time.
- Variable task_deadline: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_max_nps job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* For clarity, let's denote the relative deadline of a task as D. *)
- Let D tsk := task_deadline tsk.
-
- (* The relative deadline of a job is equal to the deadline of the corresponding task. *)
- Let job_relative_deadline j := D (job_task j).
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals... *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume we have sequential jobs, i.e, jobs from the same
- task execute in the order of their arrival. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
-
- (* Consider the EDF policy that indicates a higher-or-equal priority relation. *)
- Let higher_eq_priority: JLFP_policy Job := EDF job_arrival job_relative_deadline.
-
- (* We consider an arbitrary function can_be_preempted which defines
- a preemption model with bounded nonpreemptive segments. *)
- Variable can_be_preempted: Job -> time -> bool.
- Let preemption_time := preemption_time sched can_be_preempted.
- Hypothesis H_correct_preemption_model:
- correct_preemption_model arr_seq sched can_be_preempted.
- Hypothesis H_model_with_bounded_nonpreemptive_segments:
- model_with_bounded_nonpreemptive_segments
- job_cost job_task arr_seq can_be_preempted job_max_nps task_max_nps.
-
- (* Next, we assume that the schedule is a work-conserving schedule... *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* ... and the schedule respects the policy defined by the
- can_be_preempted function (i.e., bounded nonpreemptive segments). *)
- Hypothesis H_respects_policy:
- respects_JLFP_policy_at_preemption_point
- job_arrival job_cost arr_seq sched can_be_preempted higher_eq_priority.
-
- (* Consider an arbitrary task set ts. *)
- Variable ts: list Task.
-
- (* Assume that all jobs come from the task set... *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...and the cost of a job cannot be larger than the task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Let max_arrivals be a family of proper arrival curves, i.e., for any task tsk in ts
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is a monotonic function
- that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_family_of_proper_arrival_curves:
- family_of_proper_arrival_curves job_task arr_seq max_arrivals ts.
-
- (* Consider a proper job lock-in service and task lock-in functions, i.e... *)
- Variable job_lock_in_service: Job -> time.
- Variable task_lock_in_service: Task -> time.
-
- (* ...we assume that for all jobs in the arrival sequence the lock-in service is
- (1) positive, (2) no bigger than costs of the corresponding jobs, and (3) a job
- becomes nonpreemptive after it reaches its lock-in service... *)
- Hypothesis H_proper_job_lock_in_service:
- proper_job_lock_in_service job_cost arr_seq sched job_lock_in_service.
-
- (* ...and that [task_lock_in_service tsk] is (1) no bigger than tsk's cost, (2) for any
- job of task tsk job_lock_in_service is bounded by task_lock_in_service. *)
- Hypothesis H_proper_task_lock_in_service:
- proper_task_lock_in_service
- task_cost job_task arr_seq job_lock_in_service task_lock_in_service tsk.
-
- (* We introduce as an abbreviation "rbf" for the task request bound function,
- which is defined as [task_cost(T) × max_arrivals(T,Δ)] for a task T. *)
- Let rbf := task_request_bound_function task_cost max_arrivals.
-
- (* Next, we introduce task_rbf as an abbreviation for the task
- request bound function of task tsk. *)
- Let task_rbf := rbf tsk.
-
- (* Using the sum of individual request bound functions, we define the request bound
- function of all tasks (total request bound function). *)
- Let total_rbf := total_request_bound_function task_cost max_arrivals ts.
-
- (* Next, we define an upper bound on interfering workload received from jobs
- of other tasks with higher-than-or-equal priority. *)
- Let bound_on_total_hep_workload A Δ :=
- \sum_(tsk_o <- ts | tsk_o != tsk)
- rbf tsk_o (minn ((A + ε) + D tsk - D tsk_o) Δ).
-
- (* Let's define some local names for clarity. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_backlogged_at := backlogged job_arrival job_cost sched.
- Let arrivals_between := jobs_arrived_between arr_seq.
- Let task_rbf_changes_at A := task_rbf_changes_at task_cost max_arrivals tsk A.
- Let bound_on_total_hep_workload_changes_at :=
- bound_on_total_hep_workload_changes_at task_cost task_deadline ts max_arrivals tsk.
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let max_length_of_priority_inversion :=
- max_length_of_priority_inversion job_max_nps arr_seq higher_eq_priority.
-
- (* We also define a bound for the priority inversion caused by jobs with lower priority. *)
- Definition blocking_bound :=
- \max_(tsk_other <- ts | (tsk_other != tsk) && (D tsk < D tsk_other))
- (task_max_nps tsk_other - ε).
-
- (** ** Priority inversion is bounded *)
- (** In this section, we prove that a priority inversion for task tsk is bounded by
- the maximum length of nonpreemtive segments among the tasks with lower priority. *)
- Section PriorityInversionIsBounded.
-
- (* First, we prove that the maximum length of a priority inversion of job j is
- bounded by the maximum length of a nonpreemptive section of a task with
- lower-priority task (i.e., the blocking term). *)
- Lemma priority_inversion_is_bounded_by_blocking:
- forall j t,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- t <= job_arrival j ->
- max_length_of_priority_inversion j t <= blocking_bound.
- Proof.
- intros j t ARR TSK LE.
- unfold max_length_of_priority_inversion, blocking_bound.
- apply leq_trans with
- (\max_(j_lp <- jobs_arrived_between arr_seq 0 t |
- ~~ higher_eq_priority j_lp j)
- (task_max_nps (job_task j_lp) - ε)
- ).
- { apply leq_big_max.
- intros j' JINB NOTHEP.
- specialize (H_job_cost_le_task_cost j').
- feed H_job_cost_le_task_cost.
- { apply mem_bigcat_nat_exists in JINB.
- by move: JINB => [ta' [JIN' _]]; exists ta'.
- }
- rewrite leq_sub2r //.
- apply in_arrivals_implies_arrived in JINB.
- move: (H_model_with_bounded_nonpreemptive_segments j' JINB) => [_ [_ [T _]]].
- by apply T.
- }
- { apply /bigmax_leq_seqP.
- intros j' JINB NOTHEP.
- apply leq_bigmax_cond_seq with
- (x := (job_task j')) (F := fun tsk => task_max_nps tsk - 1).
- { apply H_all_jobs_from_taskset.
- apply mem_bigcat_nat_exists in JINB.
- by inversion JINB as [ta' [JIN' _]]; exists ta'. }
- { have NINTSK: job_task j' != tsk.
- { apply/eqP; intros TSKj'.
- rewrite /higher_eq_priority /EDF -ltnNge in NOTHEP.
- rewrite /job_relative_deadline TSKj' TSK ltn_add2r in NOTHEP.
- move: NOTHEP; rewrite ltnNge; move => /negP T; apply: T.
- apply leq_trans with t; last by done.
- eapply in_arrivals_implies_arrived_between in JINB; last by eauto 2.
- move: JINB; move => /andP [_ T].
- by apply ltnW.
- }
- apply/andP; split; first by done.
- rewrite /higher_eq_priority /EDF /job_relative_deadline -ltnNge in NOTHEP.
- rewrite -TSK.
- have ARRLE: job_arrival j' < job_arrival j.
- { apply leq_trans with t; last by done.
- eapply in_arrivals_implies_arrived_between in JINB; last by eauto 2.
- by move: JINB; move => /andP [_ T].
- }
- have F: forall a b c d, a + b < c + d -> a > c -> b < d.
- { clear.
- intros.
- rewrite -addn1 -addnA -leq_subLR -addnBAC in H; last by apply ltnW.
- rewrite addn1 addnS in H.
- rewrite -subn_gt0 in H0.
- apply ltn_trans with (a - c + b); last by done.
- lia.
- }
- eapply F; eauto 2.
- }
- }
- Qed.
-
- (* Using the lemma above, we prove that the priority inversion of the task is bounded by
- the maximum length of a nonpreemptive section of lower-priority tasks. *)
- Lemma priority_inversion_is_bounded:
- priority_inversion_is_bounded_by
- job_arrival job_cost job_task arr_seq sched higher_eq_priority tsk blocking_bound.
- Proof.
- intros j ARR TSK POS t1 t2 PREF.
- move: (PREF) => [_ [_ [_ /andP [T _]]]].
- case NEQ: (t2 - t1 <= blocking_bound).
- { apply leq_trans with (t2 - t1); last by done.
- rewrite /cumulative_priority_inversion /is_priority_inversion.
- rewrite -[X in _ <= X]addn0 -[t2 - t1]mul1n -iter_addn -big_const_nat.
- rewrite leq_sum //.
- intros t _; case: (sched t); last by done.
- by intros s; case: (higher_eq_priority).
- }
- move: NEQ => /negP /negP; rewrite -ltnNge; move => NEQ.
- have PPE := preemption_time_exists
- task_max_nps job_arrival job_max_nps job_cost job_task arr_seq
- _ sched _ _ _ higher_eq_priority _ _ can_be_preempted
- _ _ _ _ j _ _ t1 t2.
- feed_n 13 PPE; try done.
- { by apply EDF_is_reflexive. }
- { by apply EDF_is_transitive. }
- move: PPE => [ppt [PPT /andP [GE LE]]].
- apply leq_trans with (cumulative_priority_inversion sched higher_eq_priority j t1 ppt);
- last apply leq_trans with (ppt - t1).
- { rewrite /cumulative_priority_inversion /is_priority_inversion.
- rewrite (@big_cat_nat _ _ _ ppt) //=.
- rewrite -[X in _ <= X]addn0 leq_add2l.
- rewrite leqn0.
- rewrite big_nat_cond big1 //; move => t /andP [/andP [GEt LTt] _ ].
- case SCHED: (sched t) => [s | ]; last by done.
- have SCHEDHP := not_quiet_implies_exists_scheduled_hp_job
- task_max_nps job_arrival job_max_nps job_cost job_task arr_seq
- _ sched _ _ _ higher_eq_priority _ _ can_be_preempted
- _ _ _ _ j _ _ t1 t2 _ (ppt - t1) _ t.
- feed_n 15 SCHEDHP; try done.
- { by apply EDF_is_reflexive. }
- { by apply EDF_is_transitive. }
- { exists ppt; split. by done. by rewrite subnKC //; apply/andP; split. }
- { by rewrite subnKC //; apply/andP; split. }
- move: SCHEDHP => [j_hp [ARRB [HP SCHEDHP]]].
- apply/eqP; rewrite eqb0 Bool.negb_involutive.
- have EQ: s = j_hp.
- { by ( try ( apply only_one_job_scheduled with (sched0 := sched) (t0 := t) ) ||
- apply only_one_job_scheduled with (sched := sched) (t := t) ); [apply/eqP | ]. }
- by rewrite EQ.
- rewrite ltn_subRL in NEQ.
- apply leq_trans with (t1 + blocking_bound); last by apply ltnW.
- apply leq_trans with (t1 + max_length_of_priority_inversion j t1); first by done.
- by rewrite leq_add2l; eapply priority_inversion_is_bounded_by_blocking; eauto 2.
- }
- { rewrite /cumulative_priority_inversion /is_priority_inversion.
- rewrite -[X in _ <= X]addn0 -[ppt - t1]mul1n -iter_addn -big_const_nat.
- rewrite leq_sum //.
- intros t _; case: (sched t); last by done.
- by intros s; case: higher_eq_priority.
- }
- { rewrite leq_subLR.
- apply leq_trans with (t1 + max_length_of_priority_inversion j t1); first by done.
- rewrite leq_add2l; eapply priority_inversion_is_bounded_by_blocking; eauto 2.
- }
- Qed.
-
- End PriorityInversionIsBounded.
-
- (** ** Response-Time Bound *)
- (** In this section, we prove that the maximum among the solutions of the response-time
- bound recurrence is a response-time bound for tsk. *)
- Section ResponseTimeBound.
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = total_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A :=
- (A < L) && (task_rbf_changes_at A || bound_on_total_hep_workload_changes_at A).
-
- (* Consider any value R, and assume that for any given arrival offset A in the search space,
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound
- + (task_rbf (A + ε) - (task_cost tsk - task_lock_in_service tsk))
- + bound_on_total_hep_workload A (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
-
- (* Then, using the results for the general RTA for EDF-schedulers, we establish a
- response-time bound for the more concrete model of bounded nonpreemptive segments.
- Note that in case of the general RTA for EDF-schedulers, we just _assume_ that
- the priority inversion is bounded. In this module we provide the preemption model
- with bounded nonpreemptive segments and _prove_ that the priority inversion is
- bounded. *)
- Theorem uniprocessor_response_time_bound_edf_with_bounded_nonpreemptive_segments:
- response_time_bounded_by tsk R.
- Proof.
- eapply uniprocessor_response_time_bound_edf; eauto 2.
- by apply priority_inversion_is_bounded.
- Qed.
-
- End ResponseTimeBound.
-
- End Analysis.
-
-End RTAforEDFwithBoundedNonpreemptiveSegmentsWithArrivalCurves.
diff --git a/classic/model/schedule/uni/limited/edf/response_time_bound.v b/classic/model/schedule/uni/limited/edf/response_time_bound.v
deleted file mode 100644
index ec3ae03b9a8f9a1af0ccc27cf7f3d1297f0f4bb4..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/edf/response_time_bound.v
+++ /dev/null
@@ -1,654 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time
- prosa.classic.model.schedule.uni.schedule_of_task.
-Require Import prosa.classic.model.schedule.uni.limited.platform.definitions
- prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.busy_interval
- prosa.classic.model.schedule.uni.limited.rbf
- prosa.classic.model.schedule.uni.limited.abstract_RTA.definitions
- prosa.classic.model.schedule.uni.limited.abstract_RTA.reduction_of_search_space
- prosa.classic.model.schedule.uni.limited.abstract_RTA.abstract_seq_rta
- prosa.classic.model.schedule.uni.limited.jlfp_instantiation.
-Require Import prosa.classic.model.arrival.curves.bounds.
-Require Import prosa.classic.analysis.uni.arrival_curves.workload_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Abstract RTA for EDF-schedulers *)
-(** In this module we propose the abstract response-time analysis (RTA) for
- EDF uniprocessor scheduling of real-time tasks with arbitrary arrival models. *)
-Module AbstractRTAforEDFwithArrivalCurves.
-
- Import Job ArrivalCurves TaskArrival ScheduleOfTask Priority
- UniprocessorSchedule Workload Service ResponseTime MaxArrivalsWorkloadBound
- BusyIntervalJLFP LimitedPreemptionPlatform RBF Service JLFPInstantiation.
-
- Section AbstractResponseTimeAnalysisForEDF.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
- Variable task_deadline: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* For clarity, let's denote the relative deadline of a task as D. *)
- Let D tsk := task_deadline tsk.
-
- (* The relative deadline of a job is equal to the deadline of the corresponding task. *)
- Let job_relative_deadline j := D (job_task j).
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Next, assume that the schedule is a work-conserving schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* Assume we have sequential jobs, i.e, jobs from the
- same task execute in the order of their arrival. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
-
- (* Assume that a job cost cannot be larger than a task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Consider an arbitrary task set ts. *)
- Variable ts: list Task.
-
- (* Next, we assume that all jobs come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Let max_arrivals be a family of proper arrival curves, i.e., for any task tsk in ts
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is a monotonic function
- that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_family_of_proper_arrival_curves:
- family_of_proper_arrival_curves job_task arr_seq max_arrivals ts.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Consider proper job lock-in service and task lock-in functions, i.e... *)
- Variable job_lock_in_service: Job -> time.
- Variable task_lock_in_service: Task -> time.
-
- (* ...we assume that for all jobs with positive cost in the arrival sequence the
- lock-in service is (1) positive, (2) no bigger than costs of the corresponding
- jobs, and (3) a job becomes nonpreemptive after it reaches its lock-in service... *)
- Hypothesis H_proper_job_lock_in_service:
- proper_job_lock_in_service job_cost arr_seq sched job_lock_in_service.
-
- (* ...and that [task_lock_in_service tsk] is (1) no bigger than tsk's cost, (2) for any
- job of task tsk job_lock_in_service is bounded by task_lock_in_service. *)
- Hypothesis H_proper_task_lock_in_service:
- proper_task_lock_in_service
- task_cost job_task arr_seq job_lock_in_service task_lock_in_service tsk.
-
- (* Consider the EDF policy that indicates a higher-or-equal priority relation.
- Note that we do not relate the EDF policy with the scheduler. However, we
- define functions for Interference and Interfering Workload that actively use
- the concept of priorities. *)
- Let EDF: JLFP_policy Job := EDF job_arrival job_relative_deadline.
-
- (* For simplicity, let's define some local names. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_backlogged_at := backlogged job_arrival job_cost sched.
- Let arrivals_between := jobs_arrived_between arr_seq.
- Let task_scheduled_at := task_scheduled_at job_task sched.
- Let quiet_time := quiet_time job_arrival job_cost arr_seq sched EDF.
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let cumulative_task_interference :=
- AbstractSeqRTA.cumul_task_interference job_task arr_seq sched.
-
- (* We introduce "rbf" as an abbreviation of the task request bound function,
- which is defined as [task_cost(T) × max_arrivals(T,Δ)] for some task T. *)
- Let rbf := task_request_bound_function task_cost max_arrivals.
-
- (* Next, we introduce task_rbf as an abbreviation
- of the task request bound function of task tsk. *)
- Let task_rbf := rbf tsk.
-
- (* Using the sum of individual request bound functions, we define the request bound
- function of all tasks (total request bound function). *)
- Let total_rbf := total_request_bound_function task_cost max_arrivals ts.
-
- (* Assume that there exists a constant priority_inversion_bound that bounds
- the length of any priority inversion experienced by any job of tsk.
- Sinse we analyze only task tsk, we ignore the lengths of priority
- inversions incurred by any other tasks. *)
- Variable priority_inversion_bound: time.
- Hypothesis H_priority_inversion_is_bounded:
- priority_inversion_is_bounded_by
- job_arrival job_cost job_task arr_seq sched EDF tsk priority_inversion_bound.
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = total_rbf L.
-
- (* Next, we define an upper bound on interfering workload received from jobs
- of other tasks with higher-than-or-equal priority. *)
- Let bound_on_total_hep_workload A Δ :=
- \sum_(tsk_o <- ts | tsk_o != tsk)
- rbf tsk_o (minn ((A + ε) + D tsk - D tsk_o) Δ).
-
- (* To reduce the time complexity of the analysis, we introduce the notion of search space for EDF.
- Intuitively, this corresponds to all "interesting" arrival offsets that the job under
- analysis might have with regard to the beginning of its busy-window. *)
-
- (* In case of search space for EDF we ask whether [task_rbf A ≠task_rbf (A + ε)]... *)
- Definition task_rbf_changes_at A := task_rbf A != task_rbf (A + ε).
-
- (* ...or there exists a task tsko from ts such that [tsko ≠tsk] and
- [rbf(tsko, A + D tsk - D tsko) ≠rbf(tsko, A + ε + D tsk - D tsko)].
- Note that we use a slightly uncommon notation [has (λ tsko ⇒ P tsko) ts]
- which can be interpreted as follows: task-set ts contains a task tsko such
- that a predicate P holds for tsko. *)
- Definition bound_on_total_hep_workload_changes_at A :=
- has (fun tsko =>
- (tsk != tsko)
- && (rbf tsko (A + D tsk - D tsko )
- != rbf tsko ((A + ε) + D tsk - D tsko))) ts.
-
- (* The final search space for EDF is a set of offsets that are less than L
- and where task_rbf or bound_on_total_hep_workload chages. *)
- Let is_in_search_space A :=
- (A < L) && (task_rbf_changes_at A || bound_on_total_hep_workload_changes_at A).
-
- (* Let R be a value that upper-bounds the solution of each response-time recurrence,
- i.e., for any relative arrival time A in the search space, there exists a corresponding
- solution F such that [F + (task cost - task lock-in service) <= R]. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = priority_inversion_bound
- + (task_rbf (A + ε) - (task_cost tsk - task_lock_in_service tsk))
- + bound_on_total_hep_workload A (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
-
-
- (* To use the theorem uniprocessor_response_time_bound_seq from the Abstract RTA module,
- we need to specify functions of interference, interfering workload and IBF. *)
-
- (* Instantiation of Interference *)
- (* We say that job j incurs interference at time t iff it cannot execute due to
- a higher-or-equal-priority job being scheduled, or if it incurs a priority inversion.
- (for more details see file limited.limited.jlfp_instantiation.v) *)
- Let interference (j: Job) (t: time) :=
- interference sched EDF j t.
-
- (* Instantiation of Interfering Workload *)
- (* The interfering workload, in turn, is defined as the sum of the priority inversion
- function and interfering workload of jobs with higher or equal priority.
- (for more details see file limited.limited.jlfp_instantiation.v) *)
- Let interfering_workload (j: Job) (t: time) := interfering_workload job_cost arr_seq sched EDF j t.
-
- (* Finally, we define the interference bound function as the sum of the priority
- interference bound and the higher-or-equal-priority workload. *)
- Let IBF A R := priority_inversion_bound + bound_on_total_hep_workload A R.
-
- (** ** Filling Out Hypothesis Of Abstract RTA Theorem *)
- (** In this section we prove that all hypotheses necessary to use the abstract theorem are satisfied. *)
- Section FillingOutHypothesesOfAbstractRTATheorem.
-
- (* First, we prove that in the instantiation of interference and interfering workload,
- we really take into account everything that can interfere with tsk's jobs, and thus,
- the scheduler satisfies the abstract notion of work conserving schedule. *)
- Lemma instantiated_i_and_w_are_coherent_with_schedule:
- AbstractRTADefinitions.work_conserving
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload.
- Proof.
- intros j t1 t2 t ARR TSK POS BUSY NEQ; split; intros HYP.
- { move: HYP => /negP.
- rewrite negb_or /is_priority_inversion /BusyIntervalJLFP.is_priority_inversion
- /is_interference_from_another_job_with_higher_eq_priority.
- move => /andP [HYP1 HYP2].
- case SCHED: (sched t) => [s | ].
- { rewrite SCHED in HYP1, HYP2.
- move: HYP1 HYP2.
- rewrite Bool.negb_involutive negb_and.
- move => HYP1 /orP [/negP HYP2| /eqP HYP2].
- - by exfalso.
- - rewrite Bool.negb_involutive in HYP2.
- move: HYP2 => /eqP /eqP HYP2.
- by subst s; rewrite /scheduled_at SCHED.
- }
- { exfalso; clear HYP1 HYP2.
- eapply instantiated_busy_interval_equivalent_busy_interval in BUSY; try done; first last.
- { by rewrite /JLFP_is_reflexive /reflexive /EDF /Priority.EDF. }
- { by apply job_task. }
- have EQ:= not_quiet_implies_not_idle
- job_arrival job_cost arr_seq
- _ sched EDF j _ _ _ _ _ t1 t2 _ t.
- feed_n 8 EQ; try done.
- { by rewrite /JLFP_is_reflexive /reflexive /EDF /Priority.EDF. }
- { by move: BUSY => [PREF _]. }
- by eapply EQ; apply/eqP.
- }
- }
- { move: HYP => /eqP HYP.
- apply/negP; rewrite /interference /JLFPInstantiation.interference /is_priority_inversion
- /BusyIntervalJLFP.is_priority_inversion
- /is_interference_from_another_job_with_higher_eq_priority
- HYP negb_or; apply/andP; split.
- - by rewrite Bool.negb_involutive /EDF /Priority.EDF.
- - by rewrite negb_and Bool.negb_involutive; apply/orP; right.
- }
- Qed.
-
- (* Next, we prove that the interference and interfering workload
- functions are consistent with sequential jobs. *)
- Lemma instantiated_interference_and_workload_consistent_with_sequential_jobs:
- AbstractSeqRTA.interference_and_workload_consistent_with_sequential_jobs
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload.
- Proof.
- intros j t1 t2 ARR TSK POS BUSY.
- eapply instantiated_busy_interval_equivalent_busy_interval in BUSY; try done; first last.
- { by rewrite /JLFP_is_reflexive /reflexive /EDF /Priority.EDF. }
- { by apply job_task. }
- eapply all_jobs_have_completed_equiv_workload_eq_service; eauto 2.
- intros s INs TSKs.
- rewrite /arrivals_between in INs.
- move: (INs) => NEQ.
- eapply in_arrivals_implies_arrived_between in NEQ; eauto 2.
- move: NEQ => /andP [_ JAs].
- move: (BUSY) => [[ _ [QT [_ /andP [JAj _]]] _]].
- apply QT; try done.
- - eapply in_arrivals_implies_arrived; eauto 2.
- - unfold EDF, Priority.EDF.
- move: TSKs => /eqP TSKs.
- rewrite /job_relative_deadline TSK TSKs leq_add2r.
- by apply leq_trans with t1; [apply ltnW | ].
- Qed.
-
- (* Recall that L is assumed to be a fixed point of the busy interval recurrence. Thanks to
- this fact, we can prove that every busy interval (according to the concrete definition)
- is bounded. In addition, we know that the conventional concept of busy interval and the
- one obtained from the abstract definition (with the interference and interfering
- workload) coincide. Thus, it follows that any busy interval (in the abstract sense)
- is bounded. *)
- Lemma instantiated_busy_intervals_are_bounded:
- AbstractRTADefinitions.busy_intervals_are_bounded_by
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload L.
- Proof.
- intros j ARR TSK POS.
- have EX := exists_busy_interval_from_total_workload_bound
- job_arrival job_cost arr_seq _ sched _
- EDF _ _ _ _ _ L _ _ j ARR POS.
- feed_n 9 EX; try eauto 2.
- { by unfold JLFP_is_reflexive, reflexive, EDF, Priority.EDF. }
- { intros.
- rewrite {2}H_fixed_point.
- apply total_workload_le_total_rbf'' with job_task; try done.
- by intros tsk0 IN0; move: (H_family_of_proper_arrival_curves tsk0 IN0) => [ARRB _].
- }
- move: EX => [t1 [t2 [H1 [H2 GGG]]]].
- exists t1, t2; split; first by done.
- split; first by done.
- eapply instantiated_busy_interval_equivalent_busy_interval; eauto 2.
- by unfold JLFP_is_reflexive, reflexive, EDF, Priority.EDF.
- Qed.
-
- (* Next, we prove that IBF is indeed an interference bound.
-
- Recall that in module abstract_seq_RTA hypothesis task_interference_is_bounded_by expects
- to receive a function that maps some task t, the relative arrival time of a job j of task t,
- and the length of the interval to the maximum amount of interference (for more details see
- files limited.abstract_RTA.definitions and limited.abstract_RTA.abstract_seq_rta).
-
- However, in this module we analyze only one task -- tsk, therefore it is “hardcodedâ€
- inside the interference bound function IBF. Therefore, in order for the IBF signature to
- match the required signature in module abstract_seq_RTA, we wrap the IBF function in a
- function that accepts, but simply ignores the task. *)
- Lemma instantiated_task_interference_is_bounded:
- AbstractSeqRTA.task_interference_is_bounded_by
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload
- (fun tsk A R => IBF A R).
- Proof.
- clear H_R_is_maximum R.
- intros j R t1 t2 ARR TSK N NCOMPL BUSY.
- move: (posnP (job_cost j)) => [ZERO|POS].
- { exfalso.
- move: NCOMPL => /negP COMPL; apply: COMPL.
- by rewrite /is_response_time_bound_of_job /completed_by ZERO.
- }
- move: (BUSY) => [[/andP [JINBI JINBI2] [QT _]] _].
- set (A := job_arrival j - t1) in *.
- have L2 := JLFPInstantiation.cumulative_task_interference_split
- job_arrival job_cost job_task arr_seq sched _ EDF _ tsk
- j.
- rewrite L2; first last; try done.
- { by eapply arrived_between_implies_in_arrivals; eauto. }
- { by unfold EDF, job_relative_deadline; eapply EDF_respects_sequential_jobs; eauto. }
- rewrite /I leq_add //.
- { unfold priority_inversion_is_bounded_by in *.
- apply leq_trans with (cumulative_priority_inversion sched EDF j t1 t2).
- { rewrite [X in _ <= X](@big_cat_nat _ _ _ (t1 + R)) //=.
- - by rewrite leq_addr.
- - by rewrite /is_priority_inversion leq_addr.
- - by rewrite ltnW.
- }
- { apply H_priority_inversion_is_bounded; try done.
- eapply instantiated_busy_interval_equivalent_busy_interval in BUSY; try done.
- { by move: BUSY => [PREF _]. }
- { by apply job_task. }
- { by rewrite /JLFP_is_reflexive /reflexive /EDF /Priority.EDF. }
- }
- }
- { rewrite
- (instantiated_cumulative_interference_of_hep_tasks_equal_total_interference_of_hep_tasks
- job_arrival job_cost _ arr_seq
- ); try done; first last.
- rewrite instantiated_quiet_time_equivalent_edf_quiet_time //.
- { by apply job_task. }
- { by rewrite /JLFP_is_reflexive /reflexive /EDF /Priority.EDF. }
- apply leq_trans with
- (workload_of_jobs job_cost (arrivals_between t1 (t1 + R))
- (fun jhp : Job => EDF jhp j && (job_task jhp != job_task j))).
- { apply service_of_jobs_le_workload; try done. }
- { rewrite /bound_on_total_hep_workload /rbf /total_ohep_request_bound_function_FP
- /task_request_bound_function
- /workload_of_jobs /arrivals_between.
- set l := jobs_arrived_between arr_seq t1 (t1 + R).
- apply leq_trans with
- (\sum_(tsk_o <- ts | tsk_o != tsk)
- (\sum_(j0 <- l | EDF j0 j && (job_task j0 == tsk_o)) job_cost j0)).
- { intros.
- have EXCHANGE := exchange_big_dep (fun j0 => EDF j0 j && (job_task j0 != job_task j)).
- rewrite EXCHANGE /=; last first.
- { move => tsko jo /negP NEQ /andP [EQ1 /eqP EQ2].
- rewrite EQ1 Bool.andb_true_l; apply/negP; intros CONTR.
- apply: NEQ; clear EQ1.
- by rewrite -TSK -EQ2.
- }
- rewrite /workload_of_jobs /l big_seq_cond [X in _ <= X]big_seq_cond.
- apply leq_sum; move => jo /andP [ARRo /andP [HEQ TSKo]].
- rewrite (big_rem (job_task jo)) //=.
- rewrite HEQ eq_refl -TSK TSKo andTb andTb leq_addr //.
- eapply H_all_jobs_from_taskset, in_arrivals_implies_arrived; eauto 2.
- }
- apply leq_sum_seq; intros tsko INtsko NEQT.
- case NEQ: (R <= job_arrival j - t1 + ε + task_deadline tsk - task_deadline tsko).
- { move: (NEQ) => /minn_idPl => MIN.
- rewrite minnC in MIN; rewrite MIN; clear MIN.
- apply leq_trans with (task_cost tsko * num_arrivals_of_task job_task arr_seq tsko t1 (t1 + R)).
- { apply leq_trans with (\sum_(j0 <- l | job_task j0 == tsko) job_cost j0).
- { rewrite big_mkcond [X in _ <= X]big_mkcond //= leq_sum //.
- by intros s _; case (job_task s == tsko); case (EDF s j). }
- { rewrite /num_arrivals_of_task -sum1_size big_distrr /= big_filter.
- rewrite -/l /workload_of_jobs.
- rewrite /is_job_of_task muln1.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- rewrite -EQ.
- apply H_job_cost_le_task_cost.
- by apply in_arrivals_implies_arrived in IN0.
- }
- }
- { rewrite leq_mul2l; apply/orP; right.
- rewrite -{2}[R](addKn t1).
- move: (H_family_of_proper_arrival_curves tsko INtsko) => [ARRB _].
- by apply ARRB; rewrite leq_addr.
- }
- }
- { apply negbT in NEQ; rewrite -ltnNge in NEQ; apply ltnW in NEQ.
- move: (NEQ) => /minn_idPr => MIN.
- rewrite minnC in MIN; rewrite MIN; clear MIN.
- set (V := job_arrival j - t1 + ε + task_deadline tsk - task_deadline tsko) in *.
- apply leq_trans with (task_cost tsko * num_arrivals_of_task job_task arr_seq tsko t1 (t1 + V)).
- { unfold l.
- apply leq_trans with
- (\sum_(jo <- jobs_arrived_between arr_seq t1 (t1 + V) | EDF jo j && (job_task jo == tsko))
- job_cost jo).
- { rewrite (job_arrived_between_cat _ _ (t1 + V)); [ |rewrite leq_addr //|rewrite leq_add2l //].
- rewrite big_cat //=.
- rewrite -[X in _ <= X]addn0 leq_add2l leqn0.
- rewrite big_seq_cond.
- apply/eqP; apply big_pred0.
- intros jo; apply/negP; intros CONTR.
- move: CONTR => /andP [ARRIN /andP [HEP /eqP TSKo]].
- unfold EDF, Priority.EDF in HEP.
- eapply in_arrivals_implies_arrived_between in ARRIN; eauto 2.
- move: ARRIN => /andP [ARRIN _]; unfold V in ARRIN.
- have EQ1: job_relative_deadline jo = task_deadline tsko;
- first by rewrite /job_relative_deadline TSKo.
- rewrite EQ1 in HEP; clear EQ1.
- have EQ2: job_relative_deadline j = task_deadline tsk;
- first by rewrite /job_relative_deadline TSK.
- rewrite EQ2 in HEP; clear EQ2.
- case NEQ2: (task_deadline tsko <= job_arrival j - t1 + ε + task_deadline tsk).
- { move: ARRIN; rewrite leqNgt; move => /negP ARRIN; apply: ARRIN.
- rewrite -(ltn_add2r (task_deadline tsko)).
- apply leq_ltn_trans with (job_arrival j + task_deadline tsk); first by done.
- rewrite addnBA; last by done.
- rewrite addnA addnA.
- rewrite subnKC; last by done.
- rewrite subnK.
- - by rewrite ltn_add2r addn1.
- - apply leq_trans with (job_arrival j - t1 + ε + task_deadline tsk); first by done.
- by rewrite !leq_add2r leq_subr.
- }
- { apply negbT in NEQ2; rewrite -ltnNge in NEQ2.
- move: HEP; rewrite leqNgt; move => /negP HEP; apply: HEP.
- apply leq_ltn_trans with (job_arrival jo + (job_arrival j - t1 + task_deadline tsk)).
- { rewrite addnBAC; last by done.
- rewrite addnBA; last apply leq_trans with (job_arrival j); [ | by done | by rewrite leq_addr].
- rewrite [in X in _ <= X]addnC.
- rewrite -addnBA; first by rewrite leq_addr.
- by apply leq_trans with (t1 + (job_arrival j - t1 + ε + task_deadline tsk - task_deadline tsko)); first rewrite leq_addr.
- }
- { rewrite ltn_add2l.
- apply leq_ltn_trans with (job_arrival j - t1 + ε + task_deadline tsk); last by done.
- by rewrite leq_add2r leq_addr.
- }
- }
- }
- {
- intros.
- apply leq_trans with
- (\sum_(jo <- jobs_arrived_between arr_seq t1 (t1 + V) | job_task jo == tsko) job_cost jo).
- { rewrite big_mkcond [X in _ <= X]big_mkcond //=.
- rewrite leq_sum //; intros s _.
- by case (EDF s j).
- }
- { rewrite /num_arrivals_of_task -sum1_size big_distrr /= big_filter.
- rewrite /is_job_of_task muln1.
- apply leq_sum_seq; move => j0 IN0 /eqP EQ.
- rewrite -EQ.
- apply H_job_cost_le_task_cost.
- by apply in_arrivals_implies_arrived in IN0.
- }
- }
- }
- { rewrite leq_mul2l; apply/orP; right.
- rewrite -{2}[V](addKn t1).
- move: (H_family_of_proper_arrival_curves tsko INtsko) => [ARRB _].
- by apply ARRB; rewrite leq_addr.
- }
- }
- }
- }
-
- Qed.
-
- (* Finally, we show that there exists a solution for the response-time recurrence. *)
- Section SolutionOfResponseTimeReccurenceExists.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* Given any job j of task tsk that arrives exactly A units after the beginning of
- the busy interval, the bound of the total interference incurred by j within an
- interval of length Δ is equal to [task_rbf (A + ε) - task_cost tsk + IBF(A, Δ)]. *)
- Let total_interference_bound tsk A Δ :=
- task_rbf (A + ε) - task_cost tsk + IBF A Δ.
-
- (* Next, consider any A from the search space (in abstract sence). *)
- Variable A: time.
- Hypothesis H_A_is_in_abstract_search_space:
- AbstractRTAReduction.is_in_search_space tsk L total_interference_bound A.
-
- (* We prove that A is also in the concrete search space. *)
- Lemma A_is_in_concrete_search_space:
- is_in_search_space A.
- Proof.
- unfold total_interference_bound in *.
- unfold AbstractRTAReduction.is_in_search_space in H_A_is_in_abstract_search_space.
- unfold is_in_search_space in H_R_is_maximum.
- move: H_A_is_in_abstract_search_space => [INSP | [/andP [POSA LTL] [x [LTx INSP2]]]].
- { subst A.
- apply/andP; split; first by done.
- apply/orP; left.
- unfold task_rbf_changes_at. rewrite neq_ltn; apply/orP; left.
- rewrite /task_rbf /rbf. erewrite rbf.RBF.task_rbf_0_zero; eauto 2.
- rewrite add0n /task_rbf.
- apply leq_trans with (task_cost tsk).
- + apply leq_trans with (job_cost j); try eauto 2.
- by rewrite -H_job_of_tsk; apply H_job_cost_le_task_cost.
- + by eapply rbf.RBF.task_rbf_1_ge_task_cost; eauto 2.
- }
- { apply/andP; split; first by done.
- apply/negPn/negP; intros EQ; move: EQ => /eqP EQ.
- apply INSP2.
- move: EQ; rewrite negb_or eqb_id Bool.negb_involutive; move => /andP [/eqP EQ1 /hasPn EQ2].
- unfold task_rbf, rbf in EQ1.
- rewrite subn1 addn1 prednK; last by done.
- rewrite /task_rbf /rbf -EQ1.
- apply/eqP; rewrite eqn_add2l eqn_add2l.
- unfold bound_on_total_hep_workload .
- have Abs:
- forall (T: eqType) (xs: seq T) f1 f2 (P: _ -> bool),
- (forall x, x \in xs -> P x -> f1 x == f2 x) ->
- \sum_(x <- xs | P x) f1 x == \sum_(x <- xs | P x) f2 x.
- { clear.
- intros.
- rewrite big_seq_cond [X in _ == X]big_seq_cond.
- rewrite big_mkcond [X in _ == X]big_mkcond //=.
- rewrite eqn_leq; apply/andP; split; rewrite leq_sum //; intros i _.
- - case IN: (i \in xs); last by done.
- case Pi: (P i); simpl; last by done.
- apply H in IN; last by done.
- by move: IN => /eqP IN; rewrite IN.
- - case IN: (i \in xs); last by done.
- case Pi: (P i); simpl; last by done.
- apply H in IN; last by done.
- by move: IN => /eqP IN; rewrite IN.
- }
- apply: Abs; intros tsk_o IN NEQ.
- rewrite addn1 prednK; last by done.
- move: (EQ2 tsk_o IN); clear EQ2.
- rewrite eq_sym NEQ Bool.andb_true_l Bool.negb_involutive; move => /eqP EQ2.
- case CASE: (A + ε + task_deadline tsk - task_deadline tsk_o <= x).
- { have F1: minn (A + task_deadline tsk - task_deadline tsk_o) x =
- A + task_deadline tsk - task_deadline tsk_o.
- { rewrite minnE.
- have CASE2: A + task_deadline tsk - task_deadline tsk_o <= x.
- { apply leq_trans with (A + ε + task_deadline tsk - task_deadline tsk_o).
- - by apply leq_sub2r; rewrite leq_add2r leq_addr.
- - by done.
- }
- move: CASE2; rewrite -subn_eq0; move => /eqP CASE2; rewrite CASE2.
- by rewrite subn0.
- }
- have F2: minn (A + ε + task_deadline tsk - task_deadline tsk_o) x =
- A + ε + task_deadline tsk - task_deadline tsk_o.
- { rewrite minnE.
- move: CASE; rewrite -subn_eq0; move => /eqP CASE; rewrite CASE.
- by rewrite subn0.
- }
- by apply/eqP; rewrite F1 F2.
- }
- { move: CASE => /negP /negP; rewrite -ltnNge; move => CASE.
- have F1: minn (A + task_deadline tsk - task_deadline tsk_o) x = x.
- { rewrite minnE; rewrite subKn //.
- rewrite -(leq_add2r 1) !addn1.
- rewrite -subSn.
- { rewrite -[in X in _ <= X]addn1.
- by rewrite -addnA [_ + 1]addnC addnA.
- }
- { intros.
- have POS := @leq_ltn_trans _ 0 _ _ CASE.
- feed POS; first by done.
- by rewrite subn_gt0 -addnA [1 + _]addnC addnA addn1 ltnS in POS.
- }
- }
- have F2: minn (A + ε + task_deadline tsk - task_deadline tsk_o) x = x.
- { by rewrite minnE; rewrite subKn // ltnW. }
- by apply/eqP; rewrite F1 F2.
- }
- }
- Qed.
-
- (* Then, there exists solution for response-time recurrence (in the abstract sense). *)
- Corollary correct_search_space:
- exists F,
- A + F = task_rbf (A + ε) - (task_cost tsk - task_lock_in_service tsk) + IBF A (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
- Proof.
- unfold total_interference_bound in *.
- unfold AbstractRTAReduction.is_in_search_space in H_A_is_in_abstract_search_space.
- unfold is_in_search_space in H_R_is_maximum.
- move: (H_R_is_maximum A) => FIX.
- feed FIX; first by apply A_is_in_concrete_search_space.
- move: FIX => [F [FIX NEQ]].
- exists F; split; last by done.
- apply/eqP; rewrite {1}FIX.
- by rewrite addnA [_ + priority_inversion_bound]addnC -!addnA.
- Qed.
-
- End SolutionOfResponseTimeReccurenceExists.
-
- End FillingOutHypothesesOfAbstractRTATheorem.
-
- (** ** Final Theorem *)
- (* Based on the properties established above, we apply the abstract analysis
- framework to infer that R is a response-time bound for tsk. *)
- Theorem uniprocessor_response_time_bound_edf:
- response_time_bounded_by tsk R.
- Proof.
- intros js ARRs TSKs.
- move: (posnP (job_cost js)) => [ZERO|POS].
- { by rewrite /is_response_time_bound_of_job /completed_by ZERO. }
- try ( eapply AbstractSeqRTA.uniprocessor_response_time_bound_seq with
- (interference0 := interference) (interfering_workload0 := interfering_workload)
- (task_interference_bound_function := fun tsk A R => IBF A R) (L0 := L); eauto 3 ) ||
- eapply AbstractSeqRTA.uniprocessor_response_time_bound_seq with
- (interference := interference) (interfering_workload := interfering_workload)
- (task_interference_bound_function := fun tsk A R => IBF A R) (L := L); eauto 3.
- - by apply instantiated_i_and_w_are_coherent_with_schedule.
- - by apply instantiated_interference_and_workload_consistent_with_sequential_jobs.
- - by apply instantiated_busy_intervals_are_bounded.
- - by apply instantiated_task_interference_is_bounded.
- - by eapply correct_search_space; eauto 2.
- Qed.
-
- End AbstractResponseTimeAnalysisForEDF.
-
-End AbstractRTAforEDFwithArrivalCurves.
diff --git a/classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/concrete_models/response_time_bound.v b/classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/concrete_models/response_time_bound.v
deleted file mode 100644
index 52d1fd6d794e553d3810895db68eb51b72cbf347..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/concrete_models/response_time_bound.v
+++ /dev/null
@@ -1,630 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.fixed_priority.nonpr_reg.response_time_bound
- prosa.classic.model.schedule.uni.limited.rbf.
-Require Import prosa.classic.model.arrival.curves.bounds
- prosa.classic.analysis.uni.arrival_curves.workload_bound.
-Require Import prosa.classic.model.schedule.uni.nonpreemptive.schedule
- prosa.classic.model.schedule.uni.limited.platform.limited
- prosa.classic.model.schedule.uni.limited.platform.preemptive
- prosa.classic.model.schedule.uni.limited.platform.nonpreemptive.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * RTA for concrete models *)
-(** In this module we prove the RTA theorems for (1) fully preemptive FP model,
- (2) fully nonpreemptive FP model, (3) FP with fixed premption points, and
- (4) FP with floating nonpreemptive regions. *)
-Module RTAforConcreteModels.
-
- Import Job ArrivalCurves TaskArrival Priority UniprocessorSchedule Workload Service
- ResponseTime MaxArrivalsWorkloadBound LimitedPreemptionPlatform ModelWithLimitedPreemptions
- RTAforFPwithBoundedNonpreemptiveSegmentsWithArrivalCurves NonpreemptiveSchedule
- FullyNonPreemptivePlatform FullyPreemptivePlatform.
-
- Section Analysis.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Consider an arbitrary task set ts. *)
- Variable ts: list Task.
-
- (* Assume that all jobs come from the task set... *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* ...and the cost of a job cannot be larger than the task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Let max_arrivals be a family of proper arrival curves, i.e., for any task tsk in ts
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is a monotonic function
- that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_family_of_proper_arrival_curves:
- family_of_proper_arrival_curves job_task arr_seq max_arrivals ts.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Next, consider any uniprocessor schedule... *)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* We also assume that the schedule is a work-conserving schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* Assume we have sequential jobs, i.e, jobs from the same
- task execute in the order of their arrival. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
-
- (* Consider an FP policy that indicates a higher-or-equal priority relation,
- and assume that the relation is reflexive and transitive. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
-
- (* Let's define some local names for clarity. *)
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let task_rbf := task_request_bound_function task_cost max_arrivals tsk.
- Let total_hep_rbf :=
- total_hep_request_bound_function_FP task_cost higher_eq_priority max_arrivals ts tsk.
- Let total_ohep_rbf :=
- total_ohep_request_bound_function_FP task_cost higher_eq_priority max_arrivals ts tsk.
-
- (** * RTA for fully preemptive FP model *)
- (** In this module we prove the RTA theorem for fully preemptive FP model *)
- Section RTAforFullyPreemptiveFPModelwithArrivalCurves.
-
- (* First, we assume that the schedule respects the FP policy under a fully preemptive model. *)
- Hypothesis H_respects_policy:
- respects_FP_policy_at_preemption_point
- job_arrival job_cost job_task arr_seq sched
- (can_be_preempted_for_fully_preemptive_model) higher_eq_priority.
-
- (* Let L be any positive fixed point of the busy interval recurrence, determined by
- the sum of blocking and higher-or-equal-priority workload. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = total_hep_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A := (A < L) && (task_rbf A != task_rbf (A + ε)).
-
- (* Next, consider any value R, and assume that for any given arrival A from search space
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = task_rbf (A + ε) + total_ohep_rbf (A + F) /\
- F <= R.
-
- (* Now, we can leverage the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model of fully preemptive scheduling. *)
- Theorem uniprocessor_response_time_bound_fully_preemptive_fp:
- response_time_bounded_by tsk R.
- Proof.
- have BLOCK: RTAforFPwithBoundedNonpreemptiveSegmentsWithArrivalCurves.blocking_bound (fun _ => ε) higher_eq_priority ts tsk = 0.
- { by rewrite /RTAforFPwithBoundedNonpreemptiveSegmentsWithArrivalCurves.blocking_bound subnn big1_eq. }
- eapply uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments with
- (task_max_nps := fun _ => ε)
- (can_be_preempted := fun j prog => true)
- (task_lock_in_service := fun tsk => task_cost tsk)
- (job_lock_in_service := fun j => job_cost j)
- (job_max_nps := fun j => ε); eauto 2; try done.
- - by eapply fully_preemptive_model_is_model_with_bounded_nonpreemptive_regions.
- - repeat split; try done.
- intros ? ? ? ARR; move => LE COMPL /negP NCOMPL.
- exfalso; apply: NCOMPL.
- apply completion_monotonic with t; try done.
- - repeat split; try done.
- rewrite /task_lock_in_service_le_task_cost. by done.
- unfold task_lock_in_service_bounds_job_lock_in_service.
- by intros ? ARR TSK; rewrite -TSK; apply H_job_cost_le_task_cost.
- - by rewrite BLOCK add0n.
- - move => A /andP [LT NEQ].
- specialize (H_R_is_maximum A); feed H_R_is_maximum.
- { by apply/andP; split. }
- move: H_R_is_maximum => [F [FIX BOUND]].
- exists F; split.
- + by rewrite BLOCK add0n subnn subn0.
- + by rewrite subnn addn0.
- Qed.
-
- End RTAforFullyPreemptiveFPModelwithArrivalCurves.
-
- (** * RTA for fully nonpreemptive FP model *)
- (** In this module we prove the RTA theorem for the fully nonpreemptive FP model. *)
- Section RTAforFullyNonPreemptiveFPModelwithArrivalCurves.
-
- (* First, assume that the schedule is nonpreemptive... *)
- Hypothesis H_nonpreemptive_sched: is_nonpreemptive_schedule job_cost sched.
-
- (* ... which respects the FP policy under a fully nonpreemptive model. *)
- Hypothesis H_respects_policy:
- respects_FP_policy_at_preemption_point
- job_arrival job_cost job_task arr_seq sched
- (can_be_preempted_for_fully_nonpreemptive_model job_cost) higher_eq_priority.
-
- (* Next, we define a bound for the priority inversion caused by tasks of lower priority. *)
- Let blocking_bound :=
- \max_(tsk_other <- ts | ~~ higher_eq_priority tsk_other tsk) (task_cost tsk_other - ε).
-
- (* Let L be any positive fixed point of the busy interval recurrence, determined by
- the sum of blocking and higher-or-equal-priority workload. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = blocking_bound + total_hep_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A := (A < L) && (task_rbf A != task_rbf (A + ε)).
-
- (* Next, consider any value R, and assume that for any given arrival A from search space
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound
- + (task_rbf (A + ε) - (task_cost tsk - ε))
- + total_ohep_rbf (A + F) /\
- F + (task_cost tsk - ε) <= R.
-
- (* Now, we can leverage the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model of fully nonpreemptive scheduling. *)
- Theorem uniprocessor_response_time_bound_fully_nonpreemptive_fp:
- response_time_bounded_by tsk R.
- Proof.
- move: (posnP (task_cost tsk)) => [ZERO|POS].
- { intros j ARR TSK.
- have ZEROj: job_cost j = 0.
- { move: (H_job_cost_le_task_cost j ARR) => NEQ.
- rewrite /job_cost_le_task_cost TSK ZERO in NEQ.
- by apply/eqP; rewrite -leqn0.
- }
- by rewrite /is_response_time_bound_of_job /completed_by ZEROj.
- }
- try ( eapply uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments with
- (job_max_nps := fun j => job_cost j)
- (task_max_nps := fun tsk => task_cost tsk)
- (job_lock_in_service := fun j => ε)
- (task_lock_in_service := fun tsk => ε)
- (L0 := L); eauto 2 ) ||
- eapply uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments with
- (job_max_nps := fun j => job_cost j)
- (task_max_nps := fun tsk => task_cost tsk)
- (job_lock_in_service := fun j => ε)
- (task_lock_in_service := fun tsk => ε)
- (L := L); eauto 2.
- - by eapply fully_nonpreemptive_model_is_correct; eauto 2.
- - eapply fully_nonpreemptive_model_is_model_with_bounded_nonpreemptive_regions; eauto 2.
- - repeat split; try done.
- - intros j t t' ARR LE SERV NCOMPL.
- rewrite /service in SERV; apply incremental_service_during in SERV.
- move: SERV => [t_first [/andP [_ H1] [H2 H3]]].
- apply H_nonpreemptive_sched with t_first; try done.
- by apply leq_trans with t; first apply ltnW.
- - repeat split; try done.
- Qed.
-
- End RTAforFullyNonPreemptiveFPModelwithArrivalCurves.
-
- (** * RTA for FP-schedulers with fixed premption points *)
- (** In this module we prove a general RTA theorem for FP-schedulers with fixed preemption points *)
- Section RTAforFixedPreemptionPointsModelwithArrivalCurves.
-
- (* First, we assume we have the model with fixed preemption points.
- I.e., each task is divided into a number of nonpreemptive segments
- by inserting staticaly predefined preemption points. *)
- Variable job_preemption_points: Job -> seq time.
- Variable task_preemption_points: Task -> seq time.
- Hypothesis H_model_with_fixed_preemption_points:
- fixed_preemption_points_model
- task_cost job_cost job_task arr_seq
- job_preemption_points task_preemption_points ts.
-
- (* Next, assume that the schedule is a schedule with limited preemptions... *)
- Hypothesis H_schedule_with_limited_preemptions:
- is_schedule_with_limited_preemptions arr_seq job_preemption_points sched.
-
- (* ... which respects the FP policy under a model with fixed preemption points. *)
- Hypothesis H_respects_policy:
- respects_FP_policy_at_preemption_point
- job_arrival job_cost job_task arr_seq sched
- (can_be_preempted_for_model_with_limited_preemptions job_preemption_points) higher_eq_priority.
-
- (* We also have a set of functions that map job or task
- to its max or last nonpreemptive segment. *)
- Let job_max_nps := job_max_nps job_preemption_points.
- Let job_last_nps := job_last_nps job_preemption_points.
- Let task_max_nps := task_max_nps task_preemption_points.
- Let task_last_nps := task_last_nps task_preemption_points.
-
- (* Next, we define a bound for the priority inversion caused by tasks of lower priority. *)
- Let blocking_bound :=
- \max_(tsk_other <- ts | ~~ higher_eq_priority tsk_other tsk) (task_max_nps tsk_other - ε).
-
- (* Let L be any positive fixed point of the busy interval recurrence, determined by
- the sum of blocking and higher-or-equal-priority workload. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = blocking_bound + total_hep_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A := (A < L) && (task_rbf A != task_rbf (A + ε)).
-
- (* Next, consider any value R, and assume that for any given arrival A from search space
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound
- + (task_rbf (A + ε) - (task_last_nps tsk - ε))
- + total_ohep_rbf (A + F) /\
- F + (task_last_nps tsk - ε) <= R.
-
- (* Now, we can reuse the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model of fixed preemption points. *)
- Theorem uniprocessor_response_time_bound_fp_with_fixed_preemption_points:
- response_time_bounded_by tsk R.
- Proof.
- move: (H_model_with_fixed_preemption_points) => [MLP [BEG [END [INCR [HYP1 [HYP2 HYP3]]]]]].
- move: (MLP) => [EMPTj [LSMj [BEGj [ENDj HH]]]].
- move: (posnP (task_cost tsk)) => [ZERO|POSt].
- { intros j ARR TSK.
- move: (H_job_cost_le_task_cost _ ARR) => POSt.
- move: POSt; rewrite /job_cost_le_task_cost TSK ZERO leqn0; move => /eqP Z.
- by rewrite /is_response_time_bound_of_job /completed_by Z.
- }
- have Fact2: 1 < size (task_preemption_points tsk).
- { have Fact2: 0 < size (task_preemption_points tsk).
- { apply/negPn/negP; rewrite -eqn0Ngt; intros CONTR; move: CONTR => /eqP CONTR.
- move: (END _ H_tsk_in_ts) => EQ.
- move: EQ; rewrite /last0 -nth_last nth_default; last by rewrite CONTR.
- by intros; rewrite -EQ in POSt.
- }
- have EQ: 2 = size [::0; task_cost tsk]; first by done.
- rewrite EQ; clear EQ.
- apply subseq_leq_size.
- rewrite !cons_uniq.
- { apply/andP; split.
- rewrite in_cons negb_or; apply/andP; split; last by done.
- rewrite neq_ltn; apply/orP; left; eauto 2.
- apply/andP; split; by done. }
- intros t EQ; move: EQ; rewrite !in_cons.
- move => /orP [/eqP EQ| /orP [/eqP EQ|EQ]]; last by done.
- { rewrite EQ; clear EQ.
- move: (BEG _ H_tsk_in_ts) => EQ.
- rewrite -EQ; clear EQ.
- rewrite /first0 -nth0.
- apply/(nthP 0).
- exists 0; by done.
- }
- { rewrite EQ; clear EQ.
- move: (END _ H_tsk_in_ts) => EQ.
- rewrite -EQ; clear EQ.
- rewrite /last0 -nth_last.
- apply/(nthP 0).
- exists ((size (task_preemption_points tsk)).-1); last by done.
- by rewrite -(leq_add2r 1) !addn1 prednK //.
- }
- }
- ( try ( eapply uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => (task_cost tsk - (task_last_nps tsk - ε)))
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L0 := L) (job_max_nps0 := job_max_nps)
- (job_cost0 := job_cost ) ) ||
- eapply uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => (task_cost tsk - (task_last_nps tsk - ε)))
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L := L) (job_max_nps := job_max_nps)
- (job_cost := job_cost ))
- ; eauto 2.
- { by apply model_with_fixed_preemption_points_is_correct. }
- {
- eapply model_with_fixed_preemption_points_is_model_with_bounded_nonpreemptive_regions; eauto 2.
- intros j ARR.
- unfold ModelWithLimitedPreemptions.job_max_nps, task_max_nps, lengths_of_segments.
- apply max_of_dominating_seq.
- intros. apply HYP2.
- by done.
- }
- { split; last split.
- { intros j ARR POS.
- rewrite subn_gt0.
- rewrite subn1 -(leq_add2r 1) !addn1 prednK; last first.
- apply LSMj; try done.
- rewrite /job_last_nps /ModelWithLimitedPreemptions.job_last_nps
- ltnS /last0 -nth_last function_of_distances_is_correct.
- apply leq_trans with (job_max_nps j);
- first by apply distance_between_neighboring_elements_le_max_distance_in_seq.
- rewrite -ENDj; last by done.
- by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- { by intros j ARR; rewrite leq_subLR leq_addl. }
- { intros ? ? ? ARR LE LS NCOMPL.
- rewrite subnBA in LS; last first.
- apply LSMj; try done.
- { rewrite lt0n; apply/negP; intros Z; move: Z => /eqP Z.
- by move: NCOMPL; rewrite /completed_by -ltnNge Z ltn0. }
- have EQ: exists Δ, t' = t + Δ.
- { exists (t' - t); rewrite subnKC; by done. }
- move: EQ => [Δ EQ]; subst t'; clear LE.
- rewrite -addnBAC in LS.
- rewrite addn1 in LS.
- apply H_schedule_with_limited_preemptions; first by done.
- rewrite /can_be_preempted_for_model_with_limited_preemptions; apply/negP.
- intros CONTR.
- move: NCOMPL; rewrite /completed_by -ltnNge; move => SERV.
- have NEQ: job_cost j - job_last_nps j < service sched j (t + Δ).
- { apply leq_trans with (service sched j t); first by done.
- rewrite /service /service_during [in X in _ <= X](@big_cat_nat _ _ _ t) //=.
- rewrite leq_addr //.
- rewrite leq_addr //.
- }
- clear LS.
- rewrite -ENDj in NEQ, SERV; last by done.
- rewrite last_seq_minus_last_distance_seq in NEQ; last by eauto 2.
- rewrite /last0 -nth_last in SERV.
- have EQ := antidensity_of_nondecreasing_seq.
- specialize (EQ (job_preemption_points j) (service sched j (t + Δ)) (size (job_preemption_points j)).-2).
- rewrite CONTR in EQ.
- feed_n 2 EQ; first by eauto 2.
- {
- apply/andP; split; first by done.
- rewrite prednK; first by done.
- rewrite -(leq_add2r 1) !addn1 prednK.
- try ( eapply number_of_preemption_points_at_least_two with (job_cost0 := job_cost); eauto 2 ) ||
- eapply number_of_preemption_points_at_least_two with (job_cost := job_cost); eauto 2.
- try ( eapply list_of_preemption_point_is_not_empty with (job_cost0 := job_cost); eauto 2 ) ||
- eapply list_of_preemption_point_is_not_empty with (job_cost := job_cost); eauto 2.
- }
- by done.
-
- rewrite -ENDj; last by done.
- apply leq_trans with (job_max_nps j).
- - by apply last_of_seq_le_max_of_seq.
- - by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- }
- {
- split.
- - by rewrite /task_lock_in_service_le_task_cost leq_subLR leq_addl.
- - intros j ARR TSK.
- move: (posnP (job_cost j)) => [ZERO | POS].
- { by rewrite ZERO. }
- unfold task_last_nps.
- rewrite !subnBA; first last.
- apply LSMj; try done.
- rewrite /ModelWithLimitedPreemptions.task_last_nps /last0 -nth_last.
- apply HYP3.
- by done.
- rewrite -(ltn_add2r 1) !addn1 prednK //.
- move: (Fact2) => Fact3.
- rewrite size_of_seq_of_distances // addn1 ltnS // in Fact2.
- rewrite -addnBAC -?[in X in _ <= X]addnBAC; first last.
- { apply leq_trans with (job_max_nps j).
- - by apply last_of_seq_le_max_of_seq.
- - by rewrite -ENDj //; apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- { apply leq_trans with (task_max_nps tsk).
- - by apply last_of_seq_le_max_of_seq.
- - by rewrite -END //; apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- rewrite -ENDj; last eauto 2.
- rewrite -END; last eauto 2.
- rewrite !last_seq_minus_last_distance_seq.
- have EQ: size (job_preemption_points j) = size (task_preemption_points tsk).
- { rewrite -TSK.
- by apply HYP1.
- }
- rewrite EQ; clear EQ.
- rewrite leq_add2r.
- apply domination_of_distances_implies_domination_of_seq; try done; eauto 2.
- rewrite BEG // BEGj //.
- try ( eapply number_of_preemption_points_at_least_two with (job_cost0 := job_cost); eauto 2 ) ||
- eapply number_of_preemption_points_at_least_two with (job_cost := job_cost); eauto 2.
- rewrite -TSK; apply HYP1; try done.
- intros. rewrite -TSK; eauto 2.
- eauto 2.
- eauto 2.
- }
- { rewrite subKn; first by done.
- rewrite /task_last_nps -(leq_add2r 1) subn1 !addn1 prednK; last first.
- { rewrite /ModelWithLimitedPreemptions.task_last_nps /last0 -nth_last.
- apply HYP3; try by done.
- rewrite -(ltn_add2r 1) !addn1 prednK //.
- move: (Fact2) => Fact3.
- by rewrite size_of_seq_of_distances // addn1 ltnS // in Fact2.
- }
- { apply leq_trans with (task_max_nps tsk).
- - by apply last_of_seq_le_max_of_seq.
- - rewrite -END; last by done.
- apply ltnW; rewrite ltnS; try done.
- by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- }
- Qed.
-
- End RTAforFixedPreemptionPointsModelwithArrivalCurves.
-
- (** * RTA for FP-schedulers with floating nonpreemptive regions *)
- (** In this module we prove a general RTA theorem for FP-schedulers with floating nonpreemptive regions *)
- Section RTAforModelWithFloatingNonpreemptiveRegionsWithArrivalCurves.
-
- (* Assume we have the model with floating nonpreemptive regions.
- I.e., for each task only the length of the maximal nonpreemptive
- segment is known. *)
- Variable job_preemption_points: Job -> seq time.
- Variable task_max_nps: Task -> time.
- Hypothesis H_task_model_with_floating_nonpreemptive_regions:
- model_with_floating_nonpreemptive_regions
- job_cost job_task arr_seq job_preemption_points task_max_nps.
-
- (* Next, assume that the schedule is a schedule with limited preemptions... *)
- Hypothesis H_schedule_with_limited_preemptions:
- is_schedule_with_limited_preemptions arr_seq job_preemption_points sched.
-
- (* ... which respects the FP policy under a model with fixed preemption points. *)
- Hypothesis H_respects_policy:
- respects_FP_policy_at_preemption_point
- job_arrival job_cost job_task arr_seq sched
- (can_be_preempted_for_model_with_limited_preemptions job_preemption_points) higher_eq_priority.
-
- (* Let's define some local names for clarity. *)
- Let job_max_nps := job_max_nps job_preemption_points.
- Let job_last_nps := job_last_nps job_preemption_points.
-
- (* Next, we define a bound for the priority inversion caused by tasks of lower priority. *)
- Let blocking_bound :=
- \max_(tsk_other <- ts | ~~ higher_eq_priority tsk_other tsk) (task_max_nps tsk_other - ε).
-
- (* Let L be any positive fixed point of the busy interval recurrence, determined by
- the sum of blocking and higher-or-equal-priority workload. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = blocking_bound + total_hep_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A := (A < L) && (task_rbf A != task_rbf (A + ε)).
-
- (* Next, consider any value R, and assume that for any given arrival A from search space
- there is a solution of the response-time bound recurrence which is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound + task_rbf (A + ε) + total_ohep_rbf (A + F) /\
- F <= R.
-
- (* Now, we can reuse the results for the abstract model with bounded nonpreemptive segments
- to establish a response-time bound for the more concrete model with floating nonpreemptive regions. *)
- Theorem uniprocessor_response_time_bound_fp_with_floating_nonpreemptive_regions:
- response_time_bounded_by tsk R.
