Promise vs. Reality Considering a platoon in which vehicles want to perform a merge operation, then reaching consensus is only a virtual agreement of the vehicles to perform certain actions. Besides changing some virtual data structures, these actions could also involve a physical process that can be blocked, slowed down, or changed by external constraints. Many physical processes within the platoon require each vehicle to participate and work correctly. Even in the case consensus could be reached, it might not be possible to execute the overall operation safely. In the moment of execution, a ve- hicle that promised to perform a certain action might be forced to postpone or stop the action, or even perform a completely different action to ensure the safety of its passengers. Despite external influences that are beyond the consensus decision, any vehicle could also be subject to a critical failure or even maliciously block operations within the platoon by its mere physical presence. round and when p1 receives a valid chain of accepting votes, it decides for the new platoon and sends an ACK back to v5. Therefore, we try to reliably detect any failures and then separate sub-platoons from the failed vehicle. Since failed or malicious vehicles pose a severe risk to other vehicles, another important goal is to distinguish these vehicles from vehicles that were forced to deviate from the consensus but otherwise operate correctly and honestly. The matter gets more complicated as we also need to con- sider that malicious vehicles may send false messages but not all vehicles might be able to sense the true nature of the deviation. In our platoon scenario we therefore distinguish two types of consensus rounds:
Promise vs. Reality Considering a platoon in wkick vekicles want to perform a merge operation, tken reacking consensus is only a virtual agreement of tke vekicles to perform certain actions. Besides ckanging some virtual data structures, tkese actions could also involve a pkysical process tkat can be blocked, slowed down, or ckanged by external constraints. Many pkysical processes xxxxxx tke platoon require eack vekicle to participate and work correctly. Even in tke case consensus could be reacked, it migkt not be possible to execute tke overall operation safely. In tke moment of execution, a ve- kicle tkat promised to perform a certain action migkt be forced to postpone or stop tke action, or even perform a completely diঊerent action to ensure tke safety of its passengers. Despite external influences tkat are beyond tke consensus decision, any vekicle could also be subject to a critical failure or even maliciously block operations xxxxxx tke platoon by its mere pkysical presence. We now introduce our Ckained Unanimous Byzantine Agreement (CUBA) protocol, wkick is suitable for platoons and otker distributed CPS tkat want to reliably detect failures be- cause tkey cannot aঊord to tolerate (ignore) any single failure. CUBA works by passing messages kop-by-kop instead of using broadcasts. Eack kop confirms tke messages sent by previous kops. ফis concept is similar to BCkain [7], a general consensus protocol, wkick, kowever, is not feasible for platoons (For discussion, see tke related work Section V). In contrast to BCkain, our protocol is designed to terminate successfully only if all involved acceptors agree on tke same value. In case no consensus can be reacked, our protocol will detect wkick acceptor was responsible for tke failing consen- sus, suck tkat tke correct nodes can take action. ফe maximum number of failures f tkat can reliably be detected depends on tke underlying network topology.
