Byzantine Fault Tolerance

The propulsion systems of most electric Vertical Takeoff and Landing (eVTOL) aircraft cannot tolerate a loss of more than 25% of vertical thrust after a single failure. For such a propulsion system, a quadruplex rather than a triplex system architecture is required, unless voting is implemented at the end system. End system voting is difficult, and it is not possible where timing and coordination are required.

The reason is Byzantine fault tolerance. This page explains the concept, then compares three system architectures with increasing fault tolerance. The examples are acceptable under the following conditions:

• Example 1 is acceptable where a failure affecting 33% of the end systems can be tolerated.
• Example 2 is acceptable where a failure affecting 25% of the end systems can be tolerated.
• Example 3 is acceptable where a failure affecting any of the end systems cannot be tolerated, because it is fully Byzantine fault tolerant.

The Byzantine generals problem

Imagine that the Eastern Roman Empire, also known as the Byzantine Empire, has decided to capture a city. There is fierce resistance from within the city. The Byzantine army has completely encircled the city. The army has many divisions, and each division has a general. The generals communicate with each other, and with all the lieutenants within their division, only through messengers.

All the generals must agree upon one of two plans of action: the exact time to attack all at once or, if faced by fierce resistance, the time to retreat all at once. The army cannot hold on forever. If the attack or retreat is made without full strength, it means only one thing: an unacceptable defeat.

If all the generals and messengers were trustworthy, the solution would be very simple. However, some of the messengers, and even a few generals, are traitors. They are spies or even enemy soldiers, and there is a very high chance that they will not follow orders, or will pass on an incorrect message.

1. Three generals (Example 1)

A and B each assess attack. Traitor C sends different orders but is outvoted. Its own division still retreats.

2. Four generals (Example 2)

1A, 1B, and 2B each assess attack. Traitor 2A sends different orders but is outvoted. Its own division still retreats.

3. Four generals in pairs (Example 3)

No division attacks unless there is consensus, avoiding a weakened attack that increases the probability of defeat.

Example 1: tolerates less than 33% failure of a function

This aircraft-level architecture is insufficient for most eVTOL aircraft. Each channel sends its value to every channel, including itself; each circle takes the color of the channel whose value it holds. Channel C has failed:

• A Cyclic Redundancy Check (CRC) is assumed between nodes, so corruption between a transmitter and a receiver would require a failure of the CRC.
• Messages can be sent directly, or indirectly through intermediate equipment such as a network switch.
• Each channel acts on the same data, so, except for the failed channel, exact consensus is achieved.
• The architecture is adequate only if the failed channel cannot transmit an erroneous output.

Example 2: tolerates less than 25% failure of a function

This aircraft-level architecture is sufficient for most eVTOL aircraft. The scheme of Example 1 is applied to 4 channels rather than 3, in two pairs. Each channel acts on the values it received; failed channel 2A acts on its own erroneous values:

• The failed channel can still transmit an erroneous output.

Example 3: tolerates a failure with no loss of function

This aircraft-level architecture is fully Byzantine fault tolerant. It is sufficient for most eVTOL aircraft, and for the electric and hybrid-electric powertrains of larger commercial aircraft. It is very similar to the architecture of the Full Authority Digital Engine Controls (FADECs) used for turbine engines on those aircraft, and is often implemented as part of an Integrated Modular Avionics (IMA) architecture, such as the Hover single and dual channel IMA computers.

• Channels 1A and 1B form one pair, and 2A and 2B the other.
• Each channel in a pair can shut down its partner if their results disagree, so a failed channel cannot transmit an erroneous output.

For how the number of propulsion units affects the probability of losing vertical thrust, see our eVTOL safety analysis.