- Proof.
- move: (H_task_model_with_floating_nonpreemptive_regions) => [LIMJ JMLETM].
- move: (LIMJ) => [ZERO [LSMj [BEG [END HH]]]].
- try ( eapply uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => task_cost tsk)
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L0 := L) (job_max_nps0 := job_max_nps)
- (job_cost0 := job_cost ) ) ||
- eapply uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments
- with (task_lock_in_service := fun tsk => task_cost tsk)
- (job_lock_in_service := fun job => (job_cost job - (job_last_nps job - ε)))
- (L := L) (job_max_nps := job_max_nps)
- (job_cost := job_cost )
- ; eauto 2.
- { by apply model_with_fixed_preemption_points_is_correct. }
- { by eapply model_with_fixed_preemption_points_is_model_with_bounded_nonpreemptive_regions; eauto 2. }
- { split; last split.
- { intros j ARR POS.
- rewrite subn_gt0.
- rewrite subn1 -(leq_add2r 1) !addn1 prednK; last first.
- apply LSMj; try done.
- rewrite /job_last_nps /ModelWithLimitedPreemptions.job_last_nps
- ltnS /last0 -nth_last function_of_distances_is_correct.
- apply leq_trans with (job_max_nps j); first by apply distance_between_neighboring_elements_le_max_distance_in_seq.
- rewrite -END; last by done.
- by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- { by intros j ARR; rewrite leq_subLR leq_addl. }
- { intros ? ? ? ARR LE LS NCOMPL.
- rewrite subnBA in LS; last first.
- apply LSMj; try done.
- { rewrite lt0n; apply/negP; intros Z; move: Z => /eqP Z.
- by move: NCOMPL; rewrite /completed_by -ltnNge Z ltn0. }
- have EQ: exists Δ, t' = t + Δ.
- { exists (t' - t); rewrite subnKC; by done. }
- move: EQ => [Δ EQ]; subst t'; clear LE.
- rewrite -addnBAC in LS.
- rewrite addn1 in LS.
- apply H_schedule_with_limited_preemptions; first by done.
- rewrite /can_be_preempted_for_model_with_limited_preemptions; apply/negP.
- intros CONTR.
- move: NCOMPL; rewrite /completed_by -ltnNge; move => SERV.
- have NEQ: job_cost j - (job_last_nps j) < service sched j (t + Δ).
- { apply leq_trans with (service sched j t); first by done.
- rewrite /service /service_during [in X in _ <= X](@big_cat_nat _ _ _ t) //=.
- rewrite leq_addr //.
- rewrite leq_addr //.
- }
- clear LS.
- rewrite -END in NEQ, SERV; last by done.
- rewrite last_seq_minus_last_distance_seq in NEQ.
- rewrite /last0 -nth_last in SERV.
- have EQ := antidensity_of_nondecreasing_seq.
- specialize (EQ (job_preemption_points j) (service sched j (t + Δ)) (size (job_preemption_points j)).-2).
- rewrite CONTR in EQ.
- feed_n 2 EQ; first by eauto 2.
- {
- apply/andP; split; first by done.
- rewrite prednK; first by done.
- rewrite -(leq_add2r 1) !addn1 prednK.
- try ( eapply number_of_preemption_points_at_least_two with (job_cost0 := job_cost); eauto 2 ) ||
- eapply number_of_preemption_points_at_least_two with (job_cost := job_cost); eauto 2.
- try ( eapply list_of_preemption_point_is_not_empty with (job_cost0 := job_cost); eauto 2 ) ||
- eapply list_of_preemption_point_is_not_empty with (job_cost := job_cost); eauto 2.
- }
- by done.
- eauto 2.
-
- rewrite -END; last by done.
- apply leq_trans with (job_max_nps j).
- - by apply last_of_seq_le_max_of_seq.
- - by apply max_distance_in_seq_le_last_element_of_seq; eauto 2.
- }
- }
- {
- split.
- - by rewrite /task_lock_in_service_le_task_cost.
- - intros j ARR TSK.
- apply leq_trans with (job_cost j); first by rewrite leq_subr.
- by rewrite -TSK; eauto 2.
- }
- {
- rewrite subnn.
- intros.
- apply H_R_is_maximum in H.
- move: H => [F [EQ LE]].
- exists F.
- by rewrite subn0 addn0; split.
- }
- Qed.
-
- End RTAforModelWithFloatingNonpreemptiveRegionsWithArrivalCurves.
-
- End Analysis.
-
-End RTAforConcreteModels.
diff --git a/classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/response_time_bound.v b/classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/response_time_bound.v
deleted file mode 100644
index 8e32ca77c23bf5de8dce6e95ee76e13496d9346b..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/response_time_bound.v
+++ /dev/null
@@ -1,293 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.arrival.curves.bounds
- prosa.classic.analysis.uni.arrival_curves.workload_bound.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time.
-Require Import prosa.classic.model.schedule.uni.limited.platform.definitions
- prosa.classic.model.schedule.uni.limited.platform.priority_inversion_is_bounded
- prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.busy_interval
- prosa.classic.model.schedule.uni.limited.fixed_priority.response_time_bound
- prosa.classic.model.schedule.uni.limited.rbf.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * RTA for FP-schedulers with bounded nonpreemptive segments *)
-(** In this module we prove a general RTA theorem for FP-schedulers *)
-Module RTAforFPwithBoundedNonpreemptiveSegmentsWithArrivalCurves.
-
- Import Job ArrivalCurves TaskArrival Priority UniprocessorSchedule Workload Service
- ResponseTime MaxArrivalsWorkloadBound LimitedPreemptionPlatform RBF
- AbstractRTAforFPwithArrivalCurves BusyIntervalJLFP PriorityInversionIsBounded.
-
- Section Analysis.
-
- Context {Task: eqType}.
- Variable task_max_nps task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_max_nps job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume we have sequential jobs, i.e, jobs from the same
- task execute in the order of their arrival. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
-
- (* Assume that a job cost cannot be larger than a task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Consider an FP policy that indicates a higher-or-equal priority relation,
- and assume that the relation is reflexive and transitive. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
-
- (* We consider an arbitrary function can_be_preempted which defines
- a preemption model with bounded nonpreemptive segments. *)
- Variable can_be_preempted: Job -> time -> bool.
- Let preemption_time := preemption_time sched can_be_preempted.
- Hypothesis H_correct_preemption_model:
- correct_preemption_model arr_seq sched can_be_preempted.
- Hypothesis H_model_with_bounded_nonpreemptive_segments:
- model_with_bounded_nonpreemptive_segments
- job_cost job_task arr_seq can_be_preempted job_max_nps task_max_nps.
-
- (* Next, we assume that the schedule is a work-conserving schedule... *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* ... and the schedule respects the policy defined by the
- can_be_preempted function (i.e., bounded nonpreemptive segments). *)
- Hypothesis H_respects_policy:
- respects_FP_policy_at_preemption_point
- job_arrival job_cost job_task arr_seq sched can_be_preempted higher_eq_priority.
-
- (* Consider an arbitrary task set ts... *)
- Variable ts: list Task.
-
- (* ..and assume that all jobs come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Let max_arrivals be a family of proper arrival curves, i.e., for any task tsk in ts
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is a monotonic function
- that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_family_of_proper_arrival_curves:
- family_of_proper_arrival_curves job_task arr_seq max_arrivals ts.
-
- (* Consider a proper job lock-in service and task lock-in functions, i.e... *)
- Variable job_lock_in_service: Job -> time.
- Variable task_lock_in_service: Task -> time.
-
- (* ...we assume that for all jobs in the arrival sequence the lock-in service is
- (1) positive, (2) no bigger than costs of the corresponding jobs, and (3) a job
- becomes nonpreemptive after it reaches its lock-in service... *)
- Hypothesis H_proper_job_lock_in_service:
- proper_job_lock_in_service job_cost arr_seq sched job_lock_in_service.
-
- (* ...and that [task_lock_in_service tsk] is (1) no bigger than tsk's cost, (2) for any
- job of task tsk job_lock_in_service is bounded by task_lock_in_service. *)
- Hypothesis H_proper_task_lock_in_service:
- proper_task_lock_in_service
- task_cost job_task arr_seq job_lock_in_service task_lock_in_service tsk.
-
- (* We also lift the FP priority relation to a corresponding JLFP priority relation. *)
- Let jlfp_higher_eq_priority := FP_to_JLFP job_task higher_eq_priority.
-
- (* Let's define some local names for clarity. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_backlogged_at := backlogged job_arrival job_cost sched.
- Let arrivals_between := jobs_arrived_between arr_seq.
- Let max_length_of_priority_inversion :=
- max_length_of_priority_inversion job_max_nps arr_seq jlfp_higher_eq_priority.
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let task_rbf := task_request_bound_function task_cost max_arrivals tsk.
- Let total_hep_rbf :=
- total_hep_request_bound_function_FP task_cost higher_eq_priority max_arrivals ts tsk.
- Let total_ohep_rbf :=
- total_ohep_request_bound_function_FP task_cost higher_eq_priority max_arrivals ts tsk.
-
- (* We also define a bound for the priority inversion caused by jobs with lower priority. *)
- Definition blocking_bound :=
- \max_(tsk_other <- ts | ~~ higher_eq_priority tsk_other tsk)
- (task_max_nps tsk_other - ε).
-
- (** ** Priority inversion is bounded *)
- (** In this section, we prove that a priority inversion for task tsk is bounded by
- the maximum length of nonpreemtive segments among the tasks with lower priority. *)
- Section PriorityInversionIsBounded.
-
- (* First, we prove that the maximum length of a priority inversion of a job j is
- bounded by the maximum length of a nonpreemptive section of a task with
- lower-priority task (i.e., the blocking term). *)
- Lemma priority_inversion_is_bounded_by_blocking:
- forall j t,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- max_length_of_priority_inversion j t <= blocking_bound.
- Proof.
- intros j t ARR TSK.
- rewrite /max_length_of_priority_inversion
- /PriorityInversionIsBounded.max_length_of_priority_inversion
- /blocking_bound /jlfp_higher_eq_priority /FP_to_JLFP.
- apply leq_trans with
- (\max_(j_lp <- jobs_arrived_between arr_seq 0 t
- | ~~ higher_eq_priority (job_task j_lp) tsk)
- (task_max_nps (job_task j_lp) - ε)
- ).
- { rewrite TSK.
- apply leq_big_max.
- intros j' JINB NOTHEP.
- specialize (H_job_cost_le_task_cost j').
- feed H_job_cost_le_task_cost.
- { apply mem_bigcat_nat_exists in JINB.
- by move: JINB => [ta' [JIN' _]]; exists ta'.
- }
- rewrite leq_sub2r //.
- apply in_arrivals_implies_arrived in JINB.
- move: (H_model_with_bounded_nonpreemptive_segments j' JINB) => [_ [_ [T _]]].
- by apply T.
- }
- { apply /bigmax_leq_seqP.
- intros j' JINB NOTHEP.
- apply leq_bigmax_cond_seq with
- (x := (job_task j')) (F := fun tsk => task_max_nps tsk - 1); last by done.
- apply H_all_jobs_from_taskset.
- apply mem_bigcat_nat_exists in JINB.
- by inversion JINB as [ta' [JIN' _]]; exists ta'.
- }
- Qed.
-
- (* Using the above lemma, we prove that the priority inversion of the task is bounded by blocking_bound. *)
- Lemma priority_inversion_is_bounded:
- priority_inversion_is_bounded_by
- job_arrival job_cost job_task arr_seq sched jlfp_higher_eq_priority tsk blocking_bound.
- Proof.
- intros j ARR TSK POS t1 t2 PREF.
- case NEQ: (t2 - t1 <= blocking_bound).
- { apply leq_trans with (t2 - t1); last by done.
- rewrite /cumulative_priority_inversion /BusyIntervalJLFP.is_priority_inversion.
- rewrite -[X in _ <= X]addn0 -[t2 - t1]mul1n -iter_addn -big_const_nat.
- rewrite leq_sum //.
- intros t _; case: (sched t); last by done.
- by intros s; case: jlfp_higher_eq_priority.
- }
- move: NEQ => /negP /negP; rewrite -ltnNge; move => NEQ.
- have PPE := preemption_time_exists
- task_max_nps job_arrival job_max_nps job_cost job_task arr_seq _ sched
- _ _ _ jlfp_higher_eq_priority _ _ can_be_preempted
- _ _ _ _ j ARR _ t1 t2 PREF .
- feed_n 11 PPE; try done.
- { unfold JLFP_is_reflexive, jlfp_higher_eq_priority, FP_to_JLFP. by done. }
- { unfold JLFP_is_transitive, jlfp_higher_eq_priority, FP_to_JLFP, transitive. eauto 2. }
- move: PPE => [ppt [PPT /andP [GE LE]]].
- apply leq_trans with (cumulative_priority_inversion sched jlfp_higher_eq_priority j t1 ppt);
- last apply leq_trans with (ppt - t1).
- - rewrite /cumulative_priority_inversion /BusyIntervalJLFP.is_priority_inversion.
- rewrite (@big_cat_nat _ _ _ ppt) //=.
- rewrite -[X in _ <= X]addn0 leq_add2l.
- rewrite leqn0.
- rewrite big_nat_cond big1 //; move => t /andP [/andP [GEt LTt] _ ].
- case SCHED: (sched t) => [s | ]; last by done.
- have SCHEDHP := not_quiet_implies_exists_scheduled_hp_job
- task_max_nps job_arrival job_max_nps job_cost job_task arr_seq _ sched
- _ _ _ jlfp_higher_eq_priority _ _ can_be_preempted
- _ _ _ _ j ARR _ t1 t2 _ (ppt - t1) _ t.
- feed_n 14 SCHEDHP; try done.
- { unfold JLFP_is_reflexive, jlfp_higher_eq_priority, FP_to_JLFP. by done. }
- { unfold JLFP_is_transitive, jlfp_higher_eq_priority, FP_to_JLFP, transitive. eauto 2. }
- { exists ppt; split. by done. by rewrite subnKC //; apply/andP; split. }
- { by rewrite subnKC //; apply/andP; split. }
- move: SCHEDHP => [j_hp [ARRB [HP SCHEDHP]]].
- apply/eqP; rewrite eqb0 Bool.negb_involutive.
- have EQ: s = j_hp.
- { by ( try ( apply only_one_job_scheduled with (sched0 := sched) (t0 := t) ) ||
- apply only_one_job_scheduled with (sched := sched) (t := t)); [apply/eqP | ]. }
- by rewrite EQ.
- rewrite ltn_subRL in NEQ.
- apply leq_trans with (t1 + blocking_bound); last by apply ltnW.
- apply leq_trans with (t1 + max_length_of_priority_inversion j t1); first by done.
- rewrite leq_add2l; eapply priority_inversion_is_bounded_by_blocking; eauto 2.
- - rewrite /cumulative_priority_inversion /BusyIntervalJLFP.is_priority_inversion.
- rewrite -[X in _ <= X]addn0 -[ppt - t1]mul1n -iter_addn -big_const_nat.
- rewrite leq_sum //.
- intros t _; case: (sched t); last by done.
- by intros s; case: jlfp_higher_eq_priority.
- - rewrite leq_subLR.
- apply leq_trans with (t1 + max_length_of_priority_inversion j t1); first by done.
- rewrite leq_add2l; eapply priority_inversion_is_bounded_by_blocking; eauto 2.
- Qed.
-
- End PriorityInversionIsBounded.
-
- (** ** Response-Time Bound *)
- (** In this section, we prove that the maximum among the solutions of the response-time
- bound recurrence is a response-time bound for tsk. *)
- Section ResponseTimeBound.
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = blocking_bound + total_hep_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space. *)
- Let is_in_search_space A := (A < L) && (task_rbf A != task_rbf (A + ε)).
-
- (* Next, consider any value R, and assume that for any given arrival offset A from the search
- space there is a solution of the response-time bound recurrence that is bounded by R. *)
- Variable R: nat.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = blocking_bound
- + (task_rbf (A + ε) - (task_cost tsk - task_lock_in_service tsk))
- + total_ohep_rbf (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
-
- (* Then, using the results for the general RTA for FP-schedulers, we establish a
- response-time bound for the more concrete model of bounded nonpreemptive segments.
- Note that in case of the general RTA for FP-schedulers, we just _assume_ that
- the priority inversion is bounded. In this module we provide the preemption model
- with bounded nonpreemptive segments and _prove_ that the priority inversion is
- bounded. *)
- Theorem uniprocessor_response_time_bound_fp_with_bounded_nonpreemptive_segments:
- response_time_bounded_by tsk R.
- Proof.
- eapply uniprocessor_response_time_bound_fp; eauto 2.
- by apply priority_inversion_is_bounded.
- Qed.
-
- End ResponseTimeBound.
-
- End Analysis.
-
-End RTAforFPwithBoundedNonpreemptiveSegmentsWithArrivalCurves.
diff --git a/classic/model/schedule/uni/limited/fixed_priority/response_time_bound.v b/classic/model/schedule/uni/limited/fixed_priority/response_time_bound.v
deleted file mode 100644
index d7648ee4a27c32883bce28e1870db2baa83d96f1..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/fixed_priority/response_time_bound.v
+++ /dev/null
@@ -1,439 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.response_time
- prosa.classic.model.schedule.uni.schedule_of_task.
-Require Import prosa.classic.model.schedule.uni.limited.platform.definitions
- prosa.classic.model.schedule.uni.limited.schedule
- prosa.classic.model.schedule.uni.limited.rbf
- prosa.classic.model.schedule.uni.limited.abstract_RTA.definitions
- prosa.classic.model.schedule.uni.limited.abstract_RTA.reduction_of_search_space
- prosa.classic.model.schedule.uni.limited.abstract_RTA.abstract_seq_rta
- prosa.classic.model.schedule.uni.limited.jlfp_instantiation.
-Require Import prosa.classic.model.arrival.curves.bounds.
-Require Import prosa.classic.analysis.uni.arrival_curves.workload_bound.
-Require Import prosa.classic.model.schedule.uni.limited.busy_interval.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Abstract RTA for FP-schedulers *)
-(** In this module we propose the abstract response-time analysis (RTA) for
- FP uniprocessor scheduling of real-time tasks with arbitrary arrival models. *)
-Module AbstractRTAforFPwithArrivalCurves.
-
- Import Job ArrivalCurves TaskArrival Priority ScheduleOfTask
- UniprocessorSchedule Workload Service ResponseTime MaxArrivalsWorkloadBound
- LimitedPreemptionPlatform RBF BusyIntervalJLFP JLFPInstantiation.
-
- Section AbstractResponseTimeAnalysisForFP.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Next, assume that the schedule is a work-conserving schedule. *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* Assume we have sequential jobs, i.e, jobs from the
- same task execute in the order of their arrival. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
-
- (* Assume that a job cost cannot be larger than a task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* Consider an arbitrary task set ts. *)
- Variable ts: list Task.
-
- (* Next, we assume that all jobs come from the task set. *)
- Hypothesis H_all_jobs_from_taskset:
- forall j, arrives_in arr_seq j -> job_task j \in ts.
-
- (* Let max_arrivals be a family of proper arrival curves, i.e., for any task tsk in ts
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is a monotonic function
- that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_family_of_proper_arrival_curves:
- family_of_proper_arrival_curves job_task arr_seq max_arrivals ts.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
- Hypothesis H_tsk_in_ts: tsk \in ts.
-
- (* Consider proper job lock-in service and task lock-in functions, i.e... *)
- Variable job_lock_in_service: Job -> time.
- Variable task_lock_in_service: Task -> time.
-
- (* ...we assume that for all jobs with positive cost in the arrival sequence the
- lock-in service is (1) positive, (2) no bigger than costs of the corresponding
- jobs, and (3) a job becomes nonpreemptive after it reaches its lock-in service... *)
- Hypothesis H_proper_job_lock_in_service:
- proper_job_lock_in_service job_cost arr_seq sched job_lock_in_service.
-
- (* ...and that [task_lock_in_service tsk] is (1) no bigger than tsk's cost, (2) for any
- job of task tsk job_lock_in_service is bounded by task_lock_in_service. *)
- Hypothesis H_proper_task_lock_in_service:
- proper_task_lock_in_service
- task_cost job_task arr_seq job_lock_in_service task_lock_in_service tsk.
-
- (* Consider an FP policy that indicates a higher-or-equal priority relation,
- and assume that the relation is reflexive. Note that we do not relate
- the FP policy with the scheduler. However, we define functions for
- Interference and Interfering Workload that actively use the concept of
- priorities. We require the FP policy to be reflexive, so a job cannot
- cause lower-priority interference (i.e. priority inversion) to itself. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
-
- (* We also lift the FP priority relation to a corresponding JLFP priority relation. *)
- Let jlfp_higher_eq_priority j1 j2 := FP_to_JLFP job_task higher_eq_priority j1 j2.
-
- (* For clarity, let's define some local names. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_backlogged_at := backlogged job_arrival job_cost sched.
- Let arrivals_between := jobs_arrived_between arr_seq.
- Let response_time_bounded_by := is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
- Let quiet_time := quiet_time job_arrival job_cost arr_seq sched jlfp_higher_eq_priority.
- Let busy_interval := busy_interval job_arrival job_cost arr_seq sched jlfp_higher_eq_priority.
- Let task_scheduled_at := task_scheduled_at job_task sched.
- Let cumulative_task_interference :=
- AbstractSeqRTA.cumul_task_interference job_task arr_seq sched.
-
- (* We introduce task_rbf as an abbreviation of the task request bound function,
- which is defined as [task_cost(tsk) × max_arrivals(tsk,Δ)]. *)
- Let task_rbf := task_request_bound_function task_cost max_arrivals tsk.
-
- (* Using the sum of individual request bound functions, we define the request bound
- function of all tasks with higher-or-equal priority (with respect to tsk). *)
- Let total_hep_rbf :=
- total_hep_request_bound_function_FP task_cost higher_eq_priority max_arrivals ts tsk.
-
- (* Similarly, we define the request bound function of all tasks other
- than tsk with higher-or-equal priority (with respect to tsk). *)
- Let total_ohep_rbf :=
- total_ohep_request_bound_function_FP task_cost higher_eq_priority max_arrivals ts tsk.
-
- (* Assume that there eixsts a constant priority_inversion_bound that bounds
- the length of any priority inversion experienced by any job of tsk.
- Sinse we analyze only task tsk, we ignore the lengths of priority
- inversions incurred by any other tasks. *)
- Variable priority_inversion_bound: time.
- Hypothesis H_priority_inversion_is_bounded:
- priority_inversion_is_bounded_by
- job_arrival job_cost job_task arr_seq sched jlfp_higher_eq_priority tsk priority_inversion_bound.
-
- (* Let L be any positive fixed point of the busy interval recurrence. *)
- Variable L: time.
- Hypothesis H_L_positive: L > 0.
- Hypothesis H_fixed_point: L = priority_inversion_bound + total_hep_rbf L.
-
- (* To reduce the time complexity of the analysis, recall the notion of search space.
- Intuitively, this corresponds to all "interesting" arrival offsets that the job under
- analysis might have with regard to the beginning of its busy-window. *)
- Let is_in_search_space A := (A < L) && (task_rbf A != task_rbf (A + ε)).
-
- (* Let R be a value that upper-bounds the solution of each response-time recurrence,
- i.e., for any relative arrival time A in the search space, there exists a corresponding
- solution F such that [F + (task cost - task lock-in service) <= R]. *)
- Variable R: time.
- Hypothesis H_R_is_maximum:
- forall A,
- is_in_search_space A ->
- exists F,
- A + F = priority_inversion_bound
- + (task_rbf (A + ε) - (task_cost tsk - task_lock_in_service tsk))
- + total_ohep_rbf (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
-
-
- (* Instantiation of Interference *)
- (* We say that job j incurs interference at time t iff it cannot execute due to
- a higher-or-equal-priority job being scheduled, or if it incurs a priority inversion.
- (for more details see file limited.jlfp_instantiation.v) *)
- Let interference (j: Job) (t: time) :=
- interference sched jlfp_higher_eq_priority j t.
-
- (* Instantiation of Interfering Workload *)
- (* The interfering workload, in turn, is defined as the sum of the priority inversion
- function and interfering workload of jobs with higher or equal priority.
- (for more details see file limited.limited.jlfp_instantiation.v) *)
- Let interfering_workload (j: Job) (t: time) :=
- interfering_workload job_cost arr_seq sched jlfp_higher_eq_priority j t.
-
- (* Finally, we define the interference bound function as the sum of the priority
- interference bound and the higher-or-equal-priority workload. *)
- Let IBF R := priority_inversion_bound + total_ohep_rbf R.
-
- (** ** Filling Out Hypotheses Of Abstract RTA Theorem *)
- (** In this section we prove that all preconditions necessary to use the abstract theorem are satisfied. *)
- Section FillingOutHypothesesOfAbstractRTATheorem.
-
- (* First, we prove that in the instantiation of interference and interfering workload,
- we really take into account everything that can interfere with tsk's jobs, and thus,
- the scheduler satisfies the abstract notion of work conserving schedule. *)
- Lemma instantiated_i_and_w_are_consistent_with_schedule:
- AbstractRTADefinitions.work_conserving
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload.
- Proof.
- intros j t1 t2 t ARR TSK POS BUSY NEQ; split; intros HYP.
- unfold AbstractRTADefinitions.busy_interval, AbstractRTADefinitions.busy_interval_prefix in *.
- { move: HYP => /negP.
- rewrite negb_or /is_priority_inversion /BusyIntervalJLFP.is_priority_inversion
- /is_interference_from_another_job_with_higher_eq_priority.
- move => /andP [HYP1 HYP2].
- case SCHED: (sched t) => [s | ].
- { rewrite SCHED in HYP1, HYP2.
- move: HYP1 HYP2.
- rewrite !Bool.negb_involutive negb_and Bool.negb_involutive.
- move => HYP1 /orP [/negP HYP2| /eqP HYP2].
- - by exfalso.
- - by subst s; rewrite /scheduled_at SCHED.
- }
- { exfalso; clear HYP1 HYP2.
- eapply instantiated_busy_interval_equivalent_busy_interval in BUSY; try done; first last.
- { by intros x; apply H_priority_is_reflexive. }
- { by apply job_task. }
- have EQ:= not_quiet_implies_not_idle
- job_arrival job_cost arr_seq _
- sched jlfp_higher_eq_priority j _ _ _ _ _ t1 t2 _ t.
- feed_n 8 EQ; try done.
- - by rewrite /jlfp_higher_eq_priority /JLFP_is_reflexive /FP_to_JLFP.
- - by move: BUSY => [PREF _].
- - by apply EQ; apply/eqP.
- }
- }
- { move: HYP => /eqP HYP.
- apply/negP.
- rewrite /interference /JLFPInstantiation.interference /is_priority_inversion
- /BusyIntervalJLFP.is_priority_inversion
- /jlfp_higher_eq_priority /is_interference_from_another_job_with_higher_eq_priority HYP negb_or.
- apply/andP; split.
- - by rewrite Bool.negb_involutive /FP_to_JLFP.
- - by rewrite negb_and Bool.negb_involutive; apply/orP; right.
- }
- Qed.
-
- (* Next, we prove that the interference and interfering workload
- functions are consistent with sequential jobs. *)
- Lemma instantiated_interference_and_workload_consistent_with_sequential_jobs:
- AbstractSeqRTA.interference_and_workload_consistent_with_sequential_jobs
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload.
- Proof.
- intros j t1 t2 ARR TSK POS BUSY.
- eapply instantiated_busy_interval_equivalent_busy_interval in BUSY; first last; try by done.
- { by intros x; apply H_priority_is_reflexive. }
- { by apply job_task. }
- eapply all_jobs_have_completed_equiv_workload_eq_service; eauto 2; intros s ARRs TSKs.
- move: (BUSY) => [[_ [QT _]] _].
- apply QT.
- - by apply in_arrivals_implies_arrived in ARRs.
- - move: TSKs => /eqP TSKs.
- by rewrite /jlfp_higher_eq_priority /FP_to_JLFP TSK TSKs.
- - by eapply in_arrivals_implies_arrived_before; eauto 2.
- Qed.
-
- (* Recall that L is assumed to be a fixed point of the busy interval recurrence. Thanks to
- this fact, we can prove that every busy interval (according to the concrete definition)
- is bounded. In addition, we know that the conventional concept of busy interval and the
- one obtained from the abstract definition (with the interference and interfering
- workload) coincide. Thus, it follows that any busy interval (in the abstract sense)
- is bounded. *)
- Lemma instantiated_busy_intervals_are_bounded:
- AbstractRTADefinitions.busy_intervals_are_bounded_by
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload L.
- Proof.
- intros j ARR TSK POS.
- have EX := exists_busy_interval
- job_arrival job_cost arr_seq _ sched _
- jlfp_higher_eq_priority j _ _ _ _ _ _ priority_inversion_bound _ L.
- feed_n 12 EX; try eauto 2.
- { by rewrite /JLFP_is_reflexive /jlfp_higher_eq_priority /FP_to_JLFP. }
- { intros.
- rewrite {2}H_fixed_point leq_add //.
- apply total_workload_le_total_rbf'; try done.
- by intros tsko INo; move: (H_family_of_proper_arrival_curves tsko INo) => [ARRB _].
- }
- move: EX => [t1 [t2 [H1 [H2 GGG]]]].
- exists t1, t2; split; first by done.
- split; first by done.
- eapply instantiated_busy_interval_equivalent_busy_interval; eauto 2.
- by intros x; apply H_priority_is_reflexive.
- Qed.
-
- (* Next, we prove that IBF is indeed an interference bound.
-
- Recall that in module abstract_seq_RTA hypothesis task_interference_is_bounded_by expects
- to receive a function that maps some task t, the relative arrival time of a job j of task t,
- and the length of the interval to the maximum amount of interference (for more details see
- files limited.abstract_RTA.definitions and limited.abstract_RTA.abstract_seq_rta).
-
- However, in this module we analyze only one task -- tsk, therefore it is “hardcodedâ€
- inside the interference bound function IBF. Moreover, in case of a model with fixed
- priorities, interference that some job j incurs from higher-or-equal priority jobs does not
- depend on the relative arrival time of job j. Therefore, in order for the IBF signature to
- match the required signature in module abstract_seq_RTA, we wrap the IBF function in a
- function that accepts, but simply ignores, the task and the relative arrival time. *)
- Lemma instantiated_task_interference_is_bounded:
- AbstractSeqRTA.task_interference_is_bounded_by
- job_arrival job_cost job_task arr_seq sched tsk interference interfering_workload
- (fun t A R => IBF R).
- Proof.
- intros ? ? ? ? ARR TSK ? NCOMPL BUSY.
- move: (posnP (job_cost j)) => [ZERO|POS].
- { exfalso.
- move: NCOMPL => /negP COMPL; apply: COMPL.
- by rewrite /is_response_time_bound_of_job /completed_by ZERO.
- }
- eapply instantiated_busy_interval_equivalent_busy_interval in BUSY; first last; try done.
- { by intros x; apply H_priority_is_reflexive. }
- { by apply job_task. }
- have T123 := cumulative_task_interference_split.
- rewrite /cumulative_task_interference in T123.
- rewrite (T123 _ _ job_arrival job_cost _ _ _ _ _ _ _ j); eauto 2; last first.
- { move: BUSY => [[_ [_ [_ /andP [GE LT]]]] _].
- by eapply arrived_between_implies_in_arrivals; eauto 2. }
- { by apply any_reflexive_FP_respects_sequential_jobs. }
- unfold IBF, interference.
- rewrite leq_add; try done.
- { unfold is_priority_inversion, FP_to_JLFP.
- unfold priority_inversion_is_bounded_by in *.
- move: (H_priority_inversion_is_bounded j ARR TSK) => BOUND.
- apply leq_trans with (cumulative_priority_inversion sched jlfp_higher_eq_priority j t1 (t1 + R0)).
- { by done. }
- { apply leq_trans with (cumulative_priority_inversion sched jlfp_higher_eq_priority j t1 t2).
- { rewrite [X in _ <= X](@big_cat_nat _ _ _ (t1 + R0)) //=.
- - by rewrite leq_addr.
- - by rewrite leq_addr.
- - by rewrite ltnW.
- }
- { by apply BOUND; move: BUSY => [PREF QT2]. }
- }
- }
- { intros.
- rewrite
- (instantiated_cumulative_interference_of_hep_tasks_equal_total_interference_of_hep_tasks
- job_arrival job_cost _ arr_seq); last first; try done.
- { by unfold quiet_time; move: BUSY => [[_ [H1 H2]] _]. }
- apply leq_trans with
- (workload_of_jobs
- job_cost (arrivals_between t1 (t1 + R0))
- (fun jhp : Job => jlfp_higher_eq_priority jhp j && (job_task jhp != job_task j))).
- { by apply service_of_jobs_le_workload. }
- { rewrite /workload_of_jobs
- /total_ohep_rbf /total_ohep_request_bound_function_FP.
- rewrite -TSK; apply total_workload_le_total_rbf; try done.
- by intros tsko INo; move: (H_family_of_proper_arrival_curves tsko INo) => [ARRB _].
- }
- }
- Qed.
-
- (* Finally, we show that there exists a solution for the response-time recurrence. *)
- Section SolutionOfResponseTimeReccurenceExists.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* Given any job j of task tsk that arrives exactly A units after the beginning of
- the busy interval, the bound of the total interference incurred by j within an
- interval of length Δ is equal to [task_rbf (A + ε) - task_cost tsk + IBF Δ]. *)
- Let total_interference_bound tsk A Δ :=
- task_rbf (A + ε) - task_cost tsk + IBF Δ.
-
- (* Next, consider any A from the search space (in the abstract sence). *)
- Variable A: time.
- Hypothesis H_A_is_in_abstract_search_space:
- AbstractRTAReduction.is_in_search_space tsk L total_interference_bound A.
-
- (* We prove that A is also in the concrete search space. *)
- Lemma A_is_in_concrete_search_space:
- is_in_search_space A.
- Proof.
- unfold total_interference_bound in *.
- move: H_A_is_in_abstract_search_space => [INSP | [/andP [POSA LTL] [x [LTx INSP2]]]].
- - rewrite INSP.
- apply/andP; split; first by done.
- rewrite neq_ltn; apply/orP; left.
- rewrite {1}/task_rbf; erewrite rbf.RBF.task_rbf_0_zero; eauto 2; try done.
- rewrite add0n /task_rbf.
- apply leq_trans with (task_cost tsk).
- + by apply leq_trans with (job_cost j); rewrite -?H_job_of_tsk; eauto 2.
- + by eapply rbf.RBF.task_rbf_1_ge_task_cost; eauto 2.
- - apply/andP; split; first by done.
- apply/negP; intros EQ; move: EQ => /eqP EQ.
- apply INSP2.
- rewrite subn1 addn1 prednK; last by done.
- by rewrite -EQ.
- Qed.
-
- (* Then, there exists a solution for the response-time recurrence (in the abstract sense). *)
- Corollary correct_search_space:
- exists F,
- A + F = task_rbf (A + ε) - (task_cost tsk - task_lock_in_service tsk) + IBF (A + F) /\
- F + (task_cost tsk - task_lock_in_service tsk) <= R.
- Proof.
- move: (H_R_is_maximum A) => FIX.
- feed FIX; first by apply A_is_in_concrete_search_space.
- move: FIX => [F [FIX NEQ]].
- exists F; split; last by done.
- apply/eqP; rewrite {1}FIX.
- by rewrite addnA [_ + priority_inversion_bound]addnC -!addnA.
- Qed.
-
- End SolutionOfResponseTimeReccurenceExists.
-
- End FillingOutHypothesesOfAbstractRTATheorem.
-
- (** ** Final Theorem *)
- (* Based on the properties established above, we apply the abstract analysis
- framework to infer that R is a response-time bound for tsk. *)
- Theorem uniprocessor_response_time_bound_fp:
- response_time_bounded_by tsk R.
- Proof.
- intros js ARRs TSKs.
- move: (posnP (job_cost js)) => [ZERO|POS].
- { by rewrite /is_response_time_bound_of_job /completed_by ZERO. }
- move: H_proper_job_lock_in_service => [T1 [T2 T3]].
- move: H_proper_task_lock_in_service => [T4 T5].
- try ( eapply AbstractSeqRTA.uniprocessor_response_time_bound_seq with
- (interference0 := interference) (interfering_workload0 := interfering_workload)
- (task_interference_bound_function := fun _ A R => IBF R) (L0 := L) (ts0 := ts); eauto 3 ) ||
- eapply AbstractSeqRTA.uniprocessor_response_time_bound_seq with
- (interference := interference) (interfering_workload := interfering_workload)
- (task_interference_bound_function := fun _ A R => IBF R) (L := L) (ts := ts); eauto 3.
- - by apply instantiated_i_and_w_are_consistent_with_schedule.
- - by apply instantiated_interference_and_workload_consistent_with_sequential_jobs.
- - by apply instantiated_busy_intervals_are_bounded.
- - by apply instantiated_task_interference_is_bounded.
- - by eapply correct_search_space; eauto 2.
- Qed.
-
- End AbstractResponseTimeAnalysisForFP.
-
-End AbstractRTAforFPwithArrivalCurves.
diff --git a/classic/model/schedule/uni/limited/jlfp_instantiation.v b/classic/model/schedule/uni/limited/jlfp_instantiation.v
deleted file mode 100644
index 58aee51244acef55759e133f186df3ad1499d567..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/jlfp_instantiation.v
+++ /dev/null
@@ -1,769 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.workload
- prosa.classic.model.schedule.uni.schedule_of_task.
-Require Import prosa.classic.model.schedule.uni.limited.busy_interval
- prosa.classic.model.schedule.uni.limited.abstract_RTA.definitions
- prosa.classic.model.schedule.uni.limited.abstract_RTA.abstract_seq_rta.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * JLFP instantiation of Interference and Interfering Workload *)
-(** In this module we instantiate functions Interference and Interfering Workload
- for an arbitrary JLFP-policy that satisfies the sequential jobs hypothesis.
- We also prove equivalence of Interference and Interfering Workload to the
- more conventional notions of service or workload. *)
-Module JLFPInstantiation.
-
- Import Job TaskArrival ScheduleOfTask Priority Workload Service BusyIntervalJLFP.
-
- Section Instantiation.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Assume we have sequential jobs, i.e., jobs from the
- same task execute in the order of their arrival. *)
- Hypothesis H_sequential_jobs: sequential_jobs job_arrival job_cost sched job_task.
-
- (* Consider a JLFP-policy that indicates a higher-or-equal priority relation,
- and assume that this relation is reflexive and transitive. *)
- Variable higher_eq_priority: JLFP_policy Job.
- Hypothesis H_priority_is_reflexive: JLFP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLFP_is_transitive higher_eq_priority.
-
- (* We also assume that the policy respects sequential jobs, meaning
- that later-arrived jobs of a task don't have higher priority than
- earlier-arrived jobs of the same task. *)
- Hypothesis H_JLFP_respects_sequential_jobs:
- JLFP_respects_sequential_jobs
- job_task job_arrival higher_eq_priority.
-
- (* Let tsk be any task in ts that is to be analyzed. *)
- Variable tsk: Task.
-
- (* For simplicity, let's define some local names. *)
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
- Let arrivals_between := jobs_arrived_between arr_seq.
- Let quiet_time := quiet_time job_arrival job_cost arr_seq sched higher_eq_priority.
- Let cumulative_task_interference :=
- AbstractSeqRTA.cumul_task_interference job_task arr_seq sched.
-
- (** ** Interference and Interfering Workload *)
- (** In this section, we introduce definitions of interference,
- interfering workload and a function that bounds cumulative interference. *)
-
- (* For proper calculation of interference and interfering workload of a job, we need to distinguish
- interference received from other jobs of the same task and other jobs of other tasks. In that
- regard, we introduce two additional relations. The first relation defines whether job j1 has a
- higher-than-or-equal-priority than job j2 and j1 is not equal to j2... *)
- Let another_job_with_higher_eq_priority: JLFP_policy Job :=
- fun j1 j2 => higher_eq_priority j1 j2 && (j1 != j2).
-
- (* ...and the second relation defines whether a job j1 has a higher-or-equal-priority than
- job j2 and the task of j1 is not equal to task of j2. *)
- Let job_from_another_task_with_higher_eq_priority: JLFP_policy Job :=
- fun j1 j2 => higher_eq_priority j1 j2 && (job_task j1 != job_task j2).
-
- (* In order to introduce the interference, first we need to recall the definition
- of priority inversion introduced in module limited.fixed_priority.busy_interval:
- [ Definition is_priority_inversion t := ]
- [ if sched t is Some jlp then ]
- [ ~~ higher_eq_priority jlp j ]
- [ else false. ]
- I.e., we say that job j is incurring a priority inversion at time t
- if there exists a job with lower priority that executes at time t.
- In order to simplify things, we ignore the fact that according to this
- definition a job can incur priority inversion even before its release
- (or after completion). All such (potentially bad) cases do not cause
- problems, as each job is analyzed only within the corresponding busy
- interval where the priority inversion behaves in the expected way. *)
- Let is_priority_inversion (j: Job) (t: time) :=
- is_priority_inversion sched higher_eq_priority j t.
-
- (* Next, we say that job j is incurring interference from another job with higher or equal
- priority at time t, if there exists job jhp (different from j) with a higher or equal priority
- that executes at time t. *)
- Definition is_interference_from_another_job_with_higher_eq_priority (j: Job) (t: time) :=
- if sched t is Some jhp then
- another_job_with_higher_eq_priority jhp j
- else false.
-
- (* Similarly, we say that job j is incurring interference from a job with higher or
- equal priority of another task at time t, if there exists a job jhp (of a different task)
- with higher or equal priority that executes at time t. *)
- Definition is_interference_from_another_task_with_higher_eq_priority (j: Job) (t: time) :=
- if sched t is Some jhp then
- job_from_another_task_with_higher_eq_priority jhp j
- else false.
-
- (* Now, we define the notion of cumulative interference, called
- interfering_workload_of_jobs_with_hep_priority, that says
- how many units of workload are generated by jobs with higher
- or equal priority released at time t. *)
- Definition interfering_workload_of_jobs_with_hep_priority (j: Job) (t: time) :=
- \sum_(jhp <- jobs_arriving_at arr_seq t |
- another_job_with_higher_eq_priority jhp j) job_cost jhp.
-
- (* Instantiation of Interference *)
- (* We say that job j incurs interference at time t iff it cannot execute due to
- a higher-or-equal-priority job being scheduled, or if it incurs a priority inversion. *)
- Definition interference j t :=
- is_priority_inversion j t || is_interference_from_another_job_with_higher_eq_priority j t.
-
- (* Instantiation of Interfering Workload *)
- (* The interfering workload, in turn, is defined as the sum of the priority inversion
- function and interfering workload of jobs with higher or equal priority. *)
- Definition interfering_workload j t :=
- is_priority_inversion j t + interfering_workload_of_jobs_with_hep_priority j t.
-
- (* For each of the concepts defined above, we introduce a corresponding cumulative function: *)
- (* (a) cumulative priority inversion... *)
- Let cumulative_priority_inversion j t1 t2 :=
- \sum_(t1 <= t < t2) is_priority_inversion j t.
-
- (* ... (b) cumulative interference from other jobs with higher or equal priority... *)
- Let cumulative_interference_from_other_jobs j t1 t2 :=
- \sum_(t1 <= t < t2) is_interference_from_another_job_with_higher_eq_priority j t.
-
- (* ... (c) and cumulative interference from jobs with higher or equal priority from other tasks... *)
- Let cumulative_interference_from_other_tasks j t1 t2 :=
- \sum_(t1 <= t < t2) is_interference_from_another_task_with_higher_eq_priority j t.
-
- (* ... (d) cumulative interference... *)
- Let cumulative_interference j t1 t2 := \sum_(t1 <= t < t2) interference j t.
-
- (* ... (e) cumulative workload from jobs with higher or equal priority... *)
- Let cumulative_interfering_workload_of_jobs_with_hep_priority j t1 t2 :=
- \sum_(t1 <= t < t2) interfering_workload_of_jobs_with_hep_priority j t.
-
- (* ... (f) and cumulative interfering workload. *)
- Let cumulative_interfering_workload j t1 t2 := \sum_(t1 <= t < t2) interfering_workload j t.
-
- (* Instantiated functions usually do not have any useful lemmas about them. In order to
- reuse existing lemmas, we need to prove equivalence of the instantiated functions to
- some conventional notions. The instantiations given in this file are equivalent to
- service and workload. Further, we prove these equivalences formally. *)
-
- (* Before we present the formal proofs of the equivalences, we recall
- the notion of workload of higher or equal priority jobs. *)
- Let workload_of_other_jobs_with_hep_priority j t1 t2 :=
- workload_of_jobs job_cost (arrivals_between t1 t2)
- (fun jhp => another_job_with_higher_eq_priority jhp j).
-
- (* Similarly, we recall notions of service of higher or equal priority jobs from other tasks... *)
- Let service_of_jobs_from_other_tasks_with_hep_priority j t1 t2 :=
- service_of_jobs sched (arrivals_between t1 t2)
- (fun jhp => job_from_another_task_with_higher_eq_priority jhp j) t1 t2.
-
- (* ... and service of all other jobs with higher or equal priority. *)
- Let service_of_other_jobs_with_hep_priority j t1 t2 :=
- service_of_jobs sched (arrivals_between t1 t2)
- (fun jhp => another_job_with_higher_eq_priority jhp j) t1 t2.
-
- (** ** Equivalences *)
- (** In this section we prove a few equivalences between the definitions obtained by
- instantiation of definitions from the Abstract RTA module (interference and
- interfering workload) and definitions corresponding to the conventional concepts.
-
- As it was mentioned previously, instantiated functions of interference and
- interfering workload usually do not have any useful lemmas about them. Hovewer,
- it is possible to prove their equivalence to the more conventional notions like
- service or workload. Next we prove the equivalence between the instantiations
- and conventional notions. *)
- Section Equivalences.
-
- (* We prove that we can split cumulative interference into two parts: (1) cumulative priority
- inversion and (2) cumulative interference from jobs with higher or equal priority. *)
- Lemma cumulative_interference_split:
- forall j t1 t2,
- cumulative_interference j t1 t2
- = cumulative_priority_inversion j t1 t2 + cumulative_interference_from_other_jobs j t1 t2.
- rewrite /cumulative_interference /cumulative_priority_inversion
- /cumulative_interference_from_other_jobs /interference.
- intros; rewrite -big_split //=.
- apply/eqP; rewrite eqn_leq; apply/andP; split; rewrite leq_sum; try done.
- { intros t _; unfold is_priority_inversion,
- BusyIntervalJLFP.is_priority_inversion,
- is_interference_from_another_job_with_higher_eq_priority.
- case SCHED: (sched t) => [s | ]; last by done.
- by case HP: (higher_eq_priority s j); simpl; rewrite ?addn0 ?add0n.
- }
- { intros t _; unfold is_priority_inversion,
- BusyIntervalJLFP.is_priority_inversion,
- is_interference_from_another_job_with_higher_eq_priority.
- case SCHED: (sched t) => [s | ]; last by done.
- unfold another_job_with_higher_eq_priority.
- by case HP: (higher_eq_priority s j); simpl; rewrite ?addn0 ?add0n.
- }
- Qed.
-
- (* Let j be any job of task tsk, and let upp_t be any time instant after job j's arrival.
- Then for any time interval lying before upp_t, the cumulative interference received by tsk
- is equal to the sum of the cumulative priority inversion of job j and the cumulative interference
- incurred by task tsk due to other tasks. *)
- Lemma cumulative_task_interference_split:
- forall j t1 t2 upp_t,
- job_task j = tsk ->
- j \in jobs_arrived_before arr_seq upp_t ->
- ~~ job_completed_by j t2 ->
- cumulative_task_interference interference tsk upp_t t1 t2 =
- cumulative_priority_inversion j t1 t2 +
- cumulative_interference_from_other_tasks j t1 t2.
- Proof.
- rewrite /cumulative_task_interference /AbstractSeqRTA.cumul_task_interference
- /ScheduleOfTask.task_scheduled_at
- /cumulative_priority_inversion
- /cumulative_interference_from_other_tasks.
- intros j t1 R upp TSK ARR NCOMPL.
- rewrite -big_split //=.
- rewrite big_nat_cond [X in _ = X]big_nat_cond.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- { apply leq_sum; intros t _.
- rewrite /interference /is_priority_inversion /BusyIntervalJLFP.is_priority_inversion
- /is_interference_from_another_task_with_higher_eq_priority
- /is_interference_from_another_job_with_higher_eq_priority
- /AbstractSeqRTA.task_interference_received_before
- /another_job_with_higher_eq_priority /job_from_another_task_with_higher_eq_priority
- /ScheduleOfTask.task_scheduled_at.
- case SCHED: (sched t) => [s | ]; last by rewrite has_pred0 addn0 leqn0 eqb0.
- case HP: (higher_eq_priority s j); simpl; last by rewrite addn0 leq_b1.
- rewrite add0n TSK.
- case: ((job_task s != tsk)); last by done.
- by rewrite Bool.andb_true_l leq_b1.
- }
- { apply leq_sum; move => t /andP [/andP [_ LT'] _].
- rewrite /is_priority_inversion /BusyIntervalJLFP.is_priority_inversion
- /is_interference_from_another_task_with_higher_eq_priority
- /is_interference_from_another_job_with_higher_eq_priority /another_job_with_higher_eq_priority
- /job_from_another_task_with_higher_eq_priority /AbstractSeqRTA.task_interference_received_before
- /ScheduleOfTask.task_scheduled_at .
- case SCHED: (sched t) => [s | ]; last by done.
- rewrite -TSK; case TSKEQ: (job_task s == job_task j); simpl.
- { rewrite Bool.andb_false_r leqn0 addn0 eqb0.
- apply/negP; intros NEQ.
- move: SCHED => /eqP SCHED.
- move: NCOMPL => /negP NCOMPL; apply: NCOMPL.
- apply completion_monotonic with t; [ by apply ltnW | ].
- apply/negP; intros NCOMPL; move: NCOMPL => /negP NCOMPL.
- have ARRle := (scheduler_executes_job_with_earliest_arrival
- job_arrival _ _ _ _ s j t TSKEQ NCOMPL SCHED).
- feed ARRle; try done.
- move: NEQ => /negP NEQ; apply: NEQ.
- by apply H_JLFP_respects_sequential_jobs.
- }
- have NEQ: s != j.
- { apply/negP; intros EQ; move: EQ => /eqP EQ.
- move: TSKEQ => /eqP TSKEQ; apply: TSKEQ.
- by rewrite EQ.
- }
- have Fact: forall b, ~~ b + b = true; first by intros b; destruct b.
- rewrite Bool.andb_true_r Fact; simpl; rewrite lt0b; clear Fact.
- apply/hasP; exists j.
- { rewrite /arrivals_of_task_before /arrivals_of_task_between.
- rewrite /arrivals_of_task_between mem_filter; apply/andP; split; first by rewrite /is_job_of_task.
- try ( by unfold jobs_arrived_before in ARR; apply jobs_arrived_between_sub with (t2 := 0) (t3 := upp) ) ||
- by unfold jobs_arrived_before in ARR; apply jobs_arrived_between_sub with (t1 := 0) (t2 := upp).
- }
- { case HP: (higher_eq_priority s j).
- { apply/orP; right.
- rewrite /is_interference_from_another_job_with_higher_eq_priority SCHED.
- by rewrite /another_job_with_higher_eq_priority NEQ Bool.andb_true_r. }
- { apply/orP; left.
- by rewrite /is_priority_inversion /BusyIntervalJLFP.is_priority_inversion SCHED HP.
- }
- }
- }
- Qed.
-
- (* In this section we prove that the (abstract) cumulative interfering workload is equivalent to
- conventional workload, i.e., the one defined with concrete schedule parameters. *)
- Section InstantiatedWorkloadEquivalence.
-
- (* Let [t1,t2) be any time interval. *)
- Variables t1 t2: time.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Then for any job j, the cumulative interfering workload is equal to the conventional workload. *)
- Lemma instantiated_cumulative_workload_of_hep_jobs_equal_total_workload_of_hep_jobs:
- cumulative_interfering_workload_of_jobs_with_hep_priority j t1 t2
- = workload_of_other_jobs_with_hep_priority j t1 t2.
- Proof.
- intros.
- unfold cumulative_interfering_workload_of_jobs_with_hep_priority, workload_of_other_jobs_with_hep_priority.
- case NEQ: (t1 < t2); last first.
- { move: NEQ => /negP /negP; rewrite -leqNgt; move => NEQ.
- rewrite big_geq; last by done.
- rewrite /arrivals_between /jobs_arrived_between big_geq; last by done.
- by rewrite /workload_of_jobs big_nil.
- }
- { unfold interfering_workload_of_jobs_with_hep_priority, workload_of_jobs.
- have EX: exists k, t2 = t1 + k.
- { exists (t2 - t1). rewrite subnKC. by done. by rewrite ltnW. }
- move: EX => [k EQ]. subst t2. clear NEQ.
- induction k.
- - rewrite !addn0.
- rewrite big_geq; last by done.
- rewrite /arrivals_between /jobs_arrived_between big_geq; last by done.
- by rewrite /workload_of_jobs big_nil.
- - rewrite addnS big_nat_recr //=; last by rewrite leq_addr.
- rewrite IHk.
- rewrite /arrivals_between /jobs_arrived_between big_nat_recr //=; last by rewrite leq_addr.
- by rewrite big_cat //=.
- }
- Qed.
-
- End InstantiatedWorkloadEquivalence.
-
- (* In this section we prove that the (abstract) cumulative interference of jobs with higher or
- equal priority is equal to total service of jobs with higher or equal priority. *)
- Section InstantiatedServiceEquivalences.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* We consider an arbitrary time interval [t1, t) that starts with a quiet time. *)
- Variable t1 t: time.
- Hypothesis H_quiet_time: quiet_time j t1.
-
- (* Then for any job j, the (abstract) instantiated function of interference is
- equal to the total service of jobs with higher or equal priority. *)
- Lemma instantiated_cumulative_interference_of_hep_jobs_equal_total_interference_of_hep_jobs:
- cumulative_interference_from_other_jobs j t1 t = service_of_other_jobs_with_hep_priority j t1 t.
- Proof.
- { rewrite /cumulative_interference_from_other_jobs /is_interference_from_another_job_with_higher_eq_priority
- /service_of_other_jobs_with_hep_priority.
- case NEQ: (t1 <= t); last first.
- { apply negbT in NEQ; rewrite -ltnNge in NEQ.
- rewrite big_geq; last by apply ltnW.
- rewrite /service_of_jobs /arrivals_between /jobs_arrived_between big_geq; last by apply ltnW.
- by rewrite big_nil.
- }
- have EX: exists k, t = t1 + k.
- { by exists (t - t1); rewrite subnKC. } move: EX => [k EQ]. subst t. clear NEQ.
- induction k.
- - rewrite addn0 big_geq; last by done.
- by rewrite /arrivals_between /jobs_arrived_between big_geq // /service_of_jobs big_nil.
- - unfold service_of_jobs, service_during.
- unfold is_interference_from_another_job_with_higher_eq_priority.
- rewrite addnS.
- rewrite big_nat_recr //=.
- unfold arrivals_between, jobs_arrived_between.
- rewrite big_nat_recr //=.
- rewrite big_cat //=.
- rewrite IHk.
- have EQ:
- \sum_(i0 <- jobs_arriving_at arr_seq (t1 + k) | higher_eq_priority i0 j && (i0 != j))
- \sum_(t1 <= t0 < (t1 + k).+1) service_at sched i0 t0
- =
- \sum_(i0 <- jobs_arriving_at arr_seq (t1 + k) | higher_eq_priority i0 j && (i0 != j))
- \sum_(t1 + k <= t0 < (t1 + k).+1) service_at sched i0 t0.
- {
- rewrite big_seq_cond [X in _ = X]big_seq_cond.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- {
- rewrite leq_sum //.
- move => jo /andP [ARR /andP [HP NTSK]].
- rewrite (@big_cat_nat _ _ _ (t1 + k)) //=.
- rewrite -[X in _ <= X]add0n leq_add //.
- rewrite leqn0.
- rewrite big_nat_cond.
- rewrite big1 //.
- move => x /andP [/andP [_ LT] _].
- apply/eqP; rewrite eqb0; apply/negP; intros NSCHED.
- unfold jobs_must_arrive_to_execute, arrival_times_are_consistent in *.
- apply H_jobs_must_arrive_to_execute in NSCHED.
- unfold has_arrived in NSCHED.
- apply H_arrival_times_are_consistent in ARR.
- rewrite -ARR in LT.
- by move: LT; rewrite ltnNge; move => /negP LT.
- by rewrite leq_addr.
- }
- {
- rewrite leq_sum //.
- move => jo /andP [ARR /andP [HP NTSK]].
- rewrite [X in _ <= X](@big_cat_nat _ _ _ (t1 + k )) //=. rewrite leq_addl //.
- by rewrite leq_addr.
- }
- }
- rewrite EQ.
- apply/eqP.
- rewrite exchange_big //=.
- rewrite (@big_cat_nat _ _ _ (t1 + k)) //=.
- rewrite exchange_big //=.
- rewrite big_nat1.
- rewrite -addnA.
- rewrite eqn_add2l.
- rewrite exchange_big //=.
- rewrite big_nat1.
- rewrite -big_cat //=. rewrite -big_nat_recr //=.
- clear EQ IHk.
- case SCHED: (sched (t1 + k)) => [jo | ].
- case PRIO: (another_job_with_higher_eq_priority jo j).
- { simpl.
- rewrite eqn_leq; apply/andP; split; last by apply service_of_jobs_le_1 with job_arrival.
- rewrite (big_rem jo) //=.
- rewrite PRIO /service_at /scheduled_at SCHED eq_refl add1n; by done.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival); try done ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival); try done.
- unfold jobs_come_from_arrival_sequence in *.
- apply H_jobs_come_from_arrival_sequence with (t1 + k). by rewrite /scheduled_at SCHED.
- { move: PRIO => /andP [PRIO1 PRIO2].
- rewrite /arrived_between ltnS; apply/andP; split.
- { rewrite leqNgt; apply/negP; intros AB.
- move: (SCHED) => /eqP /negP SCHED2; apply: SCHED2.
- apply/negP.
- apply completed_implies_not_scheduled with job_cost; try done.
- apply completion_monotonic with t1; try done.
- rewrite leq_addr; by done.
- apply H_quiet_time; try done.
- move: SCHED => /eqP SCHED.
- by apply H_jobs_come_from_arrival_sequence in SCHED.
- }
- {
- move: SCHED => /eqP SCHED.
- by apply H_jobs_must_arrive_to_execute in SCHED.
- }
- }
- }
- {
- simpl.
- rewrite eq_sym big1 //.
- intros joo PRIO2.
- apply/eqP; rewrite eqb0; apply/negP; intros SCHED2.
- move: SCHED2 => /eqP SCHED2.
- rewrite SCHED2 in SCHED.
- inversion SCHED; subst joo.
- by rewrite PRIO in PRIO2.
- }
- { simpl.
- rewrite eq_sym big1 //.
- intros.
- by rewrite /service_at /scheduled_at SCHED.
- }
- by rewrite leq_addr.
- by rewrite leq_addr .
- by rewrite leq_addr.
- by rewrite leq_addr.
- }
- Qed.
-
- (* The same applies to the alternative definition of interference. *)
- Lemma instantiated_cumulative_interference_of_hep_tasks_equal_total_interference_of_hep_tasks:
- cumulative_interference_from_other_tasks j t1 t = service_of_jobs_from_other_tasks_with_hep_priority j t1 t.
- Proof.
- rewrite /cumulative_interference_from_other_tasks /service_of_jobs_from_other_tasks_with_hep_priority
- /job_from_another_task_with_higher_eq_priority.
- case NEQ: (t1 <= t); last first.
- { apply negbT in NEQ; rewrite -ltnNge in NEQ.
- rewrite big_geq; last by apply ltnW.
- rewrite /service_of_jobs /arrivals_between /jobs_arrived_between big_geq; last by apply ltnW.
- by rewrite big_nil.
- }
- { have EX: exists k, t = t1 + k; first by exists (t - t1); rewrite subnKC.
- move: EX => [k EQ]; subst t; clear NEQ.
- induction k.
- - rewrite addn0 big_geq; last by done.
- by rewrite /arrivals_between /jobs_arrived_between big_geq // /service_of_jobs big_nil.
- - unfold service_of_jobs, service_during.
- unfold is_interference_from_another_job_with_higher_eq_priority.
- rewrite addnS.
- rewrite big_nat_recr //=.
- unfold arrivals_between, jobs_arrived_between.
- rewrite big_nat_recr //=.
- rewrite big_cat //=.
- rewrite IHk.
- have EQ:
- \sum_(i0 <- jobs_arriving_at arr_seq (t1 + k) | higher_eq_priority i0 j &&
- (job_task i0 != job_task j))
- \sum_(t1 <= t0 < (t1 + k).+1) service_at sched i0 t0
- =
- \sum_(i0 <- jobs_arriving_at arr_seq (t1 + k) | higher_eq_priority i0 j &&
- (job_task i0 != job_task j))
- \sum_(t1 + k <= t0 < (t1 + k).+1) service_at sched i0 t0.
- {
- rewrite big_seq_cond [X in _ = X]big_seq_cond.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- {
- rewrite leq_sum //.
- move => jo /andP [ARR /andP [HP NTSK]].
- rewrite (@big_cat_nat _ _ _ (t1 + k)) //=.
- rewrite -[X in _ <= X]add0n leq_add //.
- rewrite leqn0.
- rewrite big_nat_cond.
- rewrite big1 //.
- move => x /andP [/andP [_ LT] _].
- apply/eqP; rewrite eqb0; apply/negP; intros NSCHED.
- unfold jobs_must_arrive_to_execute, arrival_times_are_consistent in *.
- apply H_jobs_must_arrive_to_execute in NSCHED.
- unfold has_arrived in NSCHED.
- apply H_arrival_times_are_consistent in ARR.
- rewrite -ARR in LT.
- by move: LT; rewrite ltnNge; move => /negP LT.
- by rewrite leq_addr.
- }
- {
- rewrite leq_sum //.
- move => jo /andP [ARR /andP [HP NTSK]].
- rewrite [X in _ <= X](@big_cat_nat _ _ _ (t1 + k )) //=. rewrite leq_addl //.
- by rewrite leq_addr.
- }
- }
- rewrite EQ.
- apply/eqP.
- rewrite exchange_big //=.
- rewrite (@big_cat_nat _ _ _ (t1 + k)) //=.
- rewrite exchange_big //=.
- rewrite big_nat1.
- rewrite -addnA.
- rewrite eqn_add2l.
- rewrite exchange_big //=.
- rewrite big_nat1.
- rewrite -big_cat //=. rewrite -big_nat_recr //=.
- clear EQ IHk.
- case SCHED: (sched (t1 + k)) => [jo | ].
- unfold is_interference_from_another_task_with_higher_eq_priority.
- case PRIO: (job_from_another_task_with_higher_eq_priority jo j).
- { simpl.
- rewrite eqn_leq; apply/andP; split.
- { rewrite (big_rem jo) //=.
- unfold job_from_another_task_with_higher_eq_priority in PRIO.
- rewrite PRIO /job_from_another_task_with_higher_eq_priority
- /is_interference_from_another_task_with_higher_eq_priority /service_at
- /scheduled_at SCHED eq_refl add1n PRIO; by done.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0 := job_arrival); try done ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival := job_arrival); try done.
- unfold jobs_come_from_arrival_sequence in *.
- apply H_jobs_come_from_arrival_sequence with (t1 + k). by rewrite /scheduled_at SCHED.
- { move: PRIO => /andP [PRIO1 PRIO2].
- rewrite /arrived_between ltnS; apply/andP; split.
- { rewrite leqNgt; apply/negP; intros AB.
- move: (SCHED) => /eqP /negP SCHED2; apply: SCHED2.
- apply/negP.
- apply completed_implies_not_scheduled with job_cost; try done.
- apply completion_monotonic with t1; try done.
- rewrite leq_addr; by done.
- apply H_quiet_time; try done.
- move: SCHED => /eqP SCHED.
- by apply H_jobs_come_from_arrival_sequence in SCHED.
- }
- {
- move: SCHED => /eqP SCHED.
- by apply H_jobs_must_arrive_to_execute in SCHED.
- }
- }
- }
- {
- rewrite SCHED PRIO.
- by apply service_of_jobs_le_1 with job_arrival.
- }
- }
- {
- simpl. rewrite SCHED.
- rewrite eq_sym big1. rewrite PRIO //.
- intros joo PRIO2.
- apply/eqP; rewrite eqb0; apply/negP; intros SCHED2.
- move: SCHED2 => /eqP SCHED2.
- rewrite SCHED2 in SCHED.
- inversion SCHED; subst joo.
- unfold job_from_another_task_with_higher_eq_priority in PRIO.
- by rewrite PRIO in PRIO2.
