Petr Grigorev
email: p.grigorev@warwick.ac.uk

Thomas D Swinburne

James R Kermode
email: kermode@warwick.ac.uk

Hybrid quantum/classical study of hydrogen-decorated screw dislocations in tungsten: Ultrafast pipe diffusion, core reconstruction, and effects on glide mechanism

HAL is

I. INTRODUCTION

Plasma-facing materials (PFMs) such as tungsten are in direct contact with plasma, exposing them to extreme conditions including high thermal loads, irradiation by plasma particles, and high energy neutrons [1,2]. Consequently, the choice of PFM is crucial for stable operation of a plasma device. Due to its outstanding thermal properties, tungsten (W) has been chosen as the divertor armor and first wall material for nextgeneration plasma devices [START_REF] Clark | Nuclear Fusion Research: Understanding Plasma-Surface Interactions[END_REF]. The combination of steady thermal loads and transient events will lead to significant thermal shock events [START_REF] Wirtz | [END_REF][5][6], making it crucial to be able to understand and predict the mechanical response. It is therefore essential to model the glide of 111 screw dislocations, which are well known to be the central carriers of plasticity in body centered cubic (bcc) metals such as tungsten [START_REF] Hirth | Theory Of Dislocations[END_REF].

While the screw dislocation glide is well characterized in pure bcc materials [START_REF] Dezerald | [END_REF]9], solutes can have a strong effect on the dislocation properties leading to hardening or softening of the material [10]. In tungsten Ir, Pt, Au, and Hg solute atoms show a strong attraction to screw dislocations resulting in hardening by a pinning mechanism, while Hf, Ta, and Re reduce glide barriers and thus facilitate plastic slip [11]. Re is known to affect the stable core structure as well as the glide plane of screw dislocations in W [12,13], while interstitial carbon stabilizes the hard-core configuration in Fe, Mo, and W [14,15].

In a fusion environment, a PFM will be continuously populated with hydrogen isotopes. A full picture of the interactions of H with dislocations is essential for understanding PFM ageing, in particular the H isotope retention phenomenon [16]. H and He behavior in W has been investigated by means of atomistic simulations; thorough reviews of recent modeling activities can be found in Refs. [17][18][19]. According to DFT studies, H atoms occupy tetrahedral interstitial positions in bulk W with a migration barrier of around 0.25 eV [20][21][22][23].

Since the dislocation glide is governed by a very localized rearrangement of atomic bonds at the dislocation core, accurate atomistic methods are required to capture the migration mechanism [START_REF] Dezerald | [END_REF]. While empirical interatomic potentials are constantly improving, the accuracy and transferability of existing interatomic potentials in application to dislocations remains limited [24,25], especially when accounting for chemical effects induced by impurities, meaning that ab initio simulations are essential. However, dislocations have a net elastic disregistry which generates long-range elastic fields whose accommodation in principal demands large model systems beyond the computational size limits of ab initio methods. Combining a quantum mechanical description of the dislocation core (along with any nearby impurities) where bond rearrangement takes place with a classical description of the long-range elastic relaxation is thus an appealing prospect.

A popular solution is a cluster arrangement, where a dislocation core is contained in a cylindrical disk of atoms governed by ab initio methods oriented perpendicular to the 111 Burgers vector direction, which is then coupled to a linear elastic medium controlled by the lattice Green's function [26][27][28] able to accurately capture the far-field deformation. Another option is to embed the ab initio cluster in an atomistic region governed by empirical force fields. The embedding region is then made large enough in order to accommodate far-field deformation. This latter technique, used here, is an example of a hybrid QM/MM simulation [29,30]. In all cluster methods, an additional layer of redundant "buffer" atoms is required in the ab initio cluster simulation to mitigate electronic effects induced by the artificial free surface of the cluster. It is well known that, due to the delocalization of the electronic energy density, cluster-based simulation methods possess well-defined forces but no energy function. Recently, a partial solution to this problem was developed, allowing the evaluation of energy barriers from hybrid QM/MM simulations using the principle of virtual work to integrate the projected force along pathways in configuration space [31].

To account for the long range elastic fields, the empirical atomistic region for dislocation simulations can either be an axially periodic cylinder with the outer boundaries of the disk fixed according to linear elastic solution for an isolated dislocation [32] (so-called cluster approach), shown in Fig. 1(d), or a fully periodic supercell with an additional dislocation of opposing Burgers vector, creating an infinite dipole array with zero net disregistry [27,33]. The dislocation dipoles can be arranged in either a honeycomb or square lattice; a square lattice was found to be the most effective for reducing elastic interactions between dislocations [34], referred to as a quadrupole arrangement. An example quadrupole supercell is shown in Fig. 1(a).

