Safety and Liveness Properties: A Survey

The distinction of safety and liveness properties is often adopted in speciica-tion and design methods for distributed systems. We present a short survey on the \history" of these concepts and on papers that contributed to their general acceptance. The notions of safety and liveness properties have been rst introduced by Lamport 14]. Informally, a safety property expresses that \something (bad) will not happen" during a system execution. A liveness property expresses that eventually \something (good) must happen" during an execution. The distinction of safety and liveness properties was motivated by the diierent techniques for proving those properties. For example, Owicki and Lamport 16] propose the technique of proof lattices for liveness properties. Later, Lamport makes his informal characterization of safety properties more precise 4]. An execution of a distributed system is formalized as an innnite sequence of states. Any set of such sequences is a property. A property is called a safety property (Section 2.2 in 4]), if and only if each execution violating the property has a nite preex 1 violating that property and, vice versa 2 , if a nite preex of an execution violates the property then the execution itself violates the property. This corresponds to the intuition that the \bad thing" (i.e. violating the property) can be detected in a nite initial part of the execution and the occurrence of the \bad thing" in a preex of an execution is irremediable. The notion of safety properties is also convincing because a safety property can be generated by a transition systems with nite internal nondeterminism 3]. This \property of safety properties" seems to be one of the main justiications for the adequacy of the supported by the Deutsche Forschungsgemeinschaft SFB 342, TP A3: SEMAFOR and the ESPRIT Basic Research WG 6067 Caliban 1 Since Lamport considers only innnite sequences he needs a \trick" to talk about nite executions: the last state is repeated innnitely often. 2 In Section 2.2 of 4] Lamport requires only the rst direction; Schneider et al. (Section 5.2 of 4] and 6, 5]) associate Lamport also with the deenition of safety requiring both directions.