- }
- { simpl.
- rewrite /is_interference_from_another_task_with_higher_eq_priority eq_sym big1 //.
- rewrite SCHED; by done.
- intros.
- by rewrite /service_at /scheduled_at SCHED.
- }
- by rewrite leq_addr.
- by rewrite leq_addr .
- by rewrite leq_addr.
- by rewrite leq_addr.
- }
- Qed.
-
- End InstantiatedServiceEquivalences.
-
- (* In this section we prove that the abstract definition of busy interval is equivalent to
- the conventional, concrete definition of busy interval for JLFP scheduling. *)
- Section BusyIntervalEquivalence.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* We prove that the concept of quiet time obtained by instantiating the abstract
- definition of quiet time coincides with the conventional definition of quiet time
- (which is defined in module limited.busy_interval). *)
- Lemma instantiated_quiet_time_equivalent_edf_quiet_time:
- forall t,
- quiet_time j t <->
- AbstractRTADefinitions.quiet_time job_arrival job_cost sched interference interfering_workload j t.
- Proof.
- have zero_is_quiet_time: forall j, quiet_time j 0.
- { by intros jhp ARR HP AB; move: AB; rewrite /arrived_before ltn0. }
- have CIS := cumulative_interference_split.
- have IC1 := instantiated_cumulative_interference_of_hep_jobs_equal_total_interference_of_hep_jobs.
- have IC2 := instantiated_cumulative_interference_of_hep_tasks_equal_total_interference_of_hep_tasks.
- rewrite /cumulative_interference
- /cumulative_interference_from_other_jobs
- /interference /interfering_workload /cumulative_interference_from_other_tasks
- /service_of_jobs_from_other_tasks_with_hep_priority
- /service_of_other_jobs_with_hep_priority /job_from_another_task_with_higher_eq_priority
- in CIS, IC1, IC2.
- intros t; split; intros.
- { unfold AbstractRTADefinitions.quiet_time; split.
- { rewrite /cumulative_interference /AbstractRTADefinitions.cumul_interference
- /AbstractRTADefinitions.cumul_interfering_workload
- /cumulative_interference_from_other_jobs
- /interference /interfering_workload.
- rewrite CIS !big_split //=.
- apply/eqP; rewrite eqn_add2l.
- have L11 := all_jobs_have_completed_equiv_workload_eq_service.
- rewrite IC1; last by apply zero_is_quiet_time.
- have L2 := instantiated_cumulative_workload_of_hep_jobs_equal_total_workload_of_hep_jobs;
- rewrite /cumulative_interfering_workload_of_jobs_with_hep_priority in L2.
- rewrite L2.
- rewrite eq_sym; apply/eqP.
- apply L11 with job_arrival; try done.
- intros.
- apply H; try done.
- apply in_arrivals_implies_arrived in H0; by done.
- move: H1 => /andP [H3 H4].
- unfold FP_to_JLFP. by done.
- try ( apply in_arrivals_implies_arrived_between with (job_arrival0 := job_arrival) in H0; try done ) ||
- apply in_arrivals_implies_arrived_between with (job_arrival := job_arrival) in H0; try done.
- }
- {
- unfold pending_earlier_and_at.
- rewrite negb_and Bool.negb_involutive; apply/orP.
- case ARR: (arrived_before job_arrival j t); [right | by left].
- by apply H.
- }
- }
- {
- intros jhp ARR HP ARB.
- eapply all_jobs_have_completed_equiv_workload_eq_service with
- (P := (fun jhp => higher_eq_priority jhp j)) (t1 := 0)(t2 := t); eauto 2; last first.
- eapply arrived_between_implies_in_arrivals; eauto 2.
- move: H => [H0 H1].
- move: H0.
- rewrite /AbstractRTADefinitions.cumul_interference /AbstractRTADefinitions.cumul_interfering_workload
- /interference /interfering_workload.
- rewrite CIS !big_split //=; move => /eqP; rewrite eqn_add2l.
- rewrite IC1; last by apply zero_is_quiet_time.
- have L2 := instantiated_cumulative_workload_of_hep_jobs_equal_total_workload_of_hep_jobs;
- rewrite /cumulative_interfering_workload_of_jobs_with_hep_priority in L2.
- rewrite L2. move => H2.
- have H2EQ:
- service_of_jobs sched (arrivals_between 0 t)
- (fun jhp : Job =>
- higher_eq_priority jhp j) 0 t ==
- workload_of_jobs job_cost (arrivals_between 0 t)
- (fun jhp : Job =>
- higher_eq_priority jhp j).
- { move: H1; rewrite negb_and Bool.negb_involutive -leqNgt; move => /orP [H1 | H1].
- { intros.
- have NOTIN: j \notin arrivals_between 0 t.
- { apply/memPn.
- intros jo IN; apply/negP; intros EQ; move: EQ => /eqP EQ.
- subst jo.
- unfold arrivals_between in *.
- try ( apply in_arrivals_implies_arrived_between with (job_arrival0:= job_arrival) in IN; try done ) ||
- apply in_arrivals_implies_arrived_between with (job_arrival:= job_arrival) in IN; try done.
- by move: IN => /andP [_ IN]; move: H1; rewrite leqNgt; move => /negP LT; apply: LT.
- }
- have UL1 := sum_notin_rem_eqn.
- rewrite /workload_of_other_jobs_with_hep_priority
- /another_job_with_higher_eq_priority in H2.
- by rewrite /service_of_jobs /workload_of_jobs !sum_notin_rem_eqn in H2.
- }
- {
- have JIN: j \in arrivals_between 0 t.
- { eapply completed_implies_scheduled_before in H1; eauto 2.
- try ( apply arrived_between_implies_in_arrivals with (job_arrival0:= job_arrival); try done ) ||
- apply arrived_between_implies_in_arrivals with (job_arrival:= job_arrival); try done.
- move: H1 => [t' [H3 _]].
- apply/andP; split; first by done.
- move: H3 => /andP [H3e H3t].
- by apply leq_ltn_trans with t'.
- }
- have UNIC: uniq (arrivals_between 0 t).
- { by eapply arrivals_uniq; eauto 2. }
- unfold service_of_jobs, workload_of_jobs in H2.
- unfold service_of_jobs, workload_of_jobs.
- rewrite big_mkcond //=.
- rewrite (bigD1_seq j) //=.
- rewrite -big_mkcondl //=.
- move: H2 => /eqP H2. rewrite H2.
- rewrite [X in _ == X]big_mkcond //=.
- rewrite [X in _ == X](bigD1_seq j) //=.
- rewrite -big_mkcondl //=.
- rewrite eqn_add2r H_priority_is_reflexive.
- by rewrite eqn_leq; apply/andP; split; try eauto 2.
- }
- }
- by move: H2EQ => /eqP H2EQ.
- }
- Qed.
-
- (* Based on that, we prove that the concept of busy interval obtained by instantiating the abstract
- definition of busy interval coincides with the conventional definition of busy interval. *)
- Lemma instantiated_busy_interval_equivalent_busy_interval:
- forall t1 t2,
- busy_interval job_arrival job_cost arr_seq sched higher_eq_priority j t1 t2 <->
- AbstractRTADefinitions.busy_interval job_arrival job_cost sched interference interfering_workload j t1 t2.
- Proof.
- split.
- {
- move => [[NEQ [QTt1 [NQT REL]] QTt2]].
- - split; last by eapply instantiated_quiet_time_equivalent_edf_quiet_time in QTt2; eauto 2.
- - split; first by done.
- - split; first by apply instantiated_quiet_time_equivalent_edf_quiet_time in QTt1; eauto 2.
- by intros t NEQ' QT; eapply NQT; eauto 2; apply instantiated_quiet_time_equivalent_edf_quiet_time.
- }
- { move => [[/andP [NEQ1 NEQ2] [QTt1 NQT] QTt2]].
- - split; last by eapply instantiated_quiet_time_equivalent_edf_quiet_time; eauto 2.
- - split; first by apply leq_ltn_trans with (job_arrival j).
- - split; first by eapply instantiated_quiet_time_equivalent_edf_quiet_time; eauto 2.
- - split; first by intros t NEQ QT; eapply NQT; eauto 2; eapply instantiated_quiet_time_equivalent_edf_quiet_time in QT; eauto 2.
- - by apply/andP; split.
- }
- Qed.
-
- End BusyIntervalEquivalence.
-
- End Equivalences.
-
- End Instantiation.
-
-End JLFPInstantiation.
diff --git a/classic/model/schedule/uni/limited/platform/definitions.v b/classic/model/schedule/uni/limited/platform/definitions.v
deleted file mode 100644
index 375c04d993ae04f59b723bc9dfb5f34bcc799191..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/platform/definitions.v
+++ /dev/null
@@ -1,239 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task
- prosa.classic.model.priority
- prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.basic.platform.
-Require Import prosa.classic.model.schedule.uni.nonpreemptive.schedule.
-
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(** * Platform with limited preemptions *)
-(** In this module we introduce the notion of whether a job can be preempted at a given time
- (using a predicate can_be_preempted). In addition, we provide instantiations of the
- predicate for various preemption models. *)
-Module LimitedPreemptionPlatform.
-
- Import Job SporadicTaskset UniprocessorSchedule Priority Service.
-
- (* In this section, we define a processor platform with limited preemptions. *)
- Section Properties.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_pending := pending job_arrival job_cost sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
-
- (* First, we define the notion of a preemption time. *)
- Section PreemptionTime.
-
- (* Let can_be_preempted be a function that maps a job j and the progress of j
- at some time instant t to a boolean value, i.e., true if job j can be
- preempted at this point of execution and false otherwise. *)
- Variable can_be_preempted: Job -> time -> bool.
-
- (* We say that a time instant t is a preemption time iff there's no job currently
- scheduled at t that cannot be preempted (according to the predicate). *)
- Definition preemption_time (t: time) :=
- if sched t is Some j then
- can_be_preempted j (service sched j t)
- else true.
-
- (* Since the notion of preemption time is based on an user-provided
- predicate (variable can_be_preempted), it does not guarantee that
- the scheduler will enforce correct behavior. For that, we must
- define additional predicates. *)
- Section CorrectPreemptionModel.
-
- (* First, if a job j is not preemptive at some time instant t,
- then j must be scheduled at time t. *)
- Definition not_preemptive_implies_scheduled (j: Job) :=
- forall t,
- ~~ can_be_preempted j (service sched j t) ->
- job_scheduled_at j t.
-
- (* A job can start its execution only from a preemption point. *)
- Definition execution_starts_with_preemption_point (j: Job) :=
- forall prt,
- ~~ job_scheduled_at j prt ->
- job_scheduled_at j prt.+1 ->
- can_be_preempted j (service sched j prt.+1).
-
- (* We say that a model is a correct preemption model if both
- definitions given above are satisfied for any job. *)
- Definition correct_preemption_model :=
- forall j,
- arrives_in arr_seq j ->
- not_preemptive_implies_scheduled j
- /\ execution_starts_with_preemption_point j.
-
- End CorrectPreemptionModel.
-
- (* Note that for analysis purposes, it is important that the distance
- between preemption points of a job is bounded. To ensure that, we
- define next the model of bounded nonpreemptive segment. *)
- Section ModelWithBoundedNonpreemptiveRegions.
-
- (* We require that a job has to be executed at least one time instant
- in order to reach a nonpreemptive segment. *)
- Definition job_cannot_become_nonpreemptive_before_execution (j: Job) :=
- can_be_preempted j 0.
-
- (* And vice versa, a job cannot remain nonpreemptive after its completion. *)
- Definition job_cannot_be_nonpreemptive_after_completion (j: Job) :=
- can_be_preempted j (job_cost j).
-
- (* Consider a function that maps a job to the length of
- its maximal nonpreemptive segment. *)
- Variable job_max_nps: Job -> time.
-
- (* And a function task_max_nps... *)
- Variable task_max_nps: Task -> time.
-
- (* ...that gives an upper bound for values of the function job_max_nps. *)
- Definition job_max_nonpreemptive_segment_le_task_max_nonpreemptive_segment (j: Job) :=
- arrives_in arr_seq j ->
- job_max_nps j <= task_max_nps (job_task j).
-
- (* Next, we say that all the segments of a job j have bounded length iff for any
- progress progr of job j there exists a preemption point preeemption_point such that
- [progr <= preemption_point <= progr + (job_max_nps j - ε)]. That is, in any time
- interval of length [job_max_nps j], there exists a preeemption point which
- lies in this interval. *)
- Definition nonpreemptive_regions_have_bounded_length (j: Job) :=
- forall progr,
- 0 <= progr <= job_cost j ->
- exists preemption_point,
- progr <= preemption_point <= progr + (job_max_nps j - ε) /\
- can_be_preempted j preemption_point.
-
- (* Finally, we say that the schedule enforces bounded nonpreemptive segments
- iff the predicate can_be_preempted satisfies the two conditions above. *)
- Definition model_with_bounded_nonpreemptive_segments :=
- forall j,
- arrives_in arr_seq j ->
- job_cannot_become_nonpreemptive_before_execution j
- /\ job_cannot_be_nonpreemptive_after_completion j
- /\ job_max_nonpreemptive_segment_le_task_max_nonpreemptive_segment j
- /\ nonpreemptive_regions_have_bounded_length j.
-
- End ModelWithBoundedNonpreemptiveRegions.
-
- (* In this section we prove a few basic properties of the can_be_preempted predicate. *)
- Section Lemmas.
-
- Variable job_max_nps: Job -> time.
- Variable task_max_nps: Task -> time.
-
- (* Consider the correct model with bounded nonpreemptive segments. *)
- Hypothesis H_correct_preemption_model: correct_preemption_model.
- Hypothesis H_model_with_bounded_np_segments:
- model_with_bounded_nonpreemptive_segments job_max_nps task_max_nps.
-
- (* Assume jobs come from some arrival sequence. *)
- Hypothesis H_jobs_come_from_arrival_sequence:
- jobs_come_from_arrival_sequence sched arr_seq.
-
- (* Then, we can show that time 0 is a preemption time. *)
- Lemma zero_is_pt: preemption_time 0.
- Proof.
- unfold preemption_time.
- case SCHED: (sched 0) => [j | ]; last by done.
- move: (SCHED) => /eqP ARR.
- apply H_jobs_come_from_arrival_sequence in ARR.
- rewrite /service /service_during big_geq; last by done.
- by move: (H_model_with_bounded_np_segments j ARR) => [PP _]; apply PP.
- Qed.
-
- (* Also, we show that the first instant of execution is a preemption time. *)
- Lemma first_moment_is_pt:
- forall j prt,
- arrives_in arr_seq j ->
- ~~ job_scheduled_at j prt ->
- job_scheduled_at j prt.+1 ->
- preemption_time prt.+1.
- Proof.
- intros s pt ARR NSCHED SCHED.
- unfold preemption_time.
- move: (SCHED) => /eqP SCHED2; rewrite SCHED2; clear SCHED2.
- by move: (H_correct_preemption_model s ARR) => [_ FHF]; auto.
- Qed.
-
- End Lemmas.
-
- End PreemptionTime.
-
- (* Next, we define properties related to execution. *)
- Section Execution.
-
- (* Similarly to preemptive scheduling, we say that the schedule is
- work-conserving iff whenever a job is backlogged, the processor
- is always busy scheduling another job. *)
- (* Imported from the preemptive schedule. *)
- Definition work_conserving := Platform.work_conserving job_cost.
-
- End Execution.
-
- (* Next, we define properties related to FP scheduling. *)
- Section FP.
-
- (* Consider any preemption model. *)
- Variable preemption_model: Job -> time -> bool.
-
- (* We say that an FP policy...*)
- Variable higher_eq_priority: FP_policy Task.
-
- (* ...is respected by the schedule iff, at every preemption point,
- a scheduled task has higher (or same) priority than (as)
- any backlogged task. *)
- Definition respects_FP_policy_at_preemption_point :=
- forall j j_hp t,
- preemption_time preemption_model t ->
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- (* Next, we define properties related to JLFP policies. *)
- Section JLFP.
-
- (* Consider a scheduling model. *)
- Variable preemption_model: Job -> time -> bool.
-
- (* We say that a JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ...is respected by the schedule iff, at every preemption point,
- a scheduled task has higher (or same) priority than (as)
- any backlogged task. *)
- Definition respects_JLFP_policy_at_preemption_point :=
- forall j j_hp t,
- preemption_time preemption_model t ->
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_at sched j_hp t ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- End Properties.
-
-End LimitedPreemptionPlatform.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/limited/platform/limited.v b/classic/model/schedule/uni/limited/platform/limited.v
deleted file mode 100644
index b9a24db3dcf18e99902dcf2212316fa0de07a377..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/platform/limited.v
+++ /dev/null
@@ -1,413 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task.
-Require Import prosa.classic.model.schedule.uni.schedule.
-Require Export prosa.classic.model.schedule.uni.limited.platform.definitions.
-Require Export prosa.util.nondecreasing.
-
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(** * Platform for models with limited preemptions *)
-(** In module uni.limited.platform we introduce the notion of whether a job can be
- preempted at a given time (using a predicate can_be_preempted). In this section,
- we instantiate can_be_preempted for the model with fixed preemption points and
- model with floating nonpreemptive regions. *)
-Module ModelWithLimitedPreemptions.
-
- Import Job UniprocessorSchedule LimitedPreemptionPlatform.
-
- (* In this section, we instantiate can_be_preempted for the model with fixed preemption points and
- the model with floating nonpreemptive regions. We also prove that the definitions are correct. *)
- Section ModelsWithLimitedPreemptions.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Next, consider a function that maps a job to the sequence of its preemption points. *)
- Variable job_preemption_points: Job -> seq time.
-
- (* In this section, we provide a set of hypotheses for the models with limited preemptions. *)
- Section Definitions.
-
- (* In this section, we introduce the job-level definitions.
- They are the same for both models. *)
- Section ModelWithLimitedPreemptions.
-
- (* First, we define a function that maps a job to the
- sequence of lengths of its nonpreemptive segments. *)
- Definition lengths_of_segments j := distances (job_preemption_points j).
-
- (* Next, we define a function that maps a job to the
- length of the longest nonpreemptive segment of job j. *)
- Definition job_max_nps (j : Job) := max0 (lengths_of_segments j).
-
- (* Similarly, job_last is a function that maps a job to the
- length of the last nonpreemptive segment. *)
- Definition job_last_nps (j : Job) := last0 (lengths_of_segments j).
-
- (* Next, we describe some structural properties that
- a sequence of preemption points should satisfy. *)
-
- (* (1) The sequence of preemption points of a job with zero cost is equal to [0; 0]. *)
- Definition job_with_zero_cost_consists_of_one_empty_segment :=
- forall j, arrives_in arr_seq j -> job_cost j = 0 -> job_preemption_points j = [::0; 0].
-
- (* (2) The last nonpreemptive segment of a job with positive cost cannot be empty. *)
- Definition last_segment_is_positive :=
- forall j, arrives_in arr_seq j -> job_cost j > 0 -> job_last_nps j > 0.
-
- (* (3) We also require the sequence of preemption points to contain the beginning... *)
- Definition beginning_of_execution_in_preemption_points :=
- forall j, arrives_in arr_seq j -> first0 (job_preemption_points j) = 0.
-
- (* ... and (4) the end of execution for any job j.*)
- Definition end_of_execution_in_preemption_points :=
- forall j, arrives_in arr_seq j -> last0 (job_preemption_points j) = job_cost j.
-
- (* (5) We require the sequence of preemption points to be a nondecreasing sequence. *)
- Definition preemption_points_is_nondecreasing_sequence :=
- forall (j: Job),
- arrives_in arr_seq j ->
- nondecreasing_sequence (job_preemption_points j).
-
- (* Finally, we define a job-level model with limited preemptions
- as a concatenation of the hypotheses above. *)
- Definition limited_preemptions_job_model :=
- job_with_zero_cost_consists_of_one_empty_segment /\
- last_segment_is_positive /\
- beginning_of_execution_in_preemption_points /\
- end_of_execution_in_preemption_points /\
- preemption_points_is_nondecreasing_sequence.
-
- End ModelWithLimitedPreemptions.
-
- (* In this section, we define the model with fixed preemption points. *)
- Section ModelWithFixedPreemptionPoints.
-
- (* Consider a function that maps a task to the sequence of its preemption points. *)
- Variable task_preemption_points: Task -> seq time.
-
- (* Similarly to job's nonpreemptive segments, we define the length of the max
- nonpreemptive segment and lenght of the last nonpreemptive segment. *)
- Definition task_last_nps tsk := last0 (distances (task_preemption_points tsk)).
- Definition task_max_nps tsk := max0 (distances (task_preemption_points tsk)).
-
- (* Consider an arbitrary task set ts. *)
- Variable ts: list Task.
-
- (* Next, we describe some structural properties that
- a sequence of preemption points of task should satisfy. *)
-
- (* (1) We require the sequence of preemption points to contain the beginning... *)
- Definition task_beginning_of_execution_in_preemption_points :=
- forall tsk, tsk \in ts -> first0 (task_preemption_points tsk) = 0.
-
- (* ... and (2) the end of execution for any job j.*)
- Definition task_end_of_execution_in_preemption_points :=
- forall tsk, tsk \in ts -> last0 (task_preemption_points tsk) = task_cost tsk.
-
- (* (3) We require the sequence of preemption points
- to be a nondecreasing sequence. *)
- Definition task_preemption_points_is_nondecreasing_sequence :=
- forall tsk, tsk \in ts -> nondecreasing_sequence (task_preemption_points tsk).
-
- (* (4) Next, we require the number of nonpreemptive segments of a job to be
- equal to the number of nonpreemptive segments of its task. Note that
- some of nonpreemptive segments of a job can have zero length, nonetheless
- the number of segments should match. *)
- Definition job_consists_of_the_same_number_of_segments_as_task :=
- forall j,
- arrives_in arr_seq j ->
- size (job_preemption_points j) = size (task_preemption_points (job_task j)).
-
- (* (5) We require lengths of nonpreemptive segments of a job to be bounded
- by lenghts of the corresponding segments of its task. *)
- Definition lengths_of_task_segments_bound_length_of_job_segments :=
- forall j n,
- arrives_in arr_seq j ->
- nth 0 (distances (job_preemption_points j)) n
- <= nth 0 (distances (task_preemption_points (job_task j))) n.
-
- (* (6) Lastly, we ban empty nonpreemptive segments for tasks. *)
- Definition task_segments_are_nonempty :=
- forall tsk n,
- (tsk \in ts) ->
- n < size (distances (task_preemption_points tsk)) ->
- ε <= nth 0 (distances (task_preemption_points tsk)) n.
-
- (* We define a task-level model with fixed preemption points
- as a concatenation of the hypotheses above. *)
- Definition fixed_preemption_points_task_model :=
- task_beginning_of_execution_in_preemption_points /\
- task_end_of_execution_in_preemption_points /\
- task_preemption_points_is_nondecreasing_sequence /\
- job_consists_of_the_same_number_of_segments_as_task /\
- lengths_of_task_segments_bound_length_of_job_segments /\
- task_segments_are_nonempty.
-
- (* We define the model with fixed preemption points as
- the model with fixed preemptions points at the task-level
- and model with limited preemptions at the job-level. *)
- Definition fixed_preemption_points_model :=
- limited_preemptions_job_model /\
- fixed_preemption_points_task_model.
-
- End ModelWithFixedPreemptionPoints.
-
- (* In this section, we define the model with floating nonpreemptive regions. *)
- Section ModelWithFloatingNonpreemptiveRegions.
-
- (* Consider a function task_max_nps that maps a task to
- the lenght of its max nonpreemptive segment. *)
- Variable task_max_nps: Task -> time.
-
- (* We require [task_max_nps (job_task j)] to be an upper bound
- of the lenght of the max nonpreemptive segment of job j. *)
- Definition job_max_np_segment_le_task_max_np_segment :=
- forall (j: Job),
- arrives_in arr_seq j ->
- job_max_nps j <= task_max_nps (job_task j).
-
- (* We define the model with floating nonpreemptive regions as
- the model with floating nonpreemptive regions at the task-level
- and model with limited preemptions at the job-level. *)
- Definition model_with_floating_nonpreemptive_regions :=
- limited_preemptions_job_model /\
- job_max_np_segment_le_task_max_np_segment.
-
- End ModelWithFloatingNonpreemptiveRegions.
-
- (* Given a list of preemption points for each job, we define the function
- can_be_preempted for the model with limited preemptions as follows. We say
- that job j can be preempted at time t iff the service received by j at
- time t belongs to the list of preemptions points. *)
- Definition can_be_preempted_for_model_with_limited_preemptions (j: Job) (progr: time) :=
- progr \in job_preemption_points j.
-
- (* Based on the definition of the model with limited preemptions,
- we define a schedule with limited preemptions. *)
- Definition is_schedule_with_limited_preemptions (sched: schedule Job) :=
- forall j t,
- arrives_in arr_seq j ->
- ~~ can_be_preempted_for_model_with_limited_preemptions j (service sched j t) ->
- scheduled_at sched j t.
-
- End Definitions.
-
- (* In this section, we prove correctness of the model defined by
- function model_with_limited_preemptions. *)
- Section Lemmas.
-
- (* Consider any uniprocessor schedule with limited preemptions...*)
- Variable sched: schedule Job.
- Hypothesis H_is_schedule_with_limited_preemptions:
- is_schedule_with_limited_preemptions sched.
-
- (* ...where jobs do not execute after their completion. *)
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Next, we assume that preemption points are defined by the model with
- floating nonpreemptive regions. Note that the assumptions of the
- model with floating nonpreemptive regions are a strict subset of
- the assumptions of the model with fixed preemption points. This
- guaranties that the results below work for both models. *)
- Variable task_max_nps: Task -> time.
- Hypothesis H_limited_preemptions_job_model: limited_preemptions_job_model.
- Hypothesis H_job_max_np_segment_le_task_max_np_segment:
- job_max_np_segment_le_task_max_np_segment task_max_nps.
-
- (* First, we prove a few basic auxiliary lemmas. *)
- Section AuxiliaryLemmas.
-
- (* Consider a job j. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
-
- (* We prove that the list of preemption points is not empty. *)
- Lemma list_of_preemption_point_is_not_empty:
- 0 < size (job_preemption_points j).
- Proof.
- move: H_limited_preemptions_job_model => [EMPT [LS [BEG [END _]]]].
- move: (posnP (job_cost j)) => [ZERO|POS].
- { by specialize (EMPT j H_j_arrives ZERO); rewrite EMPT. }
- apply/negPn/negP; rewrite -eqn0Ngt; intros CONTR; move: CONTR => /eqP CONTR.
- move: (END _ H_j_arrives) => EQ.
- move: EQ; rewrite /last0 -nth_last nth_default; last by rewrite CONTR.
- intros.
- by rewrite /job_cost_positive -EQ in POS.
- Qed.
-
- (* We prove that 0 is a preemption point. *)
- Lemma zero_in_preemption_points: 0 \in job_preemption_points j.
- Proof.
- move: H_limited_preemptions_job_model => [EMPT [LS [BEG [END _]]]].
- move: (BEG _ H_j_arrives) => EQ.
- rewrite -EQ; clear EQ.
- rewrite /first0 -nth0.
- apply/(nthP 0).
- exists 0.
- - by apply list_of_preemption_point_is_not_empty.
- - by done.
- Qed.
-
- (* Next, we prove that the cost of a job is a preemption point. *)
- Lemma job_cost_in_nonpreemptive_points: job_cost j \in job_preemption_points j.
- Proof.
- move: H_limited_preemptions_job_model => [EMPT [LS [BEG [END _]]]].
- move: (END _ H_j_arrives) => EQ.
- rewrite -EQ; clear EQ.
- rewrite /last0 -nth_last.
- apply/(nthP 0).
- exists ((size (job_preemption_points j)).-1); last by done.
- rewrite -(leq_add2r 1) !addn1 prednK //.
- by apply list_of_preemption_point_is_not_empty.
- Qed.
-
- (* As a corollary, we prove that the size of the sequence of nonpreemptive points is at least 2. *)
- Corollary number_of_preemption_points_at_least_two: 2 <= size (job_preemption_points j).
- Proof.
- move: H_limited_preemptions_job_model => [EMPT [LS [BEG [END _]]]].
- move: (posnP (job_cost j)) => [ZERO|POS].
- { by specialize (EMPT j H_j_arrives ZERO); rewrite EMPT. }
- have EQ: 2 = size [::0; job_cost j]; first by done.
- rewrite EQ; clear EQ.
- apply subseq_leq_size.
- rewrite !cons_uniq.
- { apply/andP; split.
- rewrite in_cons negb_or; apply/andP; split; last by done.
- rewrite neq_ltn; apply/orP; left; eauto 2.
- apply/andP; split; by done. }
- intros t EQ; move: EQ; rewrite !in_cons.
- move => /orP [/eqP EQ| /orP [/eqP EQ|EQ]]; last by done.
- - by rewrite EQ; apply zero_in_preemption_points.
- - by rewrite EQ; apply job_cost_in_nonpreemptive_points.
- Qed.
-
- End AuxiliaryLemmas.
-
- (* We prove that the fixed_preemption_point_model function defines
- a correct preemption model. *)
- Lemma model_with_fixed_preemption_points_is_correct:
- correct_preemption_model arr_seq sched can_be_preempted_for_model_with_limited_preemptions.
- Proof.
- intros j ARR; split.
- { move => t NPP.
- by apply H_is_schedule_with_limited_preemptions. }
- { intros t NSCHED SCHED.
- have SERV: service sched j t = service sched j t.+1.
- { rewrite -[service sched j t]addn0 /service /service_during; apply/eqP.
- rewrite big_nat_recr //=.
- rewrite eqn_add2l eq_sym.
- by rewrite /service_at eqb0. }
- rewrite -[can_be_preempted_for_model_with_limited_preemptions _ _]Bool.negb_involutive.
- apply/negP; intros CONTR.
- move: NSCHED => /negP NSCHED; apply: NSCHED.
- apply H_is_schedule_with_limited_preemptions; first by done.
- by rewrite SERV.
- }
- Qed.
-
- (* Next we prove that the fixed_preemption_point_model function defines
- a model with bounded nonpremtive regions. *)
- Lemma model_with_fixed_preemption_points_is_model_with_bounded_nonpreemptive_regions:
- model_with_bounded_nonpreemptive_segments
- job_cost job_task arr_seq can_be_preempted_for_model_with_limited_preemptions
- job_max_nps task_max_nps.
- Proof.
- intros j ARR.
- move: H_limited_preemptions_job_model => [EMPT [LS [BEG [END NDEC]]]].
- move: (posnP (job_cost j)) => [ZERO|POS].
- { specialize (EMPT j ARR ZERO).
- split; last split; last split.
- - by rewrite /job_cannot_become_nonpreemptive_before_execution /can_be_preempted_for_model_with_limited_preemptions EMPT.
- - by rewrite /job_cannot_be_nonpreemptive_after_completion /can_be_preempted_for_model_with_limited_preemptions EMPT ZERO.
- - by intros _; rewrite /job_max_nps /lengths_of_segments EMPT /distances; simpl; rewrite subn0.
- - move => progr; rewrite ZERO leqn0; move => /andP [_ /eqP LE].
- exists 0; rewrite LE; split.
- + by apply/andP; split.
- + by rewrite /can_be_preempted_for_model_with_limited_preemptions EMPT.
- }
- split; last split; last split.
- { by rewrite /job_cannot_become_nonpreemptive_before_execution; eauto; apply zero_in_preemption_points. }
- { by apply job_cost_in_nonpreemptive_points. }
- { by intros ARR2; apply H_job_max_np_segment_le_task_max_np_segment. }
- { unfold nonpreemptive_regions_have_bounded_length, can_be_preempted_for_model_with_limited_preemptions.
- move => progr /andP [_ LE].
- specialize (NDEC j).
- specialize (H_is_schedule_with_limited_preemptions j).
- destruct (progr \in job_preemption_points j) eqn:NotIN.
- { exists progr; split; first apply/andP; first split; try done.
- by rewrite leq_addr.
- }
- set (preemptions := job_preemption_points j).
- set (serv := progr).
- have Fact1: job_cost j <= last0 preemptions.
- { by apply last_is_max_in_nondecreasing_seq; eauto 2; apply job_cost_in_nonpreemptive_points. }
- have Fact2: first0 preemptions <= serv < last0 preemptions.
- { apply/andP; split.
- - by rewrite /preemptions BEG.
- - rewrite /serv /preemptions END; last by done.
- rewrite ltn_neqAle; apply/andP; split; last by done.
- apply/negP; intros CONTR; move: CONTR => /eqP CONTR.
- rewrite CONTR in NotIN.
- move: NotIN => /eqP; rewrite eqbF_neg; move => /negP NIN; apply: NIN.
- by apply job_cost_in_nonpreemptive_points.
- }
- have EX: exists n,
- n.+1 < size preemptions /\
- nth 0 preemptions n < serv < nth 0 preemptions n.+1.
- { intros.
- move: (belonging_to_segment_of_seq_is_total
- preemptions serv (number_of_preemption_points_at_least_two _ ARR) Fact2) => [n [SIZE2 /andP [N1 N2]]].
- exists n; split; first by done.
- apply/andP; split; last by done.
- move: N1; rewrite leq_eqVlt; move => /orP [/eqP EQ | G]; last by done.
- exfalso.
- move: NotIN => /negP CONTR; apply: CONTR.
- unfold serv, fixed_preemption_points_model in *.
- rewrite -EQ; clear EQ.
- rewrite mem_nth //.
- by apply ltnW.
- }
- move: EX => [x [SIZE2 /andP [N1 N2]]].
- set ptl := nth 0 preemptions x.
- set ptr := nth 0 preemptions x.+1.
- exists ptr.
- split.
- { apply/andP; split.
- { by apply ltnW. }
- {
- apply leq_trans with (ptl + (job_max_nps j - ε) + 1).
- { unfold job_max_nps.
- rewrite -addnA -leq_subLR.
- rewrite -(leq_add2r 1).
- rewrite [in X in _ <= X]addnC -leq_subLR.
- rewrite !subn1 !addn1 prednK.
- { by rewrite -[_.+1.-1]pred_Sn; apply distance_between_neighboring_elements_le_max_distance_in_seq. }
- { apply max_distance_in_nontrivial_seq_is_positive; first by eauto 2.
- exists 0, (job_cost j); repeat split.
- - by apply zero_in_preemption_points.
- - by apply job_cost_in_nonpreemptive_points.
- - apply/eqP; rewrite eq_sym -lt0n.
- by apply POS.
- }
- }
- { rewrite addn1. rewrite ltn_add2r. apply N1. }
- }
- }
- { by apply mem_nth. }
- }
- Qed.
-
- End Lemmas.
-
- End ModelsWithLimitedPreemptions.
-
-End ModelWithLimitedPreemptions.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/limited/platform/nonpreemptive.v b/classic/model/schedule/uni/limited/platform/nonpreemptive.v
deleted file mode 100644
index f5a4ba31d5877d96457eb9c04ab7f1361c874bb0..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/platform/nonpreemptive.v
+++ /dev/null
@@ -1,157 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task
- prosa.classic.model.priority
- prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.basic.platform.
-Require Import prosa.classic.model.schedule.uni.nonpreemptive.schedule.
-Require Export prosa.classic.model.schedule.uni.limited.platform.definitions.
-
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(** * Platform for fully nonpreemptive model *)
-(** In module uni.limited.platform we introduce the notion of whether a job can be preempted
- at a given time (using a predicate can_be_preempted). In this section, we instantiate
- can_be_preempted for the fully nonpreemptive model and prove its correctness. *)
-Module FullyNonPreemptivePlatform.
-
- Import Job SporadicTaskset UniprocessorSchedule Priority
- Service LimitedPreemptionPlatform.
-
- Section FullyNonPreemptiveModel.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor nonpreemptive schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
- Hypothesis H_nonpreemptive_sched:
- NonpreemptiveSchedule.is_nonpreemptive_schedule job_cost sched.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* For simplicity, let's define some local names. *)
- Let job_pending := pending job_arrival job_cost sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
-
- (* Assume that a job cost cannot be larger than a task cost. *)
- Hypothesis H_job_cost_le_task_cost:
- cost_of_jobs_from_arrival_sequence_le_task_cost
- task_cost job_cost job_task arr_seq.
-
- (* We say that the model is fully nonpreemptive
- iff every job cannot be preempted until its completion. *)
- Definition can_be_preempted_for_fully_nonpreemptive_model (j: Job) (progr: time) :=
- (progr == 0) || (progr == job_cost j).
-
- (* Since in a fully nonpreemptive model a job cannot be preempted after
- it starts the execution, job_max_nps is equal to job_cost. *)
- Let job_max_nps (j: Job) := job_cost j.
-
- (* In order to bound job_max_nps, task_max_nps should be equal to task_cost. *)
- Let task_max_nps (tsk: Task) := task_cost tsk.
-
- (* Then, we prove that fully_nonpreemptive_model is a correct preemption model... *)
- Lemma fully_nonpreemptive_model_is_correct:
- correct_preemption_model arr_seq sched can_be_preempted_for_fully_nonpreemptive_model.
- Proof.
- intros j; split.
- { move => t.
- rewrite /can_be_preempted_for_fully_nonpreemptive_model Bool.negb_orb -lt0n.
- move => /andP [POS NCOMPL].
- unfold NonpreemptiveSchedule.is_nonpreemptive_schedule in *.
- move: (incremental_service_during _ _ _ _ _ POS) => [ft [/andP [_ LT] [SCHED SERV]]].
- apply H_nonpreemptive_sched with ft.
- { by apply ltnW. }
- { by done. }
- { rewrite /completed_by -ltnNge.
- move: NCOMPL; rewrite neq_ltn; move => /orP [LE|GE]; [by done | exfalso].
- move: GE; rewrite ltnNge; move => /negP GE; apply: GE.
- by eauto 2.
- }
- }
- { intros t NSCHED SCHED.
- rewrite /can_be_preempted_for_fully_nonpreemptive_model.
- apply/orP; left.
- apply/negP; intros CONTR.
- move: CONTR => /negP; rewrite -lt0n; intros POS.
- move: (incremental_service_during _ _ _ _ _ POS) => [ft [/andP [_ LT] [SCHEDn SERV]]].
- move: NSCHED => /negP NSCHED; apply: NSCHED.
- apply H_nonpreemptive_sched with ft.
- { by rewrite -ltnS. }
- { by done. }
- { rewrite /completed_by -ltnNge.
- apply leq_ltn_trans with (service sched j t.+1).
- { by rewrite /service /service_during big_nat_recr //= leq_addr. }
- { rewrite -addn1.
- apply leq_trans with (service sched j t.+2).
- - unfold service, service_during.
- have EQ: (service_at sched j t.+1) = 1.
- { by apply/eqP; rewrite eqb1. }
- by rewrite -EQ -big_nat_recr //=.
- - by eauto 2.
- }
- }
- }
- Qed.
-
- (* ... and has bounded nonpreemptive regions. *)
- Lemma fully_nonpreemptive_model_is_model_with_bounded_nonpreemptive_regions:
- model_with_bounded_nonpreemptive_segments
- job_cost job_task arr_seq can_be_preempted_for_fully_nonpreemptive_model job_max_nps task_max_nps.
- Proof.
- have F: forall n, n = 0 \/ n > 0.
- { by intros n; destruct n; [left | right]. }
- intros j; split; last split; last split.
- { by done. }
- { by apply/orP; right. }
- { intros ARR.
- rewrite /job_max_nps /task_max_nps.
- by eauto 2.
- }
- { intros progr.
- move: (F (progr)) => [EQ | GT].
- { exists progr; split.
- - by apply/andP; split; [done | rewrite leq_addr].
- - by rewrite /can_be_preempted_for_fully_nonpreemptive_model EQ. }
- { exists (maxn progr (job_cost j)).
- have POS: 0 < job_cost j.
- { by apply leq_trans with progr; last move: H0 => /andP [_ H0]. }
- split.
- { apply/andP; split; first by rewrite leq_maxl.
- rewrite /job_max_nps addnBA; last eauto 2.
- rewrite geq_max; apply/andP; split.
- - rewrite -addnBA; last by eauto 2.
- by rewrite leq_addr.
- - by rewrite addnC -addnBA // leq_addr.
- }
- { unfold can_be_preempted_for_fully_nonpreemptive_model.
- apply/orP; right.
- move: H0 => /andP [_ LE].
- rewrite eqn_leq; apply/andP; split.
- - by rewrite geq_max; apply/andP; split.
- - by rewrite leq_max; apply/orP; right.
- }
- }
- }
- Qed.
-
- End FullyNonPreemptiveModel.
-
-End FullyNonPreemptivePlatform.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/limited/platform/preemptive.v b/classic/model/schedule/uni/limited/platform/preemptive.v
deleted file mode 100644
index b6c6280235e770d77d114a5daa0af080f7edb931..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/platform/preemptive.v
+++ /dev/null
@@ -1,70 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task
- prosa.classic.model.priority
- prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.basic.platform.
-Require Export prosa.classic.model.schedule.uni.limited.platform.definitions.
-
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-(** * Platform for fully premptive model *)
-(** In module uni.limited.platform we introduce the notion of whether a job can be preempted
- at a given time (using a predicate can_be_preempted). In this section, we instantiate
- can_be_preempted for the fully preemptive model and prove its correctness. *)
-Module FullyPreemptivePlatform.
-
- Import Job SporadicTaskset UniprocessorSchedule Priority
- Service LimitedPreemptionPlatform.
-
- Section FullyPreemptiveModel.
-
- Context {Task: eqType}.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_pending := pending job_arrival job_cost sched.
- Let job_completed_by := completed_by job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
-
- (* In the fully preemptive model any job can be preempted at any time. *)
- Definition can_be_preempted_for_fully_preemptive_model (j: Job) (progr: time) := true.
-
- (* Since in a fully preemptive model a job can be preempted at
- any time job_max_nps cannot be greater than ε. *)
- Let job_max_nps (j: Job) := ε.
-
- (* In order to bound job_max_nps, we can choose task_max_nps that is equal to ε for any task. *)
- Let task_max_nps (tsk: Task) := ε.
-
- (* Then, we prove that fully_preemptive_model is a correct preemption model... *)
- Lemma fully_preemptive_model_is_correct:
- correct_preemption_model arr_seq sched can_be_preempted_for_fully_preemptive_model.
- Proof. by intros j; split; intros t CONTR. Qed.
-
- (* ... and has bounded nonpreemptive regions. *)
- Lemma fully_preemptive_model_is_model_with_bounded_nonpreemptive_regions:
- model_with_bounded_nonpreemptive_segments
- job_cost job_task arr_seq can_be_preempted_for_fully_preemptive_model job_max_nps task_max_nps.
- Proof.
- intros j; repeat split; try done.
- intros t; exists t; split.
- { by apply/andP; split; [ done | rewrite subnn addn0]. }
- { by done. }
- Qed.
-
- End FullyPreemptiveModel.
-
-End FullyPreemptivePlatform.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/limited/platform/priority_inversion_is_bounded.v b/classic/model/schedule/uni/limited/platform/priority_inversion_is_bounded.v
deleted file mode 100644
index ec0b2575135df5edb6d8afe31e31b2cacbab7ece..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/platform/priority_inversion_is_bounded.v
+++ /dev/null
@@ -1,594 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.schedule.uni.limited.platform.definitions
- prosa.classic.model.schedule.uni.limited.busy_interval.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-(** * Priority inversion is bounded *)
-(** In this module we prove that any priority inversion that occurs in the model with bounded
- nonpreemptive segments defined in module prosa.classic.model.schedule.uni.limited.platform.definitions
- is bounded. *)
-Module PriorityInversionIsBounded.
-
- Import Job Priority UniprocessorSchedule LimitedPreemptionPlatform BusyIntervalJLFP.
-
- Section PriorityInversionIsBounded.
-
- Context {Task: eqType}.
- Variable task_max_nps task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_max_nps job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* ... where jobs do not execute before their arrival nor after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Consider a JLFP policy that indicates a higher-or-equal priority relation,
- and assume that the relation is reflexive and transitive. *)
- Variable higher_eq_priority: JLFP_policy Job.
- Hypothesis H_priority_is_reflexive: JLFP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: JLFP_is_transitive higher_eq_priority.
-
- (* We consider an arbitrary function can_be_preempted which defines
- a preemption model with bounded nonpreemptive segments. *)
- Variable can_be_preempted: Job -> time -> bool.
- Let preemption_time := preemption_time sched can_be_preempted.
- Hypothesis H_correct_preemption_model:
- correct_preemption_model arr_seq sched can_be_preempted.
- Hypothesis H_model_with_bounded_nonpreemptive_segments:
- model_with_bounded_nonpreemptive_segments
- job_cost job_task arr_seq can_be_preempted job_max_nps task_max_nps.
-
- (* Next, we assume that the schedule is a work-conserving schedule... *)
- Hypothesis H_work_conserving: work_conserving job_arrival job_cost arr_seq sched.
-
- (* ... and the schedule respects the policy defined by the
- can_be_preempted function (i.e., bounded nonpreemptive segments). *)
- Hypothesis H_respects_policy:
- respects_JLFP_policy_at_preemption_point
- job_arrival job_cost arr_seq sched can_be_preempted higher_eq_priority.
-
- (* Let's define some local names for clarity. *)
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
-
- (* Finally, we introduce the notion of the maximal length of (potential) priority
- inversion at a time instant [t], which is defined as the maximum length of
- nonpreemptive segments among all jobs that arrived so far. *)
- Definition max_length_of_priority_inversion (j: Job) (t: time) :=
- \max_(j_lp <- jobs_arrived_before arr_seq t | ~~ higher_eq_priority j_lp j)
- (job_max_nps j_lp - ε).
-
- (** Next we prove that a priority inversion of a job is bounded by
- function max_length_of_priority_inversion. *)
-
- (** Note that any bound on function max_length_of_priority_inversion will also be
- a bound on the maximal priority inversion. This bound may be different
- for different scheduler and/or task models. Thus, we don't define such a bound
- in this module. *)
-
- (* Consider any job j of tsk with positive job cost. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_cost_positive: job_cost_positive job_cost j.
-
- (* Consider any busy interval prefix [t1, t2) of job j. *)
- Variable t1 t2: time.
- Hypothesis H_busy_interval_prefix:
- busy_interval_prefix job_arrival job_cost arr_seq sched higher_eq_priority j t1 t2.
-
- (* In this section, we prove that at any time instant after any preemption point
- (inside the busy interval), the processor is always busy scheduling a
- job with higher or equal priority. *)
- Section PreemptionTimeAndPriorityInversion.
-
- (* First, we show that the processor at any preemptive point is always
- busy scheduling a job with higher or equal priority. *)
- Lemma not_quiet_implies_exists_scheduled_hp_job_at_preemption_point:
- forall t,
- t1 <= t < t2 ->
- preemption_time t ->
- exists j_hp,
- arrived_between job_arrival j_hp t1 t2 /\
- higher_eq_priority j_hp j /\
- job_scheduled_at j_hp t.
- Proof.
- move: (H_busy_interval_prefix) => [SL [QUIET [NOTQUIET INBI]]].
- rename H_work_conserving into WORK, H_respects_policy into PRIO,
- H_jobs_come_from_arrival_sequence into CONS.
- move => t /andP [GEt LEt] PREEMPTP.
- have NOTIDLE := not_quiet_implies_not_idle
- job_arrival job_cost arr_seq _
- sched higher_eq_priority j _ _ _ _ _ t1 t2 _ t.
- feed_n 8 NOTIDLE; eauto 2.
- unfold is_idle, FP_is_transitive, transitive in *.
- destruct (sched t) as [j_hp|] eqn:SCHED; [clear NOTIDLE | by exfalso; apply NOTIDLE].
- move: SCHED => /eqP SCHED.
- exists j_hp.
- have HP: higher_eq_priority j_hp j.
- { apply contraT; move => /negP NOTHP; exfalso.
- have TEMP: t <= t2.-1; first by rewrite -subn1 leq_subRL_impl // addn1.
- rewrite leq_eqVlt in TEMP; move: TEMP => /orP [/eqP EQUALt2m1 | LTt2m1];
- first rewrite leq_eqVlt in GEt; first move: GEt => /orP [/eqP EQUALt1 | LARGERt1].
- { subst t; clear LEt.
- rewrite -EQUALt1 in SCHED; move: EQUALt1 => /eqP EQUALt1.
- destruct (job_scheduled_at j t1) eqn:SCHEDj.
- { simpl. have EQ:= only_one_job_scheduled sched j j_hp t1 SCHEDj SCHED.
- by subst j; apply NOTHP.
- }
- { apply NOTHP.
- apply PRIO with t1; try done.
- - by move: EQUALt1 => /eqP EQUALt1; rewrite EQUALt1.
- - apply/andP; split; last first.
- + by move: SCHEDj; rewrite /job_scheduled_at; move => /negP /negP SCHEDj.
- + have EQ: t1 = job_arrival j.
- { rewrite -eqSS in EQUALt1.
- have EQ: t2 = t1.+1.
- { rewrite prednK in EQUALt1; first by apply/eqP; rewrite eq_sym.
- apply negbNE; rewrite -eqn0Ngt; apply/neqP; intros EQ0.
- move: INBI; rewrite EQ0; move => /andP [_ CONTR].
- by rewrite ltn0 in CONTR.
- } clear EQUALt1.
- by move: INBI; rewrite EQ ltnS -eqn_leq; move => /eqP INBI.
- }
- by rewrite EQ; eapply job_pending_at_arrival; eauto 2.
- }
- }
- { feed (NOTQUIET t); first by apply/andP; split.
- apply NOTQUIET; intros j_hp' IN HP ARR.
- apply contraT; move => /negP NOTCOMP'; exfalso.
- have BACK: backlogged job_arrival job_cost sched j_hp' t.
- { apply/andP; split.
- - apply/andP; split. unfold arrived_before, has_arrived in *. by rewrite ltnW.
- apply/negP; intro COMP; apply NOTCOMP'.
- try ( by apply completion_monotonic with (t0 := t) ) ||
- by apply completion_monotonic with (t := t).
- - apply/negP; intro SCHED'.
- apply only_one_job_scheduled with (j1 := j_hp) in SCHED'; last by done.
- by apply NOTHP; subst.
- }
- feed (PRIO j_hp' j_hp t PREEMPTP IN BACK); first by done.
- by apply NOTHP; apply H_priority_is_transitive with j_hp'.
- }
- {
- unfold quiet_time in *.
- feed (NOTQUIET t.+1). apply/andP; split.
- - by apply leq_ltn_trans with t1.
- - rewrite -subn1 ltn_subRL addnC in LTt2m1.
- by rewrite -[t.+1]addn1.
- apply NOTQUIET.
- unfold quiet_time in *; intros j_hp' IN HP ARR.
- apply contraT; move => /negP NOTCOMP'; exfalso.
- have BACK: backlogged job_arrival job_cost sched j_hp' t.
- { apply/andP; split; last first.
- { apply/negP; intro SCHED'.
- apply only_one_job_scheduled with (j1 := j_hp) in SCHED'; last by done.
- apply NOTHP.
- by subst.
- }
- apply/andP; split. unfold arrived_before, has_arrived in *. by done.
- apply/negP; intro COMP; apply NOTCOMP'.
- try ( by apply completion_monotonic with (t0 := t) ) ||
- by apply completion_monotonic with (t := t).
- }
- feed (PRIO j_hp' j_hp t PREEMPTP IN BACK); first by done.
- by apply NOTHP; apply H_priority_is_transitive with j_hp'.
- }
- }
- repeat split; [| by done | by done].
- move: (SCHED) => PENDING.
- ( try ( eapply scheduled_implies_pending with (job_cost0 := job_cost) in PENDING ) ||
- eapply scheduled_implies_pending with (job_cost := job_cost) in PENDING ); [| by eauto | by done].
- apply/andP; split; last by apply leq_ltn_trans with (n := t); first by move: PENDING => /andP [ARR _].
- apply contraT; rewrite -ltnNge; intro LT; exfalso.
- feed (QUIET j_hp); first by eapply CONS, SCHED.
- specialize (QUIET HP LT).
- try ( have COMP: job_completed_by j_hp t by apply completion_monotonic with (t0 := t1) ) ||
- have COMP: job_completed_by j_hp t by apply completion_monotonic with (t := t1).
- apply completed_implies_not_scheduled in COMP; last by done.
- by move: COMP => /negP COMP; apply COMP.
- Qed.
-
- (* In addition, we prove that every nonpreemptive segment
- always begins with a preemption time. *)
- Lemma scheduling_of_any_segment_starts_with_preemption_time:
- forall j t,
- job_scheduled_at j t ->
- exists pt,
- job_arrival j <= pt <= t /\
- preemption_time pt /\
- (forall t', pt <= t' <= t -> job_scheduled_at j t').
- Proof.
- intros s t SCHEDst.
- have EX: exists t',
- (t' <= t)
- && (job_scheduled_at s t')
- && (all (fun t'' => job_scheduled_at s t'') (iota t' (t - t').+1 )).
- { exists t.
- apply/andP; split; [ by apply/andP; split | ].
- apply/allP; intros t'.
- rewrite mem_iota.
- rewrite subnn addn1 ltnS -eqn_leq.
- by move => /eqP EQ; subst t'. }
- have MIN := ex_minnP EX.
- move: MIN => [mpt /andP [/andP [LT1 SCHEDsmpt] /allP ALL] MIN]; clear EX.
- destruct mpt.
- { exists 0; repeat split.
- - apply/andP; split; last by done.
- by apply H_jobs_must_arrive_to_execute in SCHEDsmpt.
- - by eapply zero_is_pt; eauto 2.
- - by intros; apply ALL; rewrite mem_iota subn0 add0n ltnS. }
- { have NSCHED: ~~ job_scheduled_at s mpt.
- { apply/negP; intros SCHED.
- feed (MIN mpt).
- apply/andP; split; [by apply/andP; split; [ apply ltnW | ] | ].
- apply/allP; intros t'.
- rewrite mem_iota addnS ltnS.
- move => /andP [GE LE].
- move: GE; rewrite leq_eqVlt; move => /orP [/eqP EQ| LT].
- subst t'. by done.
- apply ALL.
- rewrite mem_iota addnS ltnS.
- apply/andP; split; first by done.
- apply leq_trans with (mpt + (t - mpt)); first by done.
- rewrite !subnKC; last rewrite ltnW; by done.
- by rewrite ltnn in MIN. }
- have PP: preemption_time mpt.+1.
- { (try ( apply first_moment_is_pt with (arr_seq0 := arr_seq) (j0 := s) ) ||
- apply first_moment_is_pt with (arr_seq := arr_seq) (j := s) ); eauto 2. }
- exists mpt.+1; repeat split; try done.
- - apply/andP; split; last by done.
- by apply H_jobs_must_arrive_to_execute in SCHEDsmpt.
- - move => t' /andP [GE LE].
- apply ALL; rewrite mem_iota.
- rewrite addnS ltnS subnKC; last by done.
- by apply/andP; split.
- }
- Qed.
-
- (* Next we prove that at any time instant after a preemption point the
- processor is always busy with a job with higher or equal priority. *)
- Lemma not_quiet_implies_exists_scheduled_hp_job_after_preemption_point:
- forall tp t,
- preemption_time tp ->
- t1 <= tp < t2 ->
- tp <= t < t2 ->
- exists j_hp,
- arrived_between job_arrival j_hp t1 t.+1 /\
- higher_eq_priority j_hp j /\
- job_scheduled_at j_hp t.
- Proof.
- move: (H_jobs_come_from_arrival_sequence) (H_work_conserving) => CONS WORK.
- move: (H_respects_policy) => PRIO.
- move => tp t PRPOINT /andP [GEtp LTtp] /andP [LEtp LTt].
- have NOTIDLE := not_quiet_implies_not_idle
- job_arrival job_cost arr_seq _ sched higher_eq_priority
- j _ _ _ _ _ t1 t2 _ t.
- feed_n 8 NOTIDLE; eauto 2.
- apply/andP; split; [by apply leq_trans with tp | by done].
- destruct (sched t) as [j_hp|] eqn:SCHED;
- last by exfalso; apply NOTIDLE; rewrite /is_idle SCHED.
- move: SCHED => /eqP SCHED.
- exists j_hp.
- have HP: higher_eq_priority j_hp j.
- { intros.
- have SOAS := scheduling_of_any_segment_starts_with_preemption_time _ _ SCHED.
- move: SOAS => [prt [/andP [_ LE] [PR SCH]]].
- case E:(t1 <= prt).
- - move: E => /eqP /eqP E; rewrite subn_eq0 in E.
- have EXISTS := not_quiet_implies_exists_scheduled_hp_job_at_preemption_point prt.
- feed_n 2 EXISTS; try done.
- { by apply /andP; split; last by apply leq_ltn_trans with t. }
- move: EXISTS => [j_lp [_ [HEP SCHEDjhp]]].
- have EQ: j_hp = j_lp.
- { by apply (only_one_job_scheduled sched _ _ prt); first (apply SCH; apply/andP; split). }
- by subst j_hp.
- - move: E => /eqP /neqP E; rewrite -lt0n subn_gt0 in E.
- apply negbNE; apply/negP; intros LP.
- rename j_hp into j_lp.
- have EXISTS := not_quiet_implies_exists_scheduled_hp_job_at_preemption_point tp.
- feed_n 2 EXISTS; try done.
- { by apply /andP; split. }
- move: EXISTS => [j_hp [_ [HEP SCHEDjhp]]].
- have EQ: j_hp = j_lp.
- { apply (only_one_job_scheduled sched _ _ tp).
- by done.
- apply SCH; apply/andP; split.
- apply leq_trans with t1. rewrite ltnW //. by done.
- by done.
- }
- by subst j_hp; move: LP => /negP LP; apply: LP.
- }
- repeat split; [| by done | by done].
- move: (H_busy_interval_prefix) => [SL [QUIET [NOTQUIET EXj]]].
- move: (SCHED) => PENDING.
- ( try ( eapply scheduled_implies_pending with (job_cost0 := job_cost) in PENDING ) ||
- eapply scheduled_implies_pending with (job_cost := job_cost) in PENDING );
- [| by eauto | by done].
- apply/andP; split;
- last by apply leq_ltn_trans with (n := t); first by move: PENDING => /andP [ARR _].
- apply contraT; rewrite -ltnNge; intro LT; exfalso.
- feed (QUIET j_hp); first by eapply CONS, SCHED.
- specialize (QUIET HP LT).
- have COMP: job_completed_by j_hp t.
- { by ( try ( apply completion_monotonic with (t0 := t1) ) ||
- apply completion_monotonic with (t := t1)); [ apply leq_trans with tp | ]. }
- apply completed_implies_not_scheduled in COMP; last by done.
- by move: COMP => /negP COMP; apply COMP.
- Qed.
-
- (* Now, suppose there exists some constant K that bounds the distance to
- a preemption time from the beginning of the busy interval. *)
- Variable K: time.
- Hypothesis H_preemption_time_exists:
- exists pr_t, preemption_time pr_t /\ t1 <= pr_t <= t1 + K.
-
- (* Then we prove that the processor is always busy with a job with
- higher-or-equal priority after time instant [t1 + K]. *)
- Lemma not_quiet_implies_exists_scheduled_hp_job:
- forall t,
- t1 + K <= t < t2 ->
- exists j_hp,
- arrived_between job_arrival j_hp t1 t.+1 /\
- higher_eq_priority j_hp j /\
- job_scheduled_at j_hp t.
- Proof.
- move => t /andP [GE LT].
- move: H_preemption_time_exists => [prt [PR /andP [GEprt LEprt]]].
- apply not_quiet_implies_exists_scheduled_hp_job_after_preemption_point with (tp := prt); eauto 2.
- - apply/andP; split; first by done.
- apply leq_ltn_trans with (t1 + K); first by done.
- by apply leq_ltn_trans with t.
- - apply/andP; split; last by done.
- by apply leq_trans with (t1 + K).
- Qed.
-
- End PreemptionTimeAndPriorityInversion.
-
- (* In this section we prove that the function max_length_of_priority_inversion
- indeed upper bounds the priority inversion length. *)
- Section PreemprionTimeExists.
-
- (* First we prove that if a job with higher-or-equal priority is scheduled at
- a quiet time t+1 then this is the first time when this job is scheduled. *)
- Lemma hp_job_not_scheduled_before_quiet_time:
- forall jhp t,
- quiet_time job_arrival job_cost arr_seq sched higher_eq_priority j t.+1 ->
- job_scheduled_at jhp t.+1 ->
- higher_eq_priority jhp j ->
- ~~ job_scheduled_at jhp t.
- Proof.
- intros jhp t QT SCHED1 HP.
- apply/negP; intros SCHED2.
- specialize (QT jhp).
- feed_n 3 QT; try done.
- eapply H_jobs_come_from_arrival_sequence; eauto 1.
- rewrite /arrived_before ltnS.
- apply H_jobs_must_arrive_to_execute. by done.
- apply completed_implies_not_scheduled in QT; last by done.
- by move: QT => /negP NSCHED; apply: NSCHED.
- Qed.
-
- (* Also, we show that lower-priority jobs that are scheduled inside the
- busy-interval prefix [t1,t2) must have arrived before that interval. *)
- Lemma low_priority_job_arrives_before_busy_interval_prefix:
- forall jlp t,
- t1 <= t < t2 ->
- job_scheduled_at jlp t ->
- ~~ higher_eq_priority jlp j ->
- job_arrival jlp < t1.
- Proof.
- move => jlp t /andP [GE LT] SCHED LP.
- move: (H_busy_interval_prefix) => [NEM [QT [NQT HPJ]]].
- apply negbNE; apply/negP; intros ARR; rewrite -leqNgt in ARR.
- have SCH:= scheduling_of_any_segment_starts_with_preemption_time _ _ SCHED.
- move: SCH => [pt [/andP [NEQ1 NEQ2] [PT FA]]].
- have NEQ: t1 <= pt < t2.
- { apply/andP; split.
- apply leq_trans with (job_arrival jlp); by done.
- apply leq_ltn_trans with t; by done. }
- have LL:= not_quiet_implies_exists_scheduled_hp_job_at_preemption_point pt.
- feed_n 2 LL; try done.
- move: LL => [jhp [ARRjhp [HP SCHEDhp]]].
- feed (FA pt). apply/andP; split; by done.
- have OOJ:= only_one_job_scheduled _ _ _ _ FA SCHEDhp; subst jhp.
- by move: LP => /negP LP; apply: LP.
- Qed.
-
- (* Moreover, we show that lower-priority jobs that are scheduled inside the
- busy-interval prefix [t1,t2) must be scheduled before that interval. *)
- Lemma low_priority_job_scheduled_before_busy_interval_prefix:
- forall jlp t,
- t1 <= t < t2 ->
- job_scheduled_at jlp t ->
- ~~ higher_eq_priority jlp j ->
- exists t', t' < t1 /\ job_scheduled_at jlp t'.
- Proof.
- move => jlp t NEQ SCHED LP.
- have ARR := low_priority_job_arrives_before_busy_interval_prefix _ _ NEQ SCHED LP.
- move: NEQ => /andP [GE LT].
- exists t1.-1.
- split.
- { rewrite prednK; first by done.
- by apply leq_ltn_trans with (job_arrival jlp).
- }
- { move: (H_busy_interval_prefix) => [NEM [QT [NQT HPJ]]].
- have SCHEDST := scheduling_of_any_segment_starts_with_preemption_time _ _ SCHED.
- move: SCHEDST => [pt [NEQpt [PT SCHEDc]]].
- have NEQ: pt < t1.
- { rewrite ltnNge; apply/negP; intros CONTR.
- have NQSCHED := not_quiet_implies_exists_scheduled_hp_job_at_preemption_point pt.
- feed_n 2 NQSCHED; try done.
- { apply/andP; split; first by done.
- by apply leq_ltn_trans with t; move: NEQpt => /andP [_ T].
- }
- move: NQSCHED => [jhp [ARRhp [HPhp SCHEDhp]]].
- specialize (SCHEDc pt).
- feed SCHEDc.
- { by apply/andP; split; last move: NEQpt => /andP [_ T]. }
- have EQ:= only_one_job_scheduled sched jhp jlp pt.
- feed_n 2 EQ; try done.
- subst jhp.
- by move: LP => /negP LP; apply: LP.
- }
- apply SCHEDc; apply/andP; split.
- - rewrite -add1n in NEQ.
- apply leq_subRL_impl in NEQ.
- by rewrite subn1 in NEQ.
- - apply leq_trans with t1. by apply leq_pred. by done.
- }
- Qed.
-
- (* Thus, there must be a preemption time in the interval [t1, t1 + max_priority_inversion t1].
- That is, if a job with higher-or-equal priority is scheduled at time instant t1, then t1 is
- a preemprion time. Otherwise, if a job with lower priority is scheduled at time t1,
- then this jobs also should be scheduled before the beginning of the busy interval. So, the
- next preemption time will be no more than [max_priority_inversion t1] time units later. *)
- Lemma preemption_time_exists:
- exists pr_t,
- preemption_time pr_t /\
- t1 <= pr_t <= t1 + max_length_of_priority_inversion j t1.