While in principle it is possible to create a dislocation dipole in a supercells of a few hundred atoms small enough to be treated in fully periodic density functional theory (DFT) calculations, where a total energy is defined, the strong elastic interactions between dislocations in the dipole and their periodic images is typically too large to give useful results. However, 111 screw dislocations in bcc metals are one of the small number of cases where the interactions are sufficiently weak that such simulations are meaningful [START_REF] Dezerald | [END_REF]27,33,34], although errors can be introduced when a defect or an impurity is present near one of the dislocations due to the broken symmetry.

The three nonequivalent atomic planes along the 111 direction in bcc materials [shown with red, green, and blue circles in Figs. 1(b), 1(c) 1(e), and 1(f)] form a triangular lattice in the (111) plane [see Fig. 1(b)]. The lattice consists of two types of triangles (upward and downward pointing) with opposite chirality, i.e., the screw direction of the atomic columns along 111 direction. Depending on the sign of the FIG. 2. Screw dislocation glide barrier in pure tungsten. Dashed curves with open circles represent previously reported DFT data obtained with quadrupole configurations from Refs. [42] (MVG), [44] (DVC), and [45] (KCD). The brown solid curve with filled squares shows data obtained with an EAM3 potential [42]. The blue solid line with filled circles shows results of our hybrid QM/MM simulations. The red dashed line with open circles show our 135atom DFT quadrupole result with equivalent parameters to our QM region. Insets: Screw dislocation core structure and position (red triangle) for the first, middle, and last images of the QM/MMrelaxed MEP.

Burgers vector it is possible to obtain two types of dislocation cores: "easy" and "hard" cores [35][36][37][START_REF] Cai | Dislocations in Solids, Dislocations in Solids[END_REF].

In our calculations we applied displacement fields corresponding to positive Burgers vector centered on an upwardpointing triangle in order to obtain an easy-core configuration, shown by a red solid triangle in Fig. 1(e). This results in reversed chirality of the triangle containing the dislocation core. This effect is illustrated in the middle part of Fig. 1(f). The hard-core configuration can be obtained by application of the same displacement to an downward-pointing triangle, shown by a red star in Fig. 1(e). In this case the applied displacements cancels out the natural chirality of the three nonequivalent planes in 111 direction resulting in the arrangement of core atoms in straight lines perpendicular to 111 direction. The resulting hard-core structure is shown in the right part of Fig. 1(f).

Previous DFT calculations of 111 screw dislocation dipoles in bcc metals have found that the easy core is symmetric, nondegenerate, and the most stable [10,26,32,[START_REF] Ismail-Beigi | [END_REF]. Glide migration thus occurs between two easy-core positions [34,37,40,41] shown with (filled and open) red upwardpointing triangles in Fig. 1(e). The minimum energy path (MEP) of the dislocation core passes close to a third type of core configuration-the "split" configuration when the dislocation core is centered close to an atomic column [red cross in Fig. 1(e)] resulting in a single hump-shaped glide MEP profile [37,[41][42][43][44][45] presented with dashed lines in Fig. 2. However, most interatomic potentials for tungsten incorrectly predict a degenerate easy core with a double-hump glide profile [24,25]. Recent bond order potentials (BOPs) [46] as well as embedded atom method (EAM) potentials [42] are in better agreement with DFT in terms of core stability and the shape of the glide MEP (cf. brown solid line with filled squares in Fig. 2). However, the necessity to fit a new potential for every new impurity element in the system remains a limiting factor for studying the effect of impurity-dislocation interactions.

Interaction of H with dislocations was mainly studied in the context of H isotope retention in W after plasma exposure. DFT studies of H and He interaction with screw dislocations in tungsten using quadrupole geometries showed attractive interaction with possible acceleration of pipe diffusion of H along screw dislocations [16,47]. However, the effect of H or He on the dislocation core structure and glide properties have not been investigated by DFT calculations and as such definitive conclusions is precluded by the known unreliability of empirical potentials in this regime. An energy-based QM/MM scheme [48] was applied to study H and He interaction with screw and edge dislocation in Fe, where it was demonstrated that both impurities are attracted to both types of dislocations with low diffusion barrier along the screw dislocation core [49]. H was found to affect the structure of the screw dislocation core together with lowering of the glide barrier. However, neither the dislocation glide path in the presence of H nor how the effect of H on the glide barrier depends on the energy correction scheme used during QM/MM coupling were reported.

The first aim of this paper is to provide a valuable validation of the QM/MM virtual work principle for dislocation systems by comparing calculations of the Peierls barrier [START_REF] Hirth | Theory Of Dislocations[END_REF] for 111 screw dislocations in W using both the QM/MM virtual work method and small periodic quadrupole cells where a total energy function is available (Sec. III B). After validation, the QM/MM approach is applied to study interaction of H with dislocation cores (Sec. III C) together with the effect of H on the glide mechanism (Sec. III E).

