Synthesizing Optimally Resilient Controllers

Recently, Dallal, Neider, and Tabuada studied a generalization of the classical game-theoretic model used in program synthesis, which additionally accounts for unmodeled intermittent disturbances. In this extended framework, one is interested in computing optimally resilient strategies, i.e., strategies that are resilient against as many disturbances as possible. Dallal, Neider, and Tabuada showed how to compute such strategies for safety specifications. In this work, we compute optimally resilient strategies for a much wider range of winning conditions and show that they do not require more memory than winning strategies in the classical model. Our algorithms only have a polynomial overhead in comparison to the ones computing winning strategies. In particular, for parity conditions optimally resilient strategies are positional and can be computed in quasipolynomial time.


Introduction
Reactive synthesis is an exciting and promising approach to solving a crucial problem, whose importance is ever-increasing due to ubiquitous deployment of embedded systems: obtaining correct and verified controllers for safety-critical systems. Instead of an engineer programming a controller by hand and then verifying it against a formal specification, synthesis automatically constructs a correct-by-design controller from the given specification (or reports that no such controller exists).
Typically, reactive synthesis is modeled as a two-player zero-sum game on a finite graph that is played between the system, which seeks to satisfy the specification, and its environment, which seeks to violate it. Although this model is well understood, there are still multiple obstacles to overcome before synthesis can be realistically applied in practice. These obstacles include not only the high computational complexity of the problem, but also more fundamental ones. Among the most prohibitive issues in this regard is the need for a complete model of the interaction between the system and its environment, including an accurate model of the environment, the actions available to both antagonists, as well as the effects of these actions. This modeling task often places an insurmountable burden on engineers as the environments in which real-life controllers are intended to operate tend to be highly complex or not fully known at design time. Moreover, when a controller is deployed in the real world, a common source of errors is a mismatch between the controller's intended result of an action and the result that actually manifests. Such situations arise, for instance, in the presence of disturbances, when the effect of an action is not precisely known, or when the intended control action of the controller cannot be executed, e.g., when an actuator malfunctions. By a slight abuse of notation from control theory, we subsume all such errors under the generic term disturbance.
To obtain controllers that can handle disturbances, one has to yield control over their occurrence to the environment. However, due to the antagonistic setting of the two-player zero-sum game, this would allow the environment to violate the specification by causing disturbances at will. Overcoming this requires the engineer to develop a realistic disturbance model, which is a highly complex task, as such disturbances are assumed to be rare events. Also, incorporating such a model into the game leads to a severe blowup in the size of the game, which can lead to intractability due to the high computational complexity of synthesis.
To overcome these difficulties, Dallal, Neider, and Tabuada [9] proposed a conceptually simple, yet powerful extension of infinite games termed "games with unmodeled intermittent disturbances". Such  games are played similarly to classical infinite games: two players, called Player 0 and Player 1, move a token through a finite graph, whose vertices are partitioned into vertices under the control of Player 0 and Player 1, respectively; the winner is declared based on the resulting play. In contrast to classical games, however, the graph is augmented with additional disturbance edges that originate in vertices of Player 0 and may lead to any other vertex. Moreover, the mechanics of how Player 0 moves is modified: whenever Player 0 moves the token, her move might be overridden, and the token instead moves along a disturbance edge. This change in outcome implicitly models the occurrence of a disturbance-the intended result of the controller and the actual result differ-, but it is not considered to be antagonistic. Instead, the occurrence of a disturbance is treated as a rare event without any assumptions on frequency, distribution, etc. This non-antagonistic nature of disturbances is different from existing approaches in the literature and causes many interesting phenomena that do not occur in the classical theory of infinite games. Some of these already manifest in the parity game shown in Figure 1, in which vertices are labeled with nonnegative integers, so-called colors, and Player 0 wins if the highest color seen infinitely often is even. Consider, for instance, vertex v 2 . In the classical setting without disturbances, Player 0 wins every play reaching v 2 by simply looping in this vertex forever (since the highest color seen infinitely often is even). However, this is no longer true in the presence of disturbances: a disturbance in v 2 causes a play to proceed to vertex v 1 , from which Player 0 can no longer win. In vertex v 7 , Player 0 is in a similar, yet less severe situation: she wins every play with finitely many disturbances but loses if infinitely many disturbances occur. Finally, vertex v 9 falls into a third category: from this vertex, Player 0 wins every play even if infinitely many disturbances occur. In fact, disturbances partition the set of vertices from which Player 0 can guarantee to win into three disjoint regions (indicated as shaded boxes in Figure 1): (A) vertices from which she can win if at most a fixed finite number of disturbance occur, (B) vertices from which she can win if any finite number of disturbances occurs but not if infinitely many occur, and (C) vertices from which she can win even if infinitely many disturbances occur.
The observation above gives rise to a question that is both theoretically interesting and practically important: if Player 0 can tolerate different numbers of disturbances from different vertices, how should she play to be resilient 3 to as many disturbances as possible, i.e., to tolerate as many disturbances as possible while still winning? Put slightly differently, disturbances induce an order on the space of winning strategies ("a winning strategy is better if it is more resilient"), and the natural problem is to compute optimally resilient winning strategies, yielding optimally resilient controllers. Note that this is in stark contrast to the classical theory of infinite games, where the space of winning strategies is unstructured.
Dallal, Neider, and Tabuada [9] have already solved the problem of computing optimally resilient winning strategies for safety games. Their approach exploits the existence of maximally permissive winning strategies in safety games, which allows Player 0 to avoid "harmful" disturbance edges during a play. In games with more expressive winning conditions, however, this is no longer possible, as witnessed by vertex v 4 in the example of Figure 1: although Player 0 can avoid a disturbance edge by looping in v 4 forever, she needs to move to v 2 eventually in order to see an even color (otherwise she looses), thereby potentially risking to lose if a disturbance occurs. In fact, the problem of constructing optimally resilient winning strategies for games other than safety is still open.
In this paper, we solve this problem for an extensive class of infinite games, including parity games and Muller games. In particular, our contributions are as follows: -We introduce a novel concept, termed resilience, which captures for each vertex how many disturbances need to occur for Player 0 to lose. This concept generalizes the notion of determinacy and allows us to derive optimally resilient winning strategies. -We present an algorithm for computing the resilience of vertices and optimally resilient winning strategies. Our algorithm uses solvers for the underlying game without disturbances as a subroutine, which it invokes a linear number of times on various subgames. For many winning conditions, the time complexity of our algorithm thus falls into the same complexity class as solving the original game without disturbances. In particular, we obtain an quasipolynomial algorithm for parity games with disturbances, which matches the currently best known upper bound for classical parity games. -In addition to natural assumptions on the winning condition, e.g., that games are determined and effectively solvable, our algorithm requires the winning condition to be prefix-independent. However, we show that the classical notion of game reduction carries over to the setting of games with disturbances. As a consequence, our algorithm can be applied to an extensive class of infinite games (using a reduction from prefix-dependent games to prefix-independent ones if necessary), including all ω-regular games. -Finally, we discuss various further phenomena that arise in the presence of disturbances. Amongst others, we illustrate how the additional goal of avoiding disturbances whenever possible affects the memory requirements of strategies. Moreover, we raise the question of how benevolent disturbances can be leveraged to recover from losing a play. However, an in-depth investigation of these phenomena is outside the scope of this paper and left for future work.
This paper is structured as follows: after setting up definitions and notations in Section 2, we present our algorithm for computing optimally resilient strategies in Section 3. In Section 4, we discuss the necessary assumptions on the winning condition in detail and show that the notion of game reduction carries over to games with disturbances. In Section 5, we identify further interesting research questions arising in the context of disturbances. Finally, we discuss related work in Section 6.