- Proof.
- set (service := service sched).
- move: (H_correct_preemption_model) => CORR.
- move: (H_busy_interval_prefix) => [NEM [QT1 [NQT HPJ]]].
- case SCHED: (sched t1) => [s | ]; move: SCHED => /eqP SCHED; last first.
- { exists t1; split; last first.
- apply/andP; split; [by done | by rewrite leq_addr].
- move: SCHED => /eqP SCHED.
- rewrite /preemption_time /LimitedPreemptionPlatform.preemption_time.
- by rewrite SCHED.
- }
- { case PRIO: (higher_eq_priority s j).
- { exists t1; split; last first.
- apply/andP; split; [by done | by rewrite leq_addr].
- destruct t1.
- { eapply zero_is_pt; [eauto 2 | apply H_jobs_come_from_arrival_sequence]. }
- eapply hp_job_not_scheduled_before_quiet_time in QT1; eauto 2.
- try ( eapply first_moment_is_pt with (j0 := s); eauto 2 ) ||
- eapply first_moment_is_pt with (j := s); eauto 2.
- }
- { move: (SCHED) => ARRs; apply H_jobs_come_from_arrival_sequence in ARRs.
- move: (H_model_with_bounded_nonpreemptive_segments s ARRs) => [_ [_ [_ EXPP]]].
- move: (EXPP (service s t1)) => PP; clear EXPP.
- feed PP. by apply/andP; split; [done | apply H_completed_jobs_dont_execute].
- have EX: exists pt,
- ((service s t1) <= pt <= (service s t1) + (job_max_nps s - 1))
- && can_be_preempted s pt.
- { move: PP => [pt [NEQ PP]].
- exists pt; apply/andP; split; by done.
- } clear PP.
- have MIN := ex_minnP EX.
- move: MIN => [sm_pt /andP [NEQ PP] MIN]; clear EX.
- have Fact: exists Δ, sm_pt = service s t1 + Δ.
- { exists (sm_pt - service s t1).
- apply/eqP; rewrite eq_sym; apply/eqP; rewrite subnKC //.
- by move: NEQ => /andP [T _]. }
- move: Fact => [Δ EQ]; subst sm_pt; rename Δ into sm_pt.
- exists (t1 + sm_pt); split.
- { have Fact1:
- forall prog, service s t1 <= prog < service s t1 + sm_pt ->
- ~~ can_be_preempted s prog.
- { move => prog /andP [GE LT].
- apply/negP; intros PPJ.
- feed (MIN prog); first (apply/andP; split); try done.
- - apply/andP; split; first by done.
- apply leq_trans with (service s t1 + sm_pt).
- + by apply ltnW.
- + by move: NEQ => /andP [_ K].
- - by move: MIN; rewrite leqNgt; move => /negP NLT; apply: NLT.
- }
- have Fact2: forall t', t1 <= t' < t1 + sm_pt -> job_scheduled_at s t'.
- {
- move => t' /andP [GE LT].
- have Fact: exists Δ, t' = t1 + Δ.
- { by exists (t' - t1); apply/eqP; rewrite eq_sym; apply/eqP; rewrite subnKC. }
- move: Fact => [Δ EQ]; subst t'.
- move: (Fact1 (service s (t1 + Δ)))(CORR s) => NPPJ T.
- feed T; first by done. move: T => [T _ ].
- apply: T; apply: NPPJ.
- apply/andP; split.
- { by apply Service.service_monotonic; rewrite leq_addr. }
- rewrite /service /UniprocessorSchedule.service (@Service.service_during_cat _ _ _ t1).
- { rewrite ltn_add2l; rewrite ltn_add2l in LT.
- apply leq_ltn_trans with Δ; last by done.
- rewrite -{2}(sum_of_ones t1 Δ).
- rewrite leq_sum //; clear; intros t _.
- by rewrite /service_at; destruct (scheduled_at sched s t). }
- { by apply/andP; split; [done | rewrite leq_addr]. }
- }
- rewrite /preemption_time /LimitedPreemptionPlatform.preemption_time.
- case SCHEDspt: (sched (t1 + sm_pt)) => [s0 | ]; last by done.
- move: SCHEDspt => /eqP SCHEDspt.
- destruct (s == s0) eqn: EQ.
- { move: EQ => /eqP EQ; subst s0.
- rewrite /UniprocessorSchedule.service.
- rewrite (@Service.service_during_cat _ _ _ t1); last first.
- { by apply/andP; split; [ done | rewrite leq_addr]. }
- have ALSCHED: service_during sched s t1 (t1 + sm_pt) = sm_pt.
- { rewrite -{2}(sum_of_ones t1 sm_pt) /service_during.
- apply/eqP; rewrite eqn_leq //; apply/andP; split.
- { rewrite leq_sum //; clear; intros t _.
- by unfold service_at; destruct (scheduled_at sched s t). }
- { rewrite big_nat_cond [in X in _ <= X]big_nat_cond.
- rewrite leq_sum //.
- move => x /andP [HYP _].
- rewrite lt0b.
- by apply Fact2.
- }
- }
- by rewrite ALSCHED.
- }
- destruct sm_pt.
- { exfalso; move: EQ => /negP EQ; apply: EQ.
- move: SCHED SCHEDspt => /eqP SCHED /eqP SCHEDspt.
- rewrite addn0 in SCHEDspt; rewrite SCHEDspt in SCHED.
- by inversion SCHED. }
- { rewrite addnS.
- move: (H_correct_preemption_model s0) => T.
- feed T; first by eauto 2. move: T => [_ T]; apply: T.
- apply /negP; intros CONTR.
- move: EQ => /negP EQ; apply: EQ.
- move: (Fact2 (t1 + sm_pt)) => SCHEDs0.
- feed SCHEDs0; first by apply/andP; split; [rewrite leq_addr | rewrite addnS].
- apply/eqP; eapply only_one_job_scheduled; eauto 2.
- by rewrite -addnS.
- }
- }
- move: NEQ => /andP [GE LE].
- apply/andP; split; first by rewrite leq_addr.
- rewrite leq_add2l.
- unfold max_length_of_priority_inversion.
- rewrite (big_rem s) //=.
- { rewrite PRIO; simpl.
- apply leq_trans with (job_max_nps s - ε); last by rewrite leq_maxl.
- by rewrite leq_add2l in LE. }
- eapply arrived_between_implies_in_arrivals; eauto 2.
- apply/andP; split; first by done.
- eapply low_priority_job_arrives_before_busy_interval_prefix with t1; eauto 2.
- by rewrite PRIO.
- }
- }
- Qed.
-
- End PreemprionTimeExists.
-
- End PriorityInversionIsBounded.
-
-End PriorityInversionIsBounded.
diff --git a/classic/model/schedule/uni/limited/rbf.v b/classic/model/schedule/uni/limited/rbf.v
deleted file mode 100644
index 9339f786c0b9ef062d62e18324aa8b3ac46b11e2..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/rbf.v
+++ /dev/null
@@ -1,105 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.job
- prosa.classic.model.arrival.basic.task_arrival
- prosa.classic.model.priority
- prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.arrival.curves.bounds.
-Require Import prosa.classic.analysis.uni.arrival_curves.workload_bound.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq path fintype bigop.
-
-Module RBF.
-
- Import Job Time ArrivalSequence ArrivalCurves TaskArrival Priority MaxArrivalsWorkloadBound.
-
- (* In this section, we prove some properties of Request Bound Functions (RBF). *)
- Section RBFProperties.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent:
- arrival_times_are_consistent job_arrival arr_seq.
-
- (* Consider an FP policy that indicates a higher-or-equal priority relation,
- and assume that the relation is reflexive and transitive. *)
- Variable higher_eq_priority: FP_policy Task.
- Hypothesis H_priority_is_reflexive: FP_is_reflexive higher_eq_priority.
- Hypothesis H_priority_is_transitive: FP_is_transitive higher_eq_priority.
-
- (* Let tsk be any task. *)
- Variable tsk: Task.
-
- (* Let max_arrivals be a proper arrival curve for task tsk, i.e.,
- [max_arrival tsk] is (1) an arrival bound of tsk, and (2) it is
- a monotonic function that equals 0 for the empty interval delta = 0. *)
- Variable max_arrivals: Task -> time -> nat.
- Hypothesis H_proper_arrival_curve:
- proper_arrival_curve job_task arr_seq max_arrivals tsk.
-
- (* Let's define some local names for clarity. *)
- Let task_rbf := task_request_bound_function task_cost max_arrivals tsk.
-
- (* We prove that [task_rbf 0] is equal to 0. *)
- Lemma task_rbf_0_zero:
- task_rbf 0 = 0.
- Proof.
- rewrite /task_rbf /task_request_bound_function.
- apply/eqP; rewrite muln_eq0; apply/orP; right; apply/eqP.
- by move: H_proper_arrival_curve => [_ [T _]]; apply T.
- Qed.
-
- (* We prove that task_rbf is monotone. *)
- Lemma task_rbf_monotone:
- monotone task_rbf leq.
- Proof.
- rewrite /monotone; intros.
- rewrite /task_rbf /task_request_bound_function leq_mul2l.
- apply/orP; right.
- by move: H_proper_arrival_curve => [_ T]; apply T.
- Qed.
-
- (* Consider any job j of tsk. *)
- Variable j: Job.
- Hypothesis H_j_arrives: arrives_in arr_seq j.
- Hypothesis H_job_of_tsk: job_task j = tsk.
-
- (* Then we prove that task_rbf 1 is greater than or equal to task cost. *)
- Lemma task_rbf_1_ge_task_cost:
- task_rbf 1 >= task_cost tsk.
- Proof.
- have ALT: forall n, n = 0 \/ n > 0.
- { by clear; intros n; destruct n; [left | right]. }
- specialize (ALT (task_cost tsk)); destruct ALT as [Z | POS]; first by rewrite Z.
- rewrite leqNgt; apply/negP; intros CONTR.
- move: H_proper_arrival_curve => [ARRB _].
- specialize (ARRB (job_arrival j) (job_arrival j + 1)).
- feed ARRB; first by rewrite leq_addr.
- rewrite addKn in ARRB.
- move: CONTR; rewrite /task_rbf /task_request_bound_function; move => CONTR.
- move: CONTR; rewrite -{2}[task_cost tsk]muln1 ltn_mul2l; move => /andP [_ CONTR].
- move: CONTR; rewrite -addn1 -{3}[1]add0n leq_add2r leqn0; move => /eqP CONTR.
- move: ARRB; rewrite CONTR leqn0 eqn0Ngt; move => /negP T; apply: T.
- rewrite /num_arrivals_of_task -has_predT.
- rewrite /arrivals_of_task_between /is_job_of_task.
- apply/hasP; exists j; last by done.
- rewrite /jobs_arrived_between addn1 big_nat_recl; last by done.
- rewrite big_geq ?cats0; last by done.
- rewrite mem_filter.
- apply/andP; split.
- - by apply/eqP.
- - move: H_j_arrives => [t ARR].
- move: (ARR) => CONS.
- apply H_arrival_times_are_consistent in CONS.
- by rewrite CONS.
- Qed.
-
- End RBFProperties.
-
-End RBF.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/limited/schedule.v b/classic/model/schedule/uni/limited/schedule.v
deleted file mode 100644
index 5aa18e005edd84ebea9597ad480a0f7ccebaad05..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/limited/schedule.v
+++ /dev/null
@@ -1,166 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.uni.service
- prosa.classic.model.schedule.uni.schedule.
-
-(* Let's import definition of nonpreemptive schedule. *)
-Require Import prosa.classic.model.schedule.uni.nonpreemptive.schedule.
-
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we provide additional definitions and
- lemmas about lock-in-serivce-compliant schedules. *)
- Import Job Service UniprocessorSchedule.
-
- Section Definitions.
-
- Context {Task: eqType}.
- Variable task_cost: Task -> time.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* We define the notion of lock-in service: lock-in service is the amount of service
- after which a job cannot be preempted until its completion. *)
- Variable job_lock_in_service: Job -> time.
-
- (* We require the lock-in service to be positive for any job, i.e., in order to
- become non-preemptive a job must receive at least one unit of service. *)
- Definition job_lock_in_service_positive :=
- forall j,
- arrives_in arr_seq j ->
- job_cost_positive job_cost j ->
- 0 < job_lock_in_service j.
-
- (* We also require a job's lock-in service to be at most the cost of the job. *)
- Definition job_lock_in_service_le_job_cost :=
- forall j,
- arrives_in arr_seq j ->
- job_cost_positive job_cost j ->
- job_lock_in_service j <= job_cost j.
-
- (* In order to get a consistent schedule, the scheduler should respect the notion of
- lock-in service. We assume that, after a job reaches its lock-in service, it
- cannot be preempted until its completion. *)
- Definition job_nonpreemptive_after_lock_in_service :=
- forall j t t',
- arrives_in arr_seq j ->
- t <= t' ->
- job_lock_in_service j <= service sched j t ->
- ~~ completed_by job_cost sched j t' ->
- scheduled_at sched j t'.
-
- (* We say that job_lock_in_service is a proper job lock-in service iff for all jobs in the
- arrival sequence the lock-in service is (1) positive, (2) no bigger than the costs of
- the corresponding jobs, and (3) a job becomes nonpreemptive after it reaches the
- lock-in service. *)
- Definition proper_job_lock_in_service :=
- job_lock_in_service_positive /\
- job_lock_in_service_le_job_cost /\
- job_nonpreemptive_after_lock_in_service.
-
- (* Similarly, we define the notion of task lock-in service: task lock-in service is the
- amount of service after which any job from a task reaches its lock-in service. *)
- Variable task_lock_in_service: Task -> time.
-
- (* A task's lock-in service should be at most the cost of the task. *)
- Definition task_lock_in_service_le_task_cost tsk :=
- task_lock_in_service tsk <= task_cost tsk.
-
- (* We say that the lock-in service of a task tsk bounds the job lock-in service iff for any
- job j of task tsk the job lock-in service is less-than-or-equal to the task lock-in
- service. *)
- Definition task_lock_in_service_bounds_job_lock_in_service tsk :=
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_lock_in_service j <= task_lock_in_service tsk.
-
- (* We say that task_lock_in_service is a proper task lock-in service for some task tsk
- iff [task_lock_in_service tsk] is (1) no bigger than tsk's cost, (2) for any job of
- task tsk job_lock_in_service is bounded by task_lock_in_service. *)
- Definition proper_task_lock_in_service tsk :=
- task_lock_in_service_le_task_cost tsk /\
- task_lock_in_service_bounds_job_lock_in_service tsk.
-
- End Definitions.
-
- Section Examples.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* In this section we prove that in case of the fully preemptive scheduling model
- the job_nonpreemptive_after_lock_in_service hypothesis becomes trivial. *)
- Section FullyPreemptiveModel.
-
- (* In the fully preemptive model any job can be preempted at any moment. *)
- Let job_lock_in_service (j: Job) := job_cost j.
-
- (* Then, we prove that the job_nonpreemptive_after_lock_in_service hypothesis is trivial. *)
- Lemma job_nonpreemptive_after_lock_in_service_trivial:
- job_nonpreemptive_after_lock_in_service job_cost arr_seq sched job_lock_in_service .
- Proof.
- intros j ? ? ARR LE SERV NCOMP.
- move: NCOMP => /negP NCOMP; exfalso; apply: NCOMP.
- move: (H_completed_jobs_dont_execute j t) => SERV2.
- by apply completion_monotonic with t.
- Qed.
-
- End FullyPreemptiveModel.
-
- (* In this section we prove that in case of the fully nonpreemptive scheduling model
- the job_nonpreemptive_after_lock_in_service hypothesis holds. *)
- Section FullyNonPreemptiveModel.
-
- (* In fully nonpreemptive model any job becomes nonpreemptive as soon as it receives one unit of service. *)
- Let job_lock_in_service (j: Job) := ε.
-
- (* Next, we assume that the schedule is fully nonpreemptive. *)
- Hypothesis H_is_nonpreemptive_schedule:
- NonpreemptiveSchedule.is_nonpreemptive_schedule job_cost sched.
-
- (* Then, we prove that the job_nonpreemptive_after_lock_in_service hypothesis holds. *)
- Lemma property_last_segment_is_nonpreemptive_holds:
- job_nonpreemptive_after_lock_in_service job_cost arr_seq sched job_lock_in_service .
- Proof.
- unfold NonpreemptiveSchedule.is_nonpreemptive_schedule in *.
- intros j ? ? ARR LE NEQ NCOMPL; unfold job_lock_in_service in *.
- have POS: 0 < job_cost j.
- { rewrite -[0 < _]Bool.negb_involutive -eqn0Ngt; apply/negP; intros ZERO.
- move: ZERO => /eqP ZERO.
- rewrite /completed_by in NCOMPL.
- rewrite ZERO -lt0n in NCOMPL.
- move: (H_completed_jobs_dont_execute j t') => NN.
- by rewrite ZERO leqNgt in NN; move: NN => /negP NN; apply: NN.
- }
- move: NEQ; rewrite sum_nat_gt0 filter_predT => /hasP[ts IN SCHED].
- rewrite lt0b in SCHED.
- apply H_is_nonpreemptive_schedule with ts; try done.
- apply ltnW, leq_trans with t; last by done.
- by rewrite mem_iota add0n subn0 in IN; move: IN => /andP [_ IN].
- Qed.
-
- End FullyNonPreemptiveModel.
-
- End Examples.
diff --git a/classic/model/schedule/uni/nonpreemptive/platform.v b/classic/model/schedule/uni/nonpreemptive/platform.v
deleted file mode 100644
index 241e3b4ce3a7d5612e5b7798d82fa9cd73912a6b..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/nonpreemptive/platform.v
+++ /dev/null
@@ -1,121 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.priority prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.basic.platform.
-Require Import prosa.classic.model.schedule.uni.nonpreemptive.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype bigop.
-
-Module NonpreemptivePlatform.
-
- Import Job SporadicTaskset UniprocessorSchedule Priority.
-
- (* In this section, we define properties of the processor platform. *)
- Section Properties.
-
- Context {sporadic_task: eqType}.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_completed_by := completed_by job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
-
- (* First, we define the notion of a preemption point. *)
- Section PreemptionPoint.
-
- (* We say that t is a preemption point iff (a) t is equal to 0
- or (b) there is no scheduling job at time t or
- (c) a job that was scheduled at time (t - 1) and
- has completed by t exists. *)
- Definition is_preemption_point' (t: time) :=
- t = 0
- \/ sched (t-1) = None
- \/ exists j, scheduled_at sched j (t - 1) /\ job_completed_by j t.
-
- (* Moreover, we provide a shorter definition, more convenient for the proofs. *)
- Definition is_preemption_point (t: time) :=
- t = 0 \/ forall j, job_scheduled_at j (t - 1) -> job_completed_by j t.
-
- (* Let's prove that the definitions above are equal. *)
- Lemma defitions_of_preemption_point_are_equal:
- forall t, is_preemption_point t <-> is_preemption_point' t.
- Proof.
- unfold is_preemption_point, is_preemption_point'.
- intros; split; intros.
- {
- destruct H as [H | H]; [by left | right].
- destruct (sched (t-1)) eqn:SCHED; [right; exists s | by left].
- move: SCHED => /eqP SCHED.
- by split; last by apply H in SCHED.
- }
- {
- destruct H as [H | [H | H]]; [by left| | ]; right; intros.
- unfold job_scheduled_at, scheduled_at in H0. rewrite H in H0. inversion H0.
- inversion H as [j' [H1 H2]]. unfold job_scheduled_at in H0.
- have EQ: j = j'. by apply (only_one_job_scheduled sched) with (t := t-1).
- by subst j'.
- }
- Qed.
-
- End PreemptionPoint.
-
- (* Next, we define properties related to execution. *)
- Section Execution.
-
- (* We say that a scheduler is work-conserving iff whenever a job j
- is backlogged, the processor is always busy with another job. *)
- (* Imported from the preemptive schedule. *)
- Definition work_conserving := Platform.work_conserving job_cost.
-
- End Execution.
-
- (* Next, we define properties related to FP scheduling. *)
- Section FP.
-
- (* We say that an FP policy...*)
- Variable higher_eq_priority: FP_policy sporadic_task.
-
- (* ...is respected by the schedule iff a scheduled task has
- higher (or same) priority than (as) any backlogged task at
- every preemption point. *)
- Definition respects_FP_policy_at_preemption_point :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_at sched j_hp t ->
- is_preemption_point t ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- (* Next, we define properties related to JLFP policies. *)
- Section JLFP.
-
- (* We say that a JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ... is respected by the scheduler iff a scheduled job has
- higher (or same) priority than (as) any backlogged job at
- every preemption point. *)
- Definition respects_JLFP_policy_at_preemption_point :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- backlogged job_arrival job_cost sched j t ->
- scheduled_at sched j_hp t ->
- is_preemption_point t ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- End Properties.
-
-End NonpreemptivePlatform.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/nonpreemptive/schedule.v b/classic/model/schedule/uni/nonpreemptive/schedule.v
deleted file mode 100644
index 12b2bf100c57edc38fe4077dc6a2c57e1d416582..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/nonpreemptive/schedule.v
+++ /dev/null
@@ -1,357 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job.
-Require Import prosa.classic.model.schedule.uni.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module NonpreemptiveSchedule.
-
- Export UniprocessorSchedule.
-
- Section Definitions.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_completed_by := completed_by job_cost sched.
- Let job_remaining_cost j t := remaining_cost job_cost sched j t.
-
- (* We define schedule to be nonpreemptive iff every job remains scheduled until completion. *)
- Definition is_nonpreemptive_schedule :=
- forall j t t',
- t <= t' ->
- scheduled_at sched j t ->
- ~~ job_completed_by j t' ->
- scheduled_at sched j t'.
-
- (* In this section, we prove some basic lemmas about nonpreemptive schedules. *)
- Section Lemmas.
-
- (* Assume that we have a nonpreemptive schedule. *)
- Hypothesis H_nonpreemptive: is_nonpreemptive_schedule.
-
- Section BasicLemmas.
-
- (* Consider any job j. *)
- Variable j: Job.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* First, we show that if j is scheduled at any two time instants,
- then it is also scheduled at any time between them. *)
- Lemma continuity_of_nonpreemptive_scheduling:
- forall t t1 t2,
- t1 <= t <= t2 ->
- scheduled_at sched j t1 ->
- scheduled_at sched j t2 ->
- scheduled_at sched j t.
- Proof.
- move => t t1 t2 /andP [GT LE] SCHEDt1 SCHEDt2.
- unfold is_nonpreemptive_schedule, job_completed_by in *.
- apply H_nonpreemptive with (t := t1); [by done| by done| ].
- apply /negP; intros COMP.
- apply (scheduled_implies_not_completed job_cost) in SCHEDt2; last by done.
- apply completion_monotonic with (t' := t2) in COMP; last by done.
- by move: SCHEDt2 => /negP SCHEDt2; apply: SCHEDt2.
- Qed.
-
- (* Next, we show that in any nonpreemptive schedule, once a job is scheduled,
- it cannot be preempted until completion. *)
- Lemma in_nonpreemption_schedule_preemption_implies_completeness:
- forall t t' ,
- t <= t' ->
- scheduled_at sched j t ->
- ~~ scheduled_at sched j t' ->
- job_completed_by j t'.
- Proof.
- intros t t' LE SCHED; apply contraNT.
- by apply H_nonpreemptive with (t := t).
- Qed.
-
- End BasicLemmas.
-
- (* In this section, we prove properties related to job completion. *)
- Section CompletionUnderNonpreemptive.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* If job j is scheduled at time t, then it must complete by (t + remaining_cost j t). *)
- Lemma job_completes_after_remaining_cost:
- forall j t,
- scheduled_at sched j t ->
- job_completed_by j (t + job_remaining_cost j t).
- Proof.
- intros j t SCHED.
- rewrite /job_completed_by /completed_by.
- rewrite /service /service_during.
- rewrite (@big_cat_nat _ _ _ t) //= ?leq_addr //.
- apply leq_trans with (n := service sched j t + job_remaining_cost j t);
- first by rewrite /remaining_cost subnKC //.
- rewrite leq_add2l.
- set t2 := t + _.
- apply leq_trans with (n := \sum_(t <= i < t2) 1);
- first by simpl_sum_const; rewrite /t2 addKn.
- apply leq_sum_nat.
- move => i /andP [GE LT _].
- rewrite lt0n eqb0 negbK.
- apply (H_nonpreemptive j t i); try (by done).
- unfold t2 in *; clear t2.
- have NOTCOMP: ~~ job_completed_by j t.
- {
- apply contraT. rewrite negbK. intros COMP.
- apply completed_implies_not_scheduled in COMP; last by done.
- by rewrite SCHED in COMP.
- }
- apply job_doesnt_complete_before_remaining_cost in NOTCOMP; last by done.
- apply contraT; rewrite negbK; intros COMP.
- exfalso; move: NOTCOMP => /negP NOTCOMP; apply: NOTCOMP.
- ( try ( apply completion_monotonic with (t0 := i) ) ||
- apply completion_monotonic with (t := i)); try ( by done).
- by apply leq_subRL_impl; first rewrite add1n.
- Qed.
-
- End CompletionUnderNonpreemptive.
-
- (* In this section, we determine bounds on the length of the execution interval. *)
- Section ExecutionInterval.
-
- (* Assume that jobs do not execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Let j be any job scheduled at time t. *)
- Variable j: Job.
- Variable t: time.
- Hypothesis H_j_is_scheduled_at_t: scheduled_at sched j t.
-
- (* Is this section we show that there is a bound for how early job j can start. *)
- Section LeftBound.
-
- (* We prove that job j is scheduled at time (t - service sched j t)... *)
- Lemma j_is_scheduled_at_t_minus_service:
- scheduled_at sched j (t - service sched j t).
- Proof.
- unfold is_nonpreemptive_schedule in *.
- apply contraT; intros CONTRA; exfalso.
- rename H_j_is_scheduled_at_t into SCHED.
- have COSTPOS: job_cost j > 0.
- { apply (scheduled_implies_not_completed job_cost) in SCHED; last by done.
- unfold job_completed_by, completed_by in SCHED.
- apply contraT; rewrite -eqn0Ngt.
- move => /eqP EQ0.
- rewrite EQ0 in SCHED.
- by rewrite -ltnNge ltn0 in SCHED.
- }
-
- have H: service sched j (t + job_remaining_cost j t) == job_cost j.
- { rewrite eqn_leq; apply/andP; split; eauto 2.
- by apply job_completes_after_remaining_cost.
- }
- unfold job_completed_by, completed_by in H.
- move: H => /eqP H.
- unfold service, service_during in H.
- rewrite (@big_cat_nat _ _ _ (t - service sched j t)) //= in H;
- last by rewrite leq_subLR addnC -addnA leq_addr.
- have R: forall a b c, a + b = c -> b < c -> a > 0.
- { by intros a b c EQ LT; induction a;
- first by rewrite add0n in EQ; subst b;
- rewrite ltnn in LT.
- }
- apply R in H; last first.
- {
- have CUMLED := cumulative_service_le_delta sched j 0 t.
- have CUMLEJC := cumulative_service_le_job_cost _ _ j H_completed_jobs_dont_execute 0 t.
- rewrite (@big_cat_nat _ _ _ ((t - service sched j t).+1)) //=.
- {
- rewrite big_nat_recl; last by done.
- rewrite big_geq; last by done.
- rewrite -eqb0 in CONTRA; move: CONTRA => /eqP CONTRA.
- rewrite /service_at CONTRA add0n add0n.
- apply leq_ltn_trans with
- (t + job_remaining_cost j t - ((t - service sched j t).+1)).
- set (t - service sched j t).+1 as T.
- apply leq_trans with (\sum_(T <= i < t + job_remaining_cost j t) 1).
- rewrite leq_sum //; intros; by destruct (scheduled_at sched j i).
- simpl_sum_const. by done.
- unfold job_remaining_cost, remaining_cost.
- rewrite -addn1 -addn1 addnBAC; first by
- by rewrite leq_subLR addnBA;
- first by rewrite -addnA [1+job_cost j]addnC addnA -addnBAC.
- {
- rewrite addnBAC; last by done.
- rewrite leq_subLR addnA.
- rewrite addnBA; last by done.
- rewrite [_+t]addnC [_+job_cost j]addnC addnA.
- rewrite -addnBA; last by done.
- by rewrite subnn addn0 addnC leq_add2r.
- }
- }
- {
- unfold remaining_cost.
- rewrite addnBA; last by done.
- rewrite -addn1 addnBAC; last by done.
- rewrite leq_subLR -addnBA; last by done.
- rewrite addnA [_+t]addnC -addnA leq_add2l addnBA; last by done.
- by rewrite addnC -addnBA; first by rewrite subnn addn0.
- }
- }
- {
- rewrite lt0n in H; move: H => /neqP H; apply: H.
- rewrite big_nat_cond big1 //; move => i /andP [/andP [_ LT] _].
- apply /eqP; rewrite eqb0; apply /negP; intros CONT.
-
- have Y := continuity_of_nonpreemptive_scheduling j _ (t - service sched j t) i t.
- feed_n 4 Y; try(done).
- by apply/andP; split; [rewrite ltnW | rewrite leq_subr].
- by move: CONTRA => /negP CONTRA; apply CONTRA.
- }
- Qed.
-
- (* ... and it is not scheduled at time (t - service sched j t - 1). *)
- Lemma j_is_not_scheduled_at_t_minus_service_minus_one:
- t - service sched j t > 0 ->
- ~~ scheduled_at sched j (t - service sched j t - 1).
- Proof.
- rename H_j_is_scheduled_at_t into SCHED.
- intros GT; apply/negP; intros CONTRA.
- have L1 := job_doesnt_complete_before_remaining_cost
- job_cost sched j H_completed_jobs_dont_execute t.
- feed L1; first by rewrite scheduled_implies_not_completed.
- have L2 := job_completes_after_remaining_cost
- H_completed_jobs_dont_execute
- j (t-service sched j t - 1).
- feed L2; first by done.
- have EQ:
- t + job_remaining_cost j t - 1 =
- t - service sched j t - 1 + job_remaining_cost j (t - service sched j t - 1).
- {
- have T1: service sched j (t - service sched j t - 1) = 0.
- {
-
- rewrite [service _ _ _]/service /service_during.
- rewrite big_nat_cond big1 //; move => t' /andP [/andP [_ LT] _].
- apply /eqP; rewrite eqb0; apply /negP; intros CONTR.
-
- have COMPL: completed_by job_cost sched j (t + job_remaining_cost j t - 1).
- {
- ( try ( apply completion_monotonic with (t0 := t' + job_remaining_cost j t') ) ||
- apply completion_monotonic with (t := t' + job_remaining_cost j t'));
- [| by apply job_completes_after_remaining_cost].
- unfold remaining_cost.
- have LLF: t' < t - service sched j t.
- {
- by apply ltn_trans with (t - service sched j t - 1);
- last by rewrite -addn1 addnBAC // -addnBA // subnn addn0.
- } clear LT.
- rewrite !addnBA;
- try(rewrite H_completed_jobs_dont_execute //).
- rewrite [t' + _]addnC [t + _]addnC.
- rewrite -addnBA; last by rewrite cumulative_service_le_delta.
- rewrite -addnBA; last by rewrite cumulative_service_le_delta.
- rewrite -addnBA ?leq_add2l; last by done.
- by apply leq_trans with (t' + 1 - 1);
- rewrite addn1 subn1 -pred_Sn;
- [rewrite leq_subr | rewrite leq_subRL_impl // addn1].
- }
- have L3 := job_doesnt_complete_before_remaining_cost job_cost sched
- j H_completed_jobs_dont_execute t;
- feed L3; first by rewrite scheduled_implies_not_completed.
- unfold job_completed_by in *.
- by move: L3 => /negP L3; apply L3.
- }
- rewrite /job_remaining_cost /remaining_cost T1 subn0 addnBA; last by done.
- rewrite -addnBAC.
- by rewrite -[(t-service sched j t) + _ - _]addnBAC.
- by rewrite cumulative_service_le_delta.
- }
- move: L1 => /neqP L1; apply: L1.
- rewrite -EQ in L2.
- by unfold job_completed_by, completed_by in L2; move: L2 => /eqP L2.
- Qed.
-
- (* Using the previous lemma, we show that job j cannot be scheduled
- before (t - service sched j t). *)
- Lemma j_is_not_scheduled_earlier_t_minus_service:
- forall t',
- t' < t - service sched j t ->
- ~~ scheduled_at sched j t'.
- Proof.
- intros t' GT.
- have NOTSCHED := j_is_not_scheduled_at_t_minus_service_minus_one;
- feed NOTSCHED; first by apply leq_ltn_trans with t'.
- apply/negP; intros CONTRA.
- move: NOTSCHED => /negP NOTSCHED; apply: NOTSCHED.
- apply continuity_of_nonpreemptive_scheduling with (t1 := t') (t2 := t);
- [ by done | | by done | by done ].
- apply/andP; split; last by apply leq_trans with (t - service sched j t); rewrite leq_subr.
- rewrite [t']pred_Sn -subn1 leq_sub2r //.
- Qed.
-
- End LeftBound.
-
- (* Is this section we prove that job j cannot be scheduled after (t + remaining_cost j t - 1). *)
- Section RightBound.
-
- (* We show that if job j is scheduled at time t,
- then it is also scheduled at time (t + remaining_cost j t - 1)... *)
- Lemma j_is_scheduled_at_t_plus_remaining_cost_minus_one:
- scheduled_at sched j (t + job_remaining_cost j t - 1).
- Proof.
- move: (H_j_is_scheduled_at_t) => COMP.
- apply (scheduled_implies_not_completed job_cost) in COMP; last by done.
- apply job_doesnt_complete_before_remaining_cost in COMP; last by done.
- move: COMP; apply contraR; intros CONTR.
- apply in_nonpreemption_schedule_preemption_implies_completeness
- with (t:=t); [|by done| by done].
- rewrite leq_subRL_impl // addnC ?leq_add2l.
- by rewrite scheduled_implies_positive_remaining_cost //.
- Qed.
-
- (* ... and it is not scheduled after (t + remaining cost j t - 1). *)
- Lemma j_is_not_scheduled_after_t_plus_remaining_cost_minus_one:
- forall t',
- t + job_remaining_cost j t <= t' ->
- ~~ scheduled_at sched j t'.
- Proof.
- intros t' GE.
- unfold job_completed_by in *.
- rename H_j_is_scheduled_at_t into SCHED.
- apply job_completes_after_remaining_cost in SCHED; last by done.
- by apply (completion_monotonic job_cost) with (t' := t') in SCHED; first
- by apply (completed_implies_not_scheduled job_cost).
- Qed.
-
- End RightBound.
-
- (* To conclude, we identify the interval where job j is scheduled. *)
- Lemma nonpreemptive_executing_interval:
- forall t',
- t - service sched j t <= t' < t + job_remaining_cost j t ->
- scheduled_at sched j t'.
- Proof.
- move => t' /andP [GE LE].
- move: (H_j_is_scheduled_at_t) => SCHED1; move: (H_j_is_scheduled_at_t) => SCHED2.
- rewrite -add1n in LE; apply leq_subRL_impl with (n := t') (m := 1) in LE;
- apply continuity_of_nonpreemptive_scheduling with
- (t1 := t - service sched j t)
- (t2 := t + job_remaining_cost j t - 1); first by done.
- - by apply/andP;split.
- - by apply j_is_scheduled_at_t_minus_service.
- - by apply j_is_scheduled_at_t_plus_remaining_cost_minus_one.
- Qed.
-
- End ExecutionInterval.
-
- End Lemmas.
-
- End Definitions.
-
-End NonpreemptiveSchedule.
diff --git a/classic/model/schedule/uni/response_time.v b/classic/model/schedule/uni/response_time.v
deleted file mode 100644
index f5a5cfc3c32af5a923e1df6fe8a57fb6e394b965..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/response_time.v
+++ /dev/null
@@ -1,167 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.task_arrival.
-Require Import prosa.classic.model.schedule.uni.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module ResponseTime.
-
- Import UniprocessorSchedule SporadicTaskset TaskArrival.
-
- (* In this section, we define the notion of response-time bound. *)
- Section ResponseTimeBound.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_has_completed_by := completed_by job_cost sched.
-
- Section Job.
-
- (* Given any job j, ... *)
- Variable j: Job.
-
- (* ...we say that R is a response-time bound of j in this schedule ... *)
- Variable R: time.
-
- (* ... iff j completes by (job_arrival j + R). *)
- Definition is_response_time_bound_of_job := job_has_completed_by j (job_arrival j + R).
-
- End Job.
-
- Section Task.
-
- (* Let tsk be any task that is to be analyzed. *)
- Variable tsk: sporadic_task.
-
- (* Then, we say that R is a response-time bound of tsk in this schedule ... *)
- Variable R: time.
-
- (* ... iff any job j of tsk in this arrival sequence has
- completed by (job_arrival j + R). *)
- Definition is_response_time_bound_of_task :=
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- is_response_time_bound_of_job j R.
-
- End Task.
-
- End ResponseTimeBound.
-
- (* In this section, we prove some basic lemmas about response-time bounds. *)
- Section BasicLemmas.
-
- Context {sporadic_task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> sporadic_task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* Assume that jobs don't execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* For simplicity, let's define some local names. *)
- Let response_time_bounded_by := is_response_time_bound_of_job job_arrival job_cost sched.
-
- (* We begin by proving lemmas about job response-time bounds. *)
- Section SpecificJob.
-
- (* Let j be any job... *)
- Variable j: Job.
-
- (* ...with response-time bound R. *)
- Variable R: time.
- Hypothesis response_time_bound: response_time_bounded_by j R.
-
- (* Then, the service received by j at any time t' after its response time is 0. *)
- Lemma service_after_job_rt_zero :
- forall t',
- t' >= job_arrival j + R ->
- service_at sched j t' = 0.
- Proof.
- rename response_time_bound into RT,
- H_completed_jobs_dont_execute into EXEC; ins.
- unfold is_response_time_bound_of_task, completed_by,
- completed_jobs_dont_execute in *.
- apply/eqP; rewrite eqb0; apply/negP; intros CONTR.
- unfold response_time_bounded_by,is_response_time_bound_of_job in *.
- eapply completion_monotonic in RT; eauto 2.
- apply completed_implies_not_scheduled in RT; eauto 2.
- by move: RT => /negP RT; apply:RT.
- Qed.
-
- (* The same applies for the cumulative service of job j. *)
- Lemma cumulative_service_after_job_rt_zero :
- forall t' t'',
- t' >= job_arrival j + R ->
- \sum_(t' <= t < t'') service_at sched j t = 0.
- Proof.
- ins; apply/eqP; rewrite -leqn0.
- rewrite big_nat_cond; rewrite -> eq_bigr with (F2 := fun i => 0);
- first by rewrite big_const_seq iter_addn mul0n addn0 leqnn.
- intro i; rewrite andbT; move => /andP [LE _].
- by rewrite service_after_job_rt_zero;
- [by ins | by apply leq_trans with (n := t')].
- Qed.
-
- End SpecificJob.
-
- (* Next, we prove properties about task response-time bounds. *)
- Section AllJobs.
-
- (* Consider any task tsk ...*)
- Variable tsk: sporadic_task.
-
- (* ... for which a response-time bound R is known. *)
- Variable R: time.
- Hypothesis response_time_bound:
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched tsk R.
-
- (* Then, for any job j of this task, ...*)
- Variable j: Job.
- Hypothesis H_from_arrival_sequence: arrives_in arr_seq j.
- Hypothesis H_job_of_task: job_task j = tsk.
-
- (* ...the service received by job j at any time t' after the response time is 0. *)
- Lemma service_after_task_rt_zero :
- forall t',
- t' >= job_arrival j + R ->
- service_at sched j t' = 0.
- Proof.
- intros t' LE.
- apply service_after_job_rt_zero with (R := R); last by done.
- by apply response_time_bound.
- Qed.
-
- (* The same applies for the cumulative service of job j. *)
- Lemma cumulative_service_after_task_rt_zero :
- forall t' t'',
- t' >= job_arrival j + R ->
- \sum_(t' <= t < t'') service_at sched j t = 0.
- Proof.
- by ins; apply cumulative_service_after_job_rt_zero with (R := R);
- first by apply response_time_bound.
- Qed.
-
- End AllJobs.
-
- End BasicLemmas.
-
-End ResponseTime.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/schedulability.v b/classic/model/schedule/uni/schedulability.v
deleted file mode 100644
index b25f63fa526fc2618672877ef6e9a394df113b88..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/schedulability.v
+++ /dev/null
@@ -1,123 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.response_time.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module Schedulability.
-
- Import Job SporadicTaskset ArrivalSequence UniprocessorSchedule ResponseTime.
-
- (* In this section, we define the notion of deadline miss. *)
- Section DeadlineMisses.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_deadline: Job -> time.
-
- Context {Task: eqType}.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_completed_by := completed_by job_cost sched.
- Let response_time_bounded_by :=
- is_response_time_bound_of_task job_arrival job_cost job_task arr_seq sched.
-
- Section Definitions.
-
- (* In this section, we define the notion of deadline miss for a job. *)
- Section JobLevel.
-
- (* We say that a job j...*)
- Variable j: Job.
-
- (* ...misses no deadline if it completes by its absolute deadline.*)
- Definition job_misses_no_deadline :=
- job_completed_by j (job_arrival j + job_deadline j).
-
- End JobLevel.
-
- (* Next, we define the notion of deadline miss for a task. *)
- Section TaskLevel.
-
- (* We say that a task tsk... *)
- Variable tsk: Task.
-
- (* ...misses no deadline if all of its jobs complete by their absolute deadline. *)
- Definition task_misses_no_deadline :=
- forall j,
- arrives_in arr_seq j ->
- job_task j = tsk ->
- job_misses_no_deadline j.
-
- End TaskLevel.
-
- (* Next, we define the notion of deadline miss for a task set. *)
- Section TaskSetLevel.
-
- (* We say that a task set ts... *)
- Variable ts: seq Task.
-
- (* ...misses no deadline if all of its tasks do not miss any deadlines. *)
- Definition taskset_misses_no_deadline :=
- forall tsk,
- tsk \in ts ->
- task_misses_no_deadline tsk.
-
- End TaskSetLevel.
-
- End Definitions.
-
- (* In this section, we prove some lemmas related to schedulability. *)
- Section Lemmas.
-
- Variable task_cost: Task -> time.
- Variable task_deadline: Task -> time.
-
- (* First, we infer schedulability from the response-time bounds of a task. *)
- Section ResponseTimeIsBounded.
-
- (* Assume that all jobs in the arrival sequence have the same deadline
- as their tasks. *)
- Hypothesis H_job_deadline_eq_task_deadline:
- forall j,
- arrives_in arr_seq j ->
- job_deadline_eq_task_deadline task_deadline job_deadline job_task j.
-
- (* Also assume that jobs don't execute after completion. *)
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
-
- (* Let tsk be any task.*)
- Variable tsk: Task.
-
- (* If tsk has response-time bound R that is no larger than its deadline, ... *)
- Variable R: time.
- Hypothesis H_R_le_deadline: R <= task_deadline tsk.
- Hypothesis H_response_time_bounded: response_time_bounded_by tsk R.
-
- (* ...then tsk misses no deadline. *)
- Lemma task_completes_before_deadline:
- task_misses_no_deadline tsk.
- Proof.
- unfold valid_sporadic_job, valid_realtime_job in *.
- intros j ARRj JOBtsk.
- apply completion_monotonic with (t := job_arrival j + R);
- last by apply H_response_time_bounded.
- rewrite leq_add2l.
- apply: (leq_trans H_R_le_deadline).
- by rewrite H_job_deadline_eq_task_deadline // -JOBtsk leqnn.
- Qed.
-
- End ResponseTimeIsBounded.
-
- End Lemmas.
-
- End DeadlineMisses.
-
-End Schedulability.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/schedule.v b/classic/model/schedule/uni/schedule.v
deleted file mode 100644
index 6966f04c06f9dea25bc711486658c5816ad351d8..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/schedule.v
+++ /dev/null
@@ -1,644 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module UniprocessorSchedule.
-
- Import SporadicTaskset.
- Export Time ArrivalSequence.
-
- Section Schedule.
-
- (* We begin by defining a uniprocessor schedule. *)
- Section ScheduleDef.
-
- (* Consider any job type. *)
- Variable Job: eqType.
-
- (* We define a uniprocessor schedule by mapping each point in time to either
- Some job that is scheduled or None, if the processor is idle. *)
- Definition schedule := time -> option Job.
-
- End ScheduleDef.
-
- (* In this section, we define properties of a schedule. *)
- Section ScheduleProperties.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* Let's define properties of the jobs to be scheduled. *)
- Section JobProperties.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* First, we define whether a job j is scheduled at time t, ... *)
- Definition scheduled_at (t: time) := sched t == Some j.
-
- (* ...which also yields the instantaneous service received by
- job j at time t (i.e., either 0 or 1). *)
- Definition service_at (t: time) : time := scheduled_at t.
-
- (* Based on the notion of instantaneous service, we define the
- cumulative service received by job j during any interval [t1, t2). *)
- Definition service_during (t1 t2: time) :=
- \sum_(t1 <= t < t2) service_at t.
-
- (* Using the previous definition, we define the cumulative service
- received by job j up to time t, i.e., during interval [0, t). *)
- Definition service (t: time) := service_during 0 t.
-
- (* Next, we say that job j has completed by time t if it received enough
- service in the interval [0, t). *)
- Definition completed_by (t: time) := job_cost j <= service t.
-
- (* Job j is pending at time t iff it has arrived but has not yet completed. *)
- Definition pending (t: time) := has_arrived job_arrival j t && ~~ completed_by t.
-
- (* Job j is pending earlier and at time t iff it has arrived before time t
- and has not been completed yet. *)
- Definition pending_earlier_and_at (t: time) :=
- arrived_before job_arrival j t && ~~ completed_by t.
-
- (* Job j is backlogged at time t iff it is pending and not scheduled. *)
- Definition backlogged (t: time) := pending t && ~~ scheduled_at t.
-
- End JobProperties.
-
- (* In this section, we define some properties of the processor. *)
- Section ProcessorProperties.
-
- (* We say that the processor is idle at time t iff there is no job being scheduled. *)
- Definition is_idle (t: time) := sched t == None.
-
- (* In addition, we define the total service performed by the processor in any interval
- [t1, t2) as the cumulative time in which the processor is not idle. *)
- Definition total_service_during (t1 t2: time) :=
- \sum_(t1 <= t < t2) ~~ is_idle t.
-
- (* Using the previous definition, we also define the total service up to time t2.*)
- Definition total_service (t2: time) := total_service_during 0 t2.
-
- End ProcessorProperties.
-
- Section PropertyOfSequentiality.
-
- Context {Task: eqType}.
- Variable job_task: Job -> Task.
-
- (* We say that two jobs j1 and j2 are from the same task, if job_task j1 is equal to job_task j2. *)
- Let same_task j1 j2 := job_task j1 == job_task j2.
-
- (* We say that the jobs are sequential if they are executed in the order they arrived. *)
- Definition sequential_jobs :=
- forall j1 j2 t,
- same_task j1 j2 ->
- job_arrival j1 < job_arrival j2 ->
- scheduled_at j2 t ->
- completed_by j1 t.
-
- (* Assume the hypothesis about sequential jobs holds. *)
- Hypothesis H_sequential_jobs: sequential_jobs.
-
- (* A simple corollary of this hypothesis is that the scheduler
- executes a job with the earliest arrival time. *)
- Corollary scheduler_executes_job_with_earliest_arrival:
- forall j1 j2 t,
- same_task j1 j2 ->
- ~~ completed_by j2 t ->
- scheduled_at j1 t ->
- job_arrival j1 <= job_arrival j2.
- Proof.
- intros ? ? t TSK NCOMPL SCHED.
- rewrite /same_task eq_sym in TSK.
- have SEQ := H_sequential_jobs j2 j1 t TSK.
- rewrite leqNgt; apply/negP; intros ARR.
- move: NCOMPL => /negP NCOMPL; apply: NCOMPL.
- by apply SEQ.
- Qed.
-
- End PropertyOfSequentiality.
-
- End ScheduleProperties.
-
- (* In this section, we define properties of valid schedules. *)
- Section ValidSchedules.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* We define whether jobs come from some arrival sequence... *)
- Definition jobs_come_from_arrival_sequence (arr_seq: arrival_sequence Job) :=
- forall j t, scheduled_at sched j t -> arrives_in arr_seq j.
-
- (* ..., whether a job can only be scheduled if it has arrived ... *)
- Definition jobs_must_arrive_to_execute :=
- forall j t, scheduled_at sched j t -> has_arrived job_arrival j t.
-
- (* ... and whether a job cannot be scheduled after it completes. *)
- Definition completed_jobs_dont_execute :=
- forall j t, service sched j t <= job_cost j.
-
- End ValidSchedules.
-
- (* In this section, we prove some basic lemmas about schedules. *)
- Section Lemmas.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* Let's define the remaining cost of job j as the amount of service
- that has to be received for its completion. *)
- Definition remaining_cost j t :=
- job_cost j - service sched j t.
-
- (* Let's begin with lemmas about service. *)
- Section Service.
-
- (* Let j be any job that is to be scheduled. *)
- Variable j: Job.
-
- (* First, we prove that the instantaneous service cannot be greater than 1, ... *)
- Lemma service_at_most_one:
- forall t, service_at sched j t <= 1.
- Proof.
- by intros t; apply leq_b1.
- Qed.
-
- (* ...which implies that the cumulative service received by job j in any
- interval of length delta is at most delta. *)
- Lemma cumulative_service_le_delta:
- forall t delta,
- service_during sched j t (t + delta) <= delta.
- Proof.
- unfold service_during; intros t delta.
- apply leq_trans with (n := \sum_(t <= t0 < t + delta) 1);
- last by simpl_sum_const; rewrite addKn leqnn.
- by apply leq_sum; intros t0 _; apply leq_b1.
- Qed.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs:
- completed_jobs_dont_execute job_cost sched.
-
- (* Note that if a job scheduled at some time t then remaining
- cost at this point is positive *)
- Lemma scheduled_implies_positive_remaining_cost:
- forall t,
- scheduled_at sched j t ->
- remaining_cost j t > 0.
- Proof.
- intros.
- rewrite subn_gt0 /service /service_during.
- apply leq_trans with (\sum_(0 <= t0 < t.+1) service_at sched j t0);
- last by rewrite H_completed_jobs.
- by rewrite big_nat_recr //= -addn1 leq_add2l lt0b.
- Qed.
-
- End Service.
-
- (* Next, we prove properties related to job completion. *)
- Section Completion.
-
- (* Let j be any job that is to be scheduled. *)
- Variable j: Job.
-
- (* We prove that after job j completes, it remains completed. *)
- Lemma completion_monotonic:
- forall t t',
- t <= t' ->
- completed_by job_cost sched j t ->
- completed_by job_cost sched j t'.
- Proof.
- unfold completed_by; move => t t' LE COMPt.
- apply leq_trans with (service sched j t); first by done.
- by rewrite /service /service_during [in X in _ <= X](@big_cat_nat _ _ _ t) //= leq_addr.
- Qed.
-
- (* Assume that completed jobs do not execute. *)
- Hypothesis H_completed_jobs:
- completed_jobs_dont_execute job_cost sched.
-
- (* We also prove that a completed job cannot be scheduled. *)
- Lemma completed_implies_not_scheduled :
- forall t,
- completed_by job_cost sched j t ->
- ~~ scheduled_at sched j t.
- Proof.
- rename H_completed_jobs into COMP.
- unfold completed_jobs_dont_execute in *.
- intros t COMPLETED.
- apply/negP; red; intro SCHED.
- have BUG := COMP j t.+1.
- rewrite leqNgt in BUG; move: BUG => /negP BUG; apply: BUG.
- unfold service, service_during; rewrite big_nat_recr // /= -addn1.
- apply leq_add; first by done.
- by rewrite /service_at SCHED.
- Qed.
-
- (* ... and that a scheduled job cannot be completed. *)
- Lemma scheduled_implies_not_completed:
- forall t,
- scheduled_at sched j t ->
- ~~ completed_by job_cost sched j t.
- Proof.
- move => t SCHED.
- rewrite /completed_by; apply/negP; intros CONTR.
- apply completed_implies_not_scheduled in CONTR.
- by move: CONTR => /negP CONTR; apply: CONTR.
- Qed.
-
- (* Next, we show that the service received by job j in any interval
- is no larger than its cost. *)
- Lemma cumulative_service_le_job_cost :
- forall t t',
- service_during sched j t t' <= job_cost j.
- Proof.
- unfold service_during; rename H_completed_jobs into COMP; red in COMP; ins.
- destruct (t > t') eqn:GT.
- by rewrite big_geq // -ltnS; apply ltn_trans with (n := t); ins.
- apply leq_trans with
- (n := \sum_(0 <= t0 < t') service_at sched j t0);
- last by apply COMP.
- rewrite -> big_cat_nat with (m := 0) (n := t);
- [by apply leq_addl | by ins | by rewrite leqNgt negbT //].
- Qed.
-
- (* If a job isn't complete at time t,
- it can't be completed at time (t + remaining_cost j t - 1). *)
- Lemma job_doesnt_complete_before_remaining_cost:
- forall t,
- ~~ completed_by job_cost sched j t ->
- ~~ completed_by job_cost sched j (t + remaining_cost j t - 1).
- Proof.
- intros t GT0.
- unfold remaining_cost, completed_by in *.
- have COSTGT0: job_cost j > 0.
- { apply contraT; rewrite -eqn0Ngt.
- move => /eqP EQ0.
- by rewrite EQ0 -ltnNge ltn0 in GT0.
- }
- rewrite -ltnNge.
- rewrite /service /service_during.
- set delta := (X in (t + X - 1)).
- have NONZERO: delta > 0.
- { rewrite -ltnNge in GT0.
- by rewrite /delta subn_gt0.
- }
- rewrite (@big_cat_nat _ _ _ t) //= ?leq_addr //;
- last by rewrite -addnBA; [rewrite leq_addr | done].
- apply leq_ltn_trans with (n := service sched j t + \sum_(t <= i < t + delta - 1) 1);
- first by rewrite leq_add2l; apply leq_sum; intros; apply leq_b1.
- simpl_sum_const.
- rewrite -addnBA // addKn.
- rewrite addnBA // /delta.
- rewrite subnKC; last by done.
- rewrite subn1 -(ltn_add2r 1) addn1.
- by rewrite prednK // addn1 ltnSn.
- Qed.
-
- (* In this section, we prove that the job with a positive
- cost must be scheduled to be completed. *)
- Section JobMustBeScheduled.
-
- (* We assume that job j has positive cost, from which we can
- infer that there always is a time in which j is pending. *)
- Hypothesis H_positive_cost: job_cost j > 0.
-
- (* Assume that jobs must arrive to execute. *)
- Hypothesis H_jobs_must_arrive:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Then, we prove that the job with a positive cost
- must be scheduled to be completed. *)
- Lemma completed_implies_scheduled_before:
- forall t,
- completed_by job_cost sched j t ->
- exists t',
- job_arrival j <= t' < t
- /\ scheduled_at sched j t'.
- Proof.
- intros t COMPL.
- induction t.
- { exfalso.
- unfold completed_by, service, service_during in COMPL.
- move: COMPL; rewrite big_geq //; move => /eqP H0.
- by destruct (job_cost j).
- }
- destruct (completed_by job_cost sched j t) eqn:COMPLatt.
- { feed IHt; first by done.
- move: IHt => [t' [JA SCHED]].
- exists t'. split; first apply/andP; first split.
- - by apply H_jobs_must_arrive in SCHED.
- - move: JA => /andP [_ LT]. by apply leq_trans with t.
- - by done.
- }
- { apply negbT in COMPLatt.
- unfold completed_by in *.
- rewrite -ltnNge in COMPLatt.
- unfold service, service_during in COMPL.
- rewrite big_nat_recr //= in COMPL.
- have SCHED: scheduled_at sched j t.
- { rewrite {2}/service_at in COMPL.
- destruct (scheduled_at sched j t); first by done.
- rewrite addn0 in COMPL.
- by exfalso; move: COMPL; rewrite leqNgt; move => /negP C; apply: C.
- }
- exists t. split; first apply/andP; first split; try done.
- by apply H_jobs_must_arrive in SCHED.
- }
- Qed.
-
- End JobMustBeScheduled.
-
- End Completion.
-
- (* In this section we prove properties related to job arrivals. *)
- Section Arrival.
-
- (* Assume that jobs must arrive to execute. *)
- Hypothesis H_jobs_must_arrive:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Let j be any job that is to be scheduled. *)
- Variable j: Job.
-
- (* First, we show that job j does not receive service at any time t
- prior to its arrival. *)
- Lemma service_before_job_arrival_zero :
- forall t,
- t < job_arrival j ->
- service_at sched j t = 0.
- Proof.
- rename H_jobs_must_arrive into ARR; red in ARR; intros t LT.
- specialize (ARR j t).
- apply contra with (c := scheduled_at sched j t)
- (b := has_arrived job_arrival j t) in ARR;
- last by rewrite -ltnNge.
- by apply/eqP; rewrite eqb0.
- Qed.
-
- (* Note that the same property applies to the cumulative service. *)
- Lemma cumulative_service_before_job_arrival_zero :
- forall t1 t2,
- t2 <= job_arrival j ->
- \sum_(t1 <= i < t2) service_at sched j i = 0.
- Proof.
- intros t1 t2 LE; apply/eqP; rewrite -leqn0.
- apply leq_trans with (n := \sum_(t1 <= i < t2) 0);
- last by rewrite big_const_nat iter_addn mul0n addn0.
- rewrite big_nat_cond [\sum_(_ <= _ < _) 0]big_nat_cond.
- apply leq_sum; intro i; rewrite andbT; move => /andP LTi; des.
- rewrite service_before_job_arrival_zero; first by ins.
- by apply leq_trans with (n := t2); ins.
- Qed.
-
- (* Hence, one can ignore the service received by a job before its arrival time. *)
- Lemma ignore_service_before_arrival:
- forall t1 t2,
- t1 <= job_arrival j ->
- t2 >= job_arrival j ->
- \sum_(t1 <= t < t2) service_at sched j t =
- \sum_(job_arrival j <= t < t2) service_at sched j t.
- Proof.
- intros t1 t2 LE1 GE2.
- rewrite -> big_cat_nat with (n := job_arrival j);
- [| by done | by done].
- by rewrite /= cumulative_service_before_job_arrival_zero; [rewrite add0n | apply leqnn].
- Qed.
-
- End Arrival.
-
- (* In this section, we prove properties about pending jobs. *)
- Section Pending.
-
- (* Assume that jobs must arrive to execute... *)
- Hypothesis H_jobs_must_arrive:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* ...and that completed jobs do not execute. *)
- Hypothesis H_completed_jobs:
- completed_jobs_dont_execute job_cost sched.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* We show that if job j is scheduled, then it must be pending. *)
- Lemma scheduled_implies_pending:
- forall t,
- scheduled_at sched j t ->
- pending job_arrival job_cost sched j t.
- Proof.
- rename H_jobs_must_arrive into ARRIVE,
- H_completed_jobs into COMP.
- unfold jobs_must_arrive_to_execute, completed_jobs_dont_execute in *.
- intros t SCHED.
- unfold pending; apply/andP; split; first by apply ARRIVE.
- apply/negP; unfold not; intro COMPLETED.
- have BUG := COMP j t.+1.
- rewrite leqNgt in BUG; move: BUG => /negP BUG; apply BUG.
- unfold service, service_during; rewrite -addn1 big_nat_recr // /=.
- apply leq_add; first by done.
- by rewrite /service_at SCHED.
- Qed.
-
- (* Consider any arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Then we prove that the job is pending at the moment of its arrival. *)
- Lemma job_pending_at_arrival:
- arrives_in arr_seq j ->
- job_cost j > 0 ->
- pending job_arrival job_cost sched j (job_arrival j).
- Proof.
- intros ARR POS.
- apply/andP; split; first by rewrite /has_arrived.
- rewrite -ltnNge.
- rewrite /service /service_during (ignore_service_before_arrival); try done.
- by rewrite big_geq; eauto 2.
- Qed.
-
- End Pending.
-
- (* In this section we show that the schedule is unique at any point. *)
- Section OnlyOneJobScheduled.
-
- (* Let j1 and j2 be any jobs. *)
- Variable j1 j2: Job.
-
- (* At any time t, if both j1 and j2 are scheduled, then they must be the same job. *)
- Lemma only_one_job_scheduled:
- forall t,
- scheduled_at sched j1 t ->
- scheduled_at sched j2 t ->
- j1 = j2.
- Proof.
- move => t /eqP SCHED1 /eqP SCHED2.
- by rewrite SCHED1 in SCHED2; inversion SCHED2.
- Qed.
-
- End OnlyOneJobScheduled.
-
- Section ServiceIsUnitGrowthFunction.
-
- (* First, we show that the service received by any job j
- is a unit growth funciton. *)
- Lemma service_is_unit_growth_function:
- forall j,
- unit_growth_function (service sched j).
- Proof.
- unfold unit_growth_function, service, service_during; intros j t.
- rewrite addn1 big_nat_recr //=.
- by apply leq_add; last by apply leq_b1.
- Qed.
-
- (* Next, consider any job j at any time t... *)
- Variable j: Job.
- Variable t: time.
-
- (* ...and let s0 be any value less than the service received
- by job j by time t. *)
- Variable s0: time.
- Hypothesis H_less_than_s: s0 < service sched j t.
-
- (* Then, we show that there exists an earlier time t0 where
- job j had s0 units of service. *)
- Corollary exists_intermediate_service:
- exists t0,
- t0 < t /\
- service sched j t0 = s0.
- Proof.
- feed (exists_intermediate_point (service sched j));
- [by apply service_is_unit_growth_function | intros EX].
- feed (EX 0 t); first by done.
- feed (EX s0);
- first by rewrite /service /service_during big_geq //.
- by move: EX => /= [x_mid EX]; exists x_mid.
- Qed.
-
- End ServiceIsUnitGrowthFunction.
-
- Section ScheduledAtEarlierTime.
-
- (* Next, we show that if the service is positive,
- then the job is scheduled at some earlier time. *)
- Lemma scheduled_at_earlier_time:
- forall j t,
- service sched j t > 0 ->
- exists t0,
- t0 < t /\
- scheduled_at sched j t0.
- Proof.
- intros j t GT.
- case (boolP ([exists t0:'I_t, scheduled_at sched j t0])) => [EX | ALL];
- first by move: EX => /existsP [t0 SCHED]; exists t0; split.
- rewrite negb_exists in ALL; move: ALL => /forallP ALL.
- rewrite /service /service_during big_nat_cond big1 in GT; first by rewrite ltnn in GT.
- move => i => /andP [/= LT _].
- by apply/eqP; rewrite eqb0; apply (ALL (Ordinal LT)).
- Qed.
-
- End ScheduledAtEarlierTime.
-
- Section ServiceNotZero.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* Assume that the service received by j during [t1, t2) is not zero. *)
- Variable t1 t2: time.
- Hypothesis H_service_not_zero: service_during sched j t1 t2 > 0.
-
- (* Then, there must be a time t where job j is scheduled. *)
- Lemma cumulative_service_implies_scheduled :
- exists t,
- t1 <= t < t2 /\
- scheduled_at sched j t.
- Proof.
- rename H_service_not_zero into NONZERO.
- case (boolP([exists t: 'I_t2,
- (t >= t1) && (service_at sched j t != 0)])) => [EX | ALL].
- {
- move: EX => /existsP [x /andP [GE SERV]].
- rewrite eqb0 negbK in SERV.
- exists x; split; last by done.
- by apply/andP; split; last by apply ltn_ord.
- }
- {
- rewrite negb_exists in ALL; move: ALL => /forallP ALL.
- rewrite /service_during big_nat_cond in NONZERO.
- rewrite big1 ?ltn0 // in NONZERO.
- intros i; rewrite andbT; move => /andP [GT LT].
- specialize (ALL (Ordinal LT)); simpl in ALL.
- by rewrite GT andTb negbK in ALL; apply/eqP.
- }
- Qed.
-
- End ServiceNotZero.
-
- (* In this section, we prove some lemmas about time instants
- with same service. *)
- Section TimesWithSameService.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* Consider any time instants t1 and t2... *)
- Variable t1 t2: time.
-
- (* ...where job j has received the same amount of service. *)
- Hypothesis H_same_service: service sched j t1 = service sched j t2.
-
- (* First, we show that job j is scheduled at some point t < t1 iff
- j is scheduled at some point t' < t2. *)
- Lemma same_service_implies_scheduled_at_earlier_times:
- [exists t: 'I_t1, scheduled_at sched j t] =
- [exists t': 'I_t2, scheduled_at sched j t'].
- Proof.
- rename H_same_service into SERV.
- move: t1 t2 SERV; clear t1 t2; move => t t'.
- wlog: t t' / (t <= t') => [EX SAME | LE SERV].
