# Synthesis of Admissible Shields

## TL;DR

This paper introduces admissible shields for runtime safety enforcement in reactive systems, improving upon k-stabilizing shields by enabling collaboration with the system and handling failures during recovery, demonstrated in UAV mission planning.

## Contribution

It proposes the concept of admissible shields, which are more flexible and capable than k-stabilizing shields, especially when such shields cannot be constructed.

## Key findings

- Admissible shields can be generated for UAVs where k-stabilizing shields cannot.
- They improve recovery times by collaborating with the system.
- They handle system failures during recovery phases.

## Abstract

Shield synthesis is an approach to enforce a set of safety-critical properties of a reactive system at runtime. A shield monitors the system and corrects any erroneous output values instantaneously. The shield deviates from the given outputs as little as it can and recovers to hand back control to the system as soon as possible. This paper takes its inspiration from a case study on mission planning for unmanned aerial vehicles (UAVs) in which k-stabilizing shields, which guarantee recovery in a finite time, could not be constructed. We introduce the notion of admissible shields, which improves k-stabilizing shields in two ways: (1) whereas k-stabilizing shields take an adversarial view on the system, admissible shields take a collaborative view. That is, if there is no shield that guarantees recovery within k steps regardless of system behavior, the admissible shield will attempt to work with the system to recover as soon as possible. (2) Admissible shields can handle system failures during the recovery phase. In our experimental results we show that for UAVs, we can generate admissible shields, even when k-stabilizing shields do not exist.