Infinite Games with Disturbances
An arena (with unmodeled disturbances) A = (V, V 0 , V 1 , E, D) consists of a finite directed graph (V, E), a partition {V 0 , V 1 } of V into the set of vertices V 0 of Player 0 (denoted by circles) and the set of vertices of Player 1 (denoted by squares), and a set D ⊆ V 0 × V of disturbance edges (denoted by dashed arrows). Note that only vertices of Player 0 have outgoing disturbance edges. We require that every vertex Hence, the additional bits b j for j > 0 denote whether a standard or a disturbance edge has been taken to move from v j−1 to v j . We say ρ starts in v 0 . A play prefix (v 0 , b 0 ) · · · (v j , b j ) is defined similarly and ends in v j . The number of disturbances in a play ρ = , which is either some k ∈ ω (if there are finitely many disturbances, namely k) or it is equal to ω (if there are infinitely many). A play ρ is disturbance-free, if # D (ρ) = 0.
A game (with unmodeled disturbances) G = (A, Win) consists of an arena A = (V, V 0 , V 1 , E, D) and a winning condition Win ⊆ V ω . A play ρ = (v 0 , b 0 )(v 1 , b 1 )(v 2 , b 2 ) · · · is winning for Player 0, if v 0 v 1 v 2 · · · ∈ Win, otherwise it is winning for Player 1. Hence, winning is oblivious to occurrences of disturbances. A winning condition Win is prefix-independent if for all ρ ∈ V ω and all w ∈ V * we have ρ ∈ Win if and only if wρ ∈ Win.
In examples, we often use the parity condition, the canonical ω-regular winning condition. Let Ω : V → ω be a coloring of a set V of vertices. The (max-) parity condition requires the maximal color occurring infinitely often during a play to be even. A game (A, Win) is a parity game, if Win = Parity(Ω) for some coloring Ω of the vertices of A. In figures, we label vertices of a parity game by a pair v /c where v is the name of the vertex and c its color.
Furthermore, in our proofs we make use of the safety condition for a given set U ⊆ V of unsafe vertices. It requires Player 0 to only visit safe vertices, i.e., Player 1 wins a play if it visits at least one unsafe vertex. A strategy for Player i ∈ {0, 1} is a function σ : , the next vertex is the one prescribed by the strategy unless a disturbance edge is used.
Remark 1. Note that a strategy σ does not have access to the bits indicating whether a disturbance occurred or not. However, this is not a restriction: let if the disturbance transition (v j−1 , v j ) traversed by the play did not lead to the vertex the strategy prescribed. Such consequential disturbances can be detected by comparing the actual vertex v j to σ's output σ(v 0 · · · v j−1 ). On the other hand, inconsequential disturbances will just be ignored. In particular, the number of consequential disturbances is always at most the number of disturbances.

Infinite Games without Disturbances
We characterize the classical notion of infinite games, i.e., those without disturbances, (see, e.g., [15]) as a special case of games with disturbances. Let G be a game with vertex set V . A strategy σ for Player i in G is said to be a winning strategy for her from v ∈ V , if every disturbance-free play that starts in v and that is consistent with σ is winning for Player i.
The winning region W i (G) of Player i in G contains those vertices v ∈ V such that Player i has a winning strategy from v. Thus, the winning regions of G are independent of the disturbance edges, i.e., we obtain the classical notion of infinite games. We say that Player i wins G from v, if v ∈ W i (G). Solving a game amounts to determining its winning regions. Note that every game has disjoint winning regions. In contrast, a game is determined, if every vertex is in either winning region.

Resilient Strategies
Let G be a game with vertex set V and let α ∈ ω + 2. A strategy σ for Player 0 in G is α-resilient from v ∈ V if every play ρ that starts in v, that is consistent with σ, and with # D (ρ) < α, is winning for Player 0. Thus, a k-resilient strategy with k ∈ ω is winning even under at most k − 1 disturbances, an ω-resilient strategy is winning even under any finite number of disturbances, and an (ω + 1)-resilient strategy is winning even under infinitely many disturbances. Note that every strategy is 0-resilient, as no play has strictly less than zero disturbances. Furthermore, a strategy is 1-resilient from v if and only if it is winning for Player 0 from v.
We define the resilience of a vertex v of G as r G (v) = sup{α ∈ ω + 2 | Player 0 has an α-resilient strategy for G from v}.
Note that the definition is not antagonistic, i.e., it is not defined via strategies of Player 1. Nevertheless, due to the remarks above, resilient strategies generalize winning strategies.

Remark 2.
Let G be a determined game. Then, r G (v) > 0 if and only if v ∈ W 0 (G).
A strategy σ is optimally resilient, if it is r G (v)-resilient from every vertex v. Every such strategy is a uniform winning strategy for Player 0, i.e., a strategy that is winning from every vertex in her winning region. Hence, positional optimally resilient strategies can only exist in games which have uniform positional winning strategies for Player 0.
Our goal is to determine the mapping r G and to compute an optimally resilient strategy.

Computing Optimally Resilient Strategies
To compute optimally resilient strategies, we first characterize the vertices of finite resilience in Subsection 3.1. All other vertices either have resilience ω or ω + 1. To distinguish between these possibilities, we show how to determine the vertices with resilience ω + 1 in Subsection 3.2. In Subsection 3.3, we show how to compute optimally resilient strategies using the results of the first two subsections. We only consider prefix-independent winning conditions in Subsections 3.1 and 3.3. In Section 4, we show how to overcome this restriction.