- by case/orP: (leq_total t t'); ins; [|symmetry]; apply EX.
- apply/idP/idP; move => /existsP [t0 SCHED].
- {
- have LT0: t0 < t' by apply: (leq_trans _ LE).
- by apply/existsP; exists (Ordinal LT0).
- }
- {
- destruct (ltnP t0 t) as [LT01 | LE10];
- first by apply/existsP; exists (Ordinal LT01).
- exfalso; move: SERV => /eqP SERV.
- rewrite -[_ == _]negbK in SERV.
- move: SERV => /negP BUG; apply BUG; clear BUG.
- rewrite neq_ltn; apply/orP; left.
- rewrite /service /service_during.
- rewrite -> big_cat_nat with (n := t0) (p := t');
- [simpl | by done | by apply ltnW].
- rewrite -addn1; apply leq_add; first by apply extend_sum.
- destruct t0 as [t0 LT]; simpl in *.
- destruct t'; first by rewrite ltn0 in LT.
- rewrite big_nat_recl; last by done.
- by rewrite /service_at SCHED.
- }
- Qed.
-
- End TimesWithSameService.
-
- End Lemmas.
-
- End Schedule.
-
-End UniprocessorSchedule.
diff --git a/classic/model/schedule/uni/schedule_of_task.v b/classic/model/schedule/uni/schedule_of_task.v
deleted file mode 100644
index dc2db2b7a6a4648751f99c76b8ca338daa604bf5..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/schedule_of_task.v
+++ /dev/null
@@ -1,48 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module ScheduleOfTask.
-
- Export SporadicTaskset UniprocessorSchedule.
-
- (* In this section, we define properties about schedules of tasks. *)
- Section ScheduleProperties.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- Section TaskProperties.
-
- (* Let tsk be any task. *)
- Variable tsk: Task.
-
- (* Next we define whether a task is scheduled at time t, ... *)
- Definition task_scheduled_at (t: time) :=
- if sched t is Some j then
- job_task j == tsk
- else false.
-
- (* ...which also corresponds to the instantaneous service it receives. *)
- Definition task_service_at (t: time) : time := task_scheduled_at t.
-
- (* Based on the notion of instantaneous service, we define the
- cumulative service received by tsk during any interval [t1, t2)... *)
- Definition task_service_during (t1 t2: time) :=
- \sum_(t1 <= t < t2) task_service_at t.
-
- (* ...and the cumulative service received by tsk up to time t2,
- i.e., in the interval [0, t2). *)
- Definition task_service (t2: time) := task_service_during 0 t2.
-
- End TaskProperties.
-
- End ScheduleProperties.
-
-End ScheduleOfTask.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/service.v b/classic/model/schedule/uni/service.v
deleted file mode 100644
index 7117022f299a13bdca0bd121ff79da33113f0222..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/service.v
+++ /dev/null
@@ -1,582 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.schedule prosa.classic.model.schedule.uni.workload.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module Service.
-
- Import UniprocessorSchedule Priority Workload.
-
- (* In this section, we define the more general notion of service received by sets of jobs. *)
- Section ServiceOverSets.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* Let jobs denote any (finite) set of jobs. *)
- Variable jobs: seq Job.
-
- Section Definitions.
-
- (* First, we define the service received by a generic set of jobs. *)
- Section ServiceOfJobs.
-
- (* Then, given any predicate over jobs, ...*)
- Variable P: Job -> bool.
-
- (* ...we define the cumulative service received during [t1, t2)
- by the jobs that satisfy this predicate. *)
- Definition service_of_jobs (t1 t2: time) :=
- \sum_(j <- jobs | P j) service_during sched j t1 t2.
-
- End ServiceOfJobs.
-
- (* Next, we define the service received by tasks with higher-or-equal
- priority under a given FP policy. *)
- Section PerTaskPriority.
-
- Context {Task: eqType}.
- Variable job_task: Job -> Task.
-
- (* Consider any FP policy. *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: Task.
-
- (* Based on the definition of jobs of higher or equal priority (with respect to tsk), ... *)
- Let of_higher_or_equal_priority j := higher_eq_priority (job_task j) tsk.
-
- (* ...we define the service received during [t1, t2) by jobs of higher or equal priority. *)
- Definition service_of_higher_or_equal_priority_tasks (t1 t2: time) :=
- service_of_jobs of_higher_or_equal_priority t1 t2.
-
- End PerTaskPriority.
-
- (* Next, we define the service received by jobs with higher or equal priority
- under JLFP policies. *)
- Section PerJobPriority.
-
- (* Consider any JLDP policy. *)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* Let j be the job to be analyzed. *)
- Variable j: Job.
-
- (* Based on the definition of jobs of higher or equal priority, ... *)
- Let of_higher_or_equal_priority j_hp := higher_eq_priority j_hp j.
-
- (* ...we define the service received during [t1, t2) by jobs of higher or equal priority. *)
- Definition service_of_higher_or_equal_priority_jobs (t1 t2: time) :=
- service_of_jobs of_higher_or_equal_priority t1 t2.
-
- End PerJobPriority.
-
- End Definitions.
-
- Section Lemmas.
-
- (* Let P be any predicate over jobs. *)
- Variable P: Job -> bool.
-
- (* In this section, we prove that the service received by any set of jobs
- is upper-bounded by the corresponding workload. *)
- Section ServiceBoundedByWorkload.
-
- (* Recall the definition of workload. *)
- Let workload_of := workload_of_jobs job_cost.
-
- (* Assume that jobs do not execute after completion.*)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Then, we prove that the service received by those jobs is no larger than their workload. *)
- Lemma service_of_jobs_le_workload:
- forall t1 t2,
- service_of_jobs P t1 t2 <= workload_of jobs P.
- Proof.
- intros t1 t2.
- apply leq_sum; intros j _.
- by apply cumulative_service_le_job_cost.
- Qed.
-
- End ServiceBoundedByWorkload.
-
- (* In this section, we prove that the service received by any set of jobs
- is upper-bounded by the corresponding interval length. *)
- Section ServiceBoundedByIntervalLength.
-
- (* Assume that jobs do not execute after completion.*)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the sequence of jobs is a set. *)
- Hypothesis H_no_duplicate_jobs: uniq jobs.
-
- (* Then, we prove that the service received by those jobs is no larger than their workload. *)
- Lemma service_of_jobs_le_delta:
- forall t1 t2,
- service_of_jobs P t1 t2 <= t2 - t1.
- Proof.
- unfold service_of_jobs; intros t1 t2.
- rewrite exchange_big /=.
- apply leq_trans with (n := \sum_(t1 <= t < t2) 1); last by simpl_sum_const.
- apply leq_sum; intros t _; rewrite /service_at.
- case (boolP (has (fun j => P j && scheduled_at sched j t) jobs)) => [HAS | ALL].
- {
- move: HAS => /hasP [j0 IN0 /andP [PRED0 SCHED0]].
- rewrite big_mkcond (bigD1_seq j0) //= PRED0 SCHED0 big1 //.
- intros j1 NEQ; case: ifP => PRED1; last by done.
- apply/eqP; rewrite eqb0; apply/negP; intro SCHED1.
- apply only_one_job_scheduled with (j2 := j1) in SCHED0; last by done.
- by rewrite SCHED0 eq_refl in NEQ.
- }
- {
- rewrite -all_predC in ALL; move: ALL => /allP ALL.
- rewrite big_seq_cond big1 //.
- move => j0 /andP [IN0 PRED0]; apply/eqP; rewrite eqb0.
- by specialize (ALL j0 IN0); rewrite /= PRED0 /= in ALL.
- }
- Qed.
-
- End ServiceBoundedByIntervalLength.
-
- End Lemmas.
-
- End ServiceOverSets.
-
- (* In this section, we introduce some auxiliary definitions about the service. *)
- Section ExtraDefinitions.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: Task.
-
- (* Recall the notion of a job of task tsk. *)
- Let of_task_tsk j := job_task j == tsk.
-
- (* We define the cumulative task service received by the jobs from the task
- that arrives in interval [ta1, ta2) within time interval [t1, t2). *)
- Definition task_service_of_jobs_received_in ta1 ta2 t1 t2 :=
- service_of_jobs sched (jobs_arrived_between arr_seq ta1 ta2) of_task_tsk t1 t2.
-
- (* For simplicity, let's define a shorter version of task service
- for jobs that arrive and execute in the same interval [t1, t2). *)
- Definition task_service_between t1 t2 := task_service_of_jobs_received_in t1 t2 t1 t2.
-
- End ExtraDefinitions.
-
- (* In this section, we prove some auxiliary lemmas about the service. *)
- Section ExtraLemmas.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any arrival sequence with consistent, non-duplicate arrivals. *)
- Variable arr_seq: arrival_sequence Job.
- Hypothesis H_arrival_times_are_consistent: arrival_times_are_consistent job_arrival arr_seq.
- Hypothesis H_arr_seq_is_a_set: arrival_sequence_is_a_set arr_seq.
-
- (* Next, consider any uniprocessor schedule of this arrival sequence...*)
- Variable sched: schedule Job.
-
- (* ... where jobs do not execute before their arrival or after completion. *)
- Hypothesis H_jobs_must_arrive_to_execute: jobs_must_arrive_to_execute job_arrival sched.
- Hypothesis H_completed_jobs_dont_execute: completed_jobs_dont_execute job_cost sched.
- Hypothesis H_jobs_come_from_arrival_sequence: jobs_come_from_arrival_sequence sched arr_seq.
-
- (* For simplicity, let's define some local names. *)
- Let job_completed_by := completed_by job_cost sched.
- Let arrivals_between := jobs_arrived_between arr_seq.
-
- (* First, we prove that service is monotonic. *)
- Lemma service_monotonic:
- forall j t1 t2,
- t1 <= t2 ->
- service sched j t1 <= service sched j t2.
- Proof.
- intros.
- rewrite /service /service_during [X in _ <= X](@big_cat_nat _ _ _ t1) //.
- by rewrite leq_addr.
- Qed.
-
- (* Next, we prove that service during can be splited into two parts. *)
- Lemma service_during_cat:
- forall j t t1 t2,
- t1 <= t <= t2 ->
- service_during sched j t1 t2 =
- service_during sched j t1 t + service_during sched j t t2.
- Proof.
- move => j' t t1 t2 /andP [GE LE].
- by rewrite /service_during (@ big_cat_nat _ _ _ t).
- Qed.
-
- (* We prove that if in some time interval [t1,t2) a job j receives k units of service, then
- there exists time instant t in [t1,t2) such that job is scheduled at time t and
- service of job j within interval [t1,t) is equal to k. *)
- Lemma incremental_service_during:
- forall j t1 t2 k,
- service_during sched j t1 t2 > k ->
- exists t, t1 <= t < t2 /\ scheduled_at sched j t /\ service_during sched j t1 t = k.
- Proof.
- intros j t1 t2 k SERV.
- have LE: t1 <= t2.
- { rewrite leqNgt; apply/negP; intros CONTR.
- apply ltnW in CONTR.
- by move: SERV; rewrite /service_during big_geq.
- }
- induction k.
- { case SCHED: (scheduled_at sched j t1).
- { exists t1; repeat split; try done.
- - apply/andP; split; first by done.
- rewrite ltnNge; apply/negP; intros CONTR.
- by move: SERV; rewrite/service_during big_geq.
- - by rewrite /service_during big_geq.
- }
- { apply negbT in SCHED.
- move: SERV; rewrite /service /service_during sum_nat_gt0 filter_predT; move => /hasP[t IN SCHEDt].
- rewrite lt0b in SCHEDt.
- rewrite mem_iota subnKC in IN; last by done.
- move: IN => /andP [IN1 IN2].
- move: (exists_first_intermediate_point
- ((fun t => scheduled_at sched j t)) t1 t IN1 SCHED SCHEDt)
- => [x [/andP [H1 H4] [H2 H3]]].
- exists x; repeat split; try done.
- - apply/andP; split; first by apply ltnW.
- by apply leq_ltn_trans with t.
- - apply/eqP; rewrite big_nat_cond big1 //.
- move => y /andP [H5 _].
- by apply/eqP; rewrite eqb0; apply H2.
- }
- }
- { feed IHk; first by apply ltn_trans with k.+1.
- move: IHk => [t [/andP [NEQ1 NEQ2] [SCHEDt SERVk]]].
- have SERVk1: service_during sched j t1 t.+1 = k.+1.
- { rewrite (service_during_cat _ t).
- rewrite SERVk -[X in _ = X]addn1. apply/eqP; rewrite eqn_add2l.
- rewrite /service_during big_nat1.
- rewrite /service_at SCHEDt. by simpl.
- by apply/andP; split.
- }
- move: SERV; rewrite (service_during_cat _ t.+1); last first.
- { by apply/andP; split; first apply leq_trans with t. }
- rewrite SERVk1 -addn1 leq_add2l; move => SERV.
- case SCHED: (scheduled_at sched j t.+1).
- { exists t.+1; repeat split; try done.
- apply/andP; split.
- - apply leq_trans with t; by done.
- - rewrite ltnNge; apply/negP; intros CONTR.
- by move: SERV; rewrite /service_during big_geq.
- }
- { apply negbT in SCHED.
- move: SERV; rewrite /service /service_during sum_nat_gt0 filter_predT; move => /hasP[x INx SCHEDx].
- rewrite lt0b in SCHEDx.
- rewrite mem_iota subnKC in INx; last by done.
- move: INx => /andP [INx1 INx2].
- move: (exists_first_intermediate_point
- ((fun t => scheduled_at sched j t)) t.+1 x INx1 SCHED SCHEDx) => [y [/andP [H1 H4] [H2 H3]]].
- exists y; repeat split; try done.
- - apply/andP; split.
- apply leq_trans with t; first by done.
- apply ltnW, ltn_trans with t.+1; by done.
- by apply leq_ltn_trans with x.
- - rewrite (@big_cat_nat _ _ _ t.+1) //=; [ | by apply leq_trans with t | by apply ltn_trans with t.+1].
- unfold service_during in SERVk1; rewrite SERVk1.
- apply/eqP.
- rewrite -{2}[k.+1]addn0 eqn_add2l.
- rewrite big_nat_cond big1 //.
- move => z /andP [H5 _].
- by apply/eqP; rewrite eqb0; apply H2.
- }
- }
- Qed.
-
- (* We prove that the overall service of jobs at each time instant is at most 1. *)
- Lemma service_of_jobs_le_1:
- forall (t1 t2 t: time) (P: Job -> bool),
- \sum_(j <- arrivals_between t1 t2 | P j) service_at sched j t <= 1.
- Proof.
- intros t1 t2 t P.
- case SCHED: (sched t) => [j | ]; simpl.
- { case ARR: (j \in arrivals_between t1 t2).
- { rewrite (big_rem j) //=; simpl.
- rewrite /service_at /scheduled_at SCHED; simpl.
- rewrite -[1]addn0 leq_add //.
- - by rewrite eq_refl; case (P j).
- - rewrite leqn0 big1_seq; first by done.
- move => j' /andP [_ ARRj'].
- apply/eqP; rewrite eqb0.
- apply/negP; intros CONTR; move: CONTR => /eqP CONTR.
- inversion CONTR; subst j'; clear CONTR.
- rewrite rem_filter in ARRj'; last first.
- eapply arrivals_uniq; eauto 2.
- move: ARRj'; rewrite mem_filter; move => /andP [/negP CONTR _].
- by apply: CONTR.
- }
- { apply leq_trans with 0; last by done.
- rewrite leqn0 big1_seq; first by done.
- move => j' /andP [_ ARRj'].
- apply/eqP; rewrite eqb0.
- rewrite /scheduled_at SCHED.
- apply/negP; intros CONTR; move: CONTR => /eqP CONTR.
- inversion CONTR; clear CONTR.
- by subst j'; rewrite ARR in ARRj'.
- }
- }
- { apply leq_trans with 0; last by done.
- rewrite leqn0 big1_seq; first by done.
- move => j' /andP [_ ARRj'].
- by rewrite /service_at /scheduled_at SCHED.
- }
- Qed.
-
- (* We prove that the overall service of jobs within
- some time interval [t, t + Δ) is at most Δ. *)
- Lemma total_service_of_jobs_le_delta:
- forall (t Δ: time) (P: Job -> bool),
- \sum_(j <- arrivals_between t (t + Δ) | P j)
- service_during sched j t (t + Δ) <= Δ.
- Proof.
- intros.
- have EQ: \sum_(t <= x < t + Δ) 1 = Δ.
- { by rewrite big_const_nat iter_addn mul1n addn0 -{2}[t]addn0 subnDl subn0. }
- rewrite -{3}EQ; clear EQ.
- rewrite exchange_big //=.
- rewrite leq_sum //.
- move => t' _.
- by apply service_of_jobs_le_1.
- Qed.
-
- (* Next we prove that total service that is lower than the
- range implies the existence of an idle time instant. *)
- Lemma low_service_implies_existence_of_idle_time :
- forall t1 t2,
- t1 <= t2 ->
- service_of_jobs sched (arrivals_between 0 t2) predT t1 t2 < t2 - t1 ->
- exists t, t1 <= t < t2 /\ is_idle sched t.
- Proof.
- intros ? ? LE SERV.
- have EX: exists δ, t2 = t1 + δ.
- { by exists (t2 - t1); rewrite subnKC // ltnW. }
- move: EX => [δ EQ]; subst t2; clear LE.
- rewrite {3}[t1 + δ]addnC -addnBA // subnn addn0 in SERV.
- rewrite /service_of_jobs exchange_big //= in SERV.
- apply sum_le_summation_range in SERV.
- move: SERV => [x [/andP [GEx LEx] L]].
- exists x; split; first by apply/andP; split.
- apply/negPn; apply/negP; intros NIDLE.
- unfold is_idle in NIDLE.
- destruct(sched x) eqn:SCHED; last by done.
- move: SCHED => /eqP SCHED; clear NIDLE.
- move: L => /eqP; rewrite sum_nat_eq0_nat filter_predT; move => /allP L.
- specialize (L s); feed L.
- { unfold arrivals_between.
- eapply arrived_between_implies_in_arrivals; eauto 2.
- apply/andP; split; first by done.
- apply H_jobs_must_arrive_to_execute in SCHED.
- by apply leq_ltn_trans with x.
- }
- by move: L; simpl; rewrite /service_at /scheduled_at SCHED eqb0; move => /eqP EQ.
- Qed.
-
- (* In this section we prove a few facts about splitting
- the total service of a set of jobs. *)
- Section ServiceCat.
-
- (* We show that the total service of jobs released in a time interval [t1,t2) during [t1,t2)
- is equal to the sum of:
- (1) the total service of jobs released in time interval [t1, t) during time [t1, t)
- (2) the total service of jobs released in time interval [t1, t) during time [t, t2)
- and (3) the total service of jobs released in time interval [t, t2) during time [t, t2). *)
- Lemma service_of_jobs_cat_scheduling_interval :
- forall P t1 t2 t,
- t1 <= t <= t2 ->
- service_of_jobs sched (arrivals_between t1 t2) P t1 t2
- = service_of_jobs sched (arrivals_between t1 t) P t1 t
- + service_of_jobs sched (arrivals_between t1 t) P t t2
- + service_of_jobs sched (arrivals_between t t2) P t t2.
- Proof.
- move => P t1 t2 t /andP [GEt LEt].
- rewrite /arrivals_between (job_arrived_between_cat _ _ t) //.
- rewrite {1}/service_of_jobs big_cat //=.
- rewrite exchange_big //= (@big_cat_nat _ _ _ t) //=;
- rewrite [in X in X + _ + _]exchange_big //= [in X in _ + X + _]exchange_big //=.
- apply/eqP; rewrite -!addnA eqn_add2l eqn_add2l.
- rewrite exchange_big //= (@big_cat_nat _ _ _ t) //= [in X in _ + X]exchange_big //=.
- rewrite -[service_of_jobs _ _ _ _ _]add0n /service_of_jobs eqn_add2r.
- rewrite big_nat_cond big1 //.
- move => x /andP [/andP [GEi LTi] _].
- rewrite big_seq_cond big1 //.
- move => s /andP [ARR Ps].
- rewrite /service_at /scheduled_at.
- apply/eqP; rewrite eqb0; apply/negP; intros SCHED.
- apply H_jobs_must_arrive_to_execute in SCHED.
- eapply in_arrivals_implies_arrived_between in ARR; eauto 2.
- move: SCHED; rewrite /has_arrived leqNgt; move => /negP CONTR; apply: CONTR.
- move: ARR => /andP [ARR1 ARR2].
- by apply leq_trans with t.
- Qed.
-
- (* We show that the total service of jobs released in a time interval [t1,t2) during [t,t2)
- is equal to the sum of:
- (1) the total service of jobs released in a time interval [t1,t) during [t,t2)
- and (2) the total service of jobs released in a time interval [t,t2) during [t,t2). *)
- Lemma service_of_jobs_cat_arrival_interval :
- forall P t1 t2 t,
- t1 <= t <= t2 ->
- service_of_jobs sched (arrivals_between t1 t2) P t t2 =
- service_of_jobs sched (arrivals_between t1 t) P t t2 +
- service_of_jobs sched (arrivals_between t t2) P t t2.
- Proof.
- move => P t1 t2 t /andP [GEt LEt].
- apply/eqP;rewrite eq_sym; apply/eqP.
- rewrite /arrivals_between [in X in _ = X](job_arrived_between_cat _ _ t) //.
- by rewrite {3}/service_of_jobs -big_cat //=.
- Qed.
-
- End ServiceCat.
-
- (* In this section, we introduce a connection between the cumulative
- service, cumulative workload, and completion of jobs. *)
- Section WorkloadServiceAndCompletion.
-
- (* Let P be an arbitrary predicate on jobs. *)
- Variable P: Job -> bool.
-
- (* Consider an arbitrary time interval [t1, t2). *)
- Variables t1 t2: time.
-
- (* Let jobs be a set of all jobs arrived during [t1, t2). *)
- Let jobs := arrivals_between t1 t2.
-
- (* Next, we consider some time instant [t_compl]. *)
- Variable t_compl: time.
-
- (* First, we prove that the fact that the workload of [jobs] is equal to the service
- of [jobs] implies that any job in [jobs] is completed by time t_compl. *)
- Lemma workload_eq_service_impl_all_jobs_have_completed:
- workload_of_jobs job_cost jobs P =
- service_of_jobs sched jobs P t1 t_compl ->
- (forall j, j \in jobs -> P j -> job_completed_by j t_compl).
- Proof.
- unfold jobs.
- intros.
- move: (H0) => ARR.
- apply (in_arrivals_implies_arrived_between job_arrival) in H0; last by done.
- move: H0 => /andP [T1 T2].
- have F1: forall a b, (a < b) || (a >= b).
- { intros.
- destruct (a < b) eqn:EQ; apply/orP.
- - by left.
- - by right; apply negbT in EQ; rewrite leqNgt.
- }
- move: (F1 t_compl t1) => /orP [LT | GT].
- { rewrite /service_of_jobs /service_during in H.
- rewrite exchange_big big_geq //= in H; last by rewrite ltnW.
- rewrite /workload_of_jobs in H.
- rewrite (big_rem j) ?H1 //= in H.
- move: H => /eqP; rewrite addn_eq0; move => /andP [CZ _].
- unfold job_completed_by, completed_by.
- by move: CZ => /eqP CZ; rewrite CZ.
- }
- { unfold workload_of_jobs, service_of_jobs in H.
- unfold job_completed_by, completed_by.
- rewrite /service /service_during (@big_cat_nat _ _ _ t1) //=.
- rewrite (cumulative_service_before_job_arrival_zero
- job_arrival sched _ j 0 t1) // add0n.
- apply: eq_leq; have /esym/eqP := H; rewrite eq_sum_leq_seq.
- { move=> /allP/(_ j) + /ltac:(apply/esym/eqP); apply.
- by rewrite mem_filter H1. }
- by intros; apply cumulative_service_le_job_cost.
- }
- Qed.
-
- (* And vice versa, the fact that any job in [jobs] is completed by time t_compl
- implies that the workload of [jobs] is equal to the service of [jobs]. *)
- Lemma all_jobs_have_completed_impl_workload_eq_service:
- (forall j, j \in jobs -> P j -> job_completed_by j t_compl) ->
- workload_of_jobs job_cost jobs P =
- service_of_jobs sched jobs P t1 t_compl.
- Proof.
- unfold jobs.
- intros.
- have F:
- forall j t,
- t <= t1 ->
- (j \in arrivals_between t1 t2) ->
- service_during sched j 0 t = 0.
- { intros j t LE ARR.
- eapply in_arrivals_implies_arrived_between in ARR; eauto 2.
- move: ARR => /andP [GE LT].
- unfold service_during.
- apply/eqP.
- rewrite big1_seq //.
- move => x /andP [_ ARR].
- eapply service_before_job_arrival_zero; eauto 2.
- move: ARR; rewrite mem_iota subn0 add0n; move => /andP [_ LTt].
- apply leq_trans with t; first by done.
- by apply leq_trans with t1.
- }
- destruct (t_compl <= t1) eqn:EQ.
- { unfold service_of_jobs. unfold service_during.
- rewrite exchange_big //=.
- rewrite big_geq; last by done.
- rewrite /workload_of_jobs big1_seq //.
- move => j /andP [Pj ARR].
- move: H (H _ ARR Pj) => _ H.
- rewrite <- F with (j := j) (t := t_compl); try done.
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- - by apply H.
- - by eauto 2.
- }
- apply/eqP; rewrite eqn_leq; apply/andP; split; first last.
- { by apply service_of_jobs_le_workload. }
- { unfold workload_of_jobs, service_of_jobs.
- rewrite big_seq_cond [X in _ <= X]big_seq_cond.
- rewrite leq_sum //.
- move => j /andP [ARR Pj].
- move: H (H _ ARR Pj) => _ H.
- rewrite -[service_during _ _ _ _ ]add0n.
- rewrite -(F j t1); try done.
- rewrite -(big_cat_nat) //=; last first.
- move: EQ =>/negP /negP; rewrite -ltnNge; move => EQ.
- by apply ltnW.
- }
- Qed.
-
- (* Using the lemmas above, we prove equivalence. *)
- Lemma all_jobs_have_completed_equiv_workload_eq_service:
- (forall j, j \in jobs -> P j -> job_completed_by j t_compl) <->
- workload_of_jobs job_cost jobs P =
- service_of_jobs sched jobs P t1 t_compl.
- Proof.
- split.
- - by apply all_jobs_have_completed_impl_workload_eq_service.
- - by apply workload_eq_service_impl_all_jobs_have_completed.
- Qed.
-
- End WorkloadServiceAndCompletion.
-
- End ExtraLemmas.
-
-End Service.
diff --git a/classic/model/schedule/uni/susp/build_suspension_table.v b/classic/model/schedule/uni/susp/build_suspension_table.v
deleted file mode 100644
index d7b85ed8a593a2af36a0def266a28144c2215f36..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/susp/build_suspension_table.v
+++ /dev/null
@@ -1,266 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.suspension.
-Require Import prosa.classic.model.schedule.uni.susp.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq bigop fintype.
-
-(* In this file, we take any predicate that defines whether a job
- is suspended at time t and build a table of suspension durations
- that is valid up to time t. *)
-Module SuspensionTableConstruction.
-
- Import ScheduleWithSuspensions Suspension.
-
- Section BuildingSuspensionTable.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (** Basic Setup & Setting *)
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any schedule of this arrival sequence... *)
- Variable sched: schedule Job.
-
- (* ...in which jobs must arrive to execute. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Recall the instant following the last execution of a job, which
- indicates the start of the latest suspension interval. *)
- Let start_of_latest_suspension :=
- time_after_last_execution job_arrival sched.
-
- (* For simplicity, let's also define some local names. *)
- Let job_completed_by := completed_by job_cost sched.
-
- (** Construction of Suspension Table *)
-
- (* We are going to construct a suspension table that is valid up to time t_max. *)
- Variable t_max: time.
-
- (* First, consider any predicate that indicates whether a job is suspended at time t. *)
- Variable job_suspended_at: Job -> time -> bool.
-
- (* Assume that this predicate only holds for jobs that have arrived... *)
- Hypothesis H_arrived:
- forall j t,
- t < t_max ->
- job_suspended_at j t ->
- has_arrived job_arrival j t.
-
- (* ...and that have not yet completed. *)
- Hypothesis H_not_completed:
- forall j t,
- t < t_max ->
- job_suspended_at j t ->
- ~~ job_completed_by j t.
-
- (* Assume that this predicate divides the timeline into continuous
- suspension intervals, for any given amount of received service. *)
- Hypothesis H_continuous_suspension:
- forall j t t_susp,
- t < t_max ->
- job_suspended_at j t ->
- start_of_latest_suspension j t <= t_susp < t ->
- job_suspended_at j t_susp.
-
- (* Then, we can construct a suspension table for the given suspension
- predicate as follows. *)
- Definition build_suspension_duration (j: Job) (s: time) :=
- \sum_(0 <= t < t_max | service sched j t == s) job_suspended_at j t.
-
- (* In order to prove that the suspension table matches the given predicate,
- let's first prove some helper lemmas. *)
- Section HelperLemmas.
-
- (* First, we show that for any job j suspended at time t, the cumulative suspension
- time before the beginning of the suspension is zero. *)
- Lemma not_suspended_before_suspension_start:
- forall j t,
- t < t_max ->
- job_suspended_at j t ->
- let susp_start := start_of_latest_suspension j t in
- let S := service sched j in
- \sum_(0 <= i < susp_start | S i == S susp_start) job_suspended_at j i = 0.
- Proof.
- rename H_arrived into ARR, H_not_completed into COMPLETED,
- H_continuous_suspension into CONT.
- intros j t LTmax SUSPt X1 X2; rewrite /X1 /X2; clear X1 X2.
- set ex := start_of_latest_suspension.
- set S := service sched.
- rewrite big_nat_cond big1 ?add0n //.
- move => i /= /andP [LTex /eqP SAME].
- apply/eqP; rewrite eqb0; apply/negP; intro SUSPi.
- suff BUG: S j i != S j (ex j t) by rewrite SAME eq_refl in BUG.
- rewrite neq_ltn; apply/orP; left.
- rewrite /S/ex (same_service_since_last_execution job_arrival) //.
- eapply less_service_before_start_of_suspension; last by apply LTex.
- apply ARR; last by done.
- apply ltn_trans with (n := ex j t); first by done.
- apply leq_ltn_trans with (n := t); last by done.
- by apply last_execution_bounded_by_identity, ARR.
- Qed.
-
- (* Next, we prove that after time t_max, no job suspends according to the table. *)
- Lemma suspension_duration_no_suspension_after_t_max:
- forall j t,
- has_arrived job_arrival j t ->
- t_max <= t ->
- ~~ suspended_at job_arrival job_cost build_suspension_duration sched j t.
- Proof.
- have ZERO := not_suspended_before_suspension_start.
- rename H_arrived into ARR.
- intros j t ARRt GEmax.
- rewrite /suspended_at negb_and; apply/orP; right.
- rewrite negb_and -leqNgt; apply/orP; right.
- rewrite /suspension_duration /build_suspension_duration.
- set ex := _ job_arrival _.
- set S := service sched.
- set susp_at := job_suspended_at.
- case (ltnP (ex j t) t_max) => [LT | GE].
- {
- apply leq_trans with (n := t_max); last by done.
- rewrite big_mkcond /=.
- rewrite -> big_cat_nat with (n := ex j t); [simpl | by done | by apply ltnW].
- rewrite big_nat_cond big1 ?add0n.
- {
- apply leq_trans with (n := ex j t + \sum_(ex j t <= i < t_max) 1);
- last by simpl_sum_const; rewrite subnKC // ltnW.
- by rewrite leq_add2l; apply leq_sum; intros i _; case: ifP => //_; apply leq_b1.
- }
- move => /= i /andP [LTex _]; case: ifP => /eqP SERV; last by done.
- apply/eqP; rewrite eqb0; apply/negP; intro SUSPi.
- suff BUG: S j i != S j (ex j t) by rewrite SERV eq_refl in BUG.
- rewrite neq_ltn; apply/orP; left.
- rewrite /S/ex same_service_since_last_execution //.
- eapply less_service_before_start_of_suspension; last by apply LTex.
- by apply ARR; first by apply:(ltn_trans LTex).
- }
- {
- rewrite big_nat_cond big1 ?addn0;
- first by apply last_execution_bounded_by_identity.
- move => /= i /andP [LTmax /eqP SERV].
- apply/eqP; rewrite eqb0; apply/negP; intro SUSPi.
- suff BUG: S j i != S j (ex j t) by rewrite SERV eq_refl in BUG.
- rewrite neq_ltn; apply/orP; left.
- rewrite /S/ex same_service_since_last_execution //.
- eapply less_service_before_start_of_suspension; first by apply ARR.
- by apply: (leq_trans LTmax); apply GE.
- }
- Qed.
-
- End HelperLemmas.
-
- Open Scope fun_scope.
-
- (* Using the lemmas above, we prove that up to time t_max, the constructed suspension
- table matches the given suspension predicate. *)
- Lemma suspension_duration_matches_predicate_up_to_t_max:
- forall j t,
- t < t_max ->
- job_suspended_at j t =
- suspended_at job_arrival job_cost build_suspension_duration sched j t.
- Proof.
- have ZERO := not_suspended_before_suspension_start.
- rename H_arrived into ARR, H_not_completed into COMPLETED,
- H_continuous_suspension into CONT.
- intros j t LEmax.
- apply/idP/idP.
- {
- intros SUSPt.
- set ex := time_after_last_execution job_arrival sched.
- set S := service sched.
- set susp_at := job_suspended_at.
- have LEt: ex j t <= t.
- by apply last_execution_bounded_by_identity, ARR.
- apply/andP; split; first by apply COMPLETED.
- apply/andP; split; first by done.
- rewrite /suspension_duration /build_suspension_duration.
- rewrite -/ex -/S -/susp_at.
- apply leq_trans with (n := ex j t + \sum_(ex j t <= t0 < t.+1) 1);
- first by simpl_sum_const; rewrite subnKC // ltnW // ltnS.
- rewrite leq_add2l.
- rewrite -> big_cat_nat with (m := 0) (n := ex j t); rewrite //=;
- last by apply leq_trans with (n := t); last by apply ltnW.
- rewrite ZERO // add0n.
- apply leq_trans with (n := \sum_(ex j t<= i <t.+1|S j i==S j (ex j t)) susp_at j i);
- last by rewrite big_mkcond [X in _ <= X]big_mkcond /= extend_sum.
- rewrite [X in _ <= X]big_mkcond /=.
- apply leq_sum_nat; move => i /andP [GE LT] _.
- have SAMEserv: S j i == S j (ex j t).
- {
- rewrite ltnS in LT.
- rewrite eqn_leq; apply/andP; split; last by apply extend_sum.
- by rewrite /S/ex same_service_since_last_execution ?extend_sum.
- }
- rewrite SAMEserv lt0n eqb0 negbK.
- rewrite ltnS leq_eqVlt in LT.
- move: LT => /orP [/eqP EQ | LT]; subst; first by done.
- by apply CONT with (t := t); try (apply/andP; split).
- }
- {
- move => /andP [NOTCOMP /andP [GE LT]].
- rewrite /suspension_duration /build_suspension_duration in LT.
- set S := service sched in LT.
- set susp_at := job_suspended_at in LT *.
- set ex := _ job_arrival _ in GE LT.
- rewrite -> big_cat_nat with (m := 0) (n := ex j t) in LT; rewrite //= in LT;
- last by apply leq_trans with (n := t); last by apply ltnW.
- rewrite big_nat_cond big1 ?add0n in LT; last first.
- {
- move => i /= /andP [LTex /eqP SAME].
- apply/eqP; rewrite eqb0; apply/negP; intro SUSPi.
- suff BUG: S j i != S j (ex j t) by rewrite SAME eq_refl in BUG.
- rewrite neq_ltn; apply/orP; left.
- rewrite /S/ex same_service_since_last_execution //.
- eapply less_service_before_start_of_suspension; last by apply LTex.
- by apply ARR; first by apply:(ltn_trans LTex); apply:(leq_ltn_trans _ LEmax).
- }
- case (boolP ([exists t0:'I_t_max,(S j t0==S j (ex j t))&&susp_at j t0]));last first.
- {
- rewrite negb_exists; move => /forallP ALL.
- rewrite big_nat_cond big1 in LT; first by rewrite addn0 ltnNge GE in LT.
- move => i /andP [/andP [_ LTmax] EQ].
- specialize (ALL (Ordinal LTmax)).
- by rewrite EQ /= in ALL; apply/eqP; rewrite eqb0.
- }
- move => /existsP [t0 /andP [/eqP EQ SUSP0]].
- have MAX := @arg_maxnP _ t0 (fun x=>(S j x == S j (ex j t)) && susp_at j x) id.
- feed MAX; simpl in MAX; first by rewrite EQ eq_refl SUSP0.
- move: MAX => [m /andP [/eqP EQserv SUSPm] ALL]; clear EQ SUSP0 t0.
- case (ltnP t m) => [LTm | GEm].
- {
- apply CONT with (t := m); try done; apply/andP; split; last by done.
- rewrite /start_of_latest_suspension.
- rewrite (same_service_implies_same_last_execution _ _ _ _ t); first by done.
- rewrite -/S EQserv /S /ex /start_of_latest_suspension.
- by rewrite same_service_since_last_execution.
- }
- rewrite leq_eqVlt in GEm; move: GEm => /orP [/eqP EQm | GTm]; subst; first by done.
- apply contraT; intro NOTSUSP.
- set SUM := (X in _ < _ + X) in LT.
- suff BUG: t >= ex j t + SUM by rewrite leqNgt LT in BUG.
- rewrite /SUM in LT *; clear SUM LT.
- apply leq_trans with (n := ex j t + (t - ex j t)); last by rewrite subnKC.
- rewrite leq_add2l.
- rewrite -> big_cat_nat with (n := t); rewrite //=; last by apply ltnW.
- rewrite [X in _ + X <= _]big_nat_cond [X in _ + X <= _]big1 ?addn0.
- {
- apply leq_trans with (n := \sum_(ex j t <= i < t) 1); last by simpl_sum_const.
- by rewrite big_mkcond; apply leq_sum; intros i _; case: ifP => // _; apply leq_b1.
- }
- move => i /andP [/andP [GEi LTi] /eqP SERVi].
- apply/eqP; rewrite eqb0; apply/negP; intro SUSPi.
- specialize (ALL (Ordinal LTi)); rewrite /= in ALL.
- feed ALL; first by rewrite SERVi eq_refl SUSPi.
- suff BUG: m >= t by rewrite leqNgt GTm in BUG.
- by apply: (leq_trans GEi).
- }
- Qed.
-
- End BuildingSuspensionTable.
-
-End SuspensionTableConstruction.
diff --git a/classic/model/schedule/uni/susp/last_execution.v b/classic/model/schedule/uni/susp/last_execution.v
deleted file mode 100644
index 1cb8db6dcebd3ed5bdd617b89b45272e8ccce2de..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/susp/last_execution.v
+++ /dev/null
@@ -1,411 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we show how to compute the time instant after the last
- execution of a job and prove several lemmas about that instant. This
- notion is crucial for defining suspension intervals. *)
-Module LastExecution.
-
- Export Job UniprocessorSchedule.
-
- (* In this section we define the time after the last execution of a job (if exists). *)
- Section TimeAfterLastExecution.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
-
- Section Defs.
-
- (* Let j be any job in the arrival sequence. *)
- Variable j: Job.
-
- (* Next, we will show how to find the time after the most recent
- execution of a given job j in the interval [job_arrival j, t).
- (Note that this instant can be time t itself.) *)
- Variable t: time.
-
- (* Let scheduled_before denote whether job j was scheduled in the interval [0, t). *)
- Let scheduled_before :=
- [exists t0: 'I_t, job_scheduled_at j t0].
-
- (* In case j was scheduled before, we define the last time in which j was scheduled. *)
- Let last_time_scheduled :=
- \max_(t_last < t | job_scheduled_at j t_last) t_last.
-
- (* Then, the time after the last execution of job j in the interval [0, t), if exists,
- occurs:
- (a) immediately after the last time in which job j was scheduled, or,
- (b) if j was never scheduled, at the arrival time of j. *)
- Definition time_after_last_execution :=
- if scheduled_before then
- last_time_scheduled + 1
- else job_arrival j.
-
- End Defs.
-
- (* Next, we prove lemmas about the time after the last execution. *)
- Section Lemmas.
-
- (* Assume that jobs do not execute before they arrived. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* In this section, we show that the time after the last execution occurs
- no earlier than the arrival of the job. *)
- Section JobHasArrived.
-
- (* Then, the time following the last execution of job j in the
- interval [0, t) occurs no earlier than the arrival of j. *)
- Lemma last_execution_after_arrival:
- forall t,
- has_arrived job_arrival j (time_after_last_execution j t).
- Proof.
- unfold time_after_last_execution, has_arrived; intros t.
- case EX: [exists _, _]; last by done.
- move: EX => /existsP [t0 SCHED].
- apply leq_trans with (n := t0 + 1);
- last by rewrite leq_add2r; apply leq_bigmax_cond.
- apply leq_trans with (n := t0); last by rewrite addn1.
- by apply H_jobs_must_arrive_to_execute.
- Qed.
-
- End JobHasArrived.
-
- (* Next, we establish the monotonicity of the function. *)
- Section Monotonicity.
-
- (* Let t1 be any time no earlier than the arrival of job j. *)
- Variable t1: time.
- Hypothesis H_after_arrival: has_arrived job_arrival j t1.
-
- (* Then, (time_after_last_execution j) grows monotonically
- after that point. *)
- Lemma last_execution_monotonic:
- forall t2,
- t1 <= t2 ->
- time_after_last_execution j t1 <= time_after_last_execution j t2.
- Proof.
- rename H_jobs_must_arrive_to_execute into ARR.
- intros t2 LE12.
- rewrite /time_after_last_execution.
- case EX1: [exists _, _].
- {
- move: EX1 => /existsP [t0 SCHED0].
- have EX2: [exists t:'I_t2, job_scheduled_at j t].
- {
- have LT: t0 < t2 by apply: (leq_trans _ LE12).
- by apply/existsP; exists (Ordinal LT).
- }
- rewrite EX2 2!addn1.
- set m1 := \max_(_ < t1 | _)_.
- have LTm1: m1 < t2.
- {
- apply: (leq_trans _ LE12).
- by apply bigmax_ltn_ord with (i0 := t0).
- }
- apply leq_ltn_trans with (n := Ordinal LTm1); first by done.
- by apply leq_bigmax_cond, (bigmax_pred _ _ t0).
- }
- {
- case EX2: [exists _, _]; last by done.
- move: EX2 => /existsP [t0 SCHED0].
- set m2 := \max_(_ < t2 | _)_.
- rewrite addn1 ltnW // ltnS.
- have SCHED2: scheduled_at sched j m2 by apply (bigmax_pred _ _ t0).
- by apply ARR in SCHED2.
- }
- Qed.
-
- End Monotonicity.
-
- (* Next, we prove that the function is idempotent. *)
- Section Idempotence.
-
- (* The time after the last execution of job j is an idempotent function. *)
- Lemma last_execution_idempotent:
- forall t,
- time_after_last_execution j (time_after_last_execution j t)
- = time_after_last_execution j t.
- Proof.
- rename H_jobs_must_arrive_to_execute into ARR.
- intros t.
- rewrite {2 3}/time_after_last_execution.
- case EX: [exists _,_].
- {
- move: EX => /existsP [t0 SCHED].
- rewrite /time_after_last_execution.
- set ex := [exists t0, _].
- have EX': ex.
- {
- apply/existsP; rewrite addn1.
- exists (Ordinal (ltnSn _)).
- by apply bigmax_pred with (i0 := t0).
- }
- rewrite EX'; f_equal.
- rewrite addn1; apply/eqP.
- set m := \max_(_ < t | _)_.
- have LT: m < m.+1 by done.
- rewrite eqn_leq; apply/andP; split.
- {
- rewrite -ltnS; apply bigmax_ltn_ord with (i0 := Ordinal LT).
- by apply bigmax_pred with (i0 := t0).
- }
- {
- apply leq_trans with (n := Ordinal LT); first by done.
- by apply leq_bigmax_cond, bigmax_pred with (i0 := t0).
- }
- }
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP EX.
- rewrite /time_after_last_execution.
- set ex := [exists _, _].
- suff EX': ex = false; first by rewrite EX'.
- apply negbTE; rewrite negb_exists; apply/forallP.
- intros x.
- apply/negP; intro SCHED.
- apply ARR in SCHED.
- by apply leq_ltn_trans with (p := job_arrival j) in SCHED;
- first by rewrite ltnn in SCHED.
- }
- Qed.
-
- End Idempotence.
-
- (* Next, we show that time_after_last_execution is bounded by the identity function. *)
- Section BoundedByIdentity.
-
- (* Let t be any time no earlier than the arrival of j. *)
- Variable t: time.
- Hypothesis H_after_arrival: has_arrived job_arrival j t.
-
- (* Then, the time following the last execution of job j in the interval [0, t)
- occurs no later than time t. *)
- Lemma last_execution_bounded_by_identity:
- time_after_last_execution j t <= t.
- Proof.
- unfold time_after_last_execution.
- case EX: [exists _, _]; last by done.
- move: EX => /existsP [t0 SCHED].
- by rewrite addn1; apply bigmax_ltn_ord with (i0 := t0).
- Qed.
-
- End BoundedByIdentity.
-
- (* In this section, we show that if the service received by a job
- remains the same, the time after last execution also doesn't change. *)
- Section SameLastExecution.
-
- (* Consider any time instants t and t'... *)
- Variable t t': time.
-
- (* ...in which job j has received the same amount of service. *)
- Hypothesis H_same_service: service sched j t = service sched j t'.
-
- (* Then, we prove that the times after last execution relative to
- instants t and t' are exactly the same. *)
- Lemma same_service_implies_same_last_execution:
- time_after_last_execution j t = time_after_last_execution j t'.
- Proof.
- rename H_same_service into SERV.
- have IFF := same_service_implies_scheduled_at_earlier_times
- sched j t t' SERV.
- rewrite /time_after_last_execution.
- rewrite IFF; case EX2: [exists _, _]; [f_equal | by done].
- have EX1: [exists x: 'I_t, job_scheduled_at j x] by rewrite IFF.
- clear IFF.
- move: t t' SERV EX1 EX2 => t1 t2; clear t t'.
- wlog: t1 t2 / t1 <= t2 => [EQ SERV EX1 EX2 | LE].
- by case/orP: (leq_total t1 t2); ins; [|symmetry]; apply EQ.
-
- set m1 := \max_(t < t1 | job_scheduled_at j t) t.
- set m2 := \max_(t < t2 | job_scheduled_at j t) t.
- move => SERV /existsP [t1' SCHED1'] /existsP [t2' SCHED2'].
- apply/eqP; rewrite eqn_leq; apply/andP; split.
- {
- have WID := big_ord_widen_cond t2
- (fun x => job_scheduled_at j x) (fun x => x).
- rewrite /m1 /m2 {}WID //.
- rewrite big_mkcond [\max_(t < t2 | _) _]big_mkcond.
- apply leq_big_max; intros i _.
- case AND: (_ && _); last by done.
- by move: AND => /andP [SCHED _]; rewrite SCHED.
- }
- {
- destruct (leqP t2 m1) as [GEm1 | LTm1].
- {
- apply leq_trans with (n := t2); last by done.
- by apply ltnW, bigmax_ltn_ord with (i0 := t2').
- }
- destruct (ltnP m2 t1) as [LTm2 | GEm2].
- {
- apply leq_trans with (n := Ordinal LTm2); first by done.
- by apply leq_bigmax_cond, bigmax_pred with (i0 := t2').
- }
- have LTm2: m2 < t2 by apply bigmax_ltn_ord with (i0 := t2').
- have SCHEDm2: job_scheduled_at j m2 by apply bigmax_pred with (i0 := t2').
- exfalso; move: SERV => /eqP SERV.
- rewrite -[_ == _]negbK in SERV.
- move: SERV => /negP SERV; apply SERV; clear SERV.
- rewrite neq_ltn; apply/orP; left.
- rewrite /service /service_during.
- rewrite -> big_cat_nat with (n := m2) (p := t2);
- [simpl | by done | by apply ltnW].
- rewrite -addn1; apply leq_add; first by apply extend_sum.
- destruct t2; first by rewrite ltn0 in LTm1.
- rewrite big_nat_recl; last by done.
- by rewrite /service_at -/job_scheduled_at SCHEDm2.
- }
- Qed.
-
- End SameLastExecution.
-
- (* In this section, we show that the service received by a job
- does not change since the last execution. *)
- Section SameService.
-
- (* We prove that, for any time t, the service received by job j
- before (time_after_last_execution j t) is the same as the service
- by j before time t. *)
- Lemma same_service_since_last_execution:
- forall t,
- service sched j (time_after_last_execution j t) = service sched j t.
- Proof.
- intros t; rewrite /time_after_last_execution.
- case EX: [exists _, _].
- {
- move: EX => /existsP [t0 SCHED0].
- set m := \max_(_ < _ | _) _; rewrite addn1.
- have LTt: m < t by apply: (bigmax_ltn_ord _ _ t0).
- rewrite leq_eqVlt in LTt.
- move: LTt => /orP [/eqP EQ | LTt]; first by rewrite EQ.
- rewrite {2}/service/service_during.
- rewrite -> big_cat_nat with (n := m.+1);
- [simpl | by done | by apply ltnW].
- rewrite [X in _ + X]big_nat_cond [X in _ + X]big1 ?addn0 //.
- move => i /andP [/andP [GTi LTi] _].
- apply/eqP; rewrite eqb0; apply/negP; intro BUG.
- have LEi: (Ordinal LTi) <= m by apply leq_bigmax_cond.
- by apply (leq_ltn_trans LEi) in GTi; rewrite ltnn in GTi.
- }
- {
- apply negbT in EX; rewrite negb_exists in EX.
- move: EX => /forallP ALL.
- rewrite /service /service_during.
- rewrite (ignore_service_before_arrival job_arrival) // big_geq //.
- rewrite big_nat_cond big1 //; move => i /andP [/= LTi _].
- by apply/eqP; rewrite eqb0; apply (ALL (Ordinal LTi)).
- }
- Qed.
-
- End SameService.
-
- (* In this section, we show that for any smaller value of service, we can
- always find the last execution that corresponds to that service. *)
- Section ExistsIntermediateExecution.
-
- (* Assume that job j has completed by time t. *)
- Variable t: time.
- Hypothesis H_j_has_completed: completed_by job_cost sched j t.
-
- (* Then, for any value of service less than the cost of j, ...*)
- Variable s: time.
- Hypothesis H_less_than_cost: s < job_cost j.
-
- (* ...there exists a last execution where the service received
- by job j equals s. *)
- Lemma exists_last_execution_with_smaller_service:
- exists t0,
- service sched j (time_after_last_execution j t0) = s.
- Proof.
- have SAME := same_service_since_last_execution.
- rename H_jobs_must_arrive_to_execute into ARR.
- move: H_j_has_completed => COMP.
- feed (exists_intermediate_point (service sched j));
- first by apply service_is_unit_growth_function.
- move => EX; feed (EX (job_arrival j) t).
- { feed (cumulative_service_implies_scheduled sched j 0 t).
- apply leq_ltn_trans with (n := s); first by done.
- apply leq_trans with (job_cost j); by done.
- move => [t' [/= LTt SCHED]].
- apply leq_trans with (n := t'); last by apply ltnW.
- by apply ARR in SCHED.
- }
- feed (EX s).
- { apply/andP; split.
- - rewrite /service /service_during.
- by rewrite (ignore_service_before_arrival job_arrival) // big_geq.
- - apply leq_ltn_trans with (n := s); first by done.
- by apply leq_trans with (job_cost j).
- }
- move: EX => [x_mid [_ SERV]]; exists x_mid.
- by rewrite -SERV SAME.
- Qed.
-
- End ExistsIntermediateExecution.
-
- (* In this section we prove that before the last execution the job
- must have received strictly less service. *)
- Section LessServiceBeforeLastExecution.
-
- (* Let t be any time... *)
- Variable t: time.
-
- (* ...and consider any earlier time t0 no earlier than the arrival of job j... *)
- Variable t0: time.
- Hypothesis H_no_earlier_than_arrival: has_arrived job_arrival j t0.
-
- (* ...and before the last execution of job j (with respect to time t). *)
- Hypothesis H_before_last_execution: t0 < time_after_last_execution j t.
-
- (* Then, we can prove that the service received by j before time t0
- is strictly less than the service received by j before time t. *)
- Lemma less_service_before_start_of_suspension:
- service sched j t0 < service sched j t.
- Proof.
- rename H_no_earlier_than_arrival into ARR, H_before_last_execution into LT.
- set ex := time_after_last_execution in LT.
- set S := service sched.
- case EX:([exists t0:'I_t, scheduled_at sched j t0]); last first.
- {
- rewrite /ex /time_after_last_execution EX in LT.
- apply leq_trans with (p := t0) in LT; last by done.
- by rewrite ltnn in LT.
- }
- {
- rewrite /ex /time_after_last_execution EX in LT.
- set m := (X in _ < X + 1) in LT.
- apply leq_ltn_trans with (n := S j m);
- first by rewrite -/m addn1 ltnS in LT; apply extend_sum.
- move: EX => /existsP [t' SCHED'].
- have LTt: m < t by apply bigmax_ltn_ord with (i0 := t').
- rewrite /S /service /service_during.
- rewrite -> big_cat_nat with (p := t) (n := m); [simpl | by done | by apply ltnW].
- rewrite -addn1 leq_add2l; destruct t; first by done.
- rewrite big_nat_recl //.
- apply leq_trans with (n := scheduled_at sched j m); last by apply leq_addr.
- rewrite lt0n eqb0 negbK.
- by apply bigmax_pred with (i0 := t').
- }
- Qed.
-
- End LessServiceBeforeLastExecution.
-
- End Lemmas.
-
- End TimeAfterLastExecution.
-
-End LastExecution.
diff --git a/classic/model/schedule/uni/susp/platform.v b/classic/model/schedule/uni/susp/platform.v
deleted file mode 100644
index 91f9254561dacc4a76d639e46d8382386bf49d2f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/susp/platform.v
+++ /dev/null
@@ -1,105 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.suspension
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.susp.schedule.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module PlatformWithSuspensions.
-
- Export ScheduleWithSuspensions Priority.
-
- Section Definitions.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Assume that job suspension times are given. *)
- Variable next_suspension: job_suspension Job.
-
- (* Consider any job arrival sequence ...*)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any uniprocessor schedule of these jobs. *)
- Variable sched: schedule Job.
-
- (* For simplicity, let's recall the definitions of pending, scheduled, and backlogged job.
- Note that this notion of backlogged is specific for suspension-aware schedulers. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_backlogged_at := backlogged job_arrival job_cost next_suspension sched.
-
- (* In this section, we define schedule constraints for suspension-aware schedules. *)
- Section ScheduleConstraints.
-
- (* First, we consider constraints related to execution. *)
- Section Execution.
-
- (* We say that a scheduler is work-conserving iff whenever a job j
- is backlogged, the processor is always busy with another job. *)
- Definition work_conserving :=
- forall j t,
- arrives_in arr_seq j ->
- job_backlogged_at j t ->
- exists j_other, job_scheduled_at j_other t.
-
- End Execution.
-
- (* Next, we consider constraints related to FP policies. *)
- Section FP.
-
- (* We say that an FP policy...*)
- Variable higher_eq_priority: FP_policy Task.
-
- (* ... is respected by the scheduler iff at any time t, a scheduled job
- has higher (or same) priority than (as) any backlogged job. *)
- Definition respects_FP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- job_backlogged_at j t ->
- job_scheduled_at j_hp t ->
- higher_eq_priority (job_task j_hp) (job_task j).
-
- End FP.
-
- (* Next, we consider constraints related to JLFP policies. *)
- Section JLFP.
-
- (* We say that a JLFP policy ...*)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* ... is respected by the scheduler iff every scheduled job
- has higher (or same) priority than (as) any backlogged job. *)
- Definition respects_JLFP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- job_backlogged_at j t ->
- job_scheduled_at j_hp t ->
- higher_eq_priority j_hp j.
-
- End JLFP.
-
- (* Next, we consider constraints related to JLDP policies. *)
- Section JLDP.
-
- (* We say that a JLDP policy ...*)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* ... is respected by the scheduler iff at any time t, a scheduled job
- has higher (or same) priority than (as) any backlogged job. *)
- Definition respects_JLDP_policy :=
- forall j j_hp t,
- arrives_in arr_seq j ->
- job_backlogged_at j t ->
- job_scheduled_at j_hp t ->
- higher_eq_priority t j_hp j.
-
- End JLDP.
-
- End ScheduleConstraints.
-
- End Definitions.
-
-End PlatformWithSuspensions.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/susp/schedule.v b/classic/model/schedule/uni/susp/schedule.v
deleted file mode 100644
index 23b3d547d6dda54fccbf06efaa9c2d6558b0d4c4..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/susp/schedule.v
+++ /dev/null
@@ -1,48 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence prosa.classic.model.suspension
- prosa.classic.model.priority.
-Require Import prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.schedule.uni.susp.suspension_intervals.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module ScheduleWithSuspensions.
-
- Export UniprocessorSchedule SuspensionIntervals.
-
- Section Definitions.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Assume that job suspension times are given. *)
- Variable next_suspension: job_suspension Job.
-
- (* Consider any uniprocessor schedule. *)
- Variable sched: schedule Job.
-
- (* Recall the predicates that denote whether a job is scheduled
- and suspended. *)
- Let job_pending_at := pending job_arrival job_cost sched.
- Let job_scheduled_at := scheduled_at sched.
- Let job_suspended_at := suspended_at job_arrival job_cost next_suspension sched.
-
- (* First, we redefine the notion of backlogged job to account for suspensions. *)
- Section BackloggedJob.
-
- (* We say that job j...*)
- Variable j: Job.
-
- (* ...is backlogged at time t iff it is pending and neither
- scheduled nor suspended. *)
- Definition backlogged (t: time) :=
- job_pending_at j t
- && ~~ job_scheduled_at j t
- && ~~ job_suspended_at j t.
-
- End BackloggedJob.
-
- End Definitions.
-
-End ScheduleWithSuspensions.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/susp/suspension_intervals.v b/classic/model/schedule/uni/susp/suspension_intervals.v
deleted file mode 100644
index 2acf86b8c1d6af1aecbed0650795e09556520069..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/susp/suspension_intervals.v
+++ /dev/null
@@ -1,523 +0,0 @@
-Require Import prosa.classic.util.all.
-
-Require Import prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.schedule.
-Require Import prosa.classic.model.schedule.uni.susp.last_execution.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module SuspensionIntervals.
-
- Export Job UniprocessorSchedule Suspension LastExecution.
-
- (* In this section we define job suspension intervals in a schedule. *)
- Section DefiningSuspensionIntervals.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any job suspension times... *)
- Variable next_suspension: job_suspension Job.
-
- (* ...and any uniprocessor schedule. *)
- (*Context {arr_seq: arrival_sequence Job}.*)
- Variable sched: schedule Job.
-
- (* For simplicity, let's define some local names. *)
- Let job_scheduled_at := scheduled_at sched.
- Let job_completed_by := completed_by job_cost sched.
-
- (* Based on the time after the last execution of a job, we define next
- whether a job is suspended. *)
- Section JobSuspension.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- Section DefiningSuspension.
-
- (* We are going to define whether job j is suspended at time t. *)
- Variable t: time.
-
- (* First, we define the beginning of the latest self suspension as the
- time following the last execution of job j in the interval [0, t).
- (Note that suspension_start can return time t itself.) *)
- Let suspension_start := time_after_last_execution job_arrival sched j t.
-
- (* Next, using the service received by j in the interval [0, suspension_start),...*)
- Let current_service := service sched j suspension_start.
-
- (* ... we recall the duration of the suspension expected for job j after having
- received that amount of service. *)
- Definition suspension_duration := next_suspension j current_service.
-
- (* Then, we say that job j is suspended at time t iff j has not completed
- by time t and t lies in the latest suspension interval.
- (Also note that the suspension interval can have duration 0, in which
- case suspended_at will be trivially false.) *)
- Definition suspended_at :=
- ~~ completed_by job_cost sched j t &&
- (suspension_start <= t < suspension_start + suspension_duration).
-
- End DefiningSuspension.
-
- (* Based on the notion of suspension, we also define the cumulative
- suspension time of job j in any interval [t1, t2)... *)
- Definition cumulative_suspension_during (t1 t2: time) :=
- \sum_(t1 <= t < t2) (suspended_at t).
-
- (* ...and the cumulative suspension time in any interval [0, t). *)
- Definition cumulative_suspension (t: time) := cumulative_suspension_during 0 t.
-
- End JobSuspension.
-
- (* Next, we define whether the schedule respects self-suspensions. *)
- Section SuspensionAwareSchedule.
-
- (* We say that the schedule respects self-suspensions iff suspended
- jobs are never scheduled. *)
- Definition respects_self_suspensions :=
- forall j t,
- job_scheduled_at j t -> ~ suspended_at j t.
-
- End SuspensionAwareSchedule.
-
- (* In this section, we prove several results related to job suspensions. *)
- Section Lemmas.
-
- (* First, we prove that at any time within any suspension interval,
- a job is always suspended. *)
- Section InsideSuspensionInterval.
-
- (* Assume that jobs do not execute before they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* ...and nor after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule respects self-suspensions. *)
- Hypothesis H_respects_self_suspensions: respects_self_suspensions.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* Consider any time t after the arrival of j... *)
- Variable t: time.
- Hypothesis H_has_arrived: has_arrived job_arrival j t.
-
- (* ...and recall the latest suspension interval of job j relative to time t. *)
- Let suspension_start := time_after_last_execution job_arrival sched j t.
- Let duration := suspension_duration j t.
-
- (* First, we analyze the service received during a suspension interval. *)
- Section SameService.
-
- (* Let t_in be any time in the suspension interval relative to time t. *)
- Variable t_in: time.
- Hypothesis H_within_suspension_interval:
- suspension_start <= t_in <= suspension_start + duration.
-
- (* Then, we show that the service received before time t_in
- equals the service received before the beginning of the
- latest suspension interval (if exists). *)
- Lemma same_service_in_suspension_interval:
- service sched j t_in = service sched j suspension_start.
- Proof.
- rename H_within_suspension_interval into BETWEEN,
- H_respects_self_suspensions into SUSP, t_in into i.
- generalize dependent i.
- suff SAME:
- forall delta,
- delta <= duration ->
- service sched j (suspension_start + delta) =
- service sched j suspension_start.
- {
- move => i /andP [GE LT].
- feed (SAME (i-suspension_start)); first by rewrite leq_subLR.
- by rewrite addnBA // addKn in SAME.
- }
- induction delta; first by rewrite addn0.
- intros LT.
- feed IHdelta; first by apply ltnW.
- rewrite addnS -[service _ _ suspension_start]addn0.
- rewrite /service /service_during big_nat_recr //=.
- f_equal; first by done.
- apply/eqP; rewrite eqb0; apply/negP; intro SCHED.
- move: (SCHED) => SCHED'.
- apply SUSP in SCHED; apply SCHED; clear SCHED.
- rewrite /suspended_at /suspension_duration.
- case: (boolP (completed_by _ _ _ _)) => [COMP | NOTCOMP];
- first by apply completed_implies_not_scheduled in COMP;
- first by rewrite SCHED' in COMP.
- rewrite andTb (same_service_implies_same_last_execution _ _ _ _
- suspension_start) //.
- rewrite /suspension_start last_execution_idempotent //.
- apply/andP; split; first by apply leq_addr.
- by rewrite ltn_add2l.
- Qed.
-
- End SameService.
-
- (* Next, we infer that the job is suspended at all times during
- the suspension interval. *)
- Section JobSuspendedAtAllTimes.
-
- (* Let t_in be any time before the completion of job j. *)
- Variable t_in: time.
- Hypothesis H_not_completed: ~~ job_completed_by j t_in.
-
- (* If t_in lies in the suspension interval relative to time t, ...*)
- Hypothesis H_within_suspension_interval:
- suspension_start <= t_in < suspension_start + duration.
-
- (* ...then job j is suspended at time t_in. More precisely, the suspension
- interval relative to time t_in is included in the suspension interval
- relative to time t. *)
- Lemma suspended_in_suspension_interval:
- suspended_at j t_in.
- Proof.
- rename H_within_suspension_interval into BETWEEN.
- move: BETWEEN => /andP [GE LT].
- have ARR: has_arrived job_arrival j t_in.
- {
- apply leq_trans with (n := suspension_start); last by done.
- rewrite -/(has_arrived job_arrival j suspension_start).
- by apply last_execution_after_arrival.
- }
- apply/andP; split; first by done.
- apply/andP; split;
- first by apply last_execution_bounded_by_identity.
- apply (leq_trans LT).
- have SAME: time_after_last_execution job_arrival sched j t =
- time_after_last_execution job_arrival sched j t_in.