II. METHODS

A. Description of the QM/MM scheme

A QM/MM simulation always defines three principal regions: a QM region, here containing a dislocation core, a buffer region surrounding the QM region, and the remaining bulk region. On each force call a DFT calculation is performed on a cell containing atoms from QM and buffer regions surrounded by vacuum. The buffer region is essential to reduce the effect of artificial free surfaces of the cell on the accuracy of the forces in the QM region. Forces on the buffer atoms obtained by DFT are ignored during minimization, with forces on buffer and bulk atoms given by a classical interatomic potential, here the "EAM3" embedded atom model from Ref. [42], resulting in the "abrupt buffered force mixing" QM/MM scheme described in Ref. [50]. The advantage of the scheme is accurate forces throughout the system including near the QM/MM interface. However, energy per atom in the QM region is not accessible due to the nonlocal nature of electronic energy and thus the value of the total energy of the system is not available. Therefore, the virtual work principle described in Ref. [31] was employed in order to extract the energy barriers of interest.

To briefly summarize the virtual work approach, in a system of N atoms we define a (possibly unconverged) pathway X(λ) ∈ R 3N , where λ ∈ [0, 1] is an affine parameter along the path. For any given configuration X(λ) we also have access to the QM/MM force vector F(λ) ∈ R 3N . The virtual work principle states that the energy difference along the pathway E (λ) ≡ E (λ) -E (0) is given by

E (λ) = λ 0 F(λ ) d dλ X(λ )dλ , ( 1
)
where d dλ X(λ ) is the pathway tangent at λ . Using the chain rule it is simple to show that any nonlinear mapping λ(λ) leaves the energy barrier max λ E (λ) unchanged.

The scheme described above was implemented within the framework of the atomic simulation environment [51] using the LAMMPS [52] code to obtain forces from the interatomic potential and the VASP [53] code for DFT calculations. A cluster configuration with open boundaries along 110 and 112 directions and periodic boundary conditions along the 111 Burgers vector direction was used for hybrid QM/MM simulations. For pure W cells, the QM region contains 23 atoms as schematically shown in Fig. 1(d). The buffer size was chosen to be 12 Å, resulting in a DFT cluster containing a total 144 atoms for pure DFT simulation. Convergence tests for the glide barrier using buffer sizes up to 14 Å and QM regions containing up to 23 QM atoms showed a relative difference of less than 10% (≈7 meV), comparable to the error bars associated with NEB convergence (cf. Sec. II B below) and in agreement with previous tests of our QM/MM approach for fcc Al and bcc Mo [31]. The PBE generalized gradient approximation [54] was used to describe effects of electron exchange and correlation together with a projector augmented wave (PAW) basis set with a cut-off energy of 550 eV. The Brillouin zone was sampled with a 1×1×12 Monkhorst-Pack k-point grid, reflecting the fact that the cluster is periodic along the dislocation line. Occupancies were smeared with a Methfessel-Paxton scheme of order one with a 0.1 eV smearing width. The values of these parameters were chosen after a series of convergence tests on forces with a tolerance of few meV/Å. The lattice parameter a 0 = 3.17 Å and elastic constants C 11 = 540 GPa, C 12 = 204 GPa, and C 44 = 142 GPa obtained from VASP calculations with the above mentioned parameters were used to generate an initial displacement field using Stroh method [55] as implemented within the atomman [START_REF]Atomman: Atomistic manipulation toolkit[END_REF] package. The EAM3 potential from Ref. [42] was used for force calculation in the MM part of the hybrid scheme. The potential was rescaled to match the DFT lattice parameter and bulk modulus as described in Ref. [31]. Endpoints for each MEP were relaxed with a maximum force tolerance of 0.01 eV/Å, while a force tolerance of 0.05 eV/Å was applied for nudged elastic band (NEB) [START_REF] Jonsson | Classical and Quantum Dynamics in Condensed Phase Simulations[END_REF] MEP calculations. The FIRE minimization method was used in all cases [START_REF] Bitzek | [END_REF].

The periodic dislocation quadrupole configurations [Fig. 1(a)] for full DFT simulations were generated by our own implementation of the method described in Refs. [34,37,[START_REF] Cai | Handbook of Materials Modeling: Methods[END_REF], which is available as part of the matscipy [START_REF] Kermode | Matscipy: Generic python materials science toolkit[END_REF] package. For the quadrupole case, the NEB glide calculation was carried out by moving both dislocation cores simultaneously and dividing the resulting barrier by two.

No elastic correction for the resulting energy barrier was applied, though previous studies have shown this correction is minimal [41,44,45], as we confirm below.