Characterizing Vertices of Finite Resilience
Our goal in this subsection is to characterize vertices with finite resilience in a game with prefixindependent winning condition, i.e., those vertices from which Player 0 can win even under k − 1 disturbances, but not under k disturbances, for some k ∈ ω. To illustrate our approach, consider the parity game in Figure 1 (on Page 2). The winning region of Player 1 only contains the vertex v 1 . Thus, by Remark 2, v 1 is the only vertex with resilience zero, every other vertex has a larger resilience. Now, consider the vertex v 2 , which has a disturbance edge leading into the winning region of Player 1. Due to this edge, v 2 has resilience one. From v 1 , a disturbance-free play violating the winning condition starts that is consistent with every strategy for Player 0. Due to prefix-independence, prepending the disturbance edge does not change the winner and consistency with every strategy for her. Hence, this play witnesses that v 2 has resilience at most one, while v 2 being in Player 0's winning region yields the matching lower bound.
However, v 2 is the only vertex to which this reasoning applies. Now, consider v 3 : from here, Player 1 can force a play to visit v 2 using a standard edge. From this property, one can argue that v 3 has resilience one as well. Again, this is the only vertex to which this reasoning is applicable.
In particular, from v 4 Player 0 can avoid reaching the vertices for which we have determined the resilience by using the self loop. However, this comes at a steep price for her: doing so results in a losing play, as the color of v 4 is odd. Thus, if she wants to have a chance at winning, she has to take a risk by moving to v 2 , from which she has a 1-resilient strategy that is winning, if no more disturbances occur. For this reason, v 4 has resilience one as well. The same reasoning applies to v 6 : Player 1 can force the play to v 4 and from there Player 0 has to take a risk by moving to v 2 .
The vertices v 3 , v 4 , and v 6 share the property that Player 1 can either enforce a play violating the winning condition or to reach a vertex with already determined finite resilience. These three vertices are the only ones currently satisfying this property. They all have resilience one since Player 1 can enforce to reach a vertex of resilience one, but he cannot enforce to reach a vertex of resilience zero. Now, we can also determine the resilience of v 5 . The disturbance edge from v 5 to v 3 witnesses that it is two.
Afterwards, these two arguments no longer apply to new vertices: no disturbance edge leads from a v ∈ {v 7 , . . . , v 10 } to a vertex whose resilience is already determined and Player 0 has a winning strategy from each of these vertices that additionally avoids vertices whose resilience is already determined. Thus, our reasoning cannot determine their resilience. This is consistent with our goal, as all four vertices have non-finite resilience, i.e., v 7 and v 8 have resilience ω and v 9 and v 1 0 have resilience ω + 1. Note that our reasoning here cannot distinguish these two values. We solve this problem in Subsection 3.2.
In this subsection, we formalize the reasoning described above: starting from the vertices in Player 1's winning region having resilience zero, we use a disturbance update and a risk update to determine all vertices of finite resilience. To simplify our proofs, we describe both as monotone operators updating partial rankings mapping vertices to ω, which might update already defined values. We show that alternatingly applying these updates eventually yields a stable ranking that indeed characterizes the vertices of finite resilience.
Throughout this section, we fix a game G = (A, Win) with A = (V, V 0 , V 1 , E, D) and with prefixindependent Win ⊆ V ω satisfying the following condition: the game (A, Win ∩ Safety(U )) is determined for every U ⊆ V . We discuss this requirement in Section 4.
A ranking for G is a partial mapping r : V → ω. The domain of r is denoted by dom(r), its image by im(r). Let r and r ′ be two rankings. We say that r ′ refines r if dom(r ′ ) ⊇ dom(r) and Let r be a ranking for G. We define the ranking r ′ as . We call r ′ the disturbance update of r.
Lemma 1. The disturbance update r ′ of a sound ranking r is sound and refines r.
Proof. As the minimization defining r ′ (v) ranges over a superset of . This immediately implies refinement. From this inequality, we also obtain r ′ (v) = 0 for every v ∈ W 1 (G), due to soundness of r. Finally, consider some v ∈ W 0 (G). Then, r(v) > 0 by soundness of r. Thus, r ′ (v) > 0 as well, as both r(v) and r(v ′ ) + 1 are greater than zero. Altogether, r ′ is sound as well.