- {
- set b := _ _ t.
- rewrite [_ _ t_in](same_service_implies_same_last_execution _ _ _ _ b);
- first by rewrite last_execution_idempotent.
- apply same_service_in_suspension_interval.
- by apply/andP; split; last by apply ltnW.
- }
- rewrite /suspension_start SAME leq_add2l.
- by rewrite /duration /suspension_duration SAME.
- Qed.
-
- End JobSuspendedAtAllTimes.
-
- End InsideSuspensionInterval.
-
- (* Next, we prove lemmas about the state of a suspended job. *)
- Section StateOfSuspendedJob.
-
- (* Assume that jobs do not execute before they arrived. *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* Assume that j is suspended at time t. *)
- Variable t: time.
- Hypothesis H_j_is_suspended: suspended_at j t.
-
- (* First, we show that j must have arrived by time t. *)
- Lemma suspended_implies_arrived: has_arrived job_arrival j t.
- Proof.
- rename H_j_is_suspended into SUSP.
- move: SUSP => /andP [_ SUSP].
- rewrite -[_ && _]negbK in SUSP; move: SUSP => /negP SUSP.
- rewrite /has_arrived leqNgt; apply/negP; intro LT.
- apply SUSP; clear SUSP.
- rewrite negb_and; apply/orP; left.
- rewrite -ltnNge.
- apply: (leq_trans LT); clear LT.
- rewrite /time_after_last_execution.
- case EX: [exists _, _]; last by apply leqnn.
- set t' := \max_(_ < _ | _)_.
- move: EX => /existsP [t0 EX].
- apply bigmax_pred in EX; rewrite -/t' /job_scheduled_at in EX.
- apply leq_trans with (n := t'); last by apply leq_addr.
- rewrite leqNgt; apply/negP; intro LT.
- have NOTSCHED: ~~ scheduled_at sched j t'.
- {
- rewrite -eqb0; apply/eqP.
- by eapply service_before_job_arrival_zero; first by eauto.
- }
- by rewrite EX in NOTSCHED.
- Qed.
-
- (* By the definition of suspension, it also follows that j cannot
- have completed by time t. *)
- Corollary suspended_implies_not_completed:
- ~~ completed_by job_cost sched j t.
- Proof.
- by move: H_j_is_suspended => /andP [NOTCOMP _].
- Qed.
-
- End StateOfSuspendedJob.
-
- (* Next, we establish a bound on the cumulative suspension time of any job. *)
- Section BoundOnCumulativeSuspension.
-
- (* Assume that jobs do not execute before they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* ...and nor after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule respects self-suspensions. *)
- Hypothesis H_respects_self_suspensions: respects_self_suspensions.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* Recall the total suspension of job j as given by the dynamic suspension model. *)
- Let cumulative_suspension_of_j :=
- cumulative_suspension_during j.
- Let total_suspension_of_j :=
- total_suspension job_cost next_suspension j.
-
- (* We prove that the cumulative suspension time of job j in any
- interval is upper-bounded by the total suspension time. *)
- Lemma cumulative_suspension_le_total_suspension:
- forall t1 t2,
- cumulative_suspension_of_j t1 t2 <= total_suspension_of_j.
- Proof.
- unfold cumulative_suspension_of_j, cumulative_suspension_during,
- total_suspension_of_j, total_suspension.
- intros t1 t2.
- apply leq_trans with (n := \sum_(0 <= s < job_cost j)
- \sum_(t1 <= t < t2 | service sched j t == s) suspended_at j t).
- { rewrite (exchange_big_dep_nat (fun x => true)) //=.
- apply leq_sum; intros s _.
- destruct (boolP (suspended_at j s)) as [SUSP | NOTSUSP]; last by done.
- rewrite (big_rem (service sched j s)); first by rewrite eq_refl.
- rewrite mem_index_iota; apply/andP; split; first by done.
- rewrite ltn_neqAle; apply/andP; split;
- last by apply cumulative_service_le_job_cost.
- apply suspended_implies_not_completed in SUSP.
- rewrite neq_ltn; apply/orP; left.
- by rewrite ltnNge.
- }
- { apply leq_sum_nat; move => s /andP [_ LT] _.
- destruct (boolP [exists t:'I_t2, (t>=t1)&& (service sched j t==s)]) as [EX|ALL];
- last first.
- {
- rewrite negb_exists in ALL; move: ALL => /forallP ALL.
- rewrite big_nat_cond big1 //.
- move => i /andP [/andP [GEi LTi] SERV].
- by specialize (ALL (Ordinal LTi)); rewrite /= SERV GEi andbT in ALL.
- }
- move: EX => /existsP [t' /andP [GE' /eqP SERV]].
- unfold suspended_at, suspension_duration.
- set b := time_after_last_execution job_arrival sched j.
- set n := next_suspension j s.
- apply leq_trans with (n := \sum_(t1 <= t < t2 | b t' <= t < b t' + n) 1).
- {
- rewrite big_mkcond [\sum_(_ <= _ < _ | b t' <= _ < _) _]big_mkcond /=.
- apply leq_sum_nat; intros t LEt _.
- case: (boolP (completed_by _ _ _ _)) => [COMP | NOTCOMP];
- [by case (_ == _) | simpl].
- case EQ: (service _ _ _ == _); last by done.
- move: EQ => /eqP EQ. rewrite /n -EQ.
- case INT: (_ <= _ < _); last by done.
- apply eq_leq; symmetry; apply/eqP; rewrite eqb1.
- move: INT => /andP [GEt LTt].
- rewrite (same_service_in_suspension_interval _ _ _ _ t') //.
- {
- rewrite -/b [b t'](same_service_implies_same_last_execution _ _ _ _ t);
- last by rewrite SERV EQ.
- by apply/andP; split.
- }
- {
- rewrite /suspension_duration -/b.
- rewrite [b t'](same_service_implies_same_last_execution _ _ _ _ t);
- last by rewrite SERV EQ.
- by apply/andP; split; last by apply ltnW.
- }
- }
- apply leq_trans with (n := \sum_(b t' <= t < b t' + n) 1);
- last by simpl_sum_const; rewrite addKn.
- by apply leq_sum1_smaller_range; move => i [LE LE']; split.
- }
- Qed.
-
- End BoundOnCumulativeSuspension.
-
- (* Next, we show that when a job completes, it must have suspended
- as long as the total suspension time. *)
- Section SuspendsForTotalSuspension.
-
- (* Assume that jobs do not execute before they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* ...and nor after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule respects self-suspensions. *)
- Hypothesis H_respects_self_suspensions: respects_self_suspensions.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* Assume that j has completed by time t. *)
- Variable t: time.
- Hypothesis H_j_has_completed: completed_by job_cost sched j t.
-
- (* Then, we prove that the cumulative suspension time must be
- exactly equal to the total suspension time of the job. *)
- Lemma cumulative_suspension_eq_total_suspension:
- cumulative_suspension j t = total_suspension job_cost next_suspension j.
- Proof.
- rename H_j_has_completed into COMP, H_jobs_must_arrive_to_execute into ARR.
- have EARLIER := exists_last_execution_with_smaller_service job_arrival
- job_cost sched ARR j t COMP.
- apply/eqP; rewrite eqn_leq; apply/andP; split;
- first by apply cumulative_suspension_le_total_suspension.
- rewrite /total_suspension /cumulative_suspension /cumulative_suspension_during.
- move: COMP => /eqP COMP.
- apply leq_trans with (n := \sum_(0 <= s < job_cost j)
- \sum_(0 <= t0 < t | service sched j t0 == s) suspended_at j t0);
- last first.
- {
- rewrite (exchange_big_dep_nat (fun x => true)) //=.
- apply leq_sum_nat; move => t0 /andP [_ LT] _.
- case (boolP [exists s: 'I_(job_cost j), service sched j t0 == s]) => [EX | ALL].
- {
- move: EX => /existsP [s /eqP EQs].
- rewrite big_mkcond /=.
- rewrite (bigD1_seq (nat_of_ord s)); [simpl | | by apply iota_uniq];
- last by rewrite mem_index_iota; apply/andP;split; last by apply ltn_ord.
- rewrite EQs eq_refl big1; first by rewrite addn0.
- by move => i /negbTE NEQ; rewrite eq_sym NEQ.
- }
- {
- rewrite big_nat_cond big1; first by done.
- move => i /andP [/andP [_ LTi] /eqP SERV].
- rewrite negb_exists in ALL; move: ALL => /forallP ALL.
- by specialize (ALL (Ordinal LTi)); rewrite /= SERV eq_refl in ALL.
- }
- }
- {
- apply leq_sum_nat; move => s /andP [_ LTs] _.
- rewrite /suspended_at /suspension_duration.
- set b := time_after_last_execution job_arrival sched j.
- set n := next_suspension j.
-
- move: (EARLIER s LTs) => [t' EQ'].
- apply leq_trans with (n := \sum_(0 <= t0 < t | (service sched j t0 == s) &&
- (b t' <= t0 < b t' + n (service sched j (b t')))) 1); last first.
- { rewrite big_mkcond [\sum_(_ <= _ < _ | _ == s)_]big_mkcond.
- apply leq_sum_nat; move => i /andP [_ LTi] _.
- case EQi: (service sched j i == s); [rewrite andTb | by rewrite andFb].
- case LE: (_ <= _ <= _); last by done.
- rewrite lt0n eqb0 negbK.
- apply suspended_in_suspension_interval with (t := t'); try (by done).
- rewrite -ltnNge.
- by apply: (leq_ltn_trans _ LTs); apply eq_leq; apply/eqP.
- }
- { apply leq_trans with (n := \sum_(b t'<= t0< b t'+ n (service sched j (b t')) |
- (0 <= t0 < t) && (service sched j t0 == s)) 1).
- {
- apply leq_trans with (n := \sum_(b t' <= t0 < b t'
- + n (service sched j (b t'))) 1);
- first by simpl_sum_const; rewrite addKn -EQ'.
- rewrite [in X in _ <= X]big_mkcond /=.
- apply leq_sum_nat; move => i /andP [LEi GTi] _.
- apply eq_leq; symmetry; apply/eqP; rewrite eqb1.
- apply/andP; split.
- {
- have SUSPi: suspended_at j i.
- {
- apply: (suspended_in_suspension_interval _ _ _ _ t');
- try (by done); last by apply/andP; split.
- rewrite -ltnNge.
- rewrite (same_service_in_suspension_interval _ _ _ _ t') //;
- first by rewrite EQ'.
- by apply/andP; split; last by apply ltnW.
- }
- apply contraT; rewrite -leqNgt; intro LE.
- apply suspended_implies_not_completed in SUSPi.
- exfalso; move: SUSPi => /negP COMPi; apply COMPi.
- try ( apply completion_monotonic with (t0 := t); try (by done) ) ||
- apply completion_monotonic with (t := t); try (by done).
- by apply/eqP.
- }
- {
- rewrite -EQ'; apply/eqP.
- apply same_service_in_suspension_interval; try (by done).
- by apply/andP; split; last by apply ltnW.
- }
- }
- {
- apply leq_sum1_smaller_range.
- by move => i [LEb /andP [LE EQs]]; split;
- last by apply/andP; split.
- }
- }
- }
- Qed.
-
- End SuspendsForTotalSuspension.
-
- (* In this section, we prove that a job executes just before it starts suspending. *)
- Section ExecutionBeforeSuspension.
-
- (* Assume that jobs do not execute before they arrive... *)
- Hypothesis H_jobs_must_arrive_to_execute:
- jobs_must_arrive_to_execute job_arrival sched.
-
- (* ...and nor after completion. *)
- Hypothesis H_completed_jobs_dont_execute:
- completed_jobs_dont_execute job_cost sched.
-
- (* Assume that the schedule respects self-suspensions. *)
- Hypothesis H_respects_self_suspensions: respects_self_suspensions.
-
- (* Let j be any job... *)
- Variable j: Job.
-
- (* ...that has arrived by some time t. *)
- Variable t: time.
- Hypothesis H_arrived: has_arrived job_arrival j t.
-
- (* If job j is not suspended at time t, but starts to suspend at time t + 1, ... *)
- Hypothesis H_not_suspended_at_t: ~~ suspended_at j t.
- Hypothesis H_begins_suspension: suspended_at j t.+1.
-
- (* ...then j must be scheduled at time t. *)
- Lemma executes_before_suspension:
- scheduled_at sched j t.
- Proof.
- rename H_not_suspended_at_t into NOTSUSPs, H_begins_suspension into SUSPs'.
- move: SUSPs' => /andP [NOTCOMP' /andP [GE LT]].
- apply contraT; intro NOTSCHED.
- suff BUG: suspended_at j t by rewrite BUG in NOTSUSPs.
- apply suspended_in_suspension_interval with (t := t.+1); try done.
- {
- apply contraT; rewrite negbK; intro COMP.
- suff COMP': completed_by job_cost sched j t.+1 by rewrite COMP' in NOTCOMP'.
- try ( by apply completion_monotonic with (t0 := t) ) ||
- by apply completion_monotonic with (t := t).
- }
- apply/andP; split; last by apply: (leq_ltn_trans _ LT).
- apply leq_trans with (n := time_after_last_execution job_arrival sched j t);
- last by apply last_execution_bounded_by_identity.
- apply eq_leq, same_service_implies_same_last_execution.
- rewrite /service /service_during big_nat_recr //= /service_at.
- by apply negbTE in NOTSCHED; rewrite NOTSCHED addn0.
- Qed.
-
- End ExecutionBeforeSuspension.
-
- End Lemmas.
-
- End DefiningSuspensionIntervals.
-
-End SuspensionIntervals.
diff --git a/classic/model/schedule/uni/susp/valid_schedule.v b/classic/model/schedule/uni/susp/valid_schedule.v
deleted file mode 100644
index 90eb778990a4ddd1d057c1934065bc12f7180d09..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/susp/valid_schedule.v
+++ /dev/null
@@ -1,75 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.priority prosa.classic.model.suspension.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.susp.schedule
- prosa.classic.model.schedule.uni.susp.platform.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* In this file, we construct a predicate that defines a valid suspension-aware schedule. *)
-Module ValidSuspensionAwareSchedule.
-
- Import ScheduleWithSuspensions Suspension Priority PlatformWithSuspensions.
-
- (** Basic Setup & Setting*)
- Section DefiningValidSchedule.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume any given job-level policy... *)
- Variable higher_eq_priority: JLDP_policy Job.
-
- (* ...and job suspension times. *)
- Variable job_suspension_duration: job_suspension Job.
-
- (** Definition of the Suspension-Aware Schedule *)
-
- (* Let job_cost denote any job cost function... *)
- Variable job_cost: Job -> time.
-
- (* ...and let sched_susp be any schedule. *)
- Variable sched_susp: schedule Job.
-
- (* For sched_susp to denote a valid suspension-aware schedule,
- the following properties must be satisfied. *)
-
- (* 1) All scheduled jobs must come from the arrival sequence. *)
- Let H1_jobs_come_from_arrival_sequence := jobs_come_from_arrival_sequence sched_susp arr_seq.
-
- (* 2) Jobs only execute after they arrive. *)
- Let H2_jobs_must_arrive_to_execute := jobs_must_arrive_to_execute job_arrival sched_susp.
-
- (* 3) Jobs do not execute for longer than their costs. *)
- Let H3_completed_jobs_dont_execute := completed_jobs_dont_execute job_cost sched_susp.
-
- (* 4) The schedule is work-conserving if there are non-suspended jobs. *)
- Let H4_work_conserving :=
- work_conserving job_arrival job_cost job_suspension_duration arr_seq sched_susp.
-
- (* 5) The schedule respects task priorities. *)
- Let H5_respects_priority :=
- respects_JLDP_policy job_arrival job_cost job_suspension_duration arr_seq
- sched_susp higher_eq_priority.
-
- (* 6) Suspended jobs are not allowed to be schedule. *)
- Let H6_respects_self_suspensions :=
- respects_self_suspensions job_arrival job_cost job_suspension_duration sched_susp.
-
- (* All these properties can be combined into the following predicate. *)
- Definition valid_suspension_aware_schedule :=
- H1_jobs_come_from_arrival_sequence /\
- H2_jobs_must_arrive_to_execute /\
- H3_completed_jobs_dont_execute /\
- H4_work_conserving /\
- H5_respects_priority /\
- H6_respects_self_suspensions.
-
- End DefiningValidSchedule.
-
-End ValidSuspensionAwareSchedule.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/sustainability.v b/classic/model/schedule/uni/sustainability.v
deleted file mode 100644
index de0113e7ffc28dd76a1a205a6877b1ee55dbd67a..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/sustainability.v
+++ /dev/null
@@ -1,359 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.schedule.uni.schedule
- prosa.classic.model.schedule.uni.schedulability.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module Sustainability.
-
- Import ArrivalSequence UniprocessorSchedule Schedulability.
-
- Section SustainabilityDefs.
-
- (* Consider any job type. *)
- Context {Job: eqType}.
-
- Section DefiningParameters.
-
- (** Defining Parameter Type *)
- Section ParameterType.
-
- (* We begin by defining the set of possible parameter labels, ... *)
- Inductive parameter_label :=
- | JOB_ARRIVAL
- | JOB_COST
- | JOB_DEADLINE
- | JOB_JITTER
- | JOB_SUSPENSION.
-
- (* ...which can be compared with the built-in decidable equality. *)
- Scheme Equality for parameter_label.
- Lemma eqlabelP: Equality.axiom parameter_label_beq.
- Proof.
- intros x y.
- by destruct x; destruct y; try (by apply ReflectT); try (by apply ReflectF).
- Qed.
- Canonical label_eqMixin := EqMixin eqlabelP.
- Canonical label_eqType := Eval hnf in EqType parameter_label label_eqMixin.
-
- (* Next, we associate to each label a type of function over jobs. *)
- Definition type_of_label (l: parameter_label) : Type :=
- match l with
- | JOB_ARRIVAL => Job -> instant
- | JOB_COST => Job -> time
- | JOB_DEADLINE => Job -> time
- | JOB_JITTER => Job -> time
- | JOB_SUSPENSION => Job -> time -> duration
- end.
-
- (* For each function type, we also define a default value to simplify lookups. *)
- Definition default_val (l : parameter_label) : type_of_label l :=
- match l with
- | JOB_ARRIVAL => fun _ => 0
- | JOB_COST => fun _ => 0
- | JOB_DEADLINE => fun _ => 0
- | JOB_JITTER => fun _ => 0
- | JOB_SUSPENSION => fun _ _ => 0
- end.
-
- (* Finally, we define a job parameter as a pair containing a label and a function. *)
- Record job_parameter := param
- {
- p_label : parameter_label;
- p_function : type_of_label p_label
- }.
-
- (* With the definitions above, we can declare parameter lists as follows. *)
- Variable example_job_cost: Job -> time.
- Variable example_job_suspension: Job -> time -> duration.
- Let example_params :=
- [:: param JOB_COST example_job_cost; param JOB_SUSPENSION example_job_suspension].
-
- End ParameterType.
-
- (** Looking up parameters *)
- Section ParameterLookup.
-
- (* By comparing labels, we define a function that finds a parameter in a list. *)
- Definition find_param (l : parameter_label) (s : seq job_parameter) :=
- nth (param l (default_val l)) s
- (find (fun x => p_label x == l) s).
-
- (* Next, we define a function that converts a given parameter p to the
- type of label l, given a proof EQ that the labels are the same. *)
- Let convert_parameter_type (p: job_parameter) (l: parameter_label)
- (EQ_PROOF: p_label p = l) :=
- eq_rect (p_label p) (fun x => type_of_label x) (p_function p) l EQ_PROOF.
-
- (* This allows returning the function of (type_of_label l) from a parameter p.
- (If the label of p is not l, we return a dummy default value instead.) *)
- Definition get_param_function (l: parameter_label) (p: job_parameter) : type_of_label l :=
- if (parameter_label_eq_dec (p_label p) l) is left EQ_PROOF then
- convert_parameter_type p l EQ_PROOF
- else (default_val l).
-
- (* To conclude, we define a function that returns the function with label l from a parameter list. *)
- Definition return_param (l: parameter_label) (s: seq job_parameter) : type_of_label l :=
- get_param_function l (find_param l s).
-
- (* To illustrate how these functions work, consider this simple parameter list. *)
- Variable example_job_cost: Job -> time.
- Variable example_job_suspension: Job -> time -> duration.
- Let example_params :=
- [:: param JOB_COST example_job_cost; param JOB_SUSPENSION example_job_suspension].
-
- (* In that case, JOB_COST returns the function example_job_cost, ...*)
- Example return_param_works1:
- return_param JOB_COST example_params = example_job_cost.
- Proof. by done. Qed.
-
- (* ...and JOB_SUSPENSION_DURATION returns the function example_job_suspension. *)
- Example return_param_works2:
- return_param JOB_SUSPENSION example_params = example_job_suspension.
- Proof. by done. Qed.
-
- End ParameterLookup.
-
- (** Additional properties of parameter lists *)
- Section Properties.
-
- (* Given a set of labels, we define whether two parameter lists differ only
- by the parameters with those labels.
- Note: This predicate assumes that both lists have similar, unique labels. *)
- Definition differ_only_by (variable_labels: seq parameter_label) (s1 s2: seq job_parameter) :=
- forall (param param': job_parameter),
- List.In param s1 ->
- List.In param' s2 ->
- p_label param = p_label param' ->
- p_label param \notin variable_labels ->
- param = param'.
-
- (* Next, we define a function that returns the labels of a parameter list. *)
- Definition labels_of (params: seq job_parameter) := [seq p_label p | p <- params].
-
- (* Next, we define whether a parameter list has unique labels. *)
- Definition has_unique_labels (params: seq job_parameter) := uniq (labels_of params).
-
- (* We also define whether a parameter list corresponds to a given set of labels. *)
- Definition corresponding_labels (params: seq job_parameter) (labels: seq parameter_label) :=
- forall l, l \in labels_of params <-> l \in labels.
-
- (* Finally, we prove that in any list of unique parameters, return_param always
- returns the corresponding parameter. *)
- Lemma found_param_label:
- forall (params: seq job_parameter) (p: job_parameter) (label: parameter_label),
- has_unique_labels params ->
- List.In p params ->
- p_label p = label ->
- p = param label (return_param label params).
- Proof.
- induction params as [| p0 params']; first by done.
- move => p label /= /andP [NOTIN UNIQ] IN EQ /=.
- move: IN => [EQ0 | IN].
- {
- subst p0; rewrite /return_param /find_param /= EQ eq_refl /=.
- by destruct p, label; simpl in *; subst.
- }
- {
- rewrite /return_param /find_param /=.
- case EQ': (_ == _); last by apply IHparams'.
- move: EQ' => /eqP EQ'; rewrite EQ' in NOTIN.
- move: NOTIN => /negP NOTIN; exfalso; apply NOTIN.
- by apply/mapP2; exists p.
- }
- Qed.
-
- End Properties.
-
- End DefiningParameters.
-
- (** Definition of sustainability for scheduling policies. *)
- Section SustainabilityPolicy.
-
- (* First, we define the set of possible labels for the job parameters. *)
- Variable all_labels: seq parameter_label.
-
- (* Next, let's consider any good schedulability property of a job, such as
- "no deadline miss" or "response time bounded by R".
- Given a sequence of job parameters, a schedule and a job j in this schedule,
- the predicate indicates whether j satisfies the schedulability property. *)
- Variable is_schedulable:
- seq job_parameter -> schedule Job -> Job -> bool.
-
- (* Also, consider any predicate that, given a parameter list, states whether the arrival
- sequence and schedule belong to a certain task model. *)
- Variable belongs_to_task_model:
- seq job_parameter -> arrival_sequence Job -> schedule Job -> Prop.
-
- (* Let sustainable_param denote the label of the parameter for which we claim sustainability. *)
- Variable sustainable_param: parameter_label.
-
- (* Let better_params denote any total order relation over the old and new values of the
- sustainable parameter, i.e., it indicates: "the second parameter is better than the first".
- For example, in many task models, lower job costs lead to better schedules, so a valid
- predicate would be: (fun job_cost job_cost' => forall j, job_cost j >= job_cost' j). *)
- Variable has_better_params: (type_of_label sustainable_param) ->
- (type_of_label sustainable_param) -> Prop.
-
- (* Next, we define whether the sustainable parameter becomes better when moving from list
- params to params'. *)
- Definition sustainable_param_becomes_better (params params': seq job_parameter) :=
- let P := return_param sustainable_param params in
- let P' := return_param sustainable_param params' in
- has_better_params P P'.
-
- Section VaryingParameters.
-
- (* Let variable_params denote the set of parameters that are allowed to vary. *)
- Variable variable_params: seq parameter_label.
-
- (* Now we define whether both the sustainable and the variable parameters belong to a parameter list. *)
- Definition sustainable_and_varying_params_in (params: seq job_parameter) :=
- forall label,
- label \in sustainable_param :: variable_params ->
- label \in labels_of params.
-
- (* Next, we define whether a parameter list has consistent labels. Since
- we'll have to quantify over many parameter lists, this prevents issues
- with empty/invalid parameter lists. *)
- Definition has_consistent_labels (params: seq job_parameter) :=
- has_unique_labels params /\
- corresponding_labels params all_labels /\
- sustainable_and_varying_params_in params.
-
- (* Next, we define whether all jobs sets with given params are schedulable... *)
- Definition jobs_are_schedulable_with (params: seq job_parameter) :=
- forall arr_seq sched j,
- belongs_to_task_model params arr_seq sched ->
- is_schedulable params sched j.
-
- (* ...and also define whether the job sets that only differ from the given params
- by the 'set of variable parameters' are all schedulable. *)
- Definition jobs_are_V_schedulable_with (params: seq job_parameter) :=
- forall (similar_params: seq job_parameter),
- has_consistent_labels similar_params ->
- differ_only_by variable_params params similar_params ->
- jobs_are_schedulable_with similar_params.
-
- (* Then, we say that the scheduling policy is weakly-sustainable with sustainable_param
- and variable_params iff the following holds:
- if jobs are V-schedulable with the original parameters, then they are also
- schedulable with better parameters (according to the has_better_params relation). *)
- Definition weakly_sustainable :=
- forall (params better_params: seq job_parameter),
- has_consistent_labels params ->
- has_consistent_labels better_params ->
- differ_only_by [::sustainable_param] params better_params ->
- sustainable_param_becomes_better params better_params ->
- jobs_are_V_schedulable_with params ->
- jobs_are_schedulable_with better_params.
-
- (* Next, using the contrapositive of weakly_sustainable, we provide
- an alternative definition of weak sustainability. *)
- Section AlternativeDefinition.
-
- (* First, let's define whether the sustainable parameter becomes
- worse when switching from params to params'. *)
- Definition sustainable_param_becomes_worse (params params': seq job_parameter) :=
- let P := return_param sustainable_param params in
- let P' := return_param sustainable_param params' in
- has_better_params P' P.
-
- (* Next, we define whether jobs are not schedulable with a given set of parameters. *)
- Definition jobs_are_not_schedulable_with (params: seq job_parameter) :=
- exists arr_seq sched j,
- belongs_to_task_model params arr_seq sched /\
- ~~ is_schedulable params sched j.
-
- (* Based on that, we formalize the alternative definition of weakly sustainable. *)
- Definition weakly_sustainable_contrapositive :=
- forall params params_worse,
- has_consistent_labels params ->
- has_consistent_labels params_worse ->
- jobs_are_not_schedulable_with params ->
- differ_only_by [:: sustainable_param] params params_worse ->
- sustainable_param_becomes_worse params params_worse ->
- exists params_worse',
- has_consistent_labels params_worse' /\
- differ_only_by variable_params params_worse params_worse' /\
- jobs_are_not_schedulable_with params_worse'.
-
- (* Assume De Morgan's law for propositional and predicate logic. *)
- Hypothesis H_classical_forall_exists:
- forall (T: Type) (P: T -> Prop),
- ~ (forall x, ~ P x) -> exists x, P x.
- Hypothesis H_classical_and_or:
- forall (P Q: Prop), ~ (P /\ Q) -> ~ P \/ ~ Q.
-
- (* Then, we can prove the equivalence of the two definitions. *)
- Theorem weak_sustainability_equivalence:
- weakly_sustainable <-> weakly_sustainable_contrapositive.
- Proof.
- rename H_classical_forall_exists into NOTALL, H_classical_and_or into ANDOR.
- split.
- {
- intros WEAK params params_worse CONS CONSworse NOTSCHED DIFF WORSE.
- apply NOTALL; intro ALL.
- unfold weakly_sustainable in *.
- specialize (WEAK params_worse params CONSworse CONS).
- feed WEAK.
- {
- intros p p' IN IN' EQ NOTIN; symmetry.
- apply DIFF; try by done.
- by rewrite -EQ.
- }
- feed WEAK; first by done.
- feed WEAK.
- {
- intros params' CONS' DIFF'; specialize (ALL params').
- apply ANDOR in ALL; move: ALL => [BUG | ALL] //.
- apply ANDOR in ALL; move: ALL => [BUG | ALL] //.
- unfold jobs_are_not_schedulable_with in *.
- intros arr_seq sched j BELONGS; apply contraT; intro NOTSCHED'.
- by exfalso; apply ALL; exists arr_seq, sched, j.
- }
- unfold jobs_are_schedulable_with, jobs_are_not_schedulable_with in *.
- clear -WEAK NOTSCHED.
- move: NOTSCHED => [arr_seq [sched [j [BELONGS NOTSCHED]]]].
- specialize (WEAK arr_seq sched j BELONGS).
- by rewrite WEAK in NOTSCHED.
- }
- {
- intros WEAK params better_params CONS CONSbetter DIFF BETTER VSCHED.
- intros arr_seq sched j BELONGS; apply contraT; intros NOTSCHED.
- unfold weakly_sustainable_contrapositive in *.
- feed (WEAK better_params params); first by done.
- feed WEAK; first by done.
- feed WEAK; first by exists arr_seq, sched, j.
- feed WEAK.
- {
- intros p p' IN IN' EQ NOTIN; symmetry.
- apply DIFF; try by done.
- by rewrite -EQ.
- }
- feed WEAK; first by done.
- move: WEAK => [params_worse' [CONS' [DIFF' NOTSCHED']]].
- unfold jobs_are_V_schedulable_with in *.
- specialize (VSCHED params_worse' CONS' DIFF').
- move: NOTSCHED' => [arr_seq' [sched' [j' [BELONGS' NOTSCHED']]]].
- specialize (VSCHED arr_seq' sched' j' BELONGS').
- by rewrite VSCHED in NOTSCHED'.
- }
- Qed.
-
- End AlternativeDefinition.
-
- End VaryingParameters.
-
- (* Also, we say that the scheduling policy is strongly-sustainable
- with sustainable_param iff it is weakly-sustainable with
- sustainable_param and the set of variable parameters is empty. *)
- Definition strongly_sustainable := weakly_sustainable [::].
-
- End SustainabilityPolicy.
-
- End SustainabilityDefs.
-
- Global Arguments job_parameter: clear implicits.
-
-End Sustainability.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/transformation/construction.v b/classic/model/schedule/uni/transformation/construction.v
deleted file mode 100644
index 8e6b88202ed28002a2d1556471935dfee6c77f43..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/transformation/construction.v
+++ /dev/null
@@ -1,170 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence.
-Require Import prosa.classic.model.schedule.uni.schedule.
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat fintype bigop seq path finfun.
-
-Module ScheduleConstruction.
-
- Import Job ArrivalSequence UniprocessorSchedule.
-
- (* In this section, we construct a schedule recursively by augmenting prefixes. *)
- Section ConstructionFromPrefixes.
-
- Context {Job: eqType}.
-
- (* Let arr_seq be any arrival sequence.*)
- Variable arr_seq: arrival_sequence Job.
-
- (* Assume we are given a function that takes an existing schedule prefix
- up to interval [0, t) and returns what should be scheduled at time t. *)
- Variable build_schedule:
- schedule Job -> time -> option Job.
-
- (* Then, starting from a base schedule, ... *)
- Variable base_sched: schedule Job.
-
- (* ...we can update individual times using the build_schedule function, ... *)
- Definition update_schedule (prev_sched: schedule Job)
- (t_next: time) : schedule Job :=
- fun t =>
- if t == t_next then
- build_schedule prev_sched t
- else prev_sched t.
-
- (* ...which recursively generates schedule prefixes up to time t_max. *)
- Fixpoint schedule_prefix (t_max: time) : schedule Job :=
- if t_max is t_prev.+1 then
- update_schedule (schedule_prefix t_prev) t_prev.+1
- else
- update_schedule base_sched 0.
-
- (* Based on the schedule prefixes, we construct a complete schedule. *)
- Definition build_schedule_from_prefixes := fun t => schedule_prefix t t.
-
- (* In this section, we prove some lemmas about the construction. *)
- Section Lemmas.
-
- (* Let sched be the generated schedule. *)
- Let sched := build_schedule_from_prefixes.
-
- (* First, we show that the scheduler preserves its prefixes. *)
- Lemma prefix_construction_same_prefix:
- forall t t_max,
- t <= t_max ->
- schedule_prefix t_max t = sched t.
- Proof.
- intros t t_max LEt.
- induction t_max;
- first by rewrite leqn0 in LEt; move: LEt => /eqP EQ; subst.
- rewrite leq_eqVlt in LEt.
- move: LEt => /orP [/eqP EQ | LESS]; first by subst.
- {
- feed IHt_max; first by done.
- unfold schedule_prefix, update_schedule at 1.
- assert (FALSE: t == t_max.+1 = false).
- {
- by apply negbTE; rewrite neq_ltn LESS orTb.
- } rewrite FALSE.
- by rewrite -IHt_max.
- }
- Qed.
-
- Section ServiceDependent.
-
- (* If the generation function only depends on the service
- received by jobs during the schedule prefix, ...*)
- Hypothesis H_depends_only_on_service:
- forall sched1 sched2 t,
- (forall j, service sched1 j t = service sched2 j t) ->
- build_schedule sched1 t = build_schedule sched2 t.
-
- (* ...then we can prove that the final schedule, at any time t,
- is exactly the result of the construction function. *)
- Lemma service_dependent_schedule_construction:
- forall t,
- sched t = build_schedule sched t.
- Proof.
- intros t.
- feed (prefix_construction_same_prefix t t); [by done | intros EQ].
- rewrite -{}EQ.
- induction t as [t IH] using strong_ind.
- destruct t.
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_service.
- by intros j; rewrite /service /service_during big_geq // big_geq //.
- }
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_service.
- intros j; rewrite /service /service_during.
- rewrite big_nat_recr //= big_nat_recr //=; f_equal.
- apply eq_big_nat; move => i /= LT.
- rewrite /service_at /scheduled_at.
- by rewrite prefix_construction_same_prefix; last by apply ltnW.
- }
- Qed.
-
- End ServiceDependent.
-
- Section PrefixDependent.
-
- (* If the generation function only depends on the schedule prefix, ... *)
- Hypothesis H_depends_only_on_prefix:
- forall (sched1 sched2: schedule Job) t,
- (forall t0, t0 < t -> sched1 t0 = sched2 t0) ->
- build_schedule sched1 t = build_schedule sched2 t.
-
- (* ...then we can prove that the final schedule, at any time t,
- is exactly the result of the construction function. *)
- Lemma prefix_dependent_schedule_construction:
- forall t, sched t = build_schedule sched t.
- Proof.
- intros t.
- feed (prefix_construction_same_prefix t t); [by done | intros EQ].
- rewrite -{}EQ.
- induction t using strong_ind.
- destruct t.
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_prefix.
- by intros t; rewrite ltn0.
- }
- {
- rewrite /= /update_schedule eq_refl.
- apply H_depends_only_on_prefix.
- intros t0 LT.
- by rewrite prefix_construction_same_prefix.
- }
- Qed.
-
- End PrefixDependent.
-
- Section ImmediateProperty.
-
- Variable P: option Job -> Prop.
-
- Hypothesis H_immediate_property:
- forall sched_prefix t, P (build_schedule sched_prefix t).
-
- Lemma immediate_property_of_schedule_construction:
- forall t, P (sched t).
- Proof.
- destruct t.
- {
- rewrite /sched /build_schedule_from_prefixes /schedule_prefix /update_schedule eq_refl.
- by apply H_immediate_property.
- }
- {
- rewrite /sched /build_schedule_from_prefixes /schedule_prefix /update_schedule eq_refl.
- by apply H_immediate_property.
- }
- Qed.
-
- End ImmediateProperty.
-
- End Lemmas.
-
- End ConstructionFromPrefixes.
-
-End ScheduleConstruction.
\ No newline at end of file
diff --git a/classic/model/schedule/uni/workload.v b/classic/model/schedule/uni/workload.v
deleted file mode 100644
index e4cc66d2512e543d382a03e2e4dd00d9500c240f..0000000000000000000000000000000000000000
--- a/classic/model/schedule/uni/workload.v
+++ /dev/null
@@ -1,136 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.time prosa.classic.model.arrival.basic.task prosa.classic.model.arrival.basic.job prosa.classic.model.arrival.basic.arrival_sequence
- prosa.classic.model.priority.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Module Workload.
-
- Import Time ArrivalSequence Priority.
-
- (* In this section, we define the notion of workload for sets of jobs. *)
- Section WorkloadDefs.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* ...and any (finite) set of jobs. *)
- Variable jobs: seq Job.
-
- (* First, we define the workload for generic sets of jobs. *)
- Section WorkloadOfJobs.
-
- (* Given any predicate over Jobs, ... *)
- Variable P: Job -> bool.
-
- (* ...we define the total workload of the jobs that satisfy such a predicate. *)
- Definition workload_of_jobs := \sum_(j <- jobs | P j) job_cost j.
-
- End WorkloadOfJobs.
-
- (* Then, we define the workload of tasks with higher or equal priority
- under FP policies. *)
- Section PerTaskPriority.
-
- (* Consider any FP policy that indicates whether a task has
- higher or equal priority. *)
- Variable higher_eq_priority: FP_policy Task.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: Task.
-
- (* Recall the notion of a job of higher or equal priority. *)
- Let of_higher_or_equal_priority j :=
- higher_eq_priority (job_task j) tsk.
-
- (* Then, we define the workload of all jobs of tasks with
- higher-or-equal priority than tsk. *)
- Definition workload_of_higher_or_equal_priority_tasks :=
- workload_of_jobs of_higher_or_equal_priority.
-
- End PerTaskPriority.
-
- (* Then, we define the workload of jobs with higher or equal priority
- under JLFP policies. *)
- Section PerJobPriority.
-
- (* Consider any JLFP policy that indicates whether a job has
- higher or equal priority. *)
- Variable higher_eq_priority: JLFP_policy Job.
-
- (* Let j be the job to be analyzed. *)
- Variable j: Job.
-
- (* Recall the notion of a job of higher or equal priority. *)
- Let of_higher_or_equal_priority j_hp := higher_eq_priority j_hp j.
-
- (* Then, we define the workload of higher or equal priority of all jobs
- with higher-or-equal priority than j. *)
- Definition workload_of_higher_or_equal_priority_jobs :=
- workload_of_jobs of_higher_or_equal_priority.
-
- End PerJobPriority.
-
- End WorkloadDefs.
-
- (* We also define the workload of a task. *)
- Section TaskWorkload.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence. *)
- Variable arr_seq: arrival_sequence Job.
-
- (* Let tsk be the task to be analyzed. *)
- Variable tsk: Task.
-
- (* Recall the notion of a job of task tsk. *)
- Let of_task_tsk j := job_task j == tsk.
-
- (* We define the task workload as the workload of jobs of task tsk. *)
- Definition task_workload jobs := workload_of_jobs job_cost jobs of_task_tsk.
-
- (* Next, we recall the definition of the task workload in interval [t1, t2). *)
- Definition task_workload_between (t1 t2: time) :=
- task_workload (jobs_arrived_between arr_seq t1 t2).
-
- End TaskWorkload.
-
- (* In this section, we prove a few basic lemmas about the workload. *)
- Section BasicLemmas.
-
- Context {Job: eqType}.
- Variable job_arrival: Job -> time.
- Variable job_cost: Job -> time.
-
- (* Consider any job arrival sequence... *)
- Variable arr_seq: arrival_sequence Job.
-
- (* For simplicity, let's define some local names. *)
- Let arrivals_between := jobs_arrived_between arr_seq.
-
- (* We prove that workload can be splited into two parts. *)
- Lemma workload_of_jobs_cat:
- forall t t1 t2 P,
- t1 <= t <= t2 ->
- workload_of_jobs job_cost (arrivals_between t1 t2) P =
- workload_of_jobs job_cost (arrivals_between t1 t) P
- + workload_of_jobs job_cost (arrivals_between t t2) P.
- Proof.
- move => t t1 t2 P /andP [GE LE].
- rewrite /workload_of_jobs /arrivals_between.
- by rewrite (job_arrived_between_cat _ _ t) // big_cat.
- Qed.
-
- End BasicLemmas.
-
-End Workload.
\ No newline at end of file
diff --git a/classic/model/suspension.v b/classic/model/suspension.v
deleted file mode 100644
index ea74aa71d24b7aeffc8ce23cb7ff584d991e21ae..0000000000000000000000000000000000000000
--- a/classic/model/suspension.v
+++ /dev/null
@@ -1,69 +0,0 @@
-Require Import prosa.classic.util.all.
-Require Import prosa.classic.model.arrival.basic.arrival_sequence.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq bigop.
-
-Module Suspension.
-
- Import ArrivalSequence.
-
- (* First, we define the actual job suspension times. *)
- Section SuspensionTimes.
-
- (* Consider any type of job. *)
- Variable Job: eqType.
-
- (* We define job suspension as a function that takes a job in the arrival
- sequence and its current service and returns how long the job must
- suspend next. *)
- Definition job_suspension := Job -> (* job *)
- time -> (* current service *)
- duration. (* duration of next suspension *)
-
- End SuspensionTimes.
-
- (* Next, we define the total suspension time incurred by a job. *)
- Section TotalSuspensionTime.
-
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
-
- (* Consider any job suspension function. *)
- Variable next_suspension: job_suspension Job.
-
- (* Let j be any job. *)
- Variable j: Job.
-
- (* We define the total suspension time incurred by job j as the cumulative
- duration of each suspension point t in the interval [0, job_cost j). *)
- Definition total_suspension :=
- \sum_(0 <= t < job_cost j) (next_suspension j t).
-
- End TotalSuspensionTime.
-
- (* In this section, we define the dynamic self-suspension model as an
- upper bound on the total suspension times. *)
- Section DynamicSuspensions.
-
- Context {Task: eqType}.
- Context {Job: eqType}.
- Variable job_cost: Job -> time.
- Variable job_task: Job -> Task.
-
- (* Consider any job arrival sequence subject to job suspensions. *)
- Variable next_suspension: job_suspension Job.
-
- (* Recall the definition of total suspension time. *)
- Let total_job_suspension := total_suspension job_cost next_suspension.
-
- (* Next, assume that for each task a suspension bound is known. *)
- Variable suspension_bound: Task -> duration.
-
- (* Then, we say that the arrival sequence satisfies the dynamic
- suspension model iff the total suspension time of each job is no
- larger than the suspension bound of its task. *)
- Definition dynamic_suspension_model :=
- forall j, total_job_suspension j <= suspension_bound (job_task j).
-
- End DynamicSuspensions.
-
-End Suspension.
\ No newline at end of file
diff --git a/classic/model/time.v b/classic/model/time.v
deleted file mode 100644
index d3b100ef79c05baf845a0655b46983fa34400a90..0000000000000000000000000000000000000000
--- a/classic/model/time.v
+++ /dev/null
@@ -1,8 +0,0 @@
-Module Time.
-
- (* Time is defined as a natural number. *)
- Definition time := nat.
- Definition duration := time.
- Definition instant := time.
-
-End Time.
\ No newline at end of file
diff --git a/classic/util/all.v b/classic/util/all.v
deleted file mode 100644
index 3562aa9460cf88c355702fefe8be36c9835b6bad..0000000000000000000000000000000000000000
--- a/classic/util/all.v
+++ /dev/null
@@ -1,20 +0,0 @@
-Require Export mathcomp.zify.zify.
-Require Export prosa.classic.util.tactics.
-Require Export prosa.classic.util.notation.
-Require Export prosa.classic.util.bigcat.
-Require Export prosa.classic.util.pick.
-Require Export prosa.classic.util.bigord.
-Require Export prosa.classic.util.counting.
-Require Export prosa.classic.util.div_mod.
-Require Export prosa.classic.util.ord_quantifier.
-Require Export prosa.classic.util.sum.
-Require Export prosa.classic.util.fixedpoint.
-Require Export prosa.classic.util.induction.
-Require Export prosa.classic.util.list.
-Require Export prosa.classic.util.nat.
-Require Export prosa.classic.util.powerset.
-Require Export prosa.classic.util.sorting.
-Require Export prosa.classic.util.minmax.
-Require Export prosa.classic.util.seqset.
-Require Export prosa.classic.util.step_function.
-Require Export prosa.util.epsilon.
diff --git a/classic/util/bigcat.v b/classic/util/bigcat.v
deleted file mode 100644
index 0b701ddcdc51cd8113fea9d730f921b6292bd85c..0000000000000000000000000000000000000000
--- a/classic/util/bigcat.v
+++ /dev/null
@@ -1,103 +0,0 @@
-Require Export prosa.util.bigcat.
-
-Require Import prosa.classic.util.tactics prosa.classic.util.notation prosa.classic.util.bigord.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Lemmas about the big concatenation operator. *)
-Section BigCatLemmas.
-
- Lemma mem_bigcat_ord:
- forall (T: eqType) x n (j: 'I_n) (f: 'I_n -> list T),
- j < n ->
- x \in (f j) ->
- x \in \cat_(i < n) (f i).
- Proof.
- intros T x n j f LE IN; rewrite (big_mkord_ord nil).
- rewrite -(big_mkord (fun x => true)).
- apply mem_bigcat_nat with (j := j);
- [by apply/andP; split | by rewrite eq_fun_ord_to_nat].
- Qed.
-
- Lemma mem_bigcat_ord_exists :
- forall (T: eqType) x n (f: 'I_n -> list T),
- x \in \cat_(i < n) (f i) ->
- exists i, x \in (f i).
- Proof.
- intros T x n f IN.
- induction n; first by rewrite big_ord0 in_nil in IN.
- {
- rewrite big_ord_recr /= mem_cat in IN.
- move: IN => /orP [HEAD | TAIL].
- {
- apply IHn in HEAD; destruct HEAD as [x0 IN].
- by eexists (widen_ord _ x0); apply IN.
- }
- {
- by exists ord_max; desf.
- }
- }
- Qed.
-
- Lemma bigcat_ord_uniq :
- forall (T: eqType) n (f: 'I_n -> list T),
- (forall i, uniq (f i)) ->
- (forall x i1 i2,
- x \in (f i1) -> x \in (f i2) -> i1 = i2) ->
- uniq (\cat_(i < n) (f i)).
- Proof.
- intros T n f SINGLE UNIQ.
- induction n; first by rewrite big_ord0.
- {
- rewrite big_ord_recr cat_uniq; apply/andP; split.
- {
- apply IHn; first by done.
- intros x i1 i2 IN1 IN2.
- exploit (UNIQ x);
- [by apply IN1 | by apply IN2 | intro EQ; inversion EQ].
- by apply ord_inj.
- }
- apply /andP; split; last by apply SINGLE.
- {
- rewrite -all_predC; apply/allP; intros x INx.
-
- simpl; apply/negP; unfold not; intro BUG.
- rewrite -big_ord_narrow in BUG.
- rewrite big_mkcond /= in BUG.
- have EX := mem_bigcat_ord_exists T x n.+1 _.
- apply EX in BUG; clear EX; desf.
- apply UNIQ with (i1 := ord_max) in BUG; last by done.
- by desf; unfold ord_max in *; rewrite /= ltnn in Heq.
- }
- }
- Qed.
-
- Lemma map_bigcat_ord {T} {T'} n (f: 'I_n -> seq T) (g: T -> T') :
- map g (\cat_(i < n) (f i)) = \cat_(i < n) (map g (f i)).
- Proof.
- destruct n; first by rewrite 2!big_ord0.
- induction n; first by rewrite 2!big_ord_recr 2!big_ord0.
- rewrite big_ord_recr [\cat_(cpu < n.+2)_]big_ord_recr /=.
- by rewrite map_cat; f_equal; apply IHn.
- Qed.
-
- Lemma size_bigcat_ord {T} n (f: 'I_n -> seq T) :
- size (\cat_(i < n) (f i)) = \sum_(i < n) (size (f i)).
- Proof.
- destruct n; first by rewrite 2!big_ord0.
- induction n; first by rewrite 2!big_ord_recr 2!big_ord0 /= add0n.
- rewrite big_ord_recr [\sum_(i0 < n.+2)_]big_ord_recr size_cat /=.
- by f_equal; apply IHn.
- Qed.
-
- Lemma size_bigcat_ord_max {T} n (f: 'I_n -> seq T) m :
- (forall x, size (f x) <= m) ->
- size (\cat_(i < n) (f i)) <= m*n.
- Proof.
- intros SIZE.
- rewrite size_bigcat_ord.
- apply leq_trans with (n := \sum_(i0 < n) m);
- last by rewrite big_const_ord iter_addn addn0.
- by apply leq_sum; ins; apply SIZE.
- Qed.
-
-End BigCatLemmas.
\ No newline at end of file
diff --git a/classic/util/bigord.v b/classic/util/bigord.v
deleted file mode 100644
index 19e2d698492eccb33371c884d17f56aead319e2b..0000000000000000000000000000000000000000
--- a/classic/util/bigord.v
+++ /dev/null
@@ -1,41 +0,0 @@
-Require Import prosa.classic.util.tactics.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Lemmas about big operators over Ordinals that use Ordinal functions.
- There is no support for them in ssreflect. *)
-Section BigOrdFunOrd.
-
- Definition fun_ord_to_nat {n} {T} (x0: T) (f: 'I_n -> T) : nat -> T.
- (* if x < n, apply the function f in the (Ordinal x: 'I_n), else return default x0. *)
- intro x; destruct (x < n) eqn:LT;
- [by apply (f (Ordinal LT)) | by apply x0].
- Defined.
-
- Lemma eq_fun_ord_to_nat :
- forall n {T: Type} x0 (f: 'I_n -> T) (x: 'I_n),
- (fun_ord_to_nat x0 f) x = f x.
- Proof.
- ins; unfold fun_ord_to_nat; des_eqrefl.
- by f_equal; apply ord_inj.
- by destruct x; ins; rewrite i in EQ.
- Qed.
-
- Lemma eq_bigr_ord T n op idx r (P : pred 'I_n)
- (F1: nat -> T) (F2: 'I_n -> T) :
- (forall i, P i -> F1 i = F2 i) ->
- \big[op/idx]_(i <- r | P i) F1 i = \big[op/idx]_(i <- r | P i) F2 i.
- Proof.
- induction r; ins; first by rewrite 2!big_nil.
- rewrite 2!big_cons; destruct (P a) eqn:EQ;
- by rewrite IHr; ins; rewrite H; ins.
- Qed.
-
- Lemma big_mkord_ord {T} {n} {op} {idx} x0 (P : pred 'I_n) (F: 'I_n -> T) :
- \big[op/idx]_(i < n | P i) F i =
- \big[op/idx]_(i < n | P i) (fun_ord_to_nat x0 F) i.
- Proof.
- have EQ := eq_bigr_ord T n op idx _ _ (fun_ord_to_nat x0 F) F.
- rewrite EQ; [by ins | by ins; rewrite eq_fun_ord_to_nat].
- Qed.
-
-End BigOrdFunOrd.
\ No newline at end of file
diff --git a/classic/util/counting.v b/classic/util/counting.v
deleted file mode 100644
index 03f4b6251ad79c2f542ea8e565edca63f8600c21..0000000000000000000000000000000000000000
--- a/classic/util/counting.v
+++ /dev/null
@@ -1,104 +0,0 @@
-Require Import prosa.classic.util.tactics prosa.classic.util.ord_quantifier.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Additional lemmas about counting. *)
-Section Counting.
-
- Lemma count_or :
- forall (T: eqType) (l: seq T) P Q,
- count (fun x => P x || Q x) l <= count P l + count Q l.
- Proof.
- intros T l P Q; rewrite -count_predUI.
- apply leq_trans with (n := count (predU P Q) l);
- last by apply leq_addr.
- by apply sub_count; red; unfold predU; simpl.
- Qed.
-
- Lemma sub_in_count :
- forall (T: eqType) (l: seq T) (P1 P2: T -> bool),
- (forall x, x \in l -> P1 x -> P2 x) ->
- count P1 l <= count P2 l.
- Proof.
- intros T l P1 P2 SUB.
- apply leq_trans with (n := count (fun x => P1 x && (x \in l)) l);
- first by apply eq_leq, eq_in_count; red; move => x INx; rewrite INx andbT.
- by apply sub_count; red; move => x /andP [Px INx]; apply SUB.
- Qed.
-
- Lemma count_sub_uniqr :
- forall (T: eqType) (l1 l2: seq T) P,
- uniq l1 ->
- {subset l1 <= l2} ->
- count P l1 <= count P l2.
- Proof.
- intros T l1 l2 P UNIQ SUB.
- rewrite -!size_filter uniq_leq_size ?filter_uniq // => x.
- by rewrite !mem_filter =>/andP [-> /SUB].
- Qed.
-
- Lemma count_pred_inj :
- forall (T: eqType) (l: seq T) (P: T -> bool),
- uniq l ->
- (forall x1 x2, P x1 -> P x2 -> x1 = x2) ->
- count P l <= 1.
- Proof.
- intros T l P UNIQ INJ.
- induction l as [| x l']; [by done | simpl in *].
- {
- move: UNIQ => /andP [NOTIN UNIQ].
- specialize (IHl' UNIQ).
- rewrite leq_eqVlt in IHl'.
- move: IHl' => /orP [/eqP ONE | ZERO]; last first.
- {
- rewrite ltnS leqn0 in ZERO.
- by move: ZERO => /eqP ->; rewrite addn0 leq_b1.
- }
- destruct (P x) eqn:Px; last by rewrite add0n ONE.
- {
- move: ONE => /eqP ONE.
- rewrite eqn_leq in ONE; move: ONE => /andP [_ ONE].
- rewrite -has_count in ONE.
- move: ONE => /hasP ONE; destruct ONE as [y IN Py].
- specialize (INJ x y Px Py); subst.
- by rewrite IN in NOTIN.
- }
- }
- Qed.
-
- Lemma count_exists :
- forall (T: eqType) (l: seq T) n (P: T -> 'I_n -> bool),
- uniq l ->
- (forall y x1 x2, P x1 y -> P x2 y -> x1 = x2) ->
- count (fun (y: T) => [exists x in 'I_n, P y x]) l <= n.
- Proof.
- intros T l n P UNIQ INJ.
- induction n.
- {
- apply leq_trans with (n := count pred0 l); last by rewrite count_pred0.
- apply sub_count; red; intro x.
- by rewrite exists_ord0 //.
- }
- {
- apply leq_trans with (n := n + 1); last by rewrite addn1.
- apply leq_trans with (n := count (fun y => [exists x in 'I_n, P y (widen_ord (leqnSn n) x)] || P y ord_max) l).
- {
- apply eq_leq, eq_count; red; intro x.
- by rewrite exists_recr //.
- }
- eapply (leq_trans (count_or _ _ _ _)).
- apply leq_add.
- {
- apply IHn.
- {
- intros y x1 x2 P1 P2.
- by specialize (INJ (widen_ord (leqnSn n) y) x1 x2 P1 P2).
- }
- }
- {
- apply count_pred_inj; first by done.
- by intros x1 x2 P1 P2; apply INJ with (y := ord_max).
- }
- }
- Qed.
-
-End Counting.
diff --git a/classic/util/div_mod.v b/classic/util/div_mod.v
deleted file mode 100644
index acbdd2e26e244bff3ab176709fe302d58b89e929..0000000000000000000000000000000000000000
--- a/classic/util/div_mod.v
+++ /dev/null
@@ -1,236 +0,0 @@
-Require Export prosa.util.div_mod.
-
-Require Import Arith Nat.
-Require Import prosa.classic.util.tactics mathcomp.zify.zify prosa.classic.util.nat.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div.
-
-
- Definition div_floor (x y: nat) : nat := x %/ y.
- Definition div_ceil (x y: nat) := if y %| x then x %/ y else (x %/ y).+1.
-
- Lemma ltn_div_trunc :
- forall m n d,
- d > 0 ->
- m %/ d < n %/ d ->
- m < n.
- Proof.
- intros m n d GT0 DIV; rewrite ltn_divLR in DIV; last by ins.
- by apply leq_trans with (n := n %/ d * d);
- [by ins| by apply leq_trunc_div].
- Qed.
-
- Lemma subndiv_eq_mod:
- forall n d, n - n %/ d * d = n %% d.
- Proof.
- by ins; rewrite {1}(divn_eq n d) addnC -addnBA // subnn addn0.
- Qed.
-
- Lemma divSn_cases :
- forall n d,
- d > 1 ->
- (n %/ d = n.+1 %/d /\ n %% d + 1 = n.+1 %% d) \/
- (n %/ d + 1 = n.+1 %/ d).
- Proof.
- ins; set x := n %/ d; set y := n %% d.
- assert (GT0: d > 0); first by apply ltn_trans with (n := 1).
- destruct (ltngtP y (d - 1)) as [LTN | BUG | GE]; [left | | right];
- first 1 last.
- {
- exploit (@ltn_pmod n d); [by apply GT0 | intro LTd; fold y in LTd].
- rewrite -(ltn_add2r 1) [y+1]addn1 ltnS in BUG.
- rewrite addnBAC in BUG; last by apply GT0.
- rewrite -addnBA // subnn addn0 in BUG.
- by apply (leq_ltn_trans BUG) in LTd; rewrite ltnn in LTd.
- }
-
- {
- (* Case 1: y = d - 1*)
- move: GE => /eqP GE; rewrite -(eqn_add2r 1) in GE.
- rewrite addnBAC in GE; last by apply GT0.
- rewrite -addnBA // subnn addn0 in GE.
- move: GE => /eqP GE.
- apply f_equal with (f := fun x => x %/ d) in GE.
- rewrite divnn GT0 /= in GE.
- unfold x; rewrite -GE.
- rewrite -divnMDl; last by apply GT0.
- f_equal; rewrite addnA.
- by rewrite -divn_eq addn1.
- }
- {
- assert (EQDIV: n %/ d = n.+1 %/ d).
- {
- apply/eqP; rewrite eqn_leq; apply/andP; split;
- first by apply leq_div2r, leqnSn.
- rewrite leq_divRL; last by apply GT0.
- rewrite -ltnS {2}(divn_eq n.+1 d).
- rewrite -{1}[_ %/ d * d]addn0 ltn_add2l.
- unfold y in *.
- rewrite ltnNge; apply/negP; unfold not; intro BUG.
- rewrite leqn0 in BUG; move: BUG => /eqP BUG.
- rewrite -(modnn d) -addn1 in BUG.
- destruct d; first by rewrite sub0n in LTN.
- move: BUG; move/eqP; rewrite -[d.+1]addn1 eqn_modDr [d+1]addn1; move => /eqP BUG.
- rewrite BUG -[d.+1]addn1 -addnBA // subnn addn0 in LTN.
- by rewrite modn_small in LTN;
- [by rewrite ltnn in LTN | by rewrite addn1 ltnSn].
- }
- (* Case 2: y < d - 1 *)
- split; first by rewrite -EQDIV.
- {
- unfold x, y in *.
- rewrite -2!subndiv_eq_mod.
- rewrite addnBAC ?addn1; last by apply leq_trunc_div.
- rewrite EQDIV; apply/eqP.
- rewrite -(eqn_add2r (n%/d*d)).
- by rewrite addnBAC; last by apply leq_trunc_div.
- }
- }
- Qed.
-
- Lemma ceil_neq0 :
- forall x y,
- x > 0 ->
- y > 0 ->
- div_ceil x y > 0.
- Proof.
- unfold div_ceil; intros x y GEx GEy.
- destruct (y %| x) eqn:DIV; last by done.
- by rewrite divn_gt0; first by apply dvdn_leq.
- Qed.
-
- Lemma leq_divceil2r :
- forall d m n,
- d > 0 ->
- m <= n ->
- div_ceil m d <= div_ceil n d.
- Proof.
- unfold div_ceil; intros d m n GT0 LE.
- destruct (d %| m) eqn:DIVm, (d %| n) eqn:DIVn;
- [by apply leq_div2r | | | by apply leq_div2r].
- by apply leq_trans with (n := n %/ d); first by apply leq_div2r.
- {
- rewrite leq_eqVlt in LE; move: LE => /orP [/eqP EQ | LT];
- first by subst; rewrite DIVn in DIVm.
- rewrite ltn_divLR //.
- apply leq_trans with (n := n); first by done.
- by apply eq_leq; symmetry; apply/eqP; rewrite -dvdn_eq.
- }
- Qed.
-
-(* Versions of eqn_modDl and eqn_modDl in Prop *)
-
- Lemma eq_modDl: forall p m n d, (p + m = p + n %[mod d]) <-> (m = n %[mod d]).
- Proof.
- split; intro G.
- - apply /eqP. rewrite <- eqn_modDl with (p:=p).
- by apply /eqP.
- - rewrite -modnDm G.
- by rewrite modnDm.
- Qed.
-
- Lemma eq_modDr: forall p m n d, (m + p = n + p %[mod d]) <-> (m = n %[mod d]).
- Proof.
- split; intro G.
- - apply /eqP. rewrite <- eqn_modDr with (p:=p).
- by apply /eqP.
- - rewrite -modnDm G.
- by rewrite modnDm.
- Qed.
-
- (* If a(n)= b+a (n) then b is a multiple of c
- Proposed name modnD_k *)
-
- Lemma modulo_exists: forall a b c,
- c>0 -> a = b + a %[mod c] -> exists k, b = k*c.
- Proof.
- intros* F G.
- change a with (0+a) in G.
- apply eq_modDr in G.
- rewrite mod0n in G.
- assert (X: b = b%/c *c + b%%c) by apply divn_eq.
- rewrite -G addn0 in X.
- by exists (b%/c).
- Qed.
-
- (* If (a+1)[n+1]=0 then a[n+1]=n *)
- Lemma modnS_eq : forall a n, a.+1 %% n.+1 =0 <-> a %% n.+1 = n.
- Proof.
- intros.
- rewrite -(modnn (n.+1)).
- change (a.+1) with (1+a).
- change (n.+1) with (1+n).
- assert (X:n<n.+1) by lia.
- apply modn_small in X.
- split; intros* G.
- - apply eq_modDl in G.
- by rewrite G.
- - apply eq_modDl.
- by rewrite G.
- Qed.
-
- (* Incrementing the integer under a modulo either increments the result or yields 0 *)
-
- Lemma modnSor': forall a n, a.+1 %% n = (a %% n).+1 \/ (a.+1 %% n =0).
- Proof.
- intros*.
- destruct (ltngtP ((a%%n).+1) (n)) as [G|G|G].
- - left. apply modn_small in G.
- by rewrite -G -addn1 -modnDml addn1.
- - destruct n.
- + left. reflexivity.
- + assert (X: a%%n.+1 < n.+1). by apply ltn_pmod. lia.
- - right. destruct n.
- + discriminate G.
- + apply modnS_eq. by injection G.
- Qed.
-
- Lemma modnSor: forall a n, a.+1 %% n.+1 = (a %% n.+1).+1 \/ (a.+1 %% n.+1 =0).
- Proof.
- intros.
- destruct (ltngtP ((a%%n.+1).+1) (n.+1)) as [G|G|G].
- - left. apply modn_small in G.
- by rewrite -G -addn1 -modnDml addn1.
- - assert (X: a%%n.+1 < n.+1). by apply ltn_pmod. lia.
- - right. apply modnS_eq. lia.
- Qed.
-
- (* Old version of the lemma which is now covered by modnSor and modnS_eq *)
-
- Lemma modulo_cases : forall a c,
- a.+1 %% c.+1 = (a %% c.+1).+1 \/ (a.+1 %% c.+1 =0 /\ a %% c.+1 =c).
- Proof.
- intros. destruct (modnSor a c) as [G|G]; try by left.
- right; split; try done.
- by apply modnS_eq.
- Qed.
-
- Lemma ceil_eq1: forall a c, a > 0 -> a <= c -> div_ceil a c = 1.
- Proof.
- intros* G1. unfold div_ceil.
- rewrite leq_eqVlt. move/orP => [G2|G2].
- - move/eqP :G2 => G2. subst.
- rewrite dvdnn. rewrite divnn.
- destruct c; lia.
- - rewrite gtnNdvd // divn_small //.
- Qed.
-
- Lemma ceil_suba: forall a c, c > 0 -> a > c -> div_ceil a c = (div_ceil (a-c) c).+1.
- Proof.
- intros* G1 G2. unfold div_ceil.
- assert (X:a=a-c+c) by (rewrite subnK //; lia).