B. Error propagation for the virtual work approach

DFT codes such as VASP use a self-consistent field (SCF) procedure to determine the electronic ground state, leading to DFT atomic forces with some residual error, in addition to that induced by choice of exchange-correlation functional and other parameter choices. As a result, the atomic force vector F(λ) used in the virtual work calculation of Eq. (1) will not be the "true" vector of Hellman-Feynman forces F 0 (λ) for a given configuration X(λ). To estimate the resulting error on energy barrier calculations, we model the QM/MM force vector F(λ) for a configuration X(λ) as

F(λ) = F 0 (λ) + σ η(λ), (2)
where η(λ) is a white noise vector inside the QM region and zero otherwise and σ is a RMSD force error for the QM region. From Eq. ( 1) it is simple to show that the variance on the energy difference is given under these assumptions by

σ 2 E (λ) = σ 2 λ 0 d dλ X(λ )I QM d dλ X(λ )dλ , ( 3
)
where I QM is a diagonal matrix which is unity for atom coordinates inside the QM region and zero outside. To evaluate σ , we monitor the variation in the force vector across the QM region during the last stages of minimization, for all configurations whose maximum force component is less that 0.05 eV/Å. We have also evaluated the error in the energy barrier by sampling new forces according to the per-coordinate force distribution from the same configurations then integrating these sampled forces directly to sample the energy difference. Both cases gave essentially identical results, as represented by the error bars and filled ribbons in Figs. 2,4, and 5.

III. RESULTS

A. Quadrupole vs cluster size tests using an empirical potential

In order to estimate the effect of the finite size of the overall cell, a number of NEB calculations for the glide barrier of a 1 2 111 screw dislocation using cluster and quadrupole approaches were performed. In both cases we considered an easy-core configuration (Fig. 1). The "EAM4" potential from Ref. [42] was used. A quadrupole cell containing 135 atoms and a cluster cell containing 237 are shown in Figs. 1(a) and 1(d), respectively. The dislocation core positions were extracted by fitting to an analytical solution for the displacement field [41]. The purple dashed circle shown on the quadrupole cell has a diameter equal to the distance between two dislocation cores. The size of the cluster cell was chosen to have the same diameter of unconstrained atoms around the dislocation core. Larger cells were considered to be of equivalent sizes when the same condition was satisfied. The values of the glide barrier obtained with different sizes were compared to reference configurations with core distance (cluster radius) of 818 Å containing 377 394 atoms in cluster configuration and 235 791 atoms in quadrupole configuration. The glide barriers for both reference configurations is 0.0621 eV with FIG. 3. Size dependence of relative error in the glide barrier for quadrupole and cluster configurations computed with EAM4 interatomic potential from Ref. [42]. The reference value of 0.0621 eV was obtained from a cluster with radius 818 Å containing 377 394 atoms.

a relative difference of ≈10 -4 (≈10 -5 eV) between cluster and quadrupole configurations.

As can be seen from Fig. 3 the smallest quadrupole configuration containing 135 atoms provides a relative error of a few percent. At the same time, the error for the corresponding cluster configuration containing 237 atoms is of order of 40%. It is important to note that the 135-atom cell is the most widely used for DFT calculations and configurations with larger sizes are used only for convergence tests due to their high computational cost. In order to achieve the same accuracy of a few percent with a cluster configuration, one has to use a cell containing at least 1200 atoms, which is impractical with a full DFT calculation. Moreover, this estimation does not take into account the effect of free surfaces on DFT forces in cluster configuration which can increase the total error for a given size. We note that, since the accuracy of a quadrupole cell relies on error cancellation resulting from the symmetry of two dislocations of opposite signs, adding an impurity to one of the cores reduces this symmetry and thus deteriorates the accuracy. Adding an impurity to both cores is possible in order to keep the symmetry, however it adds extra complexity and affects the overall stability of the system. This result demonstrates that a large cluster cell is thus a more suitable choice for studying interactions of dislocation core with impurities and/or defects or clusters of defects. In this work we use a cluster configuration containing 1437 atoms for calculations using a hybrid QM/MM scheme.

B. Screw dislocation core structure and glide in pure W

The results of the hybrid QM/MM NEB cluster calculation of the screw dislocation glide barrier in pure W are shown with a solid blue line and circles in Fig. 2. The brown line with solid squares shows the results of the same calculation, but where the system was fully treated with EAM3 potential from Ref. [42] used for the MM part in QM/MM scheme. Dashed lines with hollow circles give previously reported DFT results with periodic quadrupole configurations containing 135 atoms [42,44,45]. Our results demonstrate that treating only 23 atoms around the dislocation core at the DFT level allows us to obtain an MEP and absolute barrier height in much better agreement with reference DFT results, within the range of the reported DFT data (≈10 meV). It is possible to reduce the spread of the found migration barriers by using improved NEB minimization algorithms [START_REF] Makri | [END_REF].

The structure of the dislocation core corresponding to the initial, saddle, and final points of the MEP are shown as insets in Fig. 2, with the dislocation core migration path shown with a red dashed line in each inset. The optimized dislocation core path significantly differs from the initial linear interpolation guess shown in Fig. 1(e) and shows a curved path between two easy-core configurations (left and right blues boxes). The saddle point is located close to the "split" core configuration in agreement with previous DFT calculations using quadrupole configurations [37,42,44,45].

