A safety property guarantees that something bad will never happen. A system is correct only when every possible behavior satisfies its safety and liveness guarantees. section 1.4.1
Think of safety as keeping every reachable state inside a permitted region. Liveness asks whether the system eventually reaches a desirable state; safety prevents inconsistent or forbidden states along the way. section 1.4.1 section 3.2.4
Two participants, one decision
For a transaction involving participants P1 and P2, safety forbids P1 from committing while P2 aborts, or the reverse. Both participants must not reach conflicting decisions. section 1.4.1 section 6.1.2
Figure 1.9 Behavior space of a distributed transaction with two participants
Use the behavior-space diagram to trace how individual participant transitions can produce either consistent or conflicting transaction states. section 1.4.1
A small state machine makes the guarantee precise. If x may be 0, 1, 2, or 3, declaring x = 1 or x = 2 as safe makes x = 3 intolerable; reaching it provides no guarantee of recovery. section 3.2.4
Failure handling protects safety by detecting unwanted events and inhibiting dangerous actions. Mitigation instead restores liveness, so a component may stop responding until it can safely rejoin. section 3.3.2
Guarantees depend on the system model. Two-phase commit preserves safety during transaction-coordinator failure but may block, sacrificing liveness; participant failures can be handled through recovery logs. section 6.3.2
Follow the coordinator-failure scenario to see how one participant can commit while another remains unable to commit or abort, without violating safety. section 6.3.2
Consensus expresses safety through validity, integrity, and agreement: decisions must be proposed, permanent, and identical across correct processes. Termination is separate because safety can hold while progress stops. section 10.2
Table 10.1 Symbols in set theory
| Symbol |
Meaning |
| ∀ |
For all |
| ∃ |
There exists |
The notation table supports reading the quantified consensus guarantees for validity, integrity, agreement, and termination. section 10.2
Safety is therefore a negative guarantee: it rules out bad behaviors, not necessarily delays or failures to finish. In asynchronous systems, preserving safety may be possible even when guaranteeing liveness is impossible. section 10.1 section 6.3.2