- case E1:(c %| a); case E2:(c %| a - c); rewrite {1} X.
- - rewrite divnDl //. rewrite divnn. by rewrite G1 addn1.
- - rewrite X in E1. apply dvdn_add_eq in E1.
- rewrite dvdnn E2 in E1. inversion E1.
- - apply dvdn_addr with (n:=c) in E2.
- rewrite dvdnn in E2. rewrite X E2 in E1. inversion E1.
- - rewrite divnDr // divnn G1 addn1 //.
- Qed.
-
- Lemma mod_eq: forall a b, a%%b = a - a%/b * b.
- Proof.
- intros.
- rewrite {2}(divn_eq a b).
- lia.
- Qed.
diff --git a/classic/util/find_seq.v b/classic/util/find_seq.v
deleted file mode 100644
index ae1106551785fcc08e2675e03313cb23422b3819..0000000000000000000000000000000000000000
--- a/classic/util/find_seq.v
+++ /dev/null
@@ -1,106 +0,0 @@
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq bigop div.
-Require Import prosa.classic.util.all.
-
-Section find_seq.
- Context {T:eqType}.
- Variable P: T-> bool.
- Fixpoint findP l:=
- match l with
- | nil => None
- | x::s => if P x then Some x else findP s
- end.
-
- Lemma findP_FIFO:
- forall (l:seq T) x y,
- P y = true -> y \in l -> x <> y ->
- findP l = Some x ->
- find (fun j => j==x) l < find (fun j => j==y) l.
- Proof.
- intros* PY YIN NEQ FIND.
- induction l.
- - auto.
- - case (a==x)eqn:AX;case (a==y)eqn:AY;simpl; rewrite AX AY;auto.
- + move/eqP in AX;move/eqP in AY;rewrite AX in AY;auto.
- + simpl in FIND;move/eqP in AY;rewrite AY PY in FIND;clarify;
- by move/eqP in AX.
- + rewrite in_cons in YIN. move:YIN=> /orP [/eqP EQ | YIN]. move/eqP in AY;auto.
- simpl in FIND. case (P a) eqn:PA;clarify. move/eqP in AX;auto. apply IHl;auto.
- Qed.
-
- Lemma find_uniql:
- forall (x:T) l1 l2,
- uniq(l1 ++ l2) ->
- x \in l2 ->
- ~ x \in l1.
- Proof.
- intros. intro XIN.
- induction l1. auto.
- case (a==x)eqn:AX;move/eqP in AX;simpl in H;
- move:H=>/andP [NIN U];move/negP in NIN;auto.
- rewrite AX in NIN. have XIN12: x \in (l1++l2).
- rewrite mem_cat. apply/orP. by right.
- apply IHl1;auto. rewrite in_cons in XIN.
- move:XIN=>/orP [/eqP EQ | XL1];auto.
- Qed.
-
- Lemma find_uniq:
- forall (x:T) l1 l2,
- uniq(l1 ++ l2) ->
- x \in l2 ->
- has (fun x': T=> x'==x) l1 = false.
- Proof.
- intros.
- apply /negP /negP /hasPn.
- unfold prop_in1. intros.
- apply find_uniql with (x:=x) in H; last by assumption.
- case (x0==x) eqn:XX; last trivial.
- move/eqP in XX.
- rewrite XX in H1; by contradiction.
- Qed.
-
- Lemma findP_in_seq:
- forall (l:seq T) x,
- findP l = Some x ->
- P x /\ x \in l.
- Proof.
- intros* FIND.
- split.
- - generalize dependent x. induction l.
- + by rewrite /=.
- + simpl. case (P a) eqn:CASE. intros x SOME.
- case : SOME => AX. subst. auto.
- assumption.
- - generalize dependent x. induction l.
- + by rewrite /=.
- + simpl. case (P a) eqn:CASE. intros x SOME.
- case : SOME => AX. subst. rewrite in_cons.
- apply/orP. left. trivial.
- intros x FIND. rewrite in_cons. apply/orP. right. auto.
- Qed.
-
- Lemma findP_notSome_in_seq:
- forall (l:seq T) x,
- findP l != Some x ->
- x \in l->
- ~ P x \/ exists y, findP l = Some y.
- Proof.
- intros* NFIND IN.
- generalize dependent x. induction l;intros x G IN.
- - auto.
- - simpl in G. case (P a) eqn:CASE.
- + right;exists a;simpl;by rewrite CASE.
- + case (a==x) eqn:AX.
- * left. move/eqP in AX. by rewrite -AX CASE.
- * apply IHl in G. destruct G as [NP|EXIST].
- -- by left.
- -- right. simpl. by rewrite CASE.
- rewrite in_cons in IN. move/orP in IN.
- destruct IN as [XA | XINL].
- ++ move/eqP in XA. move/eqP in AX. auto.
- ++ trivial.
- Qed.
-
-End find_seq.
-
-
-
diff --git a/classic/util/fixedpoint.v b/classic/util/fixedpoint.v
deleted file mode 100644
index a79bd8df5c9908e6c6cec5e362bd6e528f396dba..0000000000000000000000000000000000000000
--- a/classic/util/fixedpoint.v
+++ /dev/null
@@ -1,192 +0,0 @@
-Require Import prosa.classic.util.tactics prosa.classic.util.induction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Section FixedPoint.
-
- Lemma iter_fix T (F : T -> T) x k n :
- iter k F x = iter k.+1 F x ->
- k <= n ->
- iter n F x = iter n.+1 F x.
- Proof.
- move => e. elim: n. rewrite leqn0. by move/eqP<-.
- move => n IH. rewrite leq_eqVlt; case/orP; first by move/eqP<-.
- move/IH => /= IHe. by rewrite -!IHe.
- Qed.
-
- Lemma fun_mon_iter_mon :
- forall (f: nat -> nat) x0 x1 x2,
- x1 <= x2 ->
- f x0 >= x0 ->
- (forall x1 x2, x1 <= x2 -> f x1 <= f x2) ->
- iter x1 f x0 <= iter x2 f x0.
- Proof.
- intros f x0 x1 x2 LE MIN MON.
- revert LE; revert x2; rewrite leq_as_delta; intros delta.
- induction x1; try rewrite add0n.
- {
- induction delta; first by apply leqnn.
- apply leq_trans with (n := iter delta f x0); first by done.
- clear IHdelta.
- induction delta; first by done.
- {
- rewrite 2!iterS; apply MON.
- apply IHdelta.
- }
- }
- {
- rewrite iterS -addn1 -addnA [1 + delta]addnC addnA addn1 iterS.
- by apply MON, IHx1.
- }
- Qed.
-
- Lemma fun_mon_iter_mon_helper :
- forall T (f: T -> T) (le: rel T) x0 x1,
- reflexive le ->
- transitive le ->
- (forall x2, le x0 (iter x2 f x0)) ->
- (forall x1 x2, le x0 x1 -> le x1 x2 -> le (f x1) (f x2)) ->
- le (iter x1 f x0) (iter x1.+1 f x0).
- Proof.
- intros T f le x0 x1 REFL TRANS MIN MON.
- generalize dependent x0.
- induction x1; first by ins; apply (MIN 1).
- by ins; apply MON; [by apply MIN | by apply IHx1].
- Qed.
-
- Lemma fun_mon_iter_mon_generic :
- forall T (f: T -> T) (le: rel T) x0 x1 x2,
- reflexive le ->
- transitive le ->
- x1 <= x2 ->
- (forall x1 x2, le x0 x1 -> le x1 x2 -> le (f x1) (f x2)) ->
- (forall x2 : nat, le x0 (iter x2 f x0)) ->
- le (iter x1 f x0) (iter x2 f x0).
- Proof.
- intros T f le x0 x1 x2 REFL TRANS LE MON MIN.
- revert LE; revert x2; rewrite leq_as_delta; intros delta.
- induction delta; first by rewrite addn0; apply REFL.
- apply (TRANS) with (y := iter (x1 + delta) f x0);
- first by apply IHdelta.
- by rewrite addnS; apply fun_mon_iter_mon_helper.
- Qed.
-
-End FixedPoint.
-
-(* In this section, we define some properties of relations
- that are important for fixed-point iterations. *)
-Section Relations.
-
- Context {T: Type}.
- Variable R: rel T.
- Variable f: T -> T.
-
- Definition monotone (R: rel T) :=
- forall x y, R x y -> R (f x) (f y).
-
-End Relations.
-
-(* In this section we define a fixed-point iteration function
- that stops as soon as it finds the solution. If no solution
- is found, the function returns None. *)
-Section Iteration.
-
- Context {T : eqType}.
- Variable f: T -> T.
-
- Fixpoint iter_fixpoint max_steps (x: T) :=
- if max_steps is step.+1 then
- let x' := f x in
- if x == x' then
- Some x
- else iter_fixpoint step x'
- else None.
-
- Section BasicLemmas.
-
- (* We prove that iter_fixpoint either returns either None
- or Some y, where y is a fixed point. *)
- Lemma iter_fixpoint_cases :
- forall max_steps x0,
- iter_fixpoint max_steps x0 = None \/
- exists y,
- iter_fixpoint max_steps x0 = Some y /\
- y = f y.
- Proof.
- induction max_steps.
- {
- by ins; simpl; destruct (x0 == f x0); left.
- }
- {
- intros x0; simpl.
- destruct (x0 == f x0) eqn:EQ1;
- first by right; exists x0; split; last by apply/eqP.
- by destruct (IHmax_steps (f x0)) as [NONE | FOUND].
- }
- Qed.
-
- (* We also show that any inductive property P is propagated
- through the fixed-point iteration. *)
- Lemma iter_fixpoint_ind:
- forall max_steps x0 x,
- iter_fixpoint max_steps x0 = Some x ->
- forall P,
- P x0 ->
- (forall x, P x -> P (f x)) ->
- P x.
- Proof.
- induction max_steps; first by done.
- intros x0 x SOME P P0 ALL.
- move: SOME; simpl.
- case EQ: (_ == _).
- {
- move: EQ => /eqP EQ.
- case => SAME; subst.
- by rewrite EQ; apply ALL.
- }
- {
- intros SOME; clear EQ.
- apply (IHmax_steps (f x0) x SOME P); first by apply ALL.
- by apply ALL.
- }
- Qed.
-
- End BasicLemmas.
-
- Section RelationLemmas.
-
- Variable R: rel T.
- Hypothesis H_reflexive: reflexive R.
- Hypothesis H_transitive: transitive R.
- Hypothesis H_monotone: monotone f R.
-
- Lemma iter_fixpoint_ge_min:
- forall max_steps x0 x1 x,
- iter_fixpoint max_steps x1 = Some x ->
- R x0 x1 ->
- R x1 (f x1) ->
- R x0 x.
- Proof.
- induction max_steps; first by done.
- {
- intros x0 x1 x SOME MIN BOT; simpl in SOME.
- destruct (x1 == f x1) eqn:EQ1;
- first by inversion SOME; subst.
- apply IHmax_steps with (x0 := x0) in SOME; first by done.
- - by apply (@H_transitive x1).
- - by apply H_monotone.
- }
- Qed.
-
- Lemma iter_fixpoint_ge_bottom:
- forall max_steps x0 x,
- iter_fixpoint max_steps x0 = Some x ->
- R x0 (f x0) ->
- R x0 x.
- Proof.
- intros max_steps x0 x SOME BOT.
- by apply iter_fixpoint_ge_min with (max_steps := max_steps) (x1 := x0).
- Qed.
-
- End RelationLemmas.
-
-End Iteration.
\ No newline at end of file
diff --git a/classic/util/induction.v b/classic/util/induction.v
deleted file mode 100644
index 637a73b3b3bcad72e4ec56822af4c5f27c524694..0000000000000000000000000000000000000000
--- a/classic/util/induction.v
+++ /dev/null
@@ -1,31 +0,0 @@
-Require Import prosa.classic.util.tactics.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Induction lemmas for natural numbers. *)
-Section NatInduction.
-
- Lemma strong_ind :
- forall (P: nat -> Prop),
- (forall n, (forall k, k < n -> P k) -> P n) ->
- forall n, P n.
- Proof.
- intros P ALL n; apply ALL.
- induction n; first by ins; apply ALL.
- intros k LTkSn; apply ALL.
- by intros k0 LTk0k; apply IHn, leq_trans with (n := k).
- Qed.
-
- Lemma leq_as_delta :
- forall x1 (P: nat -> Prop),
- (forall x2, x1 <= x2 -> P x2) <->
- (forall delta, P (x1 + delta)).
- Proof.
- ins; split; last by intros ALL x2 LE; rewrite -(subnK LE) addnC; apply ALL.
- {
- intros ALL; induction delta.
- by rewrite addn0; apply ALL, leqnn.
- by apply ALL; rewrite -{1}[x1]addn0; apply leq_add; [by apply leqnn | by ins].
- }
- Qed.
-
-End NatInduction.
\ No newline at end of file
diff --git a/classic/util/list.v b/classic/util/list.v
deleted file mode 100644
index 8b59675235c76355f8bddc03d88f64bea32df7ec..0000000000000000000000000000000000000000
--- a/classic/util/list.v
+++ /dev/null
@@ -1,786 +0,0 @@
-Require Export prosa.util.list.
-
-Require Import prosa.classic.util.tactics.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Lemmas about lists without duplicates. *)
-Section UniqList.
-
- Lemma idx_lt_rcons :
- forall {T: eqType} (l: seq T) i x0,
- uniq l ->
- i < size l ->
- [seq x <- l | index x l < i.+1] =
- rcons [seq x <- l | index x l < i] (nth x0 l i).
- Proof.
- intros T l i x0 UNIQ LT.
- generalize dependent i.
- induction l as [| l' x] using last_ind; first by ins; rewrite ltn0 in LT.
- {
- intros i LT.
- rewrite size_rcons in LT.
- rewrite filter_rcons.
- rewrite -cats1 index_cat; desf; simpl in *;
- try (by rewrite rcons_uniq in UNIQ; move: UNIQ => /andP [NOTIN _]; rewrite Heq0 in NOTIN).
- {
- rewrite eq_refl addn0 in Heq.
- rewrite filter_cat /=.
- assert (EQ: i = size l'); first by apply/eqP; rewrite eqn_leq; apply/andP; split.
- rewrite index_cat Heq0 /= eq_refl addn0 EQ ltnn cats0.
- rewrite nth_cat ltnn subnn /=.
- f_equal; apply eq_in_filter; red; intros y INy.
- by rewrite index_cat INy ltnS index_size index_mem INy.
- }
- {
- rewrite rcons_uniq in UNIQ; move: UNIQ => /andP [NOTIN UNIQ].
- rewrite eq_refl addn0 in Heq.
- apply negbT in Heq; rewrite -leqNgt in Heq.
- rewrite nth_cat Heq.
- rewrite filter_cat /= index_cat Heq0 /= eq_refl addn0.
- rewrite ltnS in LT; rewrite ltnNge LT /= cats0 cats1.
- apply eq_trans with (y := [seq x1 <- l' | index x1 l' < i.+1]);
- first by apply eq_in_filter; red; intros y INy; rewrite -cats1 index_cat INy.
- rewrite IHl //; f_equal; apply eq_in_filter; intros y INy.
- by rewrite -cats1 index_cat INy.
- }
- }
- Qed.
-
- Lemma filter_idx_lt_take :
- forall {T: eqType} (l: seq T) i,
- uniq l ->
- i < size l ->
- [seq x <- l | index x l < i] = take i l.
- Proof.
- intros T l i UNIQ LT.
- generalize dependent l.
- induction i.
- {
- intros l UNIQ LT; destruct l as [| x0 l']; first by done.
- by apply eq_trans with (filter pred0 (x0 :: l'));
- [by apply eq_filter | by rewrite filter_pred0].
- }
- {
- intros l UNIQ LT.
- destruct (lastP l) as [| l' x]; first by rewrite ltn0 in LT.
- rewrite size_rcons ltnS in LT.
- rewrite (take_nth x); last by rewrite size_rcons; apply (leq_trans LT).
- rewrite -> idx_lt_rcons with (x0 := x); try (by done);
- last by rewrite size_rcons; apply (leq_trans LT).
- by f_equal; apply IHi; last by rewrite size_rcons; apply (leq_trans LT).
- }
- Qed.
-
- Lemma filter_idx_le_takeS :
- forall {T: eqType} (l: seq T) i,
- uniq l ->
- i < size l ->
- [seq x <- l | index x l <= i] = take i.+1 l.
- Proof.
- intros T l i UNIQ LT.
- induction l as [| x0 l]; first by done.
- simpl; rewrite eq_refl leq0n; f_equal.
- apply eq_trans with (y := [seq x <- l | index x l < i]).
- {
- apply eq_in_filter; red; intros x IN.
- desf; subst; last by done.
- by simpl in *; rewrite IN andFb in UNIQ.
- }
- simpl in *; desf.
- rewrite /= ltnS in LT.
- rewrite leq_eqVlt in LT; desf.
- {
- rewrite take_size.
- apply eq_trans with (y := filter predT l); last by rewrite filter_predT.
- by apply eq_in_filter; red; ins; rewrite index_mem.
- }
- by apply filter_idx_lt_take.
- Qed.
-
- Lemma mapP2 (T: Type) (T': eqType) (s: seq T) (f: T -> T') y:
- reflect (exists2 x, List.In x s & y = f x) (y \in map f s).
- Proof.
- elim: s => [|x s IHs]; first by right; case.
- rewrite /= in_cons eq_sym; case Hxy: (f x == y);
- first by left; exists x; [by left | by rewrite (eqP Hxy)].
- apply: (iffP IHs) => [[x' Hx' ->]|[x' Hx' Dy]];
- first by exists x'; [by right | by done].
- exists x'; last by done.
- by subst y; move: Hx' => [EQ | IN] //; subst; rewrite eq_refl in Hxy.
- Qed.
-
-End UniqList.
-
-
-(* Additional lemmas about list zip. *)
-Section Zip.
-
- Lemma zipP {T: eqType} (x0: T) (P: _ -> _ -> bool) (X Y: seq T):
- size X = size Y ->
- reflect (forall i, i < size (zip X Y) -> P (nth x0 X i) (nth x0 Y i))
- (all (fun p => P (fst p) (snd p)) (zip X Y)).
- Proof.
- intro SIZE; apply/introP.
- {
- move => /allP ALL i LT.
- apply (ALL (nth x0 X i,nth x0 Y i)).
- by rewrite -nth_zip; [by apply mem_nth | by done].
- }
- {
- rewrite -has_predC; unfold predC.
- move => /hasP HAS; simpl in *; destruct HAS as [x IN NOT].
- unfold not; intro BUG.
- exploit (BUG (index x (zip X Y))).
- by rewrite index_mem.
- have NTH := @nth_zip _ _ x0 x0 X Y (index x (zip X Y)) SIZE.
- destruct x as [x1 x2].
- rewrite {1}nth_index in NTH; last by done.
- clear BUG; intros BUG.
- inversion NTH as [[NTH0 NTH1]]; rewrite -NTH0 in NTH1.
- by rewrite -NTH0 -NTH1 in BUG; rewrite BUG in NOT.
- }
- Qed.
-
- Lemma mem_zip_exists :
- forall (T T': eqType) (x1: T) (x2: T') l1 l2 elem elem',
- size l1 = size l2 ->
- (x1, x2) \in zip l1 l2 ->
- exists idx,
- idx < size l1 /\
- idx < size l2 /\
- x1 = nth elem l1 idx /\
- x2 = nth elem' l2 idx.
- Proof.
- intros T T' x1 x2 l1 l2 elem elem' SIZE IN.
- assert (LT: index (x1, x2) (zip l1 l2) < size l1).
- {
- apply leq_trans with (n := size (zip l1 l2)); first by rewrite index_mem.
- by rewrite size_zip; apply geq_minl.
- }
- have NTH := @nth_index _ (elem,elem') (x1, x2) (zip l1 l2) IN.
- rewrite nth_zip in NTH; last by done.
- inversion NTH; rewrite H1 H0; rewrite H0 in H1.
- by exists (index (x1, x2) (zip l1 l2)); repeat split; try (by done); rewrite -?SIZE.
- Qed.
-
- Lemma mem_zip :
- forall (T T': eqType) (x1: T) (x2: T') l1 l2,
- size l1 = size l2 ->
- (x1, x2) \in zip l1 l2 ->
- x1 \in l1 /\ x2 \in l2.
- Proof.
- intros T T' x1 x2 l1 l2 SIZE IN.
- split.
- {
- rewrite -[l1](@unzip1_zip _ _ l1 l2); last by rewrite SIZE.
- by apply/mapP; exists (x1, x2).
- }
- {
- rewrite -[l2](@unzip2_zip _ _ l1 l2); last by rewrite SIZE.
- by apply/mapP; exists (x1, x2).
- }
- Qed.
-
- Lemma mem_zip_nseq_r :
- forall {T1 T2:eqType} (x: T1) (y: T2) n l,
- size l = n ->
- ((x, y) \in zip l (nseq n y)) = (x \in l).
- Proof.
- intros T1 T2 x y n l SIZE.
- apply/idP/idP.
- {
- intros IN.
- generalize dependent n.
- induction l.
- {
- intros n SIZE IN.
- by destruct n; simpl in IN; rewrite in_nil in IN.
- }
- {
- intros n SIZE; destruct n; first by ins.
- by intros MEM; apply mem_zip in MEM; [des | by rewrite size_nseq].
- }
- }
- {
- intros IN; generalize dependent n.
- induction l; first by rewrite in_nil in IN.
- intros n SIZE; destruct n; first by ins.
- rewrite in_cons in IN; move: IN => /orP [/eqP EQ | IN];
- first by rewrite in_cons; apply/orP; left; apply/eqP; f_equal.
- simpl in *; apply eq_add_S in SIZE.
- by rewrite in_cons; apply/orP; right; apply IHl.
- }
- Qed.
-
- Lemma mem_zip_nseq_l :
- forall {T1 T2:eqType} (x: T1) (y: T2) n l,
- size l = n ->
- ((x, y) \in zip (nseq n x) l) = (y \in l).
- Proof.
- intros T1 T2 x y n l SIZE.
- apply/idP/idP.
- {
- intros IN.
- generalize dependent n.
- induction l.
- {
- intros n SIZE IN.
- by destruct n; simpl in IN; rewrite in_nil in IN.
- }
- {
- intros n SIZE; destruct n; first by ins.
- by intros MEM; apply mem_zip in MEM; [des | by rewrite size_nseq].
- }
- }
- {
- intros IN; generalize dependent n.
- induction l; first by rewrite in_nil in IN.
- intros n SIZE; destruct n; first by ins.
- rewrite in_cons in IN; move: IN => /orP [/eqP EQ | IN];
- first by rewrite in_cons; apply/orP; left; apply/eqP; f_equal.
- simpl in *; apply eq_add_S in SIZE.
- by rewrite in_cons; apply/orP; right; apply IHl.
- }
- Qed.
-
- Lemma unzip1_pair:
- forall {T1 T2: eqType} (l: seq T1) (f: T1 -> T2),
- unzip1 [seq (x, f x) | x <- l] = l.
- Proof.
- intros T1 T2.
- induction l; first by done.
- by intros f; simpl; f_equal.
- Qed.
-
- Lemma unzip2_pair:
- forall {T1 T2: eqType} (l: seq T1) (f: T1 -> T2),
- unzip2 [seq (f x, x) | x <- l] = l.
- Proof.
- intros T1 T2.
- induction l; first by done.
- by intros f; simpl; f_equal.
- Qed.
-
- Lemma eq_unzip1:
- forall {T1 T2: eqType} (l1 l2: seq (T1 * T2)) x0,
- size l1 = size l2 ->
- (forall i, i < size l1 -> (fst (nth x0 l1 i)) = (fst (nth x0 l2 i))) ->
- unzip1 l1 = unzip1 l2.
- Proof.
- intros T1 T2.
- induction l1; simpl; first by destruct l2.
- intros l2 x0 SIZE ALL.
- destruct l2; first by done.
- simpl; f_equal; first by feed (ALL 0).
- case: SIZE => SIZE.
- apply IHl1 with (x0 := x0); first by done.
- intros i LTi.
- by feed (ALL i.+1);
- first by rewrite -[X in X < _]addn1 -[X in _ < X]addn1 ltn_add2r.
- Qed.
-
- Lemma eq_unzip2:
- forall {T1 T2: eqType} (l1 l2: seq (T1 * T2)) x0,
- size l1 = size l2 ->
- (forall i, i < size l1 -> (snd (nth x0 l1 i)) = (snd (nth x0 l2 i))) ->
- unzip2 l1 = unzip2 l2.
- Proof.
- intros T1 T2.
- induction l1; simpl; first by destruct l2.
- intros l2 x0 SIZE ALL.
- destruct l2; first by done.
- simpl; f_equal; first by feed (ALL 0).
- case: SIZE => SIZE.
- apply IHl1 with (x0 := x0); first by done.
- intros i LTi.
- by feed (ALL i.+1);
- first by rewrite -[X in X < _]addn1 -[X in _ < X]addn1 ltn_add2r.
- Qed.
-
-End Zip.
-
-(* Restate nth_error function from Coq library. *)
-Fixpoint nth_or_none {T: Type} (l: seq T) (n:nat) {struct n} : option T :=
- match n, l with
- | 0, x :: _ => Some x
- | n.+1, _ :: l => nth_or_none l n
- | _, _ => None
-end.
-
-(* Lemmas about nth. *)
-Section Nth.
-
- Context {T: eqType}.
-
- Lemma nth_in_or_default:
- forall (l: seq T) x0 i,
- (nth x0 l i) \in l \/ (nth x0 l i) = x0.
- Proof.
- intros l x0 i.
- generalize dependent i.
- induction l;
- first by right; destruct i.
- destruct i; simpl in *;
- first by left; rewrite in_cons eq_refl.
- by destruct (IHl i) as [IN | DEF];
- [by left; rewrite in_cons IN orbT | by rewrite DEF; right].
- Qed.
-
- Lemma nth_neq_default :
- forall (l: seq T) x0 i y,
- nth x0 l i = y ->
- y <> x0 ->
- y \in l.
- Proof.
- intros l x0 i y NTH NEQ.
- by destruct (nth_in_or_default l x0 i) as [IN | DEF];
- [by rewrite -NTH | by rewrite -NTH DEF in NEQ].
- Qed.
-
- Lemma nth_or_none_mem :
- forall (l: seq T) n x, nth_or_none l n = Some x -> x \in l.
- Proof.
- induction l; first by unfold nth_or_none; ins; destruct n; ins.
- {
- ins; destruct n.
- {
- inversion H; subst.
- by rewrite in_cons eq_refl orTb.
- }
- simpl in H; rewrite in_cons; apply/orP; right.
- by apply IHl with (n := n).
- }
- Qed.
-
- Lemma nth_or_none_mem_exists :
- forall (l: seq T) x, x \in l -> exists n, nth_or_none l n = Some x.
- Proof.
- induction l; first by intros x IN; rewrite in_nil in IN.
- {
- intros x IN; rewrite in_cons in IN.
- move: IN => /orP [/eqP EQ | IN]; first by subst; exists 0.
- specialize (IHl x IN); des.
- by exists n.+1.
- }
- Qed.
-
- Lemma nth_or_none_size_none :
- forall (l: seq T) n,
- nth_or_none l n = None <-> n >= size l.
- Proof.
- induction l; first by split; destruct n.
- by destruct n; simpl; [by split; last by rewrite ltn0 | by rewrite ltnS].
- Qed.
-
- Lemma nth_or_none_size_some :
- forall (l: seq T) n x,
- nth_or_none l n = Some x -> n < size l.
- Proof.
- induction l; first by destruct n.
- by intros n x; destruct n; simpl; last by rewrite ltnS; apply IHl.
- Qed.
-
- Lemma nth_or_none_uniq :
- forall (l: seq T) i j x,
- uniq l ->
- nth_or_none l i = Some x ->
- nth_or_none l j = Some x ->
- i = j.
- Proof.
- intros l i j x UNIQ SOMEi SOMEj.
- {
- generalize dependent j.
- generalize dependent i.
- induction l;
- first by ins; destruct i, j; simpl in *; inversion SOMEi.
- intros i SOMEi j SOMEj.
- simpl in UNIQ; move: UNIQ => /andP [NOTIN UNIQ].
- feed IHl; first by done.
- destruct i, j; simpl in *; first by done.
- - by inversion SOMEi; subst; apply nth_or_none_mem in SOMEj; rewrite SOMEj in NOTIN.
- - by inversion SOMEj; subst; apply nth_or_none_mem in SOMEi; rewrite SOMEi in NOTIN.
- - by f_equal; apply IHl.
- }
- Qed.
-
- Lemma nth_or_none_nth :
- forall (l: seq T) n x x0,
- nth_or_none l n = Some x ->
- nth x0 l n = x.
- Proof.
- induction l; first by destruct n.
- by intros n x x0 SOME; destruct n; simpl in *; [by inversion SOME | by apply IHl].
- Qed.
-
-End Nth.
-
-Section PartialMap.
-
- Lemma pmap_inj_in_uniq {T T': eqType} (s: seq T) (f: T -> option T') :
- {in s &, ssrfun.injective f} ->
- uniq s ->
- uniq (pmap f s).
- Proof.
- intros INJ UNIQ; red in INJ.
- induction s; first by done.
- simpl in *; unfold ssrfun.Option.apply.
- move: UNIQ => /andP [NOTIN UNIQ].
- feed IHs.
- by ins; apply INJ; try (by rewrite in_cons; apply/orP; right).
- specialize (IHs UNIQ).
- destruct (f a) eqn:F; simpl; last by done.
- rewrite IHs andbT mem_pmap -F.
- apply/mapP; move => [a' IN' EQ].
- exploit (INJ a a'); try (by done).
- by rewrite in_cons; apply/orP; left.
- by rewrite in_cons; apply/orP; right.
- by intros EQ'; subst; rewrite IN' in NOTIN.
- Qed.
-
- Lemma pmap_inj_uniq {T T': eqType} (s: seq T) (f: T -> option T') :
- ssrfun.injective f ->
- uniq s ->
- uniq (pmap f s).
- Proof.
- intros INJ UNIQ.
- apply pmap_inj_in_uniq; last by done.
- by red; ins; apply INJ.
- Qed.
-
-End PartialMap.
-
-(* Define a set_nth that does not grow the vector. *)
-Program Definition set_nth_if_exists {T: Type} (l: seq T) n y :=
- if n < size l then
- set_nth _ l n y
- else l.
-
-(* Define a function that replaces the first element that satisfies
- some predicate with using a mapping function f. *)
-Fixpoint replace_first {T: Type} P f (l: seq T) :=
- if l is x0 :: l' then
- if P x0 then
- f x0 :: l'
- else x0 :: replace_first P f l'
- else [::].
-
-(* Define a function that replaces the first element that satisfies
- some predicate with a constant. *)
-Definition replace_first_const {T: Type} P y (l: seq T) :=
- replace_first P (fun x => y) l.
-
-Definition set_pair_1nd {T1: Type} {T2: Type} (y: T2) (p: T1 * T2) :=
- (fst p, y).
-
-Definition set_pair_2nd {T1: Type} {T2: Type} (y: T2) (p: T1 * T2) :=
- (fst p, y).
-
-Section Replace.
-
- Context {T: eqType}.
-
- Lemma replace_first_size P f (l: seq T) :
- size (replace_first P f l) = size l.
- Proof.
- induction l; simpl; first by done.
- by destruct (P a); rewrite // /= IHl.
- Qed.
-
- Lemma replace_first_cases {P} {f} {l: seq T} {x}:
- x \in replace_first P f l ->
- x \in l \/ (exists y, x = f y /\ P y /\ y \in l).
- Proof.
- intros IN.
- induction l; simpl in *; first by rewrite IN; left.
- destruct (P a) eqn:HOLDS.
- {
- rewrite in_cons in IN; des;
- last by left; rewrite in_cons IN orbT.
- right; exists a; split; first by done.
- by split; last by rewrite in_cons eq_refl orTb.
- }
- {
- rewrite in_cons in IN; des;
- first by left; rewrite in_cons IN eq_refl orTb.
- specialize (IHl IN); des;
- first by left; rewrite in_cons IHl orbT.
- right; exists y; split; first by done.
- by split; last by rewrite in_cons IHl1 orbT.
- }
- Qed.
-
- Lemma replace_first_no_change {P} {f} {l: seq T} {x}:
- x \in l ->
- ~~ P x ->
- x \in replace_first P f l.
- Proof.
- intros IN NOT.
- induction l; simpl in *; first by rewrite in_nil in IN.
- destruct (P a) eqn:HOLDS.
- {
- rewrite in_cons in IN; des; last by rewrite in_cons IN orbT.
- by rewrite IN HOLDS in NOT.
- }
- {
- rewrite in_cons in IN; des; first by rewrite IN in_cons eq_refl orTb.
- by rewrite in_cons; apply/orP; right; apply IHl.
- }
- Qed.
-
- Lemma replace_first_idempotent {P} {f} {l: seq T} {x}:
- x \in l ->
- f x = x ->
- x \in replace_first P f l.
- Proof.
- intros IN IDEMP.
- induction l; simpl in *; first by rewrite in_nil in IN.
- destruct (P a) eqn:HOLDS.
- {
- rewrite in_cons in IN; des; last by rewrite in_cons IN orbT.
- by rewrite -IN -{1}IDEMP; rewrite in_cons eq_refl orTb.
-
- }
- {
- rewrite in_cons in IN; des; first by rewrite IN in_cons eq_refl orTb.
- by rewrite in_cons; apply/orP; right; apply IHl.
- }
- Qed.
-
- Lemma replace_first_new :
- forall P f (l: seq T) x1 x2,
- x1 \notin l ->
- x2 \notin l ->
- x1 \in replace_first P f l ->
- x2 \in replace_first P f l ->
- x1 = x2.
- Proof.
- intros P f l x1 x2 NOT1 NOT2 IN1 IN2.
- induction l; simpl in *; first by rewrite in_nil in IN1.
- {
- destruct (P a) eqn:HOLDS.
- {
- rewrite 2!in_cons in IN1 IN2.
- rewrite 2!in_cons 2!negb_or in NOT1 NOT2.
- move: NOT1 NOT2 => /andP [NEQ1 NOT1] /andP [NEQ2 NOT2].
- move: IN1 => /orP [/eqP F1 | IN1]; last by rewrite IN1 in NOT1.
- move: IN2 => /orP [/eqP F2 | IN2]; last by rewrite IN2 in NOT2.
- by rewrite F1 F2.
- }
- {
- rewrite 2!in_cons in IN1 IN2.
- rewrite 2!in_cons 2!negb_or in NOT1 NOT2.
- move: NOT1 NOT2 => /andP [NEQ1 NOT1] /andP [NEQ2 NOT2].
- move: IN1 => /orP [/eqP A1 | IN1]; first by rewrite A1 eq_refl in NEQ1.
- move: IN2 => /orP [/eqP A2 | IN2]; first by rewrite A2 eq_refl in NEQ2.
- by apply IHl.
- }
- }
- Qed.
-
- Lemma replace_first_previous P f {l: seq T} {x}:
- x \in l ->
- (x \in replace_first P f l) \/
- (P x /\ f x \in replace_first P f l).
- Proof.
- intros IN; induction l; simpl in *; first by rewrite in_nil in IN.
- destruct (P a) eqn:HOLDS.
- {
- rewrite in_cons in IN; des; subst.
- {
- right; rewrite HOLDS; split; first by done.
- by rewrite in_cons; apply/orP; left.
- }
- by rewrite in_cons IN; left; apply/orP; right.
- }
- {
- rewrite in_cons in IN; des; subst;
- first by left; rewrite in_cons eq_refl orTb.
- specialize (IHl IN); des;
- first by left; rewrite in_cons IHl orbT.
- right; rewrite IHl; split; first by done.
- by rewrite in_cons IHl0 orbT.
- }
- Qed.
-
- Lemma replace_first_failed P f {l: seq T}:
- (forall x, x \in l -> f x \notin replace_first P f l) ->
- (forall x, x \in l -> ~~ P x).
- Proof.
- intros NOTIN.
- induction l as [| a l']; simpl in *;
- first by intros x IN; rewrite in_nil in IN.
- intros x IN.
- destruct (P a) eqn:HOLDS.
- {
- exploit (NOTIN a); first by rewrite in_cons eq_refl orTb.
- by rewrite in_cons eq_refl orTb.
- }
- {
- rewrite in_cons in IN; move: IN => /orP [/eqP EQ | IN];
- first by subst; rewrite HOLDS.
- apply IHl'; last by done.
- intros y INy.
- exploit (NOTIN y); first by rewrite in_cons INy orbT.
- intros NOTINy.
- rewrite in_cons negb_or in NOTINy.
- by move: NOTINy => /andP [_ NOTINy].
- }
- Qed.
-
-End Replace.
-
-Definition pairs_to_function {T1: eqType} {T2: Type} y0 (l: seq (T1*T2)) :=
- fun x => nth y0 (unzip2 l) (index x (unzip1 l)).
-
-Section Pairs.
-
- Lemma pairs_to_function_neq_default {T1: eqType} {T2: eqType} y0 (l: seq (T1*T2)) x y :
- pairs_to_function y0 l x = y ->
- y <> y0 ->
- (x,y) \in l.
- Proof.
- unfold pairs_to_function, unzip1, unzip2; intros PAIR NEQ.
- induction l; simpl in *; first by subst.
- destruct (fst a == x) eqn:FST; simpl in *.
- {
- move: FST => /eqP FST; subst.
- by rewrite in_cons; apply/orP; left; destruct a.
- }
- {
- by specialize (IHl PAIR); rewrite in_cons; apply/orP; right.
- }
- Qed.
-
- Lemma pairs_to_function_mem {T1: eqType} {T2: eqType} y0 (l: seq (T1*T2)) x y :
- uniq (unzip1 l) ->
- (x,y) \in l ->
- pairs_to_function y0 l x = y.
- Proof.
- unfold pairs_to_function, unzip1, unzip2; intros UNIQ IN.
- induction l as [| [x' y'] l']; simpl in *; first by rewrite in_nil in IN.
- {
- move: UNIQ => /andP [NOTIN UNIQ]; specialize (IHl' UNIQ).
- destruct (x' == x) eqn:FST; simpl in *.
- {
- move: FST => /eqP FST; subst.
- rewrite in_cons /= in IN.
- move: IN => /orP [/eqP EQ | IN];
- first by case: EQ => ->.
- exfalso; move: NOTIN => /negP NOTIN; apply NOTIN.
- by apply/mapP; exists (x,y).
- }
- {
- rewrite in_cons /= in IN.
- move: IN => /orP [/eqP EQ | IN];
- first by case: EQ => EQ1 EQ2; subst; rewrite eq_refl in FST.
- by apply IHl'.
- }
- }
- Qed.
-
-End Pairs.
-
-Section Order.
-
- Context {T: eqType}.
- Variable rel: T -> T -> bool.
- Variable l: seq T.
-
- Definition total_over_list :=
- forall x1 x2,
- x1 \in l ->
- x2 \in l ->
- (rel x1 x2 \/ rel x2 x1).
-
- Definition antisymmetric_over_list :=
- forall x1 x2,
- x1 \in l ->
- x2 \in l ->
- rel x1 x2 ->
- rel x2 x1 ->
- x1 = x2.
-
-End Order.
-
-(* In this section we prove some additional lemmas about sequences. *)
-Section AdditionalLemmas.
-
- (* First, we prove that x ∈ xs implies that xs can be split
- into two parts such that xs = xsl ++ [::x] ++ xsr. *)
- Lemma in_cat:
- forall {X : eqType} (x : X) (xs : list X),
- x \in xs -> exists xsl xsr, xs = xsl ++ [::x] ++ xsr.
- Proof.
- intros ? ? ? SUB.
- induction xs; first by done.
- move: SUB; rewrite in_cons; move => /orP [/eqP EQ|IN].
- - by subst; exists [::], xs.
- - feed IHxs; first by done.
- clear IN; move: IHxs => [xsl [xsr EQ]].
- by subst; exists (a::xsl), xsr.
- Qed.
-
-
- (* We define a local function max over lists using foldl and maxn. *)
- Let max := foldl maxn 0.
-
- (* We prove that max {x, xs} is equal to max {x, max xs}. *)
- Lemma seq_max_cons: forall x xs, max (x :: xs) = maxn x (max xs).
- Proof.
- have L: forall s x xs, foldl maxn s (x::xs) = maxn x (foldl maxn s xs).
- { clear; intros.
- generalize dependent s; generalize dependent x.
- induction xs.
- { by intros; rewrite maxnC. }
- { intros; simpl in *.
- by rewrite maxnC IHxs [maxn s a]maxnC IHxs maxnA [maxn s x]maxnC.
- }
- }
- by intros; unfold max; apply L.
- Qed.
-
- (* We prove that for any two sequences xs and ys the fact that xs is a subsequence
- of ys implies that the size of xs is at most the size of ys. *)
- Lemma subseq_leq_size:
- forall {X : eqType} (xs ys: seq X),
- uniq xs ->
- (forall x, x \in xs -> x \in ys) ->
- size xs <= size ys.
- Proof.
- clear; intros ? ? ? UNIQ SUB.
- have EXm: exists m, size ys <= m; first by exists (size ys).
- move: EXm => [m SIZEm].
- move: SIZEm UNIQ SUB; move: xs ys.
- induction m; intros.
- { move: SIZEm; rewrite leqn0 size_eq0; move => /eqP SIZEm; subst ys.
- destruct xs; first by done.
- specialize (SUB s).
- by feed SUB; [rewrite in_cons; apply/orP; left | done].
- }
- { destruct xs as [ | x xs]; first by done.
- move: (@in_cat _ x ys) => Lem.
- feed Lem; first by apply SUB; rewrite in_cons; apply/orP; left.
- move: Lem => [ysl [ysr EQ]]; subst ys.
- rewrite !size_cat; simpl; rewrite -addnC add1n addSn ltnS -size_cat.
- eapply IHm.
- - move: SIZEm; rewrite !size_cat; simpl; move => SIZE.
- by rewrite add1n addnS ltnS addnC in SIZE.
- - by move: UNIQ; rewrite cons_uniq; move => /andP [_ UNIQ].
- - intros a IN.
- destruct (a == x) eqn: EQ.
- { exfalso.
- move: EQ UNIQ; rewrite cons_uniq; move => /eqP EQ /andP [NIN UNIQ].
- by subst; move: NIN => /negP NIN; apply: NIN.
- }
- { specialize (SUB a).
- feed SUB; first by rewrite in_cons; apply/orP; right.
- clear IN; move: SUB; rewrite !mem_cat; move => /orP [IN| /orP [IN|IN]].
- - by apply/orP; right.
- - exfalso.
- by move: IN; rewrite in_cons; move => /orP [IN|IN]; [rewrite IN in EQ | ].
- - by apply/orP; left.
- }
- }
- Qed.
-
-End AdditionalLemmas.
diff --git a/classic/util/minmax.v b/classic/util/minmax.v
deleted file mode 100644
index 6261fe835ab475ce638cd180349fdf15ed3bbd11..0000000000000000000000000000000000000000
--- a/classic/util/minmax.v
+++ /dev/null
@@ -1,551 +0,0 @@
-Require Export prosa.util.minmax.
-Require Import prosa.classic.util.tactics prosa.classic.util.notation prosa.classic.util.sorting prosa.classic.util.nat prosa.classic.util.list.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-Section MinMaxSeq.
-
- Section ArgGeneric.
-
- Context {T1 T2: eqType}.
-
- Variable rel: T2 -> T2 -> bool.
- Variable F: T1 -> T2.
-
- Fixpoint seq_argmin (l: seq T1) :=
- if l is x :: l' then
- if seq_argmin l' is Some y then
- if rel (F x) (F y) then Some x else Some y
- else Some x
- else None.
-
- Fixpoint seq_argmax (l: seq T1) :=
- if l is x :: l' then
- if seq_argmax l' is Some y then
- if rel (F y) (F x) then Some x else Some y
- else Some x
- else None.
-
- Section Lemmas.
-
- Lemma seq_argmin_exists:
- forall l x,
- x \in l ->
- seq_argmin l != None.
- Proof.
- induction l; first by done.
- intros x; rewrite in_cons.
- move => /orP [/eqP EQ | IN] /=;
- first by subst; destruct (seq_argmin l); first by case: ifP.
- by destruct (seq_argmin l); first by case: ifP.
- Qed.
-
- Lemma seq_argmin_in_seq:
- forall l x,
- seq_argmin l = Some x ->
- x \in l.
- Proof.
- induction l; simpl; first by done.
- intros x ARG.
- destruct (seq_argmin l);
- last by case: ARG => EQ; subst; rewrite in_cons eq_refl.
- destruct (rel (F a) (F s));
- first by case: ARG => EQ; subst; rewrite in_cons eq_refl.
- case: ARG => EQ; subst.
- by rewrite in_cons; apply/orP; right; apply IHl.
- Qed.
-
- Lemma seq_argmax_exists:
- forall l x,
- x \in l ->
- seq_argmax l != None.
- Proof.
- induction l; first by done.
- intros x; rewrite in_cons.
- move => /orP [/eqP EQ | IN] /=;
- first by subst; destruct (seq_argmax l); first by case: ifP.
- by destruct (seq_argmax l); first by case: ifP.
- Qed.
-
- Lemma seq_argmax_in_seq:
- forall l x,
- seq_argmax l = Some x ->
- x \in l.
- Proof.
- induction l; simpl; first by done.
- intros x ARG.
- destruct (seq_argmax l);
- last by case: ARG => EQ; subst; rewrite in_cons eq_refl.
- destruct (rel (F s) (F a));
- first by case: ARG => EQ; subst; rewrite in_cons eq_refl.
- case: ARG => EQ; subst.
- by rewrite in_cons; apply/orP; right; apply IHl.
- Qed.
-
- Section TotalOrder.
-
- Hypothesis H_transitive: transitive rel.
-
- Variable l: seq T1.
- Hypothesis H_total_over_list:
- forall x y,
- x \in l ->
- y \in l ->
- rel (F x) (F y) || rel (F y) (F x).
-
- Lemma seq_argmin_computes_min:
- forall x y,
- seq_argmin l = Some x ->
- y \in l ->
- rel (F x) (F y).
- Proof.
- rename H_transitive into TRANS, H_total_over_list into TOT, l into l'.
- induction l'; first by done.
- intros x y EQmin IN; simpl in EQmin.
- rewrite in_cons in IN.
- move: IN => /orP [/eqP EQ | IN].
- {
- subst; destruct (seq_argmin l') eqn:ARG; last first.
- {
- case: EQmin => EQ; subst.
- by exploit (TOT x x); try (by rewrite in_cons eq_refl); rewrite orbb.
- }
- {
- destruct (rel (F a) (F s)) eqn:REL; case: EQmin => EQ; subst;
- first by exploit (TOT x x); try (by rewrite in_cons eq_refl); rewrite orbb.
- exploit (TOT a x).
- - by rewrite in_cons eq_refl.
- - by rewrite in_cons; apply/orP; right; apply seq_argmin_in_seq.
- - by rewrite REL /=.
- }
- }
- {
- destruct (seq_argmin l') eqn:ARG.
- {
- destruct (rel (F a) (F s)) eqn:REL; case: EQmin => EQ; subst; last first.
- {
- apply IHl'; [| by done | by done].
- by intros x0 y0 INx INy; apply TOT; rewrite in_cons; apply/orP; right.
- }
- {
- apply TRANS with (y := F s); first by done.
- apply IHl'; [| by done | by done].
- by intros x0 y0 INx INy; apply TOT; rewrite in_cons; apply/orP; right.
- }
- }
- {
- case: EQmin => EQ; subst.
- by apply seq_argmin_exists in IN; rewrite ARG in IN.
- }
- }
- Qed.
-
- Lemma seq_argmax_computes_max:
- forall x y,
- seq_argmax l = Some x ->
- y \in l ->
- rel (F y) (F x).
- Proof.
- rename H_transitive into TRANS, H_total_over_list into TOT, l into l'.
- induction l'; first by done.
- intros x y EQmin IN; simpl in EQmin.
- rewrite in_cons in IN.
- move: IN => /orP [/eqP EQ | IN].
- {
- subst; destruct (seq_argmax l') eqn:ARG; last first.
- {
- case: EQmin => EQ; subst.
- by exploit (TOT x x); try (by rewrite in_cons eq_refl); rewrite orbb.
- }
- {
- destruct (rel (F s) (F a)) eqn:REL; case: EQmin => EQ; subst;
- first by exploit (TOT x x); try (by rewrite in_cons eq_refl); rewrite orbb.
- exploit (TOT a x).
- - by rewrite in_cons eq_refl.
- - by rewrite in_cons; apply/orP; right; apply seq_argmax_in_seq.
- - by rewrite REL orbF.
- }
- }
- {
- destruct (seq_argmax l') eqn:ARG.
- {
- destruct (rel (F s) (F a)) eqn:REL; case: EQmin => EQ; subst; last first.
- {
- apply IHl'; [| by done | by done].
- by intros x0 y0 INx INy; apply TOT; rewrite in_cons; apply/orP; right.
- }
- {
- apply TRANS with (y := F s); last by done.
- apply IHl'; [| by done | by done].
- by intros x0 y0 INx INy; apply TOT; rewrite in_cons; apply/orP; right.
- }
- }
- {
- case: EQmin => EQ; subst.
- by apply seq_argmax_exists in IN; rewrite ARG in IN.
- }
- }
- Qed.
-
- End TotalOrder.
-
- End Lemmas.
-
- End ArgGeneric.
-
- Section MinGeneric.
-
- Context {T: eqType}.
- Variable rel: rel T.
-
- Definition seq_min := seq_argmin rel id.
- Definition seq_max := seq_argmax rel id.
-
- Section Lemmas.
-
- Lemma seq_min_exists:
- forall l x,
- x \in l ->
- seq_min l != None.
- Proof.
- by apply seq_argmin_exists.
- Qed.
-
- Lemma seq_min_in_seq:
- forall l x,
- seq_min l = Some x ->
- x \in l.
- Proof.
- by apply seq_argmin_in_seq.
- Qed.
-
- Lemma seq_max_exists:
- forall l x,
- x \in l ->
- seq_max l != None.
- Proof.
- by apply seq_argmax_exists.
- Qed.
-
- Lemma seq_max_in_seq:
- forall l x,
- seq_max l = Some x ->
- x \in l.
- Proof.
- by apply seq_argmax_in_seq.
- Qed.
-
- Section TotalOrder.
-
- Hypothesis H_transitive: transitive rel.
-
- Variable l: seq T.
- Hypothesis H_total_over_list:
- forall x y,
- x \in l ->
- y \in l ->
- rel x y || rel y x.
-
- Lemma seq_min_computes_min:
- forall x y,
- seq_min l = Some x ->
- y \in l ->
- rel x y.
- Proof.
- by apply seq_argmin_computes_min.
- Qed.
-
- Lemma seq_max_computes_max:
- forall x y,
- seq_max l = Some x ->
- y \in l ->
- rel y x.
- Proof.
- by apply seq_argmax_computes_max.
- Qed.
-
- End TotalOrder.
-
- End Lemmas.
-
- End MinGeneric.
-
- Section ArgNat.
-
- Context {T: eqType}.
-
- Variable F: T -> nat.
-
- Definition seq_argmin_nat := seq_argmin leq F.
- Definition seq_argmax_nat := seq_argmax leq F.
-
- Section Lemmas.
-
- Lemma seq_argmin_nat_exists:
- forall l x,
- x \in l ->
- seq_argmin_nat l != None.
- Proof.
- by apply seq_argmin_exists.
- Qed.
-
- Lemma seq_argmin_nat_in_seq:
- forall l x,
- seq_argmin_nat l = Some x ->
- x \in l.
- Proof.
- by apply seq_argmin_in_seq.
- Qed.
-
- Lemma seq_argmax_nat_exists:
- forall l x,
- x \in l ->
- seq_argmax_nat l != None.
- Proof.
- by apply seq_argmax_exists.
- Qed.
-
- Lemma seq_argmax_nat_in_seq:
- forall l x,
- seq_argmax_nat l = Some x ->
- x \in l.
- Proof.
- by apply seq_argmax_in_seq.
- Qed.
-
- Section TotalOrder.
-
- Lemma seq_argmin_nat_computes_min:
- forall l x y,
- seq_argmin_nat l = Some x ->
- y \in l ->
- F x <= F y.
- Proof.
- intros l x y SOME IN.
- try ( apply seq_argmin_computes_min with (l0 := l); try (by done) ) ||
- apply seq_argmin_computes_min with (l := l); try (by done).
- - by intros x1 x2 x3; apply leq_trans.
- - by intros x1 x2 IN1 IN2; apply leq_total.
- Qed.
-
- Lemma seq_argmax_nat_computes_max:
- forall l x y,
- seq_argmax_nat l = Some x ->
- y \in l ->
- F x >= F y.
- Proof.
- intros l x y SOME IN.
- try ( apply seq_argmax_computes_max with (l0 := l); try (by done) ) ||
- apply seq_argmax_computes_max with (l := l); try (by done).
- - by intros x1 x2 x3; apply leq_trans.
- - by intros x1 x2 IN1 IN2; apply leq_total.
- Qed.
-
- End TotalOrder.
-
- End Lemmas.
-
- End ArgNat.
-
- Section MinNat.
-
- Definition seq_min_nat := seq_argmin leq id.
- Definition seq_max_nat := seq_argmax leq id.
-
- Section Lemmas.
-
- Lemma seq_min_nat_exists:
- forall l x,
- x \in l ->
- seq_min_nat l != None.
- Proof.
- by apply seq_argmin_exists.
- Qed.
-
- Lemma seq_min_nat_in_seq:
- forall l x,
- seq_min_nat l = Some x ->
- x \in l.
- Proof.
- by apply seq_argmin_in_seq.
- Qed.
-
- Lemma seq_max_nat_exists:
- forall l x,
- x \in l ->
- seq_max_nat l != None.
- Proof.
- by apply seq_argmax_exists.
- Qed.
-
- Lemma seq_max_nat_in_seq:
- forall l x,
- seq_max_nat l = Some x ->
- x \in l.
- Proof.
- by apply seq_argmax_in_seq.
- Qed.
-
- Section TotalOrder.
-
- Lemma seq_min_nat_computes_min:
- forall l x y,
- seq_min_nat l = Some x ->
- y \in l ->
- x <= y.
- Proof.
- intros l x y SOME IN.
- try ( apply seq_min_computes_min with (l0 := l); try (by done) ) ||
- apply seq_min_computes_min with (l := l); try (by done).
- - by intros x1 x2 x3; apply leq_trans.
- - by intros x1 x2 IN1 IN2; apply leq_total.
- Qed.
-
- Lemma seq_max_nat_computes_max:
- forall l x y,
- seq_max_nat l = Some x ->
- y \in l ->
- x >= y.
- Proof.
- intros l x y SOME IN.
- try ( apply seq_max_computes_max with (l0 := l); try (by done) ) ||
- apply seq_max_computes_max with (l := l); try (by done).
- - by intros x1 x2 x3; apply leq_trans.
- - by intros x1 x2 IN1 IN2; apply leq_total.
- Qed.
-
- End TotalOrder.
-
- End Lemmas.
-
- End MinNat.
-
- Section NatRange.
-
- Definition values_between (a b: nat) :=
- filter (fun x => x >= a) (map (@nat_of_ord _) (enum 'I_b)).
-
- Lemma mem_values_between a b:
- forall x, x \in values_between a b = (a <= x < b).
- Proof.
- intros x; rewrite mem_filter.
- apply/idP/idP.
- {
- move => /andP [GE IN].
- move: IN => /mapP [x' IN] EQ; subst.
- rewrite mem_enum in IN.
- by apply/andP; split.
- }
- {
- move => /andP [GE LT].
- rewrite GE andTb.
- apply/mapP; exists (Ordinal LT); last by done.
- by rewrite mem_enum.
- }
- Qed.
-
- Definition min_nat_cond P (a b: nat) :=
- seq_min_nat (filter P (values_between a b)).
-
- Definition max_nat_cond P (a b: nat) :=
- seq_max_nat (filter P (values_between a b)).
-
- Lemma min_nat_cond_exists:
- forall (P: nat -> bool) (a b: nat) x,
- a <= x < b ->
- P x ->
- min_nat_cond P a b != None.
- Proof.
- intros P a b x LE HOLDS.
- try ( apply seq_argmin_exists with (x0 := x) ) ||
- apply seq_argmin_exists with (x := x).
- by rewrite mem_filter mem_values_between HOLDS LE.
- Qed.
-
- Lemma min_nat_cond_in_seq:
- forall P a b x,
- min_nat_cond P a b = Some x ->
- a <= x < b /\ P x.
- Proof.
- intros P a b x SOME.
- apply seq_min_nat_in_seq in SOME.
- rewrite mem_filter in SOME; move: SOME => /andP [Px LE].
- by split; first by rewrite mem_values_between in LE.
- Qed.
-
- Lemma min_nat_cond_computes_min:
- forall P a b x,
- min_nat_cond P a b = Some x ->
- (forall y, a <= y < b -> P y -> x <= y).
- Proof.
- intros P a b x SOME y LE Py.
- apply seq_min_nat_computes_min with (y := y) in SOME; first by done.
- by rewrite mem_filter Py andTb mem_values_between.
- Qed.
-
- Lemma max_nat_cond_exists:
- forall (P: nat -> bool) (a b: nat) x,
- a <= x < b ->
- P x ->
- max_nat_cond P a b != None.
- Proof.
- intros P a b x LE HOLDS.
- try ( apply seq_argmax_exists with (x0 := x) ) ||
- apply seq_argmax_exists with (x := x).
- by rewrite mem_filter mem_values_between HOLDS LE.
- Qed.
-
- Lemma max_nat_cond_in_seq:
- forall P a b x,
- max_nat_cond P a b = Some x ->
- a <= x < b /\ P x.
- Proof.
- intros P a b x SOME.
- apply seq_max_nat_in_seq in SOME.
- rewrite mem_filter in SOME; move: SOME => /andP [Px LE].
- by split; first by rewrite mem_values_between in LE.
- Qed.
-
- Lemma max_nat_cond_computes_max:
- forall P a b x,
- max_nat_cond P a b = Some x ->
- (forall y, a <= y < b -> P y -> y <= x).
- Proof.
- intros P a b x SOME y LE Py.
- apply seq_max_nat_computes_max with (y := y) in SOME; first by done.
- by rewrite mem_filter Py andTb mem_values_between.
- Qed.
-
- End NatRange.
-
-End MinMaxSeq.
-
-Section Kmin.
-
- Context {T1 T2: eqType}.
-
- Variable rel: T2 -> T2 -> bool.
- Variable F: T1 -> T2.
-
- Fixpoint seq_argmin_k (l: seq T1) (k: nat) :=
- if k is S k' then
- if (seq_argmin rel F l) is Some min_x then
- let l_without_min := rem min_x l in
- min_x :: seq_argmin_k l_without_min k'
- else [::]
- else [::].
-
- Lemma seq_argmin_k_exists:
- forall k l x,
- k > 0 ->
- x \in l ->
- seq_argmin_k l k != [::].
- Proof.
- induction k; first by done.
- move => l x _ IN /=.
- destruct (seq_argmin rel F l) as [|] eqn:MIN; first by done.
- suff NOTNONE: seq_argmin rel F l != None by rewrite MIN in NOTNONE.
- try ( by apply seq_argmin_exists with (x0 := x) ) ||
- by apply seq_argmin_exists with (x := x).
- Qed.
-
-End Kmin.
diff --git a/classic/util/nat.v b/classic/util/nat.v
deleted file mode 100644
index c152181db4d3f2161171a5bef8589b222a7005fc..0000000000000000000000000000000000000000
--- a/classic/util/nat.v
+++ /dev/null
@@ -1,66 +0,0 @@
-Require Export prosa.util.nat.
-
-Require Import prosa.classic.util.tactics mathcomp.zify.zify.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop div.
-
-(* Additional lemmas about natural numbers. *)
-Section NatLemmas.
-
- Lemma addnb (b1 b2 : bool) : (b1 + b2) != 0 = b1 || b2.
- Proof.
- by destruct b1,b2;
- rewrite ?addn0 ?add0n ?addn1 ?orTb ?orbT ?orbF ?orFb.
- Qed.
-
- Lemma subh4:
- forall m n p,
- m <= n ->
- p <= n ->
- (m == n - p) = (p == n - m).
- Proof.
- intros; apply/eqP.
- destruct (p == n - m) eqn:EQ.
- by move: EQ => /eqP EQ; rewrite EQ subKn.
- by apply negbT in EQ; unfold not; intro BUG;
- rewrite BUG subKn ?eq_refl in EQ.
- Qed.
-
- Lemma addmovr:
- forall m n p,
- m >= n ->
- (m - n = p <-> m = p + n).
- Proof.
- by split; ins; lia.
- Qed.
-
- Lemma addmovl:
- forall m n p,
- m >= n ->
- (p = m - n <-> p + n = m).
- Proof.
- by split; ins; lia.
- Qed.
-
- Lemma ltSnm : forall n m, n.+1 < m -> n < m.
- Proof.
- by ins; apply ltn_trans with (n := n.+1); [by apply ltnSn |by ins].
- Qed.
-
- Lemma min_lt_same :
- forall x y z,
- minn x z < minn y z -> x < y.
- Proof.
- unfold minn; ins; desf.
- {
- apply negbT in Heq0; rewrite -ltnNge in Heq0.
- by apply leq_trans with (n := z).
- }
- {
- apply negbT in Heq; rewrite -ltnNge in Heq.
- by apply (ltn_trans H) in Heq0; rewrite ltnn in Heq0.
- }
- by rewrite ltnn in H.
- Qed.
-
-End NatLemmas.
-
diff --git a/classic/util/notation.v b/classic/util/notation.v
deleted file mode 100644
index 5522e41d77a0a43d11b6c1d5b27d95cae3ad2d9a..0000000000000000000000000000000000000000
--- a/classic/util/notation.v
+++ /dev/null
@@ -1,80 +0,0 @@
-Require Export prosa.util.notation.
-
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop.
-
-(* Here we define a more verbose notation for projections of pairs... *)
-Section Pair.
-
- Context {A B: Type}.
- Variable p: A * B.
- Definition pair_1st := fst p.
- Definition pair_2nd := snd p.
-
-End Pair.
-
-(* ...and triples. *)
-Section Triple.
-
- Context {A B C: Type}.
- Variable p: A * B * C.
- Definition triple_1st (p: A * B * C) := fst (fst p).
- Definition triple_2nd := snd (fst p).
- Definition triple_3rd := snd p.
-
-End Triple.
-
-(* Define a wrapper from an element to a singleton list. *)
-Definition make_sequence {T: Type} (opt: option T) :=
- match opt with
- | Some j => [:: j]
- | None => [::]
- end.
-
-(* Let's define big operators for lists of pairs. *)
-
-Reserved Notation "\sum_ ( ( m , n ) <- r ) F"
- (at level 41, F at level 41, m, n at level 50,
- format "'[' \sum_ ( ( m , n ) <- r ) '/ ' F ']'").
-
-Notation "\sum_ ( ( m , n ) <- r ) F" :=
- (\sum_(i <- r) (let '(m,n) := i in F)) : nat_scope.
-
-Reserved Notation "\sum_ ( ( m , n ) <- r | P ) F"
- (at level 41, F at level 30, P at level 41, m, n at level 50,
- format "'[' \sum_ ( ( m , n ) <- r | P ) '/ ' F ']'").
-
-Notation "\sum_ ( ( m , n ) <- r | P ) F" :=
- (\sum_(i <- r | (let '(m,n) := i in P))
- (let '(m,n) := i in F)) : nat_scope.
-
-Reserved Notation "\max_ ( ( m , n ) <- r ) F"
- (at level 41, F at level 41, m, n at level 50,
- format "'[' \max_ ( ( m , n ) <- r ) '/ ' F ']'").
-
-Notation "\max_ ( ( m , n ) <- r ) F" :=
- (\max_(i <- r) (let '(m,n) := i in F)) : nat_scope.
-
-Reserved Notation "\max_ ( ( m , n ) <- r | P ) F"
- (at level 41, F at level 30, P at level 41, m, n at level 50,
- format "'[' \max_ ( ( m , n ) <- r | P ) '/ ' F ']'").
-
-Notation "\max_ ( ( m , n ) <- r | P ) F" :=
- (\max_(i <- r | (let '(m,n) := i in P))
- (let '(m,n) := i in F)) : nat_scope.
-
-Notation "[ 'pairs' ( x , y ) <- s | C ]" :=
- (filter (fun i => let '(x,y) := i in C%B) s)
- (at level 0, x at level 99,
- format "[ '[hv' 'pairs' ( x , y ) <- s '/ ' | C ] ']'") : seq_scope.
-
-Notation "[ 'pairs' ( E , F ) | x <- s ]" :=
- (map (fun y => ((fun x1 => let x := x1 in E) y, (fun x2 => let x := x2 in F) y)) s)
- (at level 0, E at level 1, F at level 1,
- format "[ '[hv' 'pairs' ( E , F ) | x <- s ] ']'") : seq_scope.