C. H segregation to the screw dislocation core

A number of QM/MM relaxations were performed in order to investigate the effect of H atom on stable dislocation core structure and position. The starting configurations for each relaxation were obtained by adding an H atom to a relaxed cell containing a dislocation, with initial position given by adding the screw dislocation displacement field to a tetrahedral interstitial position as shown with blue diamonds in Fig. 4(a). Since the possible effects of H interstitials are most interesting in the context of dislocation glide, two sets of simulations were performed: with a dislocation in the initial glide position [brown triangle in Fig. 4(a)] and with a dislocation at the final position [orange triangle in Fig. 4(a)]. The relaxed configurations were then used as initial and final configuration for NEB calculations of H migration as well as the dislocation glide in the presence of an H atom.

The resulting stable H positions at the dislocation core are shown with colored diamonds in Figs. 4(f) and 4(g). The color scale represents clusters of atomic positions with distance lower than b/2. Orange diamonds show the compact cluster of positions inside the triangle of W atomic columns forming the dislocation core. Purple, cyan, and brown diamonds show three groups of positions situated outside of the dislocation core. Due to rotational symmetry these positions can be considered as one group. These findings are in agreement with pure DFT studies using a periodic quadrupole cell [16,47].

Figure 4(b) shows the effect of an H atom situated inside the dislocation core on the core structure and position. Neither the core position (red triangle) nor the differential displacement map are affected by the H atom; the dislocation core remains a symmetric nondegenerate easy-core structure situated in the center of the same atomic triangle. In contrast, Figs. 4(c) and 4(d) show the effect of an H atom situated outside the dislocation core: Fig. 4(c) shows the core has moved to the left towards the H atom, and at the same time the corresponding differential displacement map has lost symmetry and is close to the split-core structure. A similar effect is seen in Fig. 4(d), where the dislocation core has moved significantly towards the H atom and now is close to the saddle point for the pure W core glide MEP (red dashed line). Overall, we find that H stabilizes dislocation cores in configurations close to the split core that corresponds to the saddle point for dislocation glide in pure W, suggesting that the presence of H may affect the dislocation glide mechanism.

D. H migration around the screw dislocation core

The H atoms represented with orange diamonds in Fig. 4(g) are evenly distributed along the 111 direction, following the helicity of the dislocation core, indicating a possible H migration path along the dislocation line. At the same time, H atoms in the triangles adjacent to the dislocation [cyan, purple, and brown diamonds in Fig. 4 Due to the threefold symmetry of the triangular tessellation formed by the lattice in the (111) plane, positions marked by cyan, purple, and brown diamonds in Fig. 4(f) are symmetric. This means that three possible trajectories between these positions and central positions [orange diamonds in Fig. 4(f)] are equivalent. The projection on the (110) plane in Fig. 4(g) exhibits rotational twofold symmetry and it can be shown the H position on the top right part of the figure is equivalent to the position on the bottom left part of the figure. However, it also shows that the purple dashed trajectory (between orange and brown diamond) is not equivalent to the green dashed trajectory (between orange and cyan diamond). Taking into consideration the symmetry of favorable H positions, we performed NEB calculations only on the minimal set of nonequivalent pathways shown with dashed lines in Figs. [START_REF] Wirtz | [END_REF](f) and 4(g).

The first class of barriers represents pipe diffusion along the dislocation line, also reported in [47]. The second class barrier represents the energy barrier for H to leave the dislocation core towards bulk W. As can be seen from the figure, the in-core (orange) migration barriers are almost three times lower than the barriers for leaving the dislocation core (green, purple). Moreover, the value for the migration barrier of 0.05 eV is significantly lower than H bulk migration barrier of 0.25 eV [20][21][22][23] suggesting pipe diffusion along the dislocation line is favorable once an H atom becomes attached to a dislocation core. A similar but less pronounced effect was found in Ref. [47] using pure DFT simulation with a periodic quadrupole cell.

E. Screw dislocation glide in the presence of H

Our observation from Figs. 4(c) and 4(d) shows that adding an H atom shifts the stable dislocation core towards the splitcore configuration. This core configuration corresponds to a saddle point for the dislocation glide in pure W (see Fig. 5), thus it is interesting to investigate a possible effect on dislocation glide mechanism. We carried out NEB calculations using relaxed configurations with H attached to the dislocation core as initial and final images, using a number of possible combinations of initial and final positions. First we looked at a migration barrier when the initial and final structure is FIG. 5. Comparison of the screw dislocation glide barrier in pure W (blue line and circles, reproduced from Fig. 2) and in the presence of H atoms at the core (orange line and triangles). Blue-edged insets show differential displacement map, core position, and MEP for initial, final, and saddle-point configurations for the glide in pure W. Orange-edged insets show the same, together with H position for the glide in the presence of H. not affected by the H atom shown in Fig. 4(b). Here the NEB calculations failed to converge to a reasonable reaction path resulting in unrealistic core MEPs with energy differences along the path larger than 0.3 eV. A possible explanation is that the configuration when both dislocation core and H atom are situated in the downward-pointing triangle of W atoms close to the hard-core configuration [see Fig. 1(e)] is highly unstable. Indeed, the configurations shown in Figs. 4(c) and 4(d) demonstrate that the dislocation core remains within the initial upward-pointing triangle of W atoms after relaxation. All calculations with reaction paths passing close to the hard core failed to converge resulting in barriers larger than 1.0 eV.

