Properties of an execution of a computer program—particularly for concurrent and distributed systems—have long been formulated by giving safety properties ("bad things don't happen") and liveness properties ("good things do happen").[1]
P
Q
P
Q
P
Q
C
\{P\}C\{Q\}
P
Note that a bad thing is discrete, since it happens at a particular place during execution.A "good thing" need not be discrete, but the liveness property of termination is discrete.
Formal definitions that were ultimately proposed for safety properties[3] and liveness properties[4] demonstrated that this decomposition is not only intuitively appealing but is also complete: all properties of an execution are a conjunction of safety and liveness properties. Moreover, undertaking the decomposition can be helpful, because the formal definitions enable a proof that different methods must be used for verifying safety properties versus for verifying liveness properties.[5]
A safety property proscribes discrete bad things from occurring during an execution.[6] A safety property thus characterizes what is permitted by stating what is prohibited. The requirement that the bad thing be discrete means that a bad thing occurring during execution necessarily occurs at some identifiable point.
Examples of a discrete bad thing that could be used to define a safety property include:
An execution of a program can be described formally by giving the infinite sequence of program states that results as execution proceeds,where the last state for a terminating program is repeated infinitely.For a program of interest, let
S
S*
S\omega
\sigma\le\tau
\sigma
\tau
\sigma
\tau
\sigma
\tau
A property of a program is the set of allowed executions.
The essential characteristic of a safety property
SP
\sigma
SP
\sigma
\sigma\prime
\sigma\prime
SP
\sigma
\sigma\prime
SP
SP
\forall\sigma\inS\omega:\sigma\notinSP\implies(\exists\beta\le\sigma:(\forall\tau\inS\omega:\beta\tau\notinSP))
This formal definition for safety properties implies that if an execution
\sigma
SP
\sigma
SP
A liveness property prescribes good things for every execution or, equivalently, describes something that must happen during an execution. The good thing need not be discrete—it might involve an infinite number of steps. Examples of a good thing used to define a liveness property include:
The good thing in the first example is discrete but not in the others.
Producing an answer within a specified real-time bound is a safety property rather than a liveness property. This is because a discrete bad thing is being proscribed: a partial execution that reaches a state where the answer still has not been produced and the value of the clock (a state variable) violates the bound. Deadlock freedom is a safety property: the "bad thing" is a deadlock (which is discrete).
Most of the time, knowing that a program eventually does some "good thing" is not satisfactory; we want to know that the program performs the "good thing" within some number of steps or before some deadline. A property that gives a specific bound to the "good thing" is a safety property (as noted above), whereas the weaker property that merely asserts the bound exists is a liveness property. Proving such a liveness property is likely to be easier than proving the tighter safety property because proving the liveness property doesn't require the kind of detailed accounting that is required for proving the safety property.
To differ from a safety property, a liveness property
LP
\alpha\inS*
\alpha
LP
\forall\alpha\inS*:(\exists\tau\inS\omega:\alpha\tau\inLP)
This definition does not restrict a good thing to being discrete—the good thing can involve all of
\tau
Lamport used the terms safety property and liveness propertyin his 1977 paper on proving the correctness of multiprocess (concurrent) programs. He borrowed the terms from Petri net theory, which was using the terms liveness and boundedness for describing how the assignment of a Petri net's "tokens"to its "places" could evolve; Petri net safety was a specific form of boundedness. Lamport subsequently developed a formal definition of safety for a NATO short course on distributed systems in Munich.[7] It assumed that properties are invariant under stuttering. The formal definition of safety given above appears in a paper by Alpern and Schneider; the connection between the two formalizations of safety properties appears in a paper by Alpern, Demers, and Schneider.[8]
Alpern and Schneider gives the formal definition for liveness, accompanied by a proof that all properties can be constructed using safety properties and liveness properties. That proof was inspired by Gordon Plotkin's insight that safety properties correspond to closed sets and liveness properties correspond to dense sets in a natural topology on the set
S\omega