-
-(* In case we use an (option list T), we can define membership
- without having to match the option type. *)
-Reserved Notation "x \In A"
- (at level 70, format "'[hv' x '/ ' \In A ']'", no associativity).
-Notation "x \In A" :=
- (if A is Some B then in_mem x (mem B) else false) : bool_scope.
diff --git a/classic/util/ord_quantifier.v b/classic/util/ord_quantifier.v
deleted file mode 100644
index 238265b555a13ab0529c9d6dbb05977b3f3a4fea..0000000000000000000000000000000000000000
--- a/classic/util/ord_quantifier.v
+++ /dev/null
@@ -1,101 +0,0 @@
-Require Import prosa.classic.util.tactics.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype.
-
-(* Lemmas about the exists for Ordinals: [exists x, P x]. *)
-Section OrdExists.
-
- Lemma exists_ord0:
- forall P,
- [exists x in 'I_0, P x] = false.
- Proof.
- intros P.
- apply negbTE; rewrite negb_exists; apply/forall_inP.
- intros x; destruct x as [x LT].
- by exfalso; rewrite ltn0 in LT.
- Qed.
-
- Lemma exists_recr:
- forall n P,
- [exists x in 'I_n.+1, P x] =
- [exists x in 'I_n, P (widen_ord (leqnSn n) x)] || P (ord_max).
- Proof.
- intros n P.
- apply/idP/idP.
- {
- move => /exists_inP EX; destruct EX as [x IN Px].
- destruct x as [x LT].
- remember LT as LT'; clear HeqLT'.
- rewrite ltnS leq_eqVlt in LT; move: LT => /orP [/eqP EQ | LT].
- {
- apply/orP; right.
- unfold ord_max; subst x.
- apply eq_trans with (y := P (Ordinal LT')); last by done.
- by f_equal; apply ord_inj.
- }
- {
- apply/orP; left.
- apply/exists_inP; exists (Ordinal LT); first by done.
- apply eq_trans with (y := P (Ordinal LT')); last by done.
- by f_equal; apply ord_inj.
- }
- }
- {
- intro OR; apply/exists_inP.
- move: OR => /orP [/exists_inP EX | MAX].
- {
- by destruct EX as [x IN Px]; exists (widen_ord (leqnSn n) x).
- }
- by exists ord_max.
- }
- Qed.
-
-End OrdExists.
-
-(* Lemmas about the forall for Ordinals: [exists x, P x]. *)
-Section OrdForall.
-
- Lemma forall_ord0:
- forall P,
- [forall x in 'I_0, P x].
- Proof.
- intros P; apply/forall_inP.
- by intros x IN0; destruct x.
- Qed.
-
- Lemma forall_recr:
- forall n P,
- [forall x in 'I_n.+1, P x] =
- [forall x in 'I_n, P (widen_ord (leqnSn n) x)] && P (ord_max).
- Proof.
- intros n P.
- apply/idP/idP.
- {
- move => /forall_inP ALL.
- apply/andP; split; last by apply ALL.
- by apply/forall_inP; intros x IN; apply ALL.
- }
- {
- move => /andP [/forall_inP ALL MAX].
- apply/forall_inP; intros x IN.
- destruct x as [x LT].
- unfold ord_max in *.
- remember LT as LT'; clear HeqLT'.
- rewrite ltnS leq_eqVlt in LT; move: LT => /orP [/eqP EQ | LT].
- {
- subst n.
- apply/eqP; rewrite -MAX; apply/eqP.
- by unfold ord_max; apply f_equal, ord_inj.
- }
- {
- feed (ALL (Ordinal LT)); first by done.
- apply/eqP; rewrite -ALL; apply/eqP.
- by apply f_equal, ord_inj.
- }
- }
- Qed.
-
-End OrdForall.
-
-(* Tactics for simplifying exists and forall. *)
-Ltac simpl_exists_ord := rewrite !exists_recr !exists_ord0 /=.
-Ltac simpl_forall_ord := rewrite !forall_recr !forall_ord0 /=.
\ No newline at end of file
diff --git a/classic/util/pick.v b/classic/util/pick.v
deleted file mode 100644
index e73980096682f660009a0ff28f34cb9f74b00722..0000000000000000000000000000000000000000
--- a/classic/util/pick.v
+++ /dev/null
@@ -1,291 +0,0 @@
-From mathcomp Require Import ssreflect ssrbool ssrfun eqtype ssrnat seq fintype.
-
-(* In this file, we define functions for picking numbers in an interval [0, n). *)
-
-(** Auxiliary Functions *)
-
-Definition default0 {n} (x: option 'I_n) : nat := if x is Some y then y else 0.
-
-Definition arg_pred_nat n (P: pred 'I_n) ord :=
- [pred i | P i & [forall j: 'I_n, P j ==> ord i j]].
-
-Definition pred_min_nat n (P: pred 'I_n) := arg_pred_nat n P leq.
-Definition pred_max_nat n (P: pred 'I_n) := arg_pred_nat n P (fun x y => geq x y).
-Definition to_pred_ord n (P: pred nat) := (fun x:'I_n => P (nat_of_ord x)).
-
-(** Defining Pick functions *)
-
-(* (pick_any n P) returns some number < n that satisfies P, or 0 if it cannot be found. *)
-Definition pick_any n (P: pred nat) := default0 (pick (to_pred_ord n P)).
-
-(* (pick_min n P) returns the smallest number < n that satisfies P, or 0 if it cannot be found. *)
-Definition pick_min n (P: pred nat) := default0 (pick (pred_min_nat n (to_pred_ord n P))).
-
-(* (pick_max n P) returns the largest number < n that satisfies P, or 0 if it cannot be found. *)
-Definition pick_max n (P: pred nat) := default0 (pick (pred_max_nat n (to_pred_ord n P))).
-
-(** Improved notation *)
-
-(* Next we provide the following notation for the variations of pick:
- [pick-any x <= N | P], [pick-any x < N | P]
- [pick-min x <= N | P], [pick-min x < N | P]
- [pick-max x <= N | P], [pick-max x < N | P]. *)
-Notation "[ 'pick-any' x <= N | P ]" :=
- (pick_any N.+1 (fun x : nat => P%B))
- (at level 0, x ident, only parsing) : form_scope.
-
-Notation "[ 'pick-any' x < N | P ]" :=
- (pick_any N (fun x : nat => P%B))
- (at level 0, x ident, only parsing) : form_scope.
-
-Notation "[ 'pick-min' x <= N | P ]" :=
- (pick_min N.+1 (fun x : nat => P%B))
- (at level 0, x ident, only parsing) : form_scope.
-
-Notation "[ 'pick-min' x < N | P ]" :=
- (pick_min N (fun x : nat => P%B))
- (at level 0, x ident, only parsing) : form_scope.
-
-Notation "[ 'pick-max' x <= N | P ]" :=
- (pick_max N.+1 (fun x : nat => P%B))
- (at level 0, x ident, only parsing) : form_scope.
-
-Notation "[ 'pick-max' x < N | P ]" :=
- (pick_max N (fun x : nat => P%B))
- (at level 0, x ident, only parsing) : form_scope.
-
-(** Lemmas about pick_any *)
-
-Section PickAny.
-
- Variable n: nat.
- Variable p: pred nat.
-
- Variable P: nat -> Prop.
-
- Hypothesis EX: exists x, x < n /\ p x.
-
- Hypothesis HOLDS: forall x, p x -> P x.
-
- (* First, we show that any property P of (pick_any n p) can be proven by showing
- that P holds for any number < n that satisfies p. *)
- Lemma pick_any_holds: P (pick_any n p).
- Proof.
- rewrite /pick_any /default0.
- case: pickP; first by intros x PRED; apply HOLDS.
- intros NONE; red in NONE; exfalso.
- move: EX => [x [LTN PRED]].
- by specialize (NONE (Ordinal LTN)); rewrite /to_pred_ord /= PRED in NONE.
- Qed.
-
-End PickAny.
-
-(** Lemmas about pick_min *)
-Section PickMin.
-
- Variable n: nat.
- Variable p: pred nat.
-
- Variable P: nat -> Prop.
-
- (* Assume that there is some number < n that satisfies p. *)
- Hypothesis EX: exists x, x < n /\ p x.
-
- Section Bound.
-
- (* First, we show that (pick_min n p) < n. *)
- Lemma pick_min_ltn: pick_min n p < n.
- Proof.
- rewrite /pick_min /odflt /oapp.
- case: pickP.
- {
- move => x /andP [PRED /forallP ALL].
- by rewrite /default0.
- }
- {
- intros NONE; red in NONE; exfalso.
- move: EX => [x [LT PRED]]; clear EX.
- set argmin := arg_min (Ordinal LT) p id.
- specialize (NONE argmin).
- suff ARGMIN: (pred_min_nat n p) argmin by rewrite ARGMIN in NONE.
- rewrite /argmin; case: arg_minnP; first by done.
- intros y Py MINy.
- apply/andP; split; first by done.
- by apply/forallP; intros y0; apply/implyP; intros Py0; apply MINy.
- }
- Qed.
-
- End Bound.
-
- Section Minimum.
-
- Hypothesis MIN:
- forall x,
- x < n ->
- p x ->
- (forall y, y < n -> p y -> x <= y) ->
- P x.
-
- (* Next, we show that any property P of (pick_min n p) can be proven by showing
- that P holds for the smallest number < n that satisfies p. *)
- Lemma pick_min_holds: P (pick_min n p).
- Proof.
- rewrite /pick_min /odflt /oapp.
- case: pickP.
- {
- move => x /andP [PRED /forallP ALL].
- apply MIN; [by rewrite /default0 | by done |].
- intros y LTy Py; specialize (ALL (Ordinal LTy)).
- by move: ALL => /implyP ALL; apply ALL.
- }
- {
- intros NONE; red in NONE; exfalso.
- move: EX => [x [LT PRED]]; clear EX.
- set argmin := arg_min (Ordinal LT) p id.
- specialize (NONE argmin).
- suff ARGMIN: (pred_min_nat n p) argmin by rewrite ARGMIN in NONE.
- rewrite /argmin; case: arg_minnP; first by done.
- intros y Py MINy.
- apply/andP; split; first by done.
- by apply/forallP; intros y0; apply/implyP; intros Py0; apply MINy.
- }
- Qed.
-
- End Minimum.
-
-End PickMin.
-
-(** Lemmas about pick_max *)
-Section PickMax.
-
- Variable n: nat.
- Variable p: pred nat.
-
- Variable P: nat -> Prop.
-
- (* Assume that there is some number < n that satisfies p. *)
- Hypothesis EX: exists x, x < n /\ p x.
-
- Section Bound.
-
- (* First, we show that (pick_max n p) < n... *)
- Lemma pick_max_ltn: pick_max n p < n.
- Proof.
- rewrite /pick_max /odflt /oapp.
- case: pickP.
- {
- move => x /andP [PRED /forallP ALL].
- by rewrite /default0.
- }
- {
- intros NONE; red in NONE; exfalso.
- move: EX => [x [LT PRED]]; clear EX.
- set argmax := arg_max (Ordinal LT) p id.
- specialize (NONE argmax).
- suff ARGMAX: (pred_max_nat n p) argmax by rewrite ARGMAX in NONE.
- rewrite /argmax; case: arg_maxnP; first by done.
- intros y Py MAXy.
- apply/andP; split; first by done.
- by apply/forallP; intros y0; apply/implyP; intros Py0; apply MAXy.
- }
- Qed.
-
- End Bound.
-
- Section Maximum.
-
- Hypothesis MAX:
- forall x,
- x < n ->
- p x ->
- (forall y, y < n -> p y -> x >= y) ->
- P x.
-
- (* Next, we show that any property P of (pick_max n p) can be proven by showing that
- P holds for the largest number < n that satisfies p. *)
- Lemma pick_max_holds: P (pick_max n p).
- Proof.
- rewrite /pick_max /odflt /oapp.
- case: pickP.
- {
- move => x /andP [PRED /forallP ALL].
- apply MAX; [by rewrite /default0 | by rewrite /default0 |].
- intros y LTy Py; specialize (ALL (Ordinal LTy)).
- by move: ALL => /implyP ALL; apply ALL.
- }
- {
- intros NONE; red in NONE; exfalso.
- move: EX => [x [LT PRED]]; clear EX.
- set argmax := arg_max (Ordinal LT) p id.
- specialize (NONE argmax).
- suff ARGMAX: (pred_max_nat n p) argmax by rewrite ARGMAX in NONE.
- rewrite /argmax; case: arg_maxnP; first by done.
- intros y Py MAXy.
- apply/andP; split; first by done.
- by apply/forallP; intros y0; apply/implyP; intros Py0; apply MAXy.
- }
- Qed.
-
- End Maximum.
-
-End PickMax.
-
-Section Predicate.
-
- Variable n: nat.
- Variable p: pred nat.
-
- Hypothesis EX: exists x, x < n /\ p x.
-
- (* Here we prove that pick_any satiesfies the predicate p, ... *)
- Lemma pick_any_pred: p (pick_any n p).
- Proof.
- by apply pick_any_holds.
- Qed.
-
- (* ...and the same holds for pick_min... *)
- Lemma pick_min_pred: p (pick_min n p).
- Proof.
- by apply pick_min_holds.
- Qed.
-
- (* ...and pick_max. *)
- Lemma pick_max_pred: p (pick_max n p).
- Proof.
- by apply pick_max_holds.
- Qed.
-
-End Predicate.
-
-Section PickMinCompare.
-
- Variable n: nat.
- Variable p1 p2: pred nat.
-
- Hypothesis EX1 : exists x, x < n /\ p1 x.
- Hypothesis EX2 : exists x, x < n /\ p2 x.
-
- Hypothesis OUT:
- forall x y, x < n -> y < n -> p1 x -> p2 y -> ~~ p1 y -> x <= y.
-
- Lemma pick_min_compare: pick_min n p1 <= pick_min n p2.
- Proof.
- set m1:= pick_min _ _.
- set m2:= pick_min _ _.
- case IN: (p1 m2).
- {
- apply pick_min_holds; first by done.
- intros x Px LTN ALL.
- by apply ALL; first by apply pick_min_ltn.
- }
- {
- apply (OUT m1 m2).
- - by apply pick_min_ltn.
- - by apply pick_min_ltn.
- - by apply pick_min_pred.
- - by apply pick_min_pred.
- - by apply negbT.
- }
- Qed.
-
-End PickMinCompare.
diff --git a/classic/util/powerset.v b/classic/util/powerset.v
deleted file mode 100644
index 684b77b97c6dcebdfbf522222f5f240566f588bb..0000000000000000000000000000000000000000
--- a/classic/util/powerset.v
+++ /dev/null
@@ -1,19 +0,0 @@
-Require Import prosa.classic.util.tactics.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop tuple.
-
-Section PowerSet.
-
- (* Based on https://www.ps.uni-saarland.de/formalizations/fset/html/libs.fset.html *)
- Definition powerset {T: eqType} (l: seq T) : seq (seq T) :=
- let mT := ((size l).-tuple bool) in
- (map (fun m : mT => (mask m l)) (enum {: mT})).
-
- Lemma mem_powerset {T: eqType} (x: seq T) y :
- y \in (powerset x) -> {subset y <= x}.
- Proof.
- intros POW; red; intros z IN; unfold powerset in POW.
- move: POW => /mapP POW; destruct POW as [pair POW EQ]; subst.
- by apply mem_mask with (m := pair).
- Qed.
-
-End PowerSet.
\ No newline at end of file
diff --git a/classic/util/seqset.v b/classic/util/seqset.v
deleted file mode 100644
index d9593c1b711a1fe538fbdd22ece6d89da0bc23a9..0000000000000000000000000000000000000000
--- a/classic/util/seqset.v
+++ /dev/null
@@ -1,28 +0,0 @@
-Require Export prosa.util.seqset.
-
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype seq fintype.
-
-Section Lemmas.
-
- Context {T: eqType}.
- Variable s: {set T}.
-
- Lemma set_mem : forall x, (x \in s) = (x \in _set_seq s).
- Proof.
- by intros x; destruct s.
- Qed.
-
-End Lemmas.
-
-Section LemmasFinType.
-
- Context {T: finType}.
- Variable s: {set T}.
-
- Lemma set_card : #|s| = size s.
- Proof.
- have UNIQ: uniq s by destruct s.
- by move: UNIQ => /card_uniqP ->.
- Qed.
-
-End LemmasFinType.
diff --git a/classic/util/sorting.v b/classic/util/sorting.v
deleted file mode 100644
index 07cf81125059a5ac172b54d97c9082a521251029..0000000000000000000000000000000000000000
--- a/classic/util/sorting.v
+++ /dev/null
@@ -1,161 +0,0 @@
-Require Import prosa.classic.util.tactics prosa.classic.util.induction prosa.classic.util.list.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop path.
-
-(** * Sorting *)
-(** In this modeule we prove a few lemmas about sorted sequences. *)
-Section Sorting.
-
- Section SortedImplLeIdx.
-
- (* Consider an arbitrary type T... *)
- Variable T: eqType.
-
- (* ... and some binary relation leT (≺) on it. *)
- Variable leT: rel T.
- Notation "x ≺ y" := (leT x y) (at level 30).
- Let sorted xs := sorted leT xs.
-
- (* Next, let xs be a sequence of elements of type T. *)
- Variable xs: seq T.
-
- (* Since Coq requires all functions to be total, we
- need to specify a default value for cases when
- an index exceeds the size of the sequence. *)
- Variable default: T.
- Let nth := nth default.
-
- (* Next, let's introduce a notation for the nth element of a sequence. *)
- Notation "xs [| n |]" := (nth xs n) (at level 10).
-
- (* We prove that, given the fact that sequence xs is sorted,
- the i'th element of xs is ≺ than the i+1'th element. *)
- Lemma sort_ordered:
- forall (idx: nat),
- sorted xs ->
- idx < (size xs).-1 ->
- xs[|idx|] ≺ xs[|idx.+1|].
- Proof.
- intros idx SORT LT.
- induction xs; first by rewrite /= ltn0 in LT.
- simpl in SORT, LT; move: SORT => /pathP SORT.
- by simpl; apply SORT.
- Qed.
-
- (* Next we prove that the prefix of a sorted sequence is also sorted. *)
- Lemma sorted_rcons_prefix:
- forall x,
- sorted (rcons xs x) ->
- sorted xs.
- Proof.
- intros x SORT; destruct xs; simpl; first by ins.
- rewrite rcons_cons /= rcons_path in SORT.
- by move: SORT => /andP [PATH _].
- Qed.
-
- (* Let's assume that relation leT (≺) is transitive. *)
- Hypothesis H_leT_is_transitive: transitive leT.
-
- (* Given the fact that sequence xs is sorted, we prove that
- the last elements of the sequence is the max. element. *)
- Lemma order_sorted_rcons:
- forall (x lst: T),
- sorted (rcons xs lst) ->
- x \in xs ->
- x ≺ lst.
- Proof.
- intros x last SORT IN.
- induction xs as [ | a xs']; [ | clear xs; rename xs' into xs]; first by rewrite in_nil in IN.
- simpl in SORT; move: IN; rewrite in_cons; move => /orP IN.
- destruct IN as [HEAD | TAIL];
- last by apply IHxs'; [by apply path_sorted in SORT| by ins].
- move: HEAD => /eqP HEAD; subst a.
- apply order_path_min in SORT; last by ins.
- move: SORT => /allP SORT.
- by apply SORT; rewrite mem_rcons in_cons; apply/orP; left.
- Qed.
-
- (* Next, we prove that for sorted sequence xs and for any
- two indices i1 and i2, i1 < i2 implies xs[|i1|] ≺ xs[|i2|]. *)
- Lemma sorted_lt_idx_implies_rel:
- forall i1 i2,
- sorted xs ->
- i1 < i2 ->
- i2 < size xs ->
- xs[|i1|] ≺ xs [|i2|].
- Proof.
- intros i1 i2 SORT LE LEsize.
- generalize dependent i2; rewrite leq_as_delta.
- intros delta LT.
- destruct xs as [ | a xs']; [ | clear xs; rename xs' into xs]; first by rewrite ltn0 in LT.
- simpl in SORT.
- induction delta;
- first by rewrite /= addn0 ltnS in LT; rewrite /= -addnE addn0; apply/pathP.
- {
- rewrite /transitive (H_leT_is_transitive (nth (a :: xs) (i1.+1 + delta))) //;
- first by apply IHdelta, leq_ltn_trans with (n := i1.+1 + delta.+1); [rewrite leq_add2l| ].
- rewrite -[delta.+1]addn1 addnA addn1.
- move: SORT => /pathP SORT; apply SORT.
- by rewrite /= -[delta.+1]addn1 addnA addn1 ltnS in LT.
- }
- Qed.
-
- (* Finally, assuming that (1) xs is sorted and contains
- no duplicates, (2) ≺ is antisymmetric and transitive,
- we prove that x[|i1|] ≺ x[|i2|] implies i1 ≤ i2. *)
- Lemma sorted_rel_implies_le_idx:
- forall i1 i2,
- uniq xs ->
- antisymmetric_over_list leT xs ->
- sorted xs ->
- xs[|i1|] ≺ xs[|i2|] ->
- i1 < size xs ->
- i2 < size xs ->
- i1 <= i2.
- Proof.
- intros i1 i2 UNIQ ANTI SORT REL SIZE1 SIZE2.
- generalize dependent i2.
- induction i1; first by done.
- {
- intros i2 REL SIZE2.
- feed IHi1; first by apply ltn_trans with (n := i1.+1).
- apply leq_trans with (n := i1.+1); first by done.
- rewrite ltn_neqAle; apply/andP; split.
- {
- apply/eqP; red; intro BUG; subst.
- assert (REL': leT (nth xs i2) (nth xs i2.+1)).
- by apply sorted_lt_idx_implies_rel; rewrite // ltnSn.
- rewrite /antisymmetric_over_list in ANTI.
- exploit (ANTI (nth xs i2) (nth xs i2.+1)); rewrite ?mem_nth //.
- move => /eqP EQ; rewrite nth_uniq in EQ; try (by done).
- by rewrite -[_ == _]negbK in EQ; move: EQ => /negP EQ; apply EQ; apply/eqP.
- }
- {
- apply IHi1; last by done.
- rewrite /transitive (H_leT_is_transitive (nth xs i1.+1)) //.
- by apply sorted_lt_idx_implies_rel; try (by done); apply ltnSn.
- }
- }
- Qed.
-
- End SortedImplLeIdx.
-
- (* Let F be a function from some type to natural numbers. Then for a
- sequence xs, the fact that [∀ i: F(xs[i]) ≤ F(xs[i+1])] implies that
- [forall i k: F(xs[i]) ≤ F(xs[i + k])]. *)
- Lemma prev_le_next:
- forall {T: Type} (F: T -> nat) (xs: seq T) (def: T) (i k: nat),
- (forall i, i < (size xs).-1 -> F (nth def xs i) <= F (nth def xs i.+1)) ->
- (i + k <= (size xs).-1) ->
- F (nth def xs i) <= F (nth def xs (i+k)).
- Proof.
- intros T F r x i k ALL SIZE.
- generalize dependent i. generalize dependent k.
- induction k; intros; first by rewrite addn0 leqnn.
- specialize (IHk i.+1); exploit IHk; [by rewrite addSnnS | intro LE].
- apply leq_trans with (n := F (nth x r (i.+1)));
- last by rewrite -addSnnS.
- apply ALL, leq_trans with (n := i + k.+1); last by ins.
- by rewrite addnS ltnS leq_addr.
- Qed.
-
-End Sorting.
\ No newline at end of file
diff --git a/classic/util/step_function.v b/classic/util/step_function.v
deleted file mode 100644
index a34d56f3403da232d35fdc6695656155184a3a3d..0000000000000000000000000000000000000000
--- a/classic/util/step_function.v
+++ /dev/null
@@ -1,4 +0,0 @@
-Require Export prosa.util.unit_growth.
-
-Require Import prosa.classic.util.tactics prosa.classic.util.notation prosa.classic.util.induction.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat.
diff --git a/classic/util/sum.v b/classic/util/sum.v
deleted file mode 100644
index 9953f6e417c2c303ccaf442943ac817891dfb7c8..0000000000000000000000000000000000000000
--- a/classic/util/sum.v
+++ /dev/null
@@ -1,158 +0,0 @@
-Require Export prosa.util.sum.
-Require Export mathcomp.zify.zify.
-
-Require Import prosa.classic.util.tactics.
-Require Import prosa.classic.util.notation.
-Require Import prosa.classic.util.sorting.
-Require Import prosa.classic.util.nat.
-From mathcomp Require Import ssreflect ssrbool eqtype ssrnat seq fintype bigop path.
-
-(* Lemmas about sum. *)
-Section ExtraLemmas.
-
- Lemma extend_sum :
- forall t1 t2 t1' t2' F,
- t1' <= t1 ->
- t2 <= t2' ->
- \sum_(t1 <= t < t2) F t <= \sum_(t1' <= t < t2') F t.
- Proof.
- intros t1 t2 t1' t2' F LE1 LE2.
- destruct (t1 <= t2) eqn:LE12;
- last by apply negbT in LE12; rewrite -ltnNge in LE12; rewrite big_geq // ltnW.
- rewrite -> big_cat_nat with (m := t1') (n := t1); try (by done); simpl;
- last by apply leq_trans with (n := t2).
- rewrite -> big_cat_nat with (p := t2') (n := t2); try (by done); simpl.
- by rewrite addnC -addnA; apply leq_addr.
- Qed.
-
- Lemma leq_sum_nat m n (P : pred nat) (E1 E2 : nat -> nat) :
- (forall i, m <= i < n -> P i -> E1 i <= E2 i) ->
- \sum_(m <= i < n | P i) E1 i <= \sum_(m <= i < n | P i) E2 i.
- Proof.
- intros LE.
- rewrite big_nat_cond [\sum_(_ <= _ < _| P _)_]big_nat_cond.
- by apply leq_sum; move => j /andP [IN H]; apply LE.
- Qed.
-
- Lemma leq_sum1_smaller_range m n (P Q: pred nat) a b:
- (forall i, m <= i < n /\ P i -> a <= i < b /\ Q i) ->
- \sum_(m <= i < n | P i) 1 <= \sum_(a <= i < b | Q i) 1.
- Proof.
- intros REDUCE.
- rewrite big_mkcond.
- apply leq_trans with (n := \sum_(a <= i < b | Q i) \sum_(m <= i' < n | i' == i) 1).
- {
- rewrite (exchange_big_dep (fun x => true)); [simpl | by done].
- apply leq_sum_nat; intros i LE _.
- case TRUE: (P i); last by done.
- move: (REDUCE i (conj LE TRUE)) => [LE' TRUE'].
- rewrite (big_rem i); last by rewrite mem_index_iota.
- by rewrite TRUE' eq_refl.
- }
- {
- apply leq_sum_nat; intros i LE TRUE.
- rewrite big_mkcond /=.
- destruct (m <= i < n) eqn:LE'; last first.
- {
- rewrite big_nat_cond big1; first by done.
- move => i' /andP [LE'' _]; case EQ: (_ == _); last by done.
- by move: EQ => /eqP EQ; subst; rewrite LE'' in LE'.
- }
- rewrite (bigD1_seq i) /=; [ | by rewrite mem_index_iota | by rewrite iota_uniq ].
- rewrite eq_refl big1; first by done.
- by move => i' /negbTE NEQ; rewrite NEQ.
- }
- Qed.
-
- Lemma leq_pred_sum:
- forall (T:eqType) (r: seq T) (P1 P2: pred T) F,
- (forall i, P1 i -> P2 i) ->
- \sum_(i <- r | P1 i) F i <=
- \sum_(i <- r | P2 i) F i.
- Proof.
- intros.
- rewrite big_mkcond [in X in _ <= X]big_mkcond//= leq_sum //.
- intros i _.
- destruct P1 eqn:P1a; destruct P2 eqn:P2a; try done.
- exfalso.
- move: P1a P2a => /eqP P1a /eqP P2a.
- rewrite eqb_id in P1a; rewrite eqbF_neg in P2a.
- move: P2a => /negP P2a.
- by apply P2a; apply H.
- Qed.
-
- (* We show that the fact that the sum is smaller than the range
- of the summation implies the existence of a zero element. *)
- Lemma sum_le_summation_range :
- forall f t Δ,
- \sum_(t <= x < t + Δ) f x < Δ ->
- exists x, t <= x < t + Δ /\ f x = 0.
- Proof.
- induction Δ; intros; first by rewrite ltn0 in H.
- destruct (f (t + Δ)) eqn: EQ.
- { exists (t + Δ); split; last by done.
- by apply/andP; split; [rewrite leq_addr | rewrite addnS ltnS].
- }
- { move: H; rewrite addnS big_nat_recr //= ?leq_addr // EQ addnS ltnS; move => H.
- feed IHΔ.
- { by apply leq_ltn_trans with (\sum_(t <= i < t + Δ) f i + n); first rewrite leq_addr. }
- move: IHΔ => [z [/andP [LE GE] ZERO]].
- exists z; split; last by done.
- apply/andP; split; first by done.
- by rewrite ltnS ltnW.
- }
- Qed.
-
-End ExtraLemmas.
-
-
-(* Lemmas about arithmetic with sums. *)
-Section SumArithmetic.
-
- Lemma telescoping_sum :
- forall (T: Type) (F: T->nat) r (x0: T),
- (forall i, i < (size r).-1 -> F (nth x0 r i) <= F (nth x0 r i.+1)) ->
- F (nth x0 r (size r).-1) - F (nth x0 r 0) =
- \sum_(0 <= i < (size r).-1) (F (nth x0 r (i.+1)) - F (nth x0 r i)).
- Proof.
- intros T F r x0 ALL.
- have ADD1 := big_add1.
- have RECL := big_nat_recl.
- specialize (ADD1 nat 0 addn 0 (size r) (fun x => true) (fun i => F (nth x0 r i))).
- specialize (RECL nat 0 addn (size r).-1 0 (fun i => F (nth x0 r i))).
- rewrite sumnB_nat; last by ins.
- rewrite addmovr; last by rewrite -[_.-1]add0n; apply prev_le_next; try rewrite add0n leqnn.
- rewrite addnBAC; last by apply leq_sum_nat; move => i /andP [_ LT] _; apply ALL.
- rewrite addnC -RECL //.
- rewrite addmovl; last by rewrite big_nat_recr // -{1}[\sum_(_ <= _ < _) _]addn0; apply leq_add.
- by rewrite addnC -big_nat_recr.
- Qed.
-
- Lemma leq_sum_sub_uniq :
- forall (T: eqType) (r1 r2: seq T) F,
- uniq r1 ->
- {subset r1 <= r2} ->
- \sum_(i <- r1) F i <= \sum_(i <- r2) F i.
- Proof.
- intros T r1 r2 F UNIQ SUB; generalize dependent r2.
- induction r1 as [| x r1' IH]; first by ins; rewrite big_nil.
- {
- intros r2 SUB.
- assert (IN: x \in r2).
- by apply SUB; rewrite in_cons eq_refl orTb.
- simpl in UNIQ; move: UNIQ => /andP [NOTIN UNIQ]; specialize (IH UNIQ).
- destruct (splitPr IN).
- rewrite big_cat 2!big_cons /= addnA [_ + F x]addnC -addnA leq_add2l.
- rewrite mem_cat in_cons eq_refl in IN.
- rewrite -big_cat /=.
- apply IH; red; intros x0 IN0.
- rewrite mem_cat.
- feed (SUB x0); first by rewrite in_cons IN0 orbT.
- rewrite mem_cat in_cons in SUB.
- move: SUB => /orP [SUB1 | /orP [/eqP EQx | SUB2]];
- [by rewrite SUB1 | | by rewrite SUB2 orbT].
- by rewrite -EQx IN0 in NOTIN.
- }
- Qed.
-
-End SumArithmetic.
diff --git a/classic/util/tactics.v b/classic/util/tactics.v
deleted file mode 100644
index bce4cef9333d50007a55f0d7eb0072b9a29e392f..0000000000000000000000000000000000000000
--- a/classic/util/tactics.v
+++ /dev/null
@@ -1,384 +0,0 @@
-Require Export prosa.util.tactics.
-
-(* *********************************************************************)
-(* *)
-(* Basic lemmas & tactics (based on Viktor Vafeiadis' Vbase.v) *)
-(* *)
-(* *********************************************************************)
-
-(** This file collects a number of basic lemmas and tactics for better
- proof automation, structuring large proofs, or rewriting. Most of
- the rewriting support is ported from ssreflect. *)
-
-(** Symbols starting with [vlib__] are internal. *)
-
-From mathcomp Require Import ssreflect ssrbool ssrnat eqtype bigop.
-
-Open Scope bool_scope.
-Open Scope list_scope.
-
-Set Implicit Arguments.
-Unset Strict Implicit.
-
-(* ************************************************************************** *)
-(** * Very basic automation *)
-(* ************************************************************************** *)
-
-(** Set up for basic simplification *)
-
-Create HintDb vlib discriminated.
-
-(** Adaptation of the ss-reflect "[done]" tactic. *)
-
-Ltac vlib__basic_done :=
- solve [trivial with vlib | apply sym_equal; trivial | discriminate | contradiction].
-
-Ltac done := trivial with vlib; hnf; intros;
- solve [try vlib__basic_done; split;
- try vlib__basic_done; split;
- try vlib__basic_done; split;
- try vlib__basic_done; split;
- try vlib__basic_done; split; vlib__basic_done
- | match goal with H : ~ _ |- _ => solve [case H; trivial] end].
-
-(** A variant of the ssr "done" tactic that performs "eassumption". *)
-
-Ltac edone := try eassumption; trivial; hnf; intros;
- solve [try eassumption; try vlib__basic_done; split;
- try eassumption; try vlib__basic_done; split;
- try eassumption; try vlib__basic_done; split;
- try eassumption; try vlib__basic_done; split;
- try eassumption; try vlib__basic_done; split;
- try eassumption; vlib__basic_done
- | match goal with H : ~ _ |- _ => solve [case H; trivial] end].
-
-Tactic Notation "by" tactic(tac) := (tac; done).
-Tactic Notation "eby" tactic(tac) := (tac; edone).
-
-(* ************************************************************************** *)
-(** * Equality types *)
-(* ************************************************************************** *)
-
-Lemma vlib__internal_eqP :
- forall (T: eqType) (x y : T), reflect (x = y) (x == y).
-Proof. by intros; apply/eqP. Qed.
-
-Lemma beq_refl : forall (T : eqType) (x : T), x == x.
-Proof. by intros; case eqP. Qed.
-
-Lemma beq_sym : forall (T : eqType) (x y : T), (x == y) = (y == x).
-Proof. intros; do 2 case eqP; congruence. Qed.
-
-#[global] Hint Resolve beq_refl : vlib.
-#[global] Hint Rewrite beq_refl : vlib_trivial.
-
-Notation eqxx := beq_refl.
-
-(* ************************************************************************** *)
-(** * Basic simplification tactics *)
-(* ************************************************************************** *)
-
-Lemma vlib__negb_rewrite : forall b, negb b -> b = false.
-Proof. by intros []. Qed.
-
-Lemma vlib__andb_split : forall b1 b2, b1 && b2 -> b1 /\ b2.
-Proof. by intros [] []. Qed.
-
-Lemma vlib__nandb_split : forall b1 b2, b1 && b2 = false -> b1 = false \/ b2 = false.
-Proof. intros [] []; auto. Qed.
-
-Lemma vlib__orb_split : forall b1 b2, b1 || b2 -> b1 \/ b2.
-Proof. intros [] []; auto. Qed.
-
-Lemma vlib__norb_split : forall b1 b2, b1 || b2 = false -> b1 = false /\ b2 = false.
-Proof. intros [] []; auto. Qed.
-
-Lemma vlib__eqb_split : forall b1 b2 : bool, (b1 -> b2) -> (b2 -> b1) -> b1 = b2.
-Proof. intros [] [] H H'; unfold is_true in *; auto using sym_eq. Qed.
-
-Lemma vlib__beq_rewrite : forall (T : eqType) (x1 x2 : T), x1 == x2 -> x1 = x2.
-Proof. by intros *; case eqP. Qed.
-
-Lemma vlib__leq_split : forall x1 x2 x3, x1 <= x2 -> x2 <= x3 -> x1 <= x2 <= x3.
-Proof. by intros; apply/andP; split. Qed.
-
-Lemma vlib__ltn_split1 : forall x1 x2 x3, x1 <= x2 -> x2 < x3 -> x1 <= x2 < x3.
-Proof. by intros; apply/andP; split. Qed.
-
-Lemma vlib__ltn_split2 : forall x1 x2 x3, x1 < x2 -> x2 <= x3 -> x1 < x2 <= x3.
-Proof. by intros; apply/andP; split. Qed.
-
-(** Set up for basic simplification: database of reflection lemmas *)
-
-Create HintDb vlib_refl discriminated.
-
-Global Hint Resolve andP orP nandP norP negP vlib__internal_eqP neqP : vlib_refl.
-
-(* Add x <= y <= z splitting to the core hint database. *)
-#[global] Hint Immediate vlib__leq_split vlib__ltn_split1 vlib__ltn_split2 : core.
-
-
-Ltac vlib__complaining_inj f H :=
- let X := fresh in
- (match goal with | [|- ?P ] => set (X := P) end);
- injection H;
- (* (lazymatch goal with | [ |- f _ = f _ -> _] => fail | _ => idtac end);
- (* Previous statement no longer necessary in 8.4 *) *)
- clear H; intros; subst X;
- try subst.
-
-Ltac vlib__clarify1 :=
- try subst;
- repeat match goal with
- | [H: is_true (andb _ _) |- _] =>
- let H' := fresh H in case (vlib__andb_split H); clear H; intros H' H
- | [H: is_true (negb ?x) |- _] => rewrite (vlib__negb_rewrite H) in *
- | [H: is_true ?x |- _] => rewrite H in *
- | [H: ?x = true |- _] => rewrite H in *
- | [H: ?x = false |- _] => rewrite H in *
- | [H: is_true (_ == _) |- _] => generalize (vlib__beq_rewrite H); clear H; intro H
- | [H: ?f _ = ?f _ |- _] => vlib__complaining_inj f H
- | [H: ?f _ _ = ?f _ _ |- _] => vlib__complaining_inj f H
- | [H: ?f _ _ _ = ?f _ _ _ |- _] => vlib__complaining_inj f H
- | [H: ?f _ _ _ _ = ?f _ _ _ _ |- _] => vlib__complaining_inj f H
- | [H: ?f _ _ _ _ _ = ?f _ _ _ _ _ |- _] => vlib__complaining_inj f H
- | [H: ?f _ _ _ _ _ _ = ?f _ _ _ _ _ _ |- _] => vlib__complaining_inj f H
- | [H: ?f _ _ _ _ _ _ _ = ?f _ _ _ _ _ _ _ |- _] => vlib__complaining_inj f H
- end; try done.
-
-(** Perform injections & discriminations on all hypotheses *)
-
-Ltac clarify :=
- vlib__clarify1;
- repeat match goal with
- | H1: ?x = Some _, H2: ?x = None |- _ => rewrite H2 in H1; discriminate
- | H1: ?x = Some _, H2: ?x = Some _ |- _ => rewrite H2 in H1; vlib__clarify1
- end; (* autorewrite with vlib_trivial; *) try done.
-
-Ltac inv x := inversion x; clarify.
-Ltac simpls := simpl in *; try done.
-
-Tactic Notation "case_eq" constr(x) := case_eq (x).
-
-Tactic Notation "case_eq" constr(x) "as" simple_intropattern(H) :=
- destruct x as [] eqn:H; try done.
-
-Ltac vlib__clarsimp1 :=
- clarify; (autorewrite with vlib_trivial vlib in * );
- (autorewrite with vlib_trivial in * ); try done;
- clarify; auto 1 with vlib.
-
-Ltac clarsimp := intros; simpl in *; vlib__clarsimp1.
-
-Ltac autos := clarsimp; auto with vlib.
-
-(* ************************************************************************** *)
-(** Destruct but give useful names *)
-(* ************************************************************************** *)
-
-(** Destruct, but no case split *)
-Ltac desc :=
- repeat match goal with
- | H: is_true (_ == _) |- _ => generalize (vlib__beq_rewrite H); clear H; intro H
- | H : exists x, ?p |- _ =>
- let x' := fresh x in destruct H as [x' H]
- | H : ?p /\ ?q |- _ =>
- let x' := H in
- let y' := fresh H in
- destruct H as [x' y']
- | H : is_true (_ && _) |- _ =>
- let H' := fresh H in case (vlib__andb_split H); clear H; intros H H'
- | H : (_ || _) = false |- _ =>
- let H' := fresh H in case (vlib__norb_split H); clear H; intros H H'
- | H : ?x = ?x |- _ => clear H
- end.
-
-Ltac des :=
- repeat match goal with
- | H: is_true (_ == _) |- _ => generalize (vlib__beq_rewrite H); clear H; intro H
- | H : exists x, ?p |- _ =>
- let x' := fresh x in destruct H as [x' H]
- | H : exists2 x, ?p & ?q |- _ =>
- let x' := fresh x in destruct H as [x' H1 H2]
- | H : ?p /\ ?q |- _ =>
- let x' := H in
- let y' := fresh H in
- destruct H as [x' y']
- | H : is_true (_ && _) |- _ =>
- let H' := fresh H in case (vlib__andb_split H); clear H; intros H H'
- | H : (_ || _) = false |- _ =>
- let H' := fresh H in case (vlib__norb_split H); clear H; intros H H'
- | H : ?x = ?x |- _ => clear H
- | H : ?p <-> ?q |- _ =>
- let x' := H in
- let y' := fresh H in
- destruct H as [x' y']
- | H : ?p \/ ?q |- _ =>
- let x' := H in
- let y' := H in
- destruct H as [x' | y']
- | H : is_true (_ || _) |- _ => case (vlib__orb_split H); clear H; intro H
- | H : (_ && _) = false |- _ => case (vlib__nandb_split H); clear H; intro H
- end.
-
-Ltac des_if_asm :=
- clarify;
- repeat
- match goal with
- | H: context[ match ?x with _ => _ end ] |- _ =>
- match (type of x) with
- | { _ } + { _ } => destruct x; clarify
- | bool =>
- let Heq := fresh "Heq" in
- let P := fresh in
- evar(P: Prop);
- assert (Heq: reflect P x) by (subst P; trivial with vlib_refl);
- subst P; destruct Heq as [Heq|Heq]
- | _ => let Heq := fresh "Heq" in destruct x as [] eqn:Heq; clarify
- end
- end.
-
-Ltac des_if_goal :=
- clarify;
- repeat
- match goal with
- | |- context[match ?x with _ => _ end] =>
- match (type of x) with
- | { _ } + { _ } => destruct x; clarify
- | bool =>
- let Heq := fresh "Heq" in
- let P := fresh in
- evar(P: Prop);
- assert (Heq: reflect P x) by (subst P; trivial with vlib_refl);
- subst P; destruct Heq as [Heq|Heq]
- | _ => let Heq := fresh "Heq" in destruct x as [] eqn:Heq; clarify
- end
- end.
-
-Ltac des_if :=
- clarify;
- repeat
- match goal with
- | |- context[match ?x with _ => _ end] =>
- match (type of x) with
- | { _ } + { _ } => destruct x; clarify
- | bool =>
- let Heq := fresh "Heq" in
- let P := fresh in
- evar(P: Prop);
- assert (Heq: reflect P x) by (subst P; trivial with vlib_refl);
- subst P; destruct Heq as [Heq|Heq]
- | _ => let Heq := fresh "Heq" in destruct x as [] eqn:Heq; clarify
- end
- | H: context[ match ?x with _ => _ end ] |- _ =>
- match (type of x) with
- | { _ } + { _ } => destruct x; clarify
- | bool =>
- let Heq := fresh "Heq" in
- let P := fresh in
- evar(P: Prop);
- assert (Heq: reflect P x) by (subst P; trivial with vlib_refl);
- subst P; destruct Heq as [Heq|Heq]
- | _ => let Heq := fresh "Heq" in destruct x as [] eqn:Heq; clarify
- end
- end.
-
-Ltac des_eqrefl :=
- match goal with
- | H: context[match ?X with |true => _ | false => _ end Logic.eq_refl] |- _ =>
- let EQ := fresh "EQ" in
- let id' := fresh "x" in
- revert H;
- generalize (Logic.eq_refl X);
- try (generalize X at 1 3); try (generalize X at 2 3);
- intros id' EQ; destruct id'; intros H
- | |- context[match ?X with |true => _ | false => _ end Logic.eq_refl] =>
- let EQ := fresh "EQ" in
- let id' := fresh "x" in
- generalize (Logic.eq_refl X);
- try (generalize X at 1 3); try (generalize X at 2 3);
- intros id' EQ; destruct id'
- end.
-
-Ltac desf_asm := clarify; des; des_if_asm.
-
-Ltac desf := clarify; des; des_if.
-
-Ltac clarassoc := clarsimp; autorewrite with vlib_trivial vlib vlibA in *; try done.
-
-Ltac vlib__hacksimp1 :=
- clarsimp;
- match goal with
- | H: _ |- _ => solve [rewrite H; clear H; clarsimp
- |rewrite <- H; clear H; clarsimp]
- | _ => solve [f_equal; clarsimp]
- end.
-
-Ltac hacksimp :=
- clarsimp;
- try match goal with
- | H: _ |- _ => solve [rewrite H; clear H; clarsimp
- |rewrite <- H; clear H; clarsimp]
- | |- context[match ?p with _ => _ end] => solve [destruct p; vlib__hacksimp1]
- | _ => solve [f_equal; clarsimp]
- end.
-
-(* ************************************************************************** *)
-(** ** Delineating cases in proofs *)
-(* ************************************************************************** *)
-
-(** Named case tactics (taken from Libtactics) *)
-
-Tactic Notation "assert_eq" ident(x) constr(v) :=
- let H := fresh in
- assert (x = v) as H by reflexivity;
- clear H.
-
-Tactic Notation "Case_aux" ident(x) constr(name) :=
- first [
- set (x := name); move x at top
- | assert_eq x name
- | fail 1 "because we are working on a different case." ].
-
-Ltac Case name := Case_aux case name.
-Ltac SCase name := Case_aux subcase name.
-Ltac SSCase name := Case_aux subsubcase name.
-Ltac SSSCase name := Case_aux subsubsubcase name.
-Ltac SSSSCase name := Case_aux subsubsubsubcase name.
-
-(** Lightweight case tactics (without names) *)
-
-Tactic Notation "--" tactic(c) :=
- first [
- assert (WithinCaseM := True); move WithinCaseM at top
- | fail 1 "because we are working on a different case." ]; c.
-
-Tactic Notation "++" tactic(c) :=
- first [
- assert (WithinCaseP := True); move WithinCaseP at top
- | fail 1 "because we are working on a different case." ]; c.
-
-(* ************************************************************************** *)
-(** * New tactics for ssreflect *)
-(* ************************************************************************** *)
-
-(* Tactic for simplifying a sum with constant term.
- Usage: simpl_sum_const in H.
- H: \sum_(2 <= x < 4) 5 > 0 ==becomes==> H: 5 * (4 - 2) > 0 *)
-Ltac simpl_sum_const :=
- rewrite ?big_const_nat ?big_const_ord ?big_const_seq iter_addn ?muln1 ?mul1n ?mul0n
- ?muln0 ?addn0 ?add0n.
-
-(* Tactic for splitting all conjunctions in a hypothesis.
- Usage: split_conj H.
- H: A /\ (B /\ C) ==becomes==> H1: A
- H2: B
- H3: C *)
-Ltac split_conj X :=
- hnf in X;
- repeat match goal with
- | H : ?p /\ ?q |- _ =>
- let x' := H in
- let y' := fresh H in
- destruct H as [x' y']
- end.
diff --git a/create_makefile.sh b/create_makefile.sh
index 5951c7459ee8bd53d127bf320500660a056702bc..8ca5dd3af3965896a2018ce16e6f3d184605a6aa 100755
--- a/create_makefile.sh
+++ b/create_makefile.sh
@@ -6,16 +6,9 @@ FIND_OPTS=( . -name '*.v' ! -name '*#*' ! -path './.git/*' ! -path './with-proof
while ! [ -z "$1" ]
do
case "$1" in
- --without-classic)
- FIND_OPTS+=( ! -path './classic/*' )
- ;;
--without-refinements)
FIND_OPTS+=( ! -path './implementation/refinements/*' )
;;
- --only-classic)
- FIND_OPTS+=( ! -path './analysis/*' ! -path './behavior/*' ! -path './model/*' \
- ! -path './implementation/*' ! -path './results/*')
- ;;
*)
echo "Unrecognized option: $1"
exit 1
diff --git a/scripts/Makefile.patch b/scripts/Makefile.patch
index 262aaee7b368abce92f176a92ba2f0994975fdcf..e2964557632fc5bc32e26f21215647c4339fd727 100644
--- a/scripts/Makefile.patch
+++ b/scripts/Makefile.patch
@@ -56,7 +56,7 @@
+ $(HIDE)find . -depth -iname '.DS_Store' ! -path './.git/*' -delete
+
+spell::
-+ ./scripts/flag-typos-in-comments.sh `find . -iname '*.v' ! -path './classic/*'`
++ ./scripts/flag-typos-in-comments.sh `find . -iname '*.v'`
# Compilation rules ###########################################################
diff --git a/scripts/known-long-proofs.json b/scripts/known-long-proofs.json
index 9374c63cac604f3151bd83f3943fdfa035156a20..e689d8e6bc6a6b659b5e806271d2b5802633a9ad 100644
--- a/scripts/known-long-proofs.json
+++ b/scripts/known-long-proofs.json
@@ -2,305 +2,5 @@
"manual_exceptions": {
},
"legacy_proofs": {
- "./classic/analysis/apa/bertogna_edf_comp.v": {
- "bertogna_edf_comp_f_increases": 53,
- "bertogna_edf_comp_iteration_preserves_order": 159,
- "bertogna_edf_comp_rt_grows_too_much": 99,
- "edf_claimed_bounds_finds_fixed_point_of_list": 76
- },
- "./classic/analysis/apa/bertogna_edf_theory.v": {
- "bertogna_cirinei_response_time_bound_edf": 49,
- "bertogna_edf_all_cpus_in_affinity_busy": 52,
- "bertogna_edf_all_cpus_in_subaffinity_busy": 51,
- "bertogna_edf_alpha'_is_full": 116,
- "bertogna_edf_interference_by_different_tasks": 46,
- "bertogna_edf_interference_in_non_full_processors": 138,
- "bertogna_edf_sum_exceeds_total_interference": 43
- },
- "./classic/analysis/apa/bertogna_fp_comp.v": {
- "fp_analysis_yields_response_time_bounds": 113
- },
- "./classic/analysis/apa/bertogna_fp_theory.v": {
- "bertogna_cirinei_response_time_bound_fp": 47,
- "bertogna_fp_all_cpus_in_affinity_busy": 54,
- "bertogna_fp_all_cpus_in_subaffinity_busy": 53,
- "bertogna_fp_alpha'_is_full": 154,
- "bertogna_fp_interference_by_different_tasks": 45,
- "bertogna_fp_interference_in_non_full_processors": 153,
- "bertogna_fp_sum_exceeds_total_interference": 42,
- "bertogna_fp_workload_bounds_interference": 46
- },
- "./classic/analysis/apa/interference_bound_edf.v": {
- "interference_bound_edf_holds_for_single_job_that_completes_on_time": 90,
- "interference_bound_edf_many_periods_in_between": 41
- },
- "./classic/analysis/apa/workload_bound.v": {
- "W_monotonic": 51,
- "workload_bound_service_of_first_and_last_jobs": 45,
- "workload_bounded_by_W": 48
- },
- "./classic/analysis/global/basic/bertogna_edf_comp.v": {
- "bertogna_edf_comp_f_increases": 53,
- "bertogna_edf_comp_iteration_preserves_order": 160,
- "bertogna_edf_comp_rt_grows_too_much": 100,
- "edf_claimed_bounds_finds_fixed_point_of_list": 76
- },
- "./classic/analysis/global/basic/bertogna_edf_theory.v": {
- "bertogna_cirinei_response_time_bound_edf": 50,
- "bertogna_edf_interference_by_different_tasks": 46,
- "bertogna_edf_interference_in_non_full_processors": 133
- },
- "./classic/analysis/global/basic/bertogna_fp_comp.v": {
- "fp_analysis_yields_response_time_bounds": 110
- },
- "./classic/analysis/global/basic/bertogna_fp_theory.v": {
- "bertogna_cirinei_response_time_bound_fp": 48,
- "bertogna_fp_all_cpus_are_busy": 44,
- "bertogna_fp_interference_by_different_tasks": 45,
- "bertogna_fp_interference_in_non_full_processors": 173,
- "bertogna_fp_workload_bounds_interference": 47
- },
- "./classic/analysis/global/basic/interference_bound_edf.v": {
- "interference_bound_edf_holds_for_single_job_that_completes_on_time": 100,
- "interference_bound_edf_many_periods_in_between": 41
- },
- "./classic/analysis/global/basic/workload_bound.v": {
- "W_monotonic": 51,
- "workload_bound_service_of_first_and_last_jobs": 46,
- "workload_bounded_by_W": 48
- },
- "./classic/analysis/global/jitter/bertogna_edf_comp.v": {
- "bertogna_edf_comp_f_increases": 53,
- "bertogna_edf_comp_iteration_preserves_order": 160,
- "bertogna_edf_comp_rt_grows_too_much": 100,
- "edf_claimed_bounds_finds_fixed_point_of_list": 77
- },
- "./classic/analysis/global/jitter/bertogna_edf_theory.v": {
- "bertogna_cirinei_response_time_bound_edf": 60,
- "bertogna_edf_interference_by_different_tasks": 66,
- "bertogna_edf_interference_in_non_full_processors": 130
- },
- "./classic/analysis/global/jitter/bertogna_fp_comp.v": {
- "fp_analysis_yields_response_time_bounds": 125
- },
- "./classic/analysis/global/jitter/bertogna_fp_theory.v": {
- "bertogna_cirinei_response_time_bound_fp": 49,
- "bertogna_fp_all_cpus_are_busy": 46,
- "bertogna_fp_interference_by_different_tasks": 57,
- "bertogna_fp_interference_in_non_full_processors": 183,
- "bertogna_fp_workload_bounds_interference": 49
- },
- "./classic/analysis/global/jitter/interference_bound_edf.v": {
- "interference_bound_edf_holds_for_single_job_that_completes_on_time": 132,
- "interference_bound_edf_holds_for_single_job_with_small_slack": 57,
- "interference_bound_edf_j_fst_completed_on_time": 48,
- "interference_bound_edf_many_periods_in_between": 51
- },
- "./classic/analysis/global/jitter/workload_bound.v": {
- "W_monotonic": 51,
- "workload_bound_many_periods_in_between": 41,
- "workload_bound_n_k_covers_middle_jobs": 40,
- "workload_bound_n_k_equals_num_mid_jobs_plus_1": 42,
- "workload_bound_service_of_first_and_last_jobs": 51,
- "workload_bounded_by_W": 48
- },
- "./classic/analysis/global/parallel/bertogna_edf_comp.v": {
- "bertogna_edf_comp_f_increases": 53,
- "bertogna_edf_comp_iteration_preserves_order": 159,
- "bertogna_edf_comp_rt_grows_too_much": 96,
- "edf_claimed_bounds_finds_fixed_point_of_list": 76
- },
- "./classic/analysis/global/parallel/bertogna_edf_theory.v": {
- "bertogna_cirinei_response_time_bound_edf": 49,
- "bertogna_edf_interference_on_all_cpus": 78
- },
- "./classic/analysis/global/parallel/bertogna_fp_comp.v": {
- "fp_analysis_yields_response_time_bounds": 103
- },
- "./classic/analysis/global/parallel/bertogna_fp_theory.v": {
- "bertogna_cirinei_response_time_bound_fp": 41,
- "bertogna_fp_all_cpus_are_busy": 81
- },
- "./classic/analysis/global/parallel/interference_bound_edf.v": {
- "interference_bound_edf_many_periods_in_between": 42,
- "interference_bound_edf_n_k_covers_all_jobs": 47
- },
- "./classic/analysis/uni/arrival_curves/workload_bound.v": {
- "total_workload_le_total_rbf": 45,
- "total_workload_le_total_rbf'": 41,
- "total_workload_le_total_rbf''": 41
- },
- "./classic/analysis/uni/basic/fp_rta_comp.v": {
- "fp_analysis_yields_response_time_bounds": 42
- },
- "./classic/analysis/uni/basic/fp_rta_theory.v": {
- "uniprocessor_response_time_bound_fp": 46
- },
- "./classic/analysis/uni/basic/tdma_wcrt_analysis.v": {
- "formula_not_sched_St": 44,
- "formula_sched_St": 100,
- "response_time_le_WCRT": 52
- },
- "./classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_properties.v": {
- "sched_jitter_does_not_pick_j": 50,
- "sched_jitter_respects_policy": 77
- },
- "./classic/analysis/uni/susp/dynamic/jitter/jitter_schedule_service.v": {
- "jitter_reduction_inductive_step_case2": 98,
- "jitter_reduction_less_job_service_before_interval_case5": 44,
- "jitter_reduction_service_jitter": 51
- },
- "./classic/analysis/uni/susp/dynamic/jitter/taskset_rta.v": {
- "valid_response_time_bound_of_tsk_i": 57
- },
- "./classic/analysis/uni/susp/dynamic/oblivious/reduction.v": {
- "sched_new_completed_jobs_dont_execute": 42
- },
- "./classic/analysis/uni/susp/sustainability/allcosts/main_claim.v": {
- "policy_is_weakly_sustainable": 66
- },
- "./classic/analysis/uni/susp/sustainability/allcosts/reduction_properties.v": {
- "executes_before_suspension_in_sched_new": 42,
- "sched_new_has_shorter_total_suspension": 43,
- "sched_new_respects_policy": 77,
- "sched_new_work_conserving": 63,
- "suspended_in_sched_new_no_service_since_execution": 46,
- "suspended_in_sched_new_suspension_starts_no_earlier": 56
- },
- "./classic/analysis/uni/susp/sustainability/singlecost/reduction_properties.v": {
- "sched_susp_highercost_depends_only_on_prefix": 56,
- "sched_susp_highercost_same_schedule": 81
- },
- "./classic/implementation/apa/bertogna_fp_example.v": {
- "schedulability_test_succeeds": 87
- },
- "./classic/implementation/apa/schedule.v": {
- "scheduler_has_no_duplicate_jobs": 55,
- "scheduler_mapping_is_work_conserving": 46,
- "scheduler_priority": 114
- },
- "./classic/implementation/global/basic/bertogna_fp_example.v": {
- "schedulability_test_succeeds": 40
- },
- "./classic/implementation/global/jitter/bertogna_fp_example.v": {
- "schedulability_test_succeeds": 41
- },
- "./classic/implementation/global/parallel/bertogna_fp_example.v": {
- "schedulability_test_succeeds": 59
- },
- "./classic/implementation/uni/basic/fp_rta_example.v": {
- "RTA_yields_these_bounds": 45
- },
- "./classic/implementation/uni/basic/schedule_tdma.v": {
- "respects_FIFO": 45
- },
- "./classic/implementation/uni/basic/tdma_rta_example.v": {
- "respects_TDMA_policy": 46
- },
- "./classic/implementation/uni/jitter/fp_rta_example.v": {
- "RTA_yields_these_bounds": 52
- },
- "./classic/implementation/uni/susp/dynamic/oblivious/fp_rta_example.v": {
- "RTA_yields_these_bounds": 51
- },
- "./classic/implementation/uni/susp/schedule.v": {
- "scheduler_depends_only_on_prefix": 53
- },
- "./classic/model/arrival/jitter/arrival_sequence.v": {
- "actual_arrivals_between_mem_cat": 42
- },
- "./classic/model/schedule/global/basic/constrained_deadlines.v": {
- "platform_cpus_busy_with_interfering_tasks": 65,
- "platform_fp_cpus_busy_with_interfering_tasks": 84
- },
- "./classic/model/schedule/global/basic/platform.v": {
- "work_conserving_eq_work_conserving_count": 67
- },
- "./classic/model/schedule/global/jitter/constrained_deadlines.v": {
- "platform_cpus_busy_with_interfering_tasks": 65,
- "platform_fp_cpus_busy_with_interfering_tasks": 87
- },
- "./classic/model/schedule/global/jitter/platform.v": {
- "work_conserving_eq_work_conserving_count": 68
- },
- "./classic/model/schedule/uni/jitter/busy_interval.v": {
- "busy_interval_is_bounded": 59,
- "exists_busy_interval_prefix": 68,
- "not_quiet_implies_exists_scheduled_hp_job": 50
- },
- "./classic/model/schedule/uni/limited/abstract_RTA/abstract_rta.v": {
- "in": 115
- },
- "./classic/model/schedule/uni/limited/abstract_RTA/abstract_seq_rta.v": {
- "bound_for_cumulative_job_interference_actual": 140,
- "task_rbf_excl_tsk_bounds_task_workload_excl_j": 69
- },
- "./classic/model/schedule/uni/limited/busy_interval.v": {
- "busy_interval_is_bounded": 75,
- "exists_busy_interval_prefix": 62,
- "pending_hp_job_exists": 74
- },
- "./classic/model/schedule/uni/limited/edf/nonpr_reg/concrete_models/response_time_bound.v": {
- "uniprocessor_response_time_bound_edf_with_fixed_preemption_points": 174,
- "uniprocessor_response_time_bound_edf_with_floating_nonpreemptive_regions": 88
- },
- "./classic/model/schedule/uni/limited/edf/nonpr_reg/response_time_bound.v": {
- "priority_inversion_is_bounded": 57,
- "priority_inversion_is_bounded_by_blocking": 56
- },
- "./classic/model/schedule/uni/limited/edf/response_time_bound.v": {
- "A_is_in_concrete_search_space": 85,
- "instantiated_task_interference_is_bounded": 163
- },
- "./classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/concrete_models/response_time_bound.v": {
- "uniprocessor_response_time_bound_fp_with_fixed_preemption_points": 176,
- "uniprocessor_response_time_bound_fp_with_floating_nonpreemptive_regions": 88
- },
- "./classic/model/schedule/uni/limited/fixed_priority/nonpr_reg/response_time_bound.v": {
- "priority_inversion_is_bounded": 53
- },
- "./classic/model/schedule/uni/limited/fixed_priority/response_time_bound.v": {
- "instantiated_task_interference_is_bounded": 47
- },
- "./classic/model/schedule/uni/limited/jlfp_instantiation.v": {
- "cumulative_task_interference_split": 63,
- "instantiated_cumulative_interference_of_hep_jobs_equal_total_interference_of_hep_jobs": 115,
- "instantiated_cumulative_interference_of_hep_tasks_equal_total_interference_of_hep_tasks": 128,
- "instantiated_quiet_time_equivalent_edf_quiet_time": 105
- },
- "./classic/model/schedule/uni/limited/platform/limited.v": {
- "model_with_fixed_preemption_points_is_model_with_bounded_nonpreemptive_regions": 83
- },
- "./classic/model/schedule/uni/limited/platform/priority_inversion_is_bounded.v": {
- "=>": 120,
- "not_quiet_implies_exists_scheduled_hp_job_after_preemption_point": 57,
- "not_quiet_implies_exists_scheduled_hp_job_at_preemption_point": 94,
- "scheduling_of_any_segment_starts_with_preemption_time": 45
- },
- "./classic/model/schedule/uni/nonpreemptive/schedule.v": {
- "j_is_not_scheduled_at_t_minus_service_minus_one": 55,
- "j_is_scheduled_at_t_minus_service": 74
- },
- "./classic/model/schedule/uni/service.v": {
- "all_jobs_have_completed_impl_workload_eq_service": 44,
- "incremental_service_during": 70
- },
- "./classic/model/schedule/uni/susp/build_suspension_table.v": {
- "suspension_duration_matches_predicate_up_to_t_max": 95
- },
- "./classic/model/schedule/uni/susp/last_execution.v": {
- "last_execution_idempotent": 41,
- "same_service_implies_same_last_execution": 49
- },
- "./classic/model/schedule/uni/susp/suspension_intervals.v": {
- "cumulative_suspension_eq_total_suspension": 87,
- "cumulative_suspension_le_total_suspension": 57
- },
- "./classic/model/schedule/uni/sustainability.v": {
- "weak_sustainability_equivalence": 50
- },
- "./classic/util/div_mod.v": {
- "divSn_cases": 54
- }
}
}
diff --git a/scripts/module-toc-order.py b/scripts/module-toc-order.py
index a00dd210d6bc4c986f690a169c1bf7cd313da01d..050a3c9f44d821c465bff0341a0f74b15f31839a 100755
--- a/scripts/module-toc-order.py
+++ b/scripts/module-toc-order.py
@@ -20,7 +20,6 @@ MODULE_ORDER = [
'model',
'results',
'analysis',
- 'classic',
'util',
]