The results of NEB calculations for the glide in the presence of H are shown in Fig. 5 with an orange line and are compared to the results for the glide in pure W shown with the blue line (reproduced from Fig. 2). The orange-and blue-edged insets in Fig. 5 show the differential displacement maps and core position together with H positions corresponding to initial, final, and saddle points of the glide barriers. These snapshots demonstrate that the reaction path does not involve H atoms positioned in the adjacent downwardpointing triangle of W atoms.

We find that considering the relevant dislocation core configurations helps to find a physical interpretation for the MEP trajectory. As a further example, the lower orangeedged insets in Fig. 5 demonstrate that in the presence of H, glide occurs between two configurations with core structures close to the split-core configuration. These configurations are similar to the saddle point configuration for the glide in pure W shown on the central blue-edged inset. At the same time, in the presence of H the saddle point shifts to an easy-core configuration (central orange-edged inset), identical to the initial and final configurations for the glide in pure tungsten (first and last blue-edged insets). The height of the barrier is slightly higher when H is present in the material, however, this difference is not significant when compared with our estimated error bars. The presence of H also affects the shape of the MEP, which flattens near the saddle point.

IV. DISCUSSION

A. Comparison to elasticity theory

We have calculated the point defect tensor P H ∈ R 3×3 for the H defect using the method described in Ref. [62]. To a high degree of accuracy we found that P H = P H I 3 , where P H = 5.67 eV. Using the strain field given by anisotropic elasticity theory (r) at a position r away from the dislocation core, the elastic estimation of the interaction energy is obtained as E el (r) = P H Tr (r).

(

) 4
We note that in isotropic elasticity theory Tr (r) = 0 for screw dislocations, thus predicting E el (r) = 0; even when accounting for elastic anisotropy, the predicted interaction energy is still very weak outside of the core region, where elasticity theory is expected to be valid. In Fig. 6 we calculate the predicted change in binding energy for all H positions considered and compare these to the results from force integration. Matching the energy differences furthest from the core, we see reasonable agreement up to the first interpolation point then a significant deviation. This is to be expected as elasticity theory is not able to capture core strain fields or migration barriers.

B. Comparison with experiments

Contamination of tungsten with hydrogen has been studied experimentally. However, the main focus of those studies are the reaction of the material to the heat loads and thermal shock [START_REF] Clark | Nuclear Fusion Research: Understanding Plasma-Surface Interactions[END_REF][START_REF] Wirtz | [END_REF][5] and H retention [16], as well as interrelations between these phenomena. To fully elucidate the implications of the energy barriers found in this work with experimental data would require mesoscale simulations such as cluster dynamics [63,64], reaction rate theory [65,66], or kinetic Monte Carlo [67,68]. However, these simulations must also account for all other known processes involving H in W, including segregation to void and other interstitial clusters, which is beyond the scope of the current contribution. We therefore leave rigorous parametrization of a full mesoscale model for future work.

V. CONCLUSION

We have carried out QM/MM calculations of the structure and energetics of screw dislocations in tungsten, both with and without the presence of hydrogen. In pure tungsten, our work closely agrees with previously reported results using a full DFT description within a periodic quadrupole unit cell. Given the very small ∼100 meV energy barriers involved, this result provides compelling validation of our QM/MM virtual work approach. A further advantage of our approach is that an error bar on the output quantity of interest can be estimated; here these are found to be of the order of 10 meV, comparable to the accuracy of the DFT calculation itself.

When attached to a dislocation line, an H atom shifts the most stable dislocation core structure from easy to split-core configuration leading to a corresponding change in the dislocation glide MEP without affecting the height of the energy barrier. We anticipate that these structural rearrangements will have a significant effect on double-kink nucleation, which must be understood with chemical accuracy to treat urgent challenges in fusion materials science.

We would like to note that in principle it is possible to achieve similar results with a full DFT calculation by deco-rating both dislocation cores with H in a quadrupole cell in a similar way it has been done for carbon impurities in iron [14,15] or oxygen in tungsten [69]. However, in this case it is required to estimate subtle effects of all the uncertainties related to the geometry of the cell on the final results. The problem becomes even more pronounced if we think about extending the study towards larger defects such as impurity clusters and/or vacancy clusters. Our QM/MM approach significantly simplifies the simulation setup.

Finally, we emphasise that the QM/MM framework demonstrated here is able to treat dislocations with significant prismatic character (e.g., edge dislocations) that have much stronger elastic binding with interstitial defects such as H and He but cannot be contained in the small periodic supercells available to fully DFT simulations. Moreover, it is possible to model realistic 3D dislocation kink structures by extending the MM region in the direction of the Burgers vector; however, it requires a reliable empirical force field. Our methodology will thus allow investigations with ab initio accuracy ( 10 meV) into important solute-dislocation interaction phenomena to provide quantitative energetics. Important fusion-relevant examples include the experimentally observed impurity pinning of self-interstitial atom palettes [70] and the novel pipe diffusion behavior in M111 mixed character dislocations [71]. However, we believe that these applications are beyond the scope of the current paper. The atomic configurations created during this research are openly available from the University of Warwick Research Portal at http://wrap.warwick.ac.uk/132290/.

