Shield Synthesis

Definition

Shield synthesis constructs a runtime component that monitors a system’s inputs and outputs and corrects outputs that would violate a safety specification, while minimizing unnecessary deviation from the original system.

Why It Matters

It gives a formally synthesized enforcement layer when the original controller is too complex, opaque, incomplete, third-party, or learned. The shield can be certified against a small critical specification even when the whole design cannot be fully verified.

Formalism / Key Objects

  • A design D has input alphabet Sigma_I, output alphabet Sigma_O, and transition/output behavior.
  • A shield S observes the input/output stream of D and emits corrected outputs so the composition D o S satisfies a property set phi.
  • A generic shield works for any design satisfying a trusted valid subset phi_v.
  • Correctness requires the shielded system to satisfy the critical properties.
  • Minimum interference is captured by comparing output trace distance against language-distance violation severity.
  • K-Stabilizing Shield Synthesis gives a concrete safety-game construction for bounded recovery after unavoidable violations.
  • Safety Games are the underlying game-solving pattern when the specification is safety-shaped.

Connections

Common Confusions

  • A shield is not the same as a monitor if it can actively modify outputs or actions.
  • Generic shield synthesis may ignore the implementation, but it still relies on a trusted specification boundary.
  • Minimum interference does not mean zero interference; it means deviations are justified by unavoidable or realized safety risk.

Key Sources