⊓ ⊔
Again, let r be a ranking for G. For every k ∈ im(r) let the winning region of Player 1 in the game where he either wins by reaching a vertex v with r(v) ≤ k or by violating the winning condition. Now, define We call r ′ the risk update of r.
Lemma 2. The risk update r ′ of a sound ranking r is sound and refines r.
Proof. We will show r ′ (v) ≤ r(v) for every v ∈ dom(r), which implies both refinement and r ′ (v) = 0 for every v ∈ W 1 (G), as argued in the proof of Lemma 1.
from v by violating the safety condition right away.
To complete the proof of soundness of r ′ , we just have to show r ′ (v) > 0 for every v ∈ W 0 (G). Towards a contradiction, assume r ′ (v) = 0, i.e., v ∈ A 0 . Thus, Player 1 has a strategy τ from v that ensures that either the winning condition is violated or that a vertex v ′ with r(v ′ ) = 0 is reached, i.e., v ′ ∈ W 1 (G) by soundness of r. Hence, Player 1 has a winning strategy τ v ′ for G from v ′ . This implies that he also has a winning strategy from v: play according to τ until a vertex v ′ with r(v ′ ) = 0 is reached. From there, mimic τ v ′ when starting from v ′ . Every resulting disturbance-free play has a suffix that violates Win. Thus, by prefix-independence, the whole play violates Win as well, i.e., it is winning for Player 1. Thus, v ∈ W 1 (G), which yields the desired contradiction, as winning regions are always disjoint.
⊓ ⊔ Let r 0 be the unique sound ranking with domain W 1 (G), i.e., r 0 maps exactly the vertices in Player 1's winning region to zero. Starting with r 0 , we inductively define a sequence of rankings (r j ) j∈ω such that r j for an odd (even) j > 0 is the disturbance update (the risk update) of r j−1 , i.e., we alternate between disturbance and risk updates.
Due to refinement, the r j eventually stabilize, i.e., there is some j 0 such that r j = r j0 for all j ≥ j 0 . Define r * = r j0 . Due to r 0 being sound and by Lemma 1 and Lemma 2, each r j , and r * in particular, is sound. If v ∈ dom(r * ), let j v be the minimal j with v ∈ dom(r j ); otherwise, j v is undefined.
Proof. We show the following stronger result for every v ∈ dom(r * ): The disturbance update increases the maximal rank by at most one and the risk update does not increase the maximal rank at all. Furthermore, due to refinement, the rank of v is set and then only decreases. Hence, we obtain r j (v) ≤ jv +1 2 and r j (v) ≤ jv 2 for odd and even j v , respectively. In the remainder of the proof, we show a matching lower bound.
We say that a vertex v is updated to k ∈ ω in r j if r j (v) = k and either v / ∈ dom(r j−1 ) or both v ∈ dom(r j−1 ) and r j−1 (v) = k (here, r −1 is the unique ranking with empty domain). Now, we show the following by induction over j, which implies the matching lower bound.
-If j is odd, then no v is updated in r j to some k < j+1 2 .
-If j is even, then no v is updated in r j to some k < j 2 . For j = 0, we have j 2 = 0, and clearly, no vertex is assigned a negative rank by r 0 . For j = 1 and j ′ = 2, we obtain j+1 2 = j ′ 2 = 1. As r 0 , r 1 , and r 2 are sound, neither r 1 nor r 2 update some v to zero. Now let j > 2 and first consider the case where j is odd. Towards a contradiction, assume that v ∈ V is updated in r j to some value less than j+1 2 . Since j is odd, r j is the disturbance update of r j−1 . Further, , the rank of v ′ is stable during the last two updates.
First assume towards a contradiction r j−2 (v ′ ) = r j−1 (v ′ ). Then, v ′ is updated in r j−1 to some rank of at most j−3 2 , which is in turn smaller than j−1 2 , violating the induction hypothesis for j − 1. Hence, The same reasoning yields a contradiction to the assumption . The latter equality contradicts our initial assumption, namely v being updated in r j to r j (v). Now consider the case where j is even. Again, assume towards a contradiction that v ∈ V is updated in r j to some value less than j 2 . Since j is even, r j is the risk update of r j−1 . Further, as v is updated in Hence, he has a strategy τ such that every play starting in v and consistent with τ either violates Win or eventually visits some vertex Towards a contradiction, assume Thus, v ′ is updated in r j−1 to some value strictly less than j 2 , which contradicts the induction hypothesis for j − 1. Hence, we indeed obtain Thus, there are two types of vertices v ′ in U : those for which r j−3 (v ′ ) is defined, which implies r j−3 (v ′ ) = r j−1 (v ′ ) due to the induction hypothesis and refinement, and those where r j−3 (v ′ ) is undefined, which implies r j−2 (v ′ ) = r j−1 (v ′ ) due to the claim above.
We claim that Player 1 wins . This contradicts v being updated in r j , our initial assumption.
To this end, we construct a strategy τ ′ from v that either violates Win or reaches a vertex v ′′ with Thus, every play that starts in v and is consistent with τ ′ either violates Win or reaches a vertex v ′′ with From the proof of Lemma 3, we obtain an upper bound on the maximal rank of r * . This in turn implies that the r j stabilize quickly, as r j = r j+1 = r j+2 implies r j = r * . Corollary 1.
Lemma 3 also shows that an algorithm computing the r j does not need to implement the definition of the two updates as presented above, but can be optimized by taking into account that a rank is never updated once set.
The main result of this section shows that r * characterizes the resilience of vertices of finite resilience.
Lemma 4. Let r * be defined for G as described above, and let v ∈ V .
Proof. 1.) Let v ∈ dom(r * ). We prove r G (v) ≤ r * (v) and r G (v) ≥ r * (v). "r G (v) ≤ r * (v)": An α-resilient strategy from v is also α ′ -resilient from v for every α ′ ≤ α. Thus, to prove r G (v) = sup{α ∈ ω + 2 | Player 0 has an α-resilient strategy for G from v} ≤ r * (v) we just have to show that Player 0 has no (r * (v) + 1)-resilient strategy from v. By definition, for every strategy σ for Player 0, we have to show that there is a play ρ starting in v and consistent with σ that has at most r * (v) disturbances and is winning for Player 1. So, fix an arbitrary strategy σ.
We define a play with the desired properties by constructing longer and longer finite prefixes before finally appending an infinite suffix. During the construction, we ensure that each such prefix ends in dom(r * ) in order to be able to proceed with our construction.
The first prefix just contains the starting vertex (v, 0), i.e., the prefix does indeed end in dom(r * ). Now, assume we have produced a prefix w(v ′ , b ′ ) ending in some vertex v ′ ∈ dom(r * ), which implies that j v ′ is defined. We consider three cases: -If j v ′ = 0, then v ′ ∈ W 1 (G) by definition of r 0 , i.e., Player 1 has a winning strategy τ from v. Thus, we extend w(v ′ , b ′ ) by the unique disturbance-free play that starts in v ′ and is consistent with σ and τ , without its first vertex. In that case, the construction of the infinite play is complete. 1), which satisfies the invariant, as v ′′ is in dom(r * ). Further, we have j v ′′ < j v ′ as the rank of v ′′ had to be defined in order to be considered during the disturbance update assigning a rank to v ′ . -If j v ′ > 0 is even, then v ′ received its rank r * (v ′ ) during a risk update. We claim that Player 1 has a strategy τ v ′ that guarantees one of the following outcomes from v ′ : either the resulting play violates Win or it encounters a vertex v ′′ = v ′ that satisfies r * (v ′′ ) ≤ r * (v ′ ) and j v ′′ < j v ′ .
In that case, consider the unique disturbance-free play ρ ′ that starts in v ′ and is consistent with σ and the strategy τ v ′ as above. If ρ ′ violates Win, then we extend w(v ′ , b ′ ) by ρ ′ without its first vertex. In that case, the construction of the infinite play is complete. If ρ ′ does not violate Win, then we extend w(v ′ , b ′ ) by the prefix of ρ ′ without its first vertex and up to (and including) the first occurrence of a vertex v ′′ in ρ ′ satisfying the properties described above. Note that this again satisfies the invariant. It remains to argue our claim: v ′ was assigned its rank r * (v ′ ) = r j v ′ (v ′ ) because it is in Player 1's winning region in the game with winning condition Win ∩ Safety(U ), for Hence, from v ′ , Player 1 has a strategy to either violate the winning condition or to reach U . Thus, as the rank of v ′ was assigned due to the vertices in U already having ranks.
Note that only in two cases, we extend the prefix to an infinite play. In the other two cases, we just extend the prefix to a longer finite one. Thus, we first show that this construction always results in an infinite play. To this end, let w 0 (v 0 , b 0 ) and w 1 (v 1 , b 1 ) two of the prefixes constructed above such that w 1 (v 1 , b 1 ) is an extension of w 0 (v 0 , b 0 ). A simple induction proves j v1 < j v0 . Hence, as the value can only decrease finitely often, at some point an infinite suffix is added. Thus, we indeed construct an infinite play.
Finally, we have to show that the resulting play has the desired properties: by construction, the play starts in v and is consistent with σ. Furthermore, by construction, it has a disturbance-free suffix that violates Win. Thus, by prefix-independence, the whole play also violates Win. It remains to show that it has at most r * (v) disturbances. To this end, let w 0 (v 0 , b 0 ) and w 1 (v 1 , b 1 ) two of the prefixes such that w 1 (v 1 , b 1 ) is obtained by extending w 0 (v 0 , b 0 ) once. If the extension consists of taking the disturbance edge (v 0 , v 1 ) ∈ D, then we have r * (v 1 ) = r * (v 0 ) + 1. The only other possibility is the extension consisting of a finite play prefix that is consistent with the strategy τ v0 . Then, by construction, we obtain r * (v 1 ) ≤ r * (v 0 ).
Thus, there are at most r * (v) many disturbances in the play, as the current rank decreases with every disturbance edge and does not increase with the other type of extension, but is always non-negative.
"r G (v) ≥ r * (v)": Here, we construct a strategy σ f for Player 0 that is r * (v)-resilient from every v ∈ dom(r * ), i.e., from v, σ f has to be winning even under r * (v) − 1 disturbances. As every strategy is 0-resilient, we only have to consider those v with r * (v) > 0.
The proof is based on the fact that r * is both stable under the disturbance and under the risk update, i.e., the disturbance update and the risk update of r * are r * , which yields the following properties. Let (v, v ′ ) ∈ D be a disturbance edge such that r * (v) > 0. Then, we have r * (v ′ ) ≥ r * (v) − 1. Also, for every v ∈ dom(r * ) with r * (v) > 0, Player 0 has a winning strategy σ v from v for the game G v = (A, Win ∩ Safety({v ′ ∈ dom(r * ) | r * (v ′ ) < r * (v)})) (note the strict inequality). Here, we apply the determinacy of the game G v , as the risk update is formulated in terms of Player 1's winning region. Now, we define σ f as follows: it always mimics a strategy σ vcur for some v cur ∈ dom(r * ), which is initialized by the starting vertex. The strategy σ vcur is mimicked until a consequential (w.r.t. σ vcur ) disturbance edge is taken, say by reaching the vertex v ′ . In that case, the strategy σ f discards the history of the play constructed so far, updates v cur to v ′ , and begins mimicking σ v ′ . This is repeated ad infinitum. Now, consider a play that starts in dom(r * ), is consistent with σ f , and has less than r * (v) disturbances. The part up to the first consequential disturbance edge (if it exists at all) is consistent with σ v . Now, let (v 0 , v ′ 0 ) be the corresponding disturbance edge. Then, we have r * (v 0 ) ≥ r * (v), as σ v being a winning strategy for the safety condition never visits vertices with a rank smaller than r * (v). Thus, we conclude Similarly, the part between the first and the second consequential disturbance edge (if it exists at all) is consistent with σ Continuing this reasoning shows that less than r * (v) (consequential) disturbance edge lead to a vertex v ′ with r * (v ′ ) > 0, as the rank is decreased by at most one for every disturbance edge. The suffix starting in this vertex is disturbance-free and consistent with σ v ′ . Hence, the suffix satisfies Win, i.e., by prefix-independence, the whole play satisfies Win as well.
2.) Let X = V \ dom(r * ). The disturbance update of r * being r * implies that every disturbance edge starting in X leads back to X. Similarly, the risk update of r * being r * implies X = W 0 (G X ) for G X = (A, Win ∩ Safety(V \ X)). Thus, from every v ∈ X, Player 0 has a strategy σ v such that every disturbance-free play that starts in v and is consistent with σ v satisfies the winning condition Win and never leaves X. Using these properties, we construct a strategy σ ω that is ω-resilient from every v ∈ X, which implies r G (v) ∈ {ω, ω + 1}.
The definition of the strategy σ ω here is similar to the one above yielding the lower bound on the resilience. Again, σ ω always mimics a strategy σ vcur for some v cur ∈ X, which is initialized by the starting vertex. The strategy σ vcur is mimicked until a consequential (w.r.t. σ vcur ) disturbance edge is taken, say by reaching the vertex v ′ . In that case, the strategy σ ω discards the history of the play constructed so far, updates v cur to v ′ , and begins mimicking σ v ′ . This is repeated ad infinitum.
Due to the properties of the disturbance edges and the strategies σ v , such a play never leaves X, even if disturbances occur. Furthermore, if only finitely many disturbances occur, then the resulting play has a disturbance-free suffix that starts in some v ′ ∈ X and is consistent with σ v ′ . As σ v ′ is winning from v ′ in G X , this suffix satisfies Win. Hence, by prefix-independence of Win, the whole play also satisfies Win. Thus, σ ω is indeed an ω-resilient strategy from every v ∈ X.
⊓ ⊔ Combining Corollary 1 and Lemma 4, we obtain an upper bound on the resilience of vertices with finite resilience.

Characterizing Vertices of Resilience ω + 1
Our goal in this subsection is to determine the vertices of resilience ω + 1, i.e., those from which Player 0 can win even under an infinite number of disturbances. Intuitively, in this setting, we give Player 1 control over the occurrence of disturbances, as he cannot execute more than infinitely many disturbances during a play. To this end, consider again the parity game in Figure 1 (on Page 2). From v 9 Player 0 wins even if Player 1 controls whether the disturbance edge is taken from v 9 , as both v 9 and v 10 have color zero. On the other hand, giving Player 1 control over the disturbance edges implies that he wins from v 7 , as he can use the one incident to v 7 infinitely often to move to v 8 , which has color one. In the following, we prove this intuition to be correct. To this end, we transform the arena of the game so that at a Player 0 vertex, first Player 1 gets to chose whether he wants to take one of the disturbance edges and, if not, gives control to Player 0, who is then able to use a standard edge. Figure 2 depicts the game corresponding to the one from Figure 1. And indeed, Player 0 wins this so-called rigged game, which still has a parity condition, from v 9 and v 10 , but not from any other vertex. These are the only vertices of resilience ω + 1 in the original game. Given The set E ′ of edges is the union of the following sets: : Player 1 does not use a disturbance edge and yields control to Player 0.
and v ∈ V 0 }: Player 0 has control and picks a standard edge.
and v ∈ V 1 }: Player 1 takes a standard edge.
We now show that W 0 (G rig ) characterizes the vertices of resilience ω + 1 in G. Note that we have no assumptions on G here.

Lemma 5.
Let v be a vertex of a game G. Then, v ∈ W 0 (G rig ) if and only if r G (v) = ω + 1.
Proof. "⇒": Let Player 0 win G rig from v, say with winning strategy σ ′ . We inductively translate play prefixes w in G into play prefixes t ′ (w) in G rig satisfying the following invariant: t ′ ((v 0 , b 0 ) · · · (v j , b j )) starts in v 0 and ends in v j .
For the induction start, , we consider several cases: and v j ∈ V 0 , then the play did not traverse a disturbance edge and instead allowed Player 0 to pick a standard edge (v j , v j+1 ) to traverse. This move is mimicked by and v j ∈ V 1 , then the play traversed the standard edge (v j , v j+1 ). This move is mimicked by defining t ′ ( Note that our invariant is satisfied in any case. Also, we lift t ′ to infinite plays by taking limits as usual.
Using this translation, we define a strategy σ for Player 0 in G via where b 0 = 0 and where for every j ′ > 0, b j ′ = 1 if and only if v j ′ = σ(v 0 · · · v j ′ −1 ), i.e., we reconstruct the consequential disturbances. A straightforward induction shows that for every play ρ = · · · is winning for Player 0. As we have no restriction on the number of disturbances in ρ, σ is (ω + 1)-resilient from v. Thus, r G (v) = ω + 1. "⇐": Now, let r G (v) = ω + 1, i.e., Player 0 has an (ω + 1)-resilient strategy σ from v in G. This time, we inductively define a translation t of play prefixes in G rig into play prefixes in G. Here, it suffices to consider those prefixes that start and end in V ′ 1 . For these, we satisfy the following invariant: if w starts in v 0 and ends in v j , then t(w) starts in v 0 and ends in v j as well. Note that G rig has no disturbance edges. Hence, thus the bits indicating whether such an edge has been traversed are always zero in plays of G rig . Thus, we define t(v 0 , 0) = (v 0 , 0) and consider several cases for the inductive step: -First, assume we have a prefix of the form Player 0's move simulates the standard edge The invariant is satisfied in any case. Also, we can again lift t to infinite plays via limits. Now, we define a strategy σ ′ for Player 0 in G rig via A straightforward induction shows that for every play ρ that is consistent with σ ′ , the play t(ρ) is consistent with σ. Hence, t(ρ) satisfies the winning condition, if ρ starts in v, as σ is (ω Thus, σ ′ is a winning strategy for Player 0 from v.

⊓ ⊔
Consider the first implication proved above. If σ is positional, then σ ′ is positional as well. Thus, applying both implications yields the following corollary.
Corollary 3. Assume Player 0 has a positional winning strategy for G rig from v. Then, Player 0 has an (ω + 1)-resilient positional strategy from v.

Computing Optimally Resilient Strategies
This subsection is concerned with computing the resilience and optimally resilient strategies. Recall that in the proof of Lemma 4, we have constructed strategies σ f and σ ω such that σ f (σ ω ) is r G (v)-resilient from every v with r G (v) ∈ ω (with r G (v) = ω). However, even if the strategies σ v used to construct them are positional, the strategies σ f and σ ω are in general not positional, as they have to store the vertex v cur to simulate the strategy σ vcur . In the following, we show how to combine such positional strategies σ v and a positional one for G rig into a single positional optimally resilient strategy. To this end, we refine the following standard technique that combines positional winning strategies for games with prefix-independent winning conditions. Assume we have a positional strategy σ v for every vertex v in some set W ⊆ V such that σ v is winning from v. Furthermore, let R v be the set of vertices visited by plays that start in v and are consistent with σ v . Furthermore, let m(v) = min ≺ {v ′ ∈ V | v ∈ R v ′ } for some strict total ordering ≺ of W . Then, the positional strategy σ defined by σ(v) = σ m(v) (v) is winning from each v ∈ W , as along every play that starts in some v ∈ W and is consistent with σ, the value of the function m only decreases. Thus, after it has stabilized, the remaining suffix is consistent with some strategy σ v . Hence, the suffix is winning for Player 0 and prefix-independence implies that the whole play is winning for her as well.
Here, we have to adapt this reasoning to respect the resilience of the vertices and to handle disturbance edges. In particular, we have to pay attention to vertices of resilience ω + 1, as plays starting in such vertices have to be winning under infinitely many disturbances.
Recall the requirements from Subsection 3.1 for a game (A, Win): Win is prefix-independent and the game G U is determined for every U ⊆ V , where we write G U for the game (A, Win ∩ Safety(U )) for some U ⊆ V . To prove the results of this subsection, we need to impose some additional effectiveness requirements: we require that each game G U and the rigged game G rig can be effectively solved. Also, we first assume that Player 0 has positional winning strategies for each of these games, which have to be effectively computable as well. We discuss the severity of these requirements in Section 4. Theorem 1. Let G satisfy all the above requirements. Then, the resilience of G's vertices and a positional optimally resilient strategy can be effectively computed.
Proof. The effective computability of the resilience follows from the effectiveness requirements on G: to compute the ranking r * , it suffices to compute the disturbance and risk updates. The former are trivially effective while the effectiveness of the latter ones follows from our assumption. Lemma 4 shows that r * correctly determines the resilience of all vertices with finite resilience. Finally by solving the rigged game, we also correctly determine the resilience of the remaining vertices (Lemma 5). Again, this game can be solved by our assumption.
Thus, it remains to show how to compute a positional optimally resilient strategy. To this end we compute a positional strategy σ v for every v satisfying the following properties.
The existence of such a strategy has been shown in the proof of Item 1 of Lemma 4. -For every v ∈ V with r G (v) = ω, the strategy σ v is winning for Player 0 from v for the game (A, Win∩ The existence of such a strategy has been shown in the proof of Item 2 of Lemma 4. -For every v ∈ V with r G (v) = ω + 1, the strategy σ v is (ω + 1)-resilient from v. The existence of such a strategy follows from Corollary 3, as we assume Player 0 to win G rig with positional strategies. -Finally, for every v ∈ V with r G (v) = 0, we fix an arbitrary positional strategy σ v for Player 0.
Furthermore, we fix a strict linear order ≺ on V such that v ≺ v ′ implies r G (v) ≤ r G (v ′ ), i.e., we order the vertices by ascending resilience. For a vertex v with r G (v) = ω + 1, let R v be the set of vertices reachable via disturbance-free plays that start in v and are consistent with σ v . On the other hand, for a vertex v with with r G (v) = ω + 1, let R v be the set of vertices reachable via plays with arbitrarily many disturbances that start in v and are consistent with σ v . We For v with r G (v) = ω + 1 this follows immediately from the choice of σ v . Thus, let us argue the claim for v with r G (v) = ω + 1. Assume σ v reaches a vertex v ′ of resilience r G (v ′ ) = ω + 1. Then, there exists a play ρ ′ starting in v ′ that is consistent with σ v , has less than r G (v ′ ) many disturbances and is losing for Player 0. Thus the play obtained by first taking the play prefix to v ′ and then appending ρ ′ without its first vertex yields a play starting in v, consistent with σ v , but losing for Player 0. This play implies that σ v is not (ω + 1)-resilient from v, which yields the desired contradiction.
Let m : V → V be given as m(v) = min ≺ {v ′ ∈ V | v ∈ R v ′ } and define the positional strategy σ as σ(v) = σ m(v) (v). By our assumptions, σ can be effectively computed. It remains to show that it is optimally resilient.
To this end, we apply the following two properties of edges (v, v ′ ) that may appear during a play that is consistent with σ, i.e., we either have v ∈ V 0 and σ The first property follows from minimality of m(v) and ( * ) while the second one follows from the definition of R v . 2. If (v, v ′ ) ∈ D, then we have to distinguish several subcases, which all follow immediately from the definition of resilience: -If r G (v) = ω, then r G (v ′ ) = ω, and -If r G (v) = ω + 1, then r G (v ′ ) = ω + 1 and m(v) ≥ m(v ′ ) (here, the second property follows from the definition of R v for v with r G (v) = ω + 1, which takes disturbance edges into account). Now, consider a play ρ = (v 0 , b 0 )(v 1 , b 1 )(v 2 , b 2 ) · · · that is consistent with σ. If r G (v 0 ) = 0 then we have nothing to show, as every strategy is 0-resilient from v. Now, assume r G (v 0 ) ∈ ω \ {0}. We have to show that if ρ has less than r G (v 0 ) disturbances, then it is winning for Player 0. An inductive application of the above properties shows that in that case the last disturbance edge leads to a vertex of non-zero resilience. Furthermore, as the values m(v j ) are only decreasing afterwards, they have to stabilize at some later point. Hence, there is some suffix of ρ that starts in some v ′ with non-zero resilience and that is consistent with the strategy σ v ′ . Thus, the suffix is winning for Player 0 by the choice of σ v ′ and prefix-independence implies that ρ is winning for her as well.
Next, assume r G (v 0 ) = ω. We have to show that if ρ has a finite number of disturbances, then it is winning for Player 0. Again, an inductive application of the above properties shows that in that case the last disturbance edge leads to a vertex of resilience ω or ω + 1. Afterwards, the values m(v j ) stabilize again. Hence, there is some suffix of ρ that starts in some v ′ with non-zero resilience and that is consistent with the strategy σ v ′ . Thus, the suffix is winning for Player 0 by the choice of σ v ′ and prefix-independence implies that ρ is winning for her as well.
Finally, assume r G (v 0 ) = ω + 1. Then, the above properties imply that ρ only visits vertices with resilience ω + 1 and that the values m(v j ) eventually stabilize. Hence, there is a suffix of ρ that is consistent with some (ω + 1)-resilient strategy σ v ′ , where v ′ is the first vertex of the suffix. Hence, the suffix is winning for Player 0, no matter how many disturbances occurred. This again implies that ρ is winning for her as well.
⊓ ⊔ Next, we analyze the complexity of the algorithm sketched above in some more detail. The inductive definition of the r j can be turned into an algorithm computing r * (using the results of Lemma 3 to optimize the naive implementation), which has to solve O(|V |) many games (and compute winning strategies for some of them) with winning condition Win ∩ Safety(U ). Furthermore, the rigged game, which is of size O(|V |), has to be solved and winning strategies have to be determined. Thus, the overall complexity is in general dominated by the complexity of solving these tasks. We explicitly state one complexity result for the important case of parity games, using the fact that each of these games is then a parity game as well. Also, we use one of the recently presented quasipolynomial time algorithms for solving parity games [6,12,17] to solve the G U and G rig .
Theorem 2. Optimally resilient strategies in parity games are positional and can be computed in quasipolynomial time.
Using similar arguments, one can also analyze games where positional strategies do not suffice. As above, assume G satisfies the same determinacy and effectiveness assumptions, but only require that Player 0 has finite-state winning strategies 4 for each game with winning condition (A, Win ∩ Safety(U )) and for the rigged game G rig . Then, one can show that she has a finite-state optimally resilient strategy. In fact, by reusing memory states, one can construct an optimally resilient strategy that it is not larger than any constituent strategy.