FIG. 1 .

 1 FIG. 1. Visualizations of a fully periodic 135-atom quadrupole supercell (a) and a 237-atom cluster supercell (d), with atoms colored by displacement along 111 direction. The purple dashed circles show the radius of the unconstrained region for the cluster cell (a) and the circle with a diameter equal to the distance between two dislocations with opposite Burgers vectors for the quadrupole cell (d). Two cells were considered equivalent if the sizes of these two regions were equal (see Sec. III A). The red triangles in (a), (d), and (e) show two equivalent easy-core positions. Solid and empty triangles show initial and final core positions used for NEB calculation of the dislocation glide MEP with a red dashed line corresponding to the initial linear guess for the MEP. (e) Differential displacement map corresponding to the initial easy-core configuration. A red star and red cross show hard-core and split-core positions, respectively. The structure of a perfect bcc crystal in the (111) plane and (b) in the (110) plane (c). Left part of (f) shows the same bcc structure as (c), with colored arrows showing the 111 displacement for the easy core. Middle part of (f) shows resulting easy-core structure. Right part of (f) shows hard-core structure, which can be obtained by reversing the displacement. Red, green, and blue colors of W atoms in (b), (c), (e), and (f) show three nonequivalent atomic planes along 111 direction in bcc structure. Note change of ordering of W atoms along 111 direction from red-green-blue for ideal bcc structure to green-red-blue for easy core and the single horizontal red-green-blue plane for the hard core (f).

FIG. 4 .

 4 FIG. 4. (a) Set of initial H positions at a dislocation core for relaxation. Two sets of simulations were performed: with initial glide core position (brown triangle) and final glide core position (orange triangle). Relaxed configurations with H atom attached to the core shown in (f) and (g). (b), (c), and (d) Examples of corresponding differential displacement maps and core positions for different types of positions. The red dashed line in (b), (c), and (d) shows the core glide trajectory in pure W for comparison. (e) H migration barriers in the vicinity of screw dislocation core. Dashed lines in (f) and (g) show H migration trajectories corresponding to the barriers in (e).

  (g)] core form compact clusters in the 111 direction, prohibiting migration along the dislocation line through these positions. Thus, two classes of H migration barriers were investigated: between orange positions along the dislocation line [orange dashed lines in Figs. 4(f) and 4(g)] and starting at an orange position inside the core and finishing outside the dislocation core triangle at either brown positions [purple dashed line in Figs. 4(f) and 4(g)] or cyan position [green dashed line in Figs. 4(f) and 4(g)].

FIG. 6 .

 6 FIG. 6. (a) QM/MM and anisotropic elasticity theory MEPs for H migration from core (NEB coordinate 0) to two different near-core sites (coordinate 1). (b) Map of interaction energy predicted by anisotropic elasticity theory, with the migration paths overlaid.

ACKNOWLEDGMENTS

P.G. and J.R.K. acknowledge funding from the EPSRC under Grants No. EP/P002188/1, No. EP/R012474/1, and No. EP/R043612/1. Additional support was provided by the Leverhulme Trust under Grant RPG-2017-191. We are grateful to the UK Materials and Molecular Modelling Hub for computational resources, which is partially funded by EPSRC under Grant EP/P020194/1. We are grateful for computational support from the UK national high performance computing service, ARCHER, for which access was obtained via the UKCP consortium and funded by EPSRC grant reference EP/P022065/1. Additional computing facilities were provided by the Scientific Computing Research Technology Platform of the University of Warwick.


For many, using together the words Public and Permissioned when referring to a blockchain network, as in Public-Permissioned Blockchain, is a misnomer. Until now the words Public and Permissioned have been used as opposites, where Permissioned is seen as synonymous with Private. However, a new kind of blockchain network is emerging, being pioneered by Alastria. Public-Permissioned blockchain networks bring a lot of value to the digitization of the productive economy of a country or a region like the European Union, complementing -but not replacing -the other types of networks, namely Public-Permissionless and Private-Permissioned (aka Private Consortiums).

In this context Blockchain networks are socio-technical systems that, given their inherent difficulties to scale in different dimensions, can be considered as a kind of good with some scarce resources which require a proper governance model to avoid resource abuse and depletion.

Two classical models to manage scarce resources are the state (government controlled) and the market (managed as private goods subject to offer and demand).

We explore in this document a third way to manage that type of resorces, the Common-Pool Resources (CPR) model.

Introduction to Public-Permissioned blockchain networks

A Public-Permissioned blockchain network is a new type of network filling the gap between the Public-Permissionless networks (like Bitcoin or Ethereum) and the Private Consortium networks.

