Subtype requirements -- signature and behavior

• preservation of behavioral properties

Safety properties -- nothing bad

• invariant properties -- true of all states
• history properties -- true of all execution sequences