Safety and Liveness From a Methodological Point of View

The anomaly is that a liveness property, which should constrain only infinite behavior, can implicitly rule out some finite behaviors. We agree that most reasonable specifications will be written in the form recommended by Dederichs and Weber. As observed by Abadi and Lamport [1], who called specifications having this form machine closed, one tries to write liveness properties that “[do] not rule out any finite behavior.” As pointed out by Apt, Francez, and Katz [3], who defined a fairness condition for a programming language to be feasible if it produces machine-closed specifications for all programs, feasibility is necessary to “prevent a scheduler from ‘painting itself into a corner’ ”.