Discussion
In this section, we discuss the assumptions required to be able to compute (positional) optimally resilient strategies with the algorithm presented in Section 3. To this end, fix a game G = (A, Win) with vertex set V and recall that G rig is the corresponding rigged game and that we defined G U = (A, Win∩Safety(U )) for every U ⊆ V . Now, the assumptions on G for Theorem 1 to hold are as follows: 5 1. Every game G U is determined. 2. Player 0 has a positional winning strategy from every vertex in her winning regions in the games G U and in the rigged game G rig .
3. Each game G U and the game G rig can be effectively solved and positional winning strategies can be effectively computed for each such game. 4. Win is prefix-independent.
First, consider the determinacy assumption. It is straightforward to show Safety(U )). Hence, one can first determine and then remove the winning region of Player 1 in the safety game and only then solve the subgame of G played in Player 0's winning region of the safety game. Thus, all subgames of G being determined is a sufficient condition for our determinacy requirement being satisfied. The winning conditions one typically studies, e.g., parity and in fact all Borel ones [20], satisfy this property.
The next requirement concerns the existence of positional winning strategies for the games G U and G rig . For the former games, this requirement is satisfied if Player 0 has positional winning strategies for all subgames of G. As every positional optimally resilient strategy is also a winning strategy in a certain subgame, this condition is necessary. Now, consider the rigged game, whose winning condition can be written as The winning conditions one typically studies, e.g., again the Borel ones, are closed under taking such supersequences. Thus, if G is from a class of winning conditions that allows for positional winning strategies for Player 0, then this class typically also contains G rig .
Also, the assumption on the effective solvability and computability of positional strategies is obviously necessary, as we solve a more general problem here when determining optimally resilient strategies. Finally, let us consider prefix-independence. If the winning condition is not prefix-independent, the algorithm presented in Section 3 does not compute the resilience of vertices correctly anymore. As an example, consider the family G k = (A, Win k ) of games shown in Figure 3. In G k , it is Player 0's goal to avoid more than k visits to v. Such a visit only occurs via a disturbance or if the initial vertex is v. Hence, we have r G k (v) = k and r G k (v ′ ) = k + 1. Applying the algorithm from Section 3, however, the initial ranking function r 0 has an empty domain, since we have W 1 (G k ) = ∅. Thus, the computation of the r j immediately stabilizes, yielding r * with empty domain. This is a counterexample to Lemma 4, if the winning condition is prefix-dependent.
To conclude this section, we show that we can, however, still leverage the algorithm from Section 3 in order to compute the resilience of a wide range of games with prefix-dependent winning conditions. To this end, we extend the framework of game reductions to games with disturbances. The update function can be extended to finite play prefixes: Upd + (v) = Init(v) and Upd + (wv) = Upd(Upd + (w), v) for w ∈ V + and v ∈ V . A next-move function Nxt : V i × M → V for Player i has to satisfy (v, Nxt(v, m)) ∈ E for all v ∈ V i and all m ∈ M . It induces a strategy σ for Player i with memory M via σ(v 0 · · · v j ) = Nxt(v j , Upd + (v 0 · · · v j )). A strategy is called finite-state if it can be implemented by a memory structure.
The arena A and M = (M, Init, Upd) induce the expanded arena The disturbance edges D ′ are defined analogously, i.e., ((v, m), (v ′ , m ′ )) ∈ D ′ if and only if (v, v ′ ) ∈ D and Upd(m, v ′ ) = m ′ . Every play (v 0 , b 0 )(v 1 , b 1 )(v 2 , b 2 ) · · · in A has a unique extended play ext(ρ) = ((v 0 , m 0 ), b 0 )((v 1 , m 1 ), b 1 )((v 2 , m 2 ), b 2 ) · · · in A×M defined by m 0 = Init(v 0 ) and m j+1 = Upd(m j , v j+1 ), i.e., m j = Upd + (v 0 · · · v j ). Play prefixes are translated analogously. yield unnecessarily large optimally resilient strategies. In current research, we study how to synthesize minimal optimally resilient strategies for games with prefix-dependent winning conditions. Moreover, in the case of prefix-dependent winning conditions, the question arises whether or not optimally resilient strategies may be necessarily larger than winning ones. It is easy to construct a game in which Player 0 has a positional winning strategy, but an optimally resilient one requires an infinite amount of memory. One example is a game with a single vertex with a self-loop, from which a disturbance edge leads into a disturbance-free subgame in which Player 0 needs an infinite amount of memory to win. Thus, it is an interesting question for further research whether a similar result to Theorem 1 holds true for prefix-dependent games with positional winning strategies, e.g., weak parity games [7] or bounded parity games [8]. 6

Outlook
In this work we have developed a fine-grained view on the quality of strategies: instead of evaluating whether or not a given strategy is winning or not, we evaluate it according to its resilience against intermittent disturbances. While this measure of quality enables the construction of "better" strategies than the distinction between winning and losing strategies, there remain aspects of optimality that are not captured in our notion of resilience. In this section we discuss these aspects and give examples of games in which further analysis yields crucial differences between optimally resilient strategies. In further research, we aim to synthesize optimal strategies with respect to these criteria. Fig. 4: Intuitively, moving from v 1 to v 3 is preferable for Player 0, as it allows her to possibly "recover" from a first fault with the "help" of a second one.
As a first example, consider the parity game shown in Figure 4. Vertices v 0 and v 3 have resilience 1 and ω + 1, respectively, while vertices v 1 , v 2 , and v ′ 2 have resilience 0. Player 0's only choice consists of choosing to move to v 2 or to v ′ 2 from v 1 . Let σ and σ ′ be the unique positional strategies for Player 0 that move to v 2 and v ′ 2 from v 1 , respectively. Both strategies are optimally resilient and thus, the algorithm from Section 3 may yield either one, depending on the underlying parity game solver used. Intuitively, however, σ ′ is preferable for Player 0 over σ, as a play prefix ending in v ′ 2 may proceed to her winning region if a single disturbance occurs. All plays encountering v 2 at some point, however, are losing for her. Hence, another interesting avenue for further research is to study how to recover from losing, i.e., how to construct strategies that leverage benevolent disturbances in order to recover from entering Player 1's winning region. For safety games, this has been addressed by Dallal, Neider, and Tabuada [9].
The previous example shows that Player 0 can still make "meaningful" choices even if the play has moved outside her winning region. The game G shown in Figure 5 demonstrates that she can do so as well when remaining in vertices of resilience ω. Every vertex in G has resilience ω, since every play with finitely many disturbances eventually remains in vertices of color 0. Moreover, the only choice to be made by Player 0 is whether to move to vertex v 1 or to vertex v ′ 1 from vertex v 0 . Let σ and σ ′ be positional strategies that implement the former and the latter choice, respectively.
First consider a scenario in which visiting an odd color models the occurrence of some undesirable event, e.g., that a request has not been answered. In this case, Player 0 should aim to prevent visits to v ′ 3 in G, the only vertex of odd color. Hence, the strategy σ should be more desirable for her, as it requires two disturbances in direct succession in order to trigger a visit to v ′ 3 . When playing consistently with σ ′ , however, a single disturbance suffices to make a visit to v ′ 3 unavoidable. On the other hand, consider a setting in which it is Player 0's goal to avoid the occurrence of disturbances. In that case, σ ′ is preferable over σ, as it allows for fewer situations in which disturbances may occur, since no disturbances are possible from vertices v 2 and v 3 .
Note that the two goals of minimizing visits to vertices of odd color and minimizing the occurrence of disturbances are not contradictory: if both events are undesirable, it may be optimal for Player 0 to play according to a combination of strategies σ and σ ′ . In general, it is interesting to study how to how to best brace for a finite number of disturbances.

W1 W0
v 0/1 v 1/0 v 2/1 Fig. 6: Additional memory allows Player 0 to remain in the right-hand loop longer and longer, thus decreasing the potential for disturbances.
Recall that, due to Theorem 2, optimally resilient strategies for parity games do not require memory. In contrast, the game shown in Figure 6 demonstrates that additional memory can prove beneficial in order to further improve such strategies. Any strategy for Player 0 that does not stay in v 2 from some point onwards is optimally resilient. However, every visit to v 1 carries with it the possibility of a disturbance occurring, which would lead the play into a losing sink for Player 0. Hence, it is in her best interest to remain in vertex v 2 for as long as possible in order to minimize the possibility for disturbances to occur. This behavior does, however, require memory to implement, as Player 0 needs to track the number of visits to v 2 in order to not remain in that state ad infinitum. Thus, for each optimally resilient strategy σ with finite memory there exists another optimally resilient strategy that uses more memory, but visits v 1 more rarely than σ, reducing the possibilities for disturbances to occur. Hence, it is interesting to study how to balance the avoidance of disturbances with the satisfaction of the winning condition. We address all these problems in further research.

Related Work
The notion of unmodeled intermittent disturbances has recently been formulated by Dallal, Neider, and Tabuada [9]. In this work, the authors also present an algorithm for computing optimally resilient strategies for safety games with disturbances, which is an extension of the classical attractor computation [15]. Due to the relatively simple nature of such games, however, this algorithm cannot easily be extended to handle more expressive winning conditions, and the approach presented in this work relies on fundamentally different ideas.
Resilience is not a novel concept in the context of reactive systems synthesis. It appears, for instance, in the work by Topcu et al. [22] as well as Ehlers and Topcu [11]. A notion of resilience that is very similar to the one considered here has been proposed by Huang et al. [16], where the game graph is augmented with so-called "error edges". However, this setting differs from the one studied in this work in various aspects. Firstly, Huang et al. work in the framework of concurrent games and model errors as under the control of Player 1. This is in contrast to the setting considered here, in which the players play in alternation and disturbances are seen as rare events rather than antagonistic to Player 0. Secondly, Huang et al. restrict themselves to safety games, wheres we consider a much broader class of infinite games. Finally, Huang et al. compute resilient strategies with respect to a fixed parameter k, thus requiring to repeat the computation for various values of k to find optimal resilient strategies. By contrast, our approach computes an optimal strategy in a single run.
Related to resilience are various notions of fault tolerance [1,10,14] and robustness [2,3,4,5,19,21]. In fact, robustness in the area of reactive controller synthesis has attracted considerable interest in the recent years, typically in setting with specifications of the form ϕ ⇒ ψ stating that the controller needs to fulfill the guarantee ψ if the environment satisfies the assumption ϕ. A prominent example of such work is that of Bloem et al. [2], in which the authors understand robustness as the property that "if assumptions are violated temporarily, the system is required to recover to normal operation with as few errors as possible" and consider the synthesis of robust controllers for the GR(1) fragment of Linear Temporal Logic [5]. Other examples include quantitative synthesis [3], where robustness is defined in terms of payoffs, and the synthesis of robust controllers for cyber-physical systems [19,21]. For a more in-depth discussion of related notions of resilience and robustness in reactive synthesis, we refer the interested reader to Dallal, Neider, and Tabuada's section on related work [9, Section I]. Moreover, a survey of a large body of work dealing with robustness in reactive synthesis has been presented by Bloem et al. [4].