See Figure 1 for a representation of this term, which is based on the taxonomy being specified in the governance group of ISO TC 307.

 We use in this document the word blockchain in a generic sense, including a DLT. A Public-Permissioned blockchain network combines the permissioning from private consortiums with a decentralized governance model, trying to achieve the best properties of both models. This is done in order to obtain features required for the implementation of many important use cases that can not fit in any of the other two models.

It is important to understand that the above taxonomy does not apply to software (eg. Geth, Besu, Fabric, Corda, etc.) but to an actual operating network implemented with that software, and more specifically to its governance model. The taxonomy is very simple and so it can not include many nuances affecting different aspects related to the same concepts in different real-world implementations. However, this simplicity is very useful to discuss the main properties of the model, at least when comparing it to Public-Permissionless and Consortium networks.

The main aspects considered in the taxonomy are permissioning and governance model.

Permissioning

The permissioning feature allows us to bring some benefits from the Consortium arena:

• Technical benefits: we can use consensus algorithms better fitted for permissioned blockchains and which provide better performance and are more energy-efficient.

• Compliance benefits: participating nodes have well known real-world identities, facilitating compliance with regulations like GDPR or AML, especially if their location is restricted to a region with a common regulatory system.

• Operational benefits: easier to manage and implement crisis management.

• Economic benefits: the network does not require a cryptocurrency embedded in the consensus algorithm in order to incentivize miners. This makes the operation of the network very similar to the operation of any other infrastructure. The transaction costs for the participants can be made strictly proportional to the cost of operating the infrastructure, so they are very stable and do not depend on speculation in the market of an embedded cryptocurrency.

Decentralized governance model

On the other hand, having a decentralized and transparent governance model is critical for improving the level of trust and confidence in the network, especially for external users that do not participate directly (e.g. citizens and businesses who do not run a node), but instead access services indirectly via some other entity.

The concept of combining permissioning with a decentralized governance model is is represented in Figure 2.

Public as in Public Services

The word Public has in this context a different meaning than the one used (improperly) until now.

A Public-Permissioned network is public in much the same way as most essential public services of a country like public health, public education or public roads. Using the analogy of those public services, we could say that those services are permissioned in the sense that citizens and entities must identify themselves. However, there are no artificial barriers of entry for citizens in order to access public health or public education. In the case of public roads, the criteria are more stringent but, in any case, they are objective and transparent: any car using the public roads has to display very clearly the license plate, which is sort of the identity of the car. Furthermore, anyone can drive a car in the public roads, provided she has a valid driver's license.

There are public goods that do not require "permissioning" in order to use them, but when those goods are scarce and subject to depletion if abused, then permissioning is required in order to ensure inclusion, fair access and usage, and sustainability of the resource.

Permissioning and Decentralized Governance Model

It can be argued that requiring the network to be permissioned reduces decentralization and increases the level of trust required by participants in the network. Indeed, permissioning was initially applied in the blockchain space to create Private Consortium blockchain networks, where permissioning is used not only to verify the identities of participants, but also to create barriers of entry to external participants like for example to avoid competitors from entering the Consortium. Additionally, because the number of participants is low and typically from the same sector (eg. banks with banks), implementing the same use-case(eg. logistics) and normally highly regulated, the governance model of the Consortium is centralized. This is normally not a problem in those consortiums because the objective normally is to increase efficiency via a "virtual" shared database without requiring that the database be operated by a central entity.

This explains why many people associate permissioning with centralized and non-inclusive governance models in the blockchain arena.

In order to merit the name of Public-Permissioned, a special Governance Model is required in order to ensure inclusion, fair access and usage and sustainability of the network, and at the same time ensure that it is not controlled by a single entity or a cartel of entities. More concretely, this blockchain network could be considered as a new type of infrastructure with the following principles [Navarro2018]:

Non-discriminatory and open access

Access is non-discriminatory even if it is not free, because pricing is determined using transparent mechanisms, typically cost-oriented. Access is open because everybody has the right to join and use the infrastructure according to the access rules.

Open participation

Everybody has the right to join the community to participate in the construction, operation, provision and governance of the infrastructure. The network should be inclusive, open to participation of any entity independent of its size or sector of activity. Such a governance model is critical in providing the required level of trust and confidence in the network from all participants. Running a network that is permissioned and at the same time public (in the sense of inclusive) and sustainable, presents many challenges that have to be addressed explicitly and proactively and are specific to this type of network and which do not appear in either Public-Permissionless or Consortium networks.

There are several specific instances of the governance model that can achieve these objectives, but in this document we focus on a specific governance model which arises from considering the blockchain network as a Common-Pool Resource (CPR) [Ostrom1990].

The Position of Alastria in the Trust Continuum

Even though in practice Public-Permissionless networks are more centralized than what they are normally assumed to be, from a theoretical point of view Alastria (and in general Public-Permissioned