# A MILP Model for a Byzantine Fault Tolerant Blockchain Consensus
## 3 Formulation for the dBFT Consensus
### Model Constraints and Blockchain Operational Requirements
#### 3.4.4 Honest Nodes Constraints  
If all nodes were to be Byzantine, then the aforementioned constraints would be sufficient for the model. However, we assume that, at least, \(M=|R_{OK}|\) will be honest, which will, consequently, respect the following constraints defined in Equations (16)-(24). Honest nodes will not relay more than one block (Equation (16)), and they will force a Primary to exist if they can prove that they have enough change view messages, as ensured in Equation (17). \[\sum_{t\in\mathcal{T}:t>1}\sum_{v\in\mathcal{V}}BlockRelay^{-}_{t,i,v}\leq 1 \qquad\qquad\forall i\in\mathcal{R}_{OK} \tag{16}\]  
\[\sum_{i\geq R}2\cdot IsPrimary_{i2,v}\geq TotalChView^{+}_{i,v-1}-M+1\qquad \qquad\forall i\in\mathcal{R}_{OK},v\in\mathcal{V}:v>1 \tag{17}\]  
Honest nodes will try to perform its whole of sending PrepareRequest when Primary (Equation (18)) and also respond to received messages. Equation (19) has four parameters \((Send^{-},Recv^{+},Rate,Delta)\) which are assigned to the following groups: \((PrepResp^{-},PrepReq^{+},1,0)\), \((Commit^{-},PrepResp^{+},2,-M+1)\) and \((BlockRelay^{-},Commit^{+},2,-M+1)\). \[\sum_{t\in\mathcal{T}:t>1}PrepReq^{-}_{t,i,v}\geq IsPrimary_{i,v}\qquad\qquad \forall i\in\mathcal{R}_{OK},v\in\mathcal{V}:v>1 \tag{18}\]  
\[\sum_{t\in\mathcal{T}:t>1}Rate\cdot Send^{-}_{t,i,v}\geq\sum_{t\in\mathcal{T} :t>1}\sum_{j\in\mathcal{R}}Recv^{+}_{t,i,j,v}+Delta\qquad\qquad\forall i\in \mathcal{R}_{OK},v\in\mathcal{V}:v>1 \tag{19}\]  
Honest nodes will not send payloads on a higher view if a certificate of previous view was not obtained, as iteratively created in Equation (20) by setting variable \(Send^{-}\) to \(PrepReq^{-}\), \(PrepResp^{-}\), \(Commit^{-}\) and \(ChView^{-}\). \[\sum_{t\in\mathcal{T}:t>1}Send^{-}_{t,i,v}\leq\frac{1}{M}TotalChView^{+}_{i,v-1} \qquad\qquad\forall i\in\mathcal{R}_{OK},v\in\mathcal{V}:v>1 \tag{20}\]  
If a commit state is not achieved, honest nodes will emit a Change View, ensured at Equations (21) and (22). The first one ensures that only for View 1 (the first view), while Equation (22) has an additional parcel that avoids forcing an honest node to send a Change View if previous view was not active. \[\sum_{t\in\mathcal{T}:t>1}ChView^{-}_{t,i,1}\geq 1-\sum_{t\in\mathcal{T}:t>1} Commit^{-}_{t,i,1} \tag{21}\]  
\[\sum_{t\in\mathcal{T}:t>1}ChView^{-}_{t,i,v}\geq 1-\left(\sum_{t\in \mathcal{T}:t>1}\sum_{v\in\mathcal{V}:v\geq 2\leq v}Commit^{-}_{t,i,v}2 \right)-\left(1-\sum_{t\geq\mathcal{R}}IsPrimary_{i2,v}\right) \qquad\forall v\in\mathcal{V}:v>1, \tag{22}\]  
Equation (23) links the following pairs of sending actions: \((SendA^{-},\)\(SendB^{-})\): \((PrepReq^{-},\)\(ChView^{-})\), \((PrepResp^{-},\)\(ChView^{-})\), \((Commit^{-},\)\(ChView^{-})\), \((ChView^{-},\)\(Commit^{-})\), \((PrepReq^{-},\)\(BlockRelay^{-})\), \((PrepResp^{-},\)\(BlockRelay^{-})\), \((Commit^{-},\)\(BlockRelay^{-})\) and \((ChView^{-},\ BlockRelay^{-})\). Those constraints are created to ensure, for example, that Change View will lock honest nodes from sending PrepareRequest, PrepareResponse or Commit. A similar lock is ensured for Change View if the node has the committed in an instant before or relayed a block with \(BlockRelay^{-}\), which will also block an honest to send anything else. As should be noticed, the second parcel of the equation has a summation that limits \(t2\) to be within the limits \(1<t2\leq t\). \[ \begin{split} SendA^{-}_{t,t,\
u}\leq 1-\sum_{1<t2\leq t\in\mathcal{T} }SendB^{-}_{t2,t,\
u}\qquad\qquad\forall i\in\mathcal{R}_{OK},v\in\mathcal{V},t>1\in\mathcal{T}\end{split}  \tag{23}\]  
The set of constraints created from Equation (24) blocks an honest node to send packages if a block was relayed on view before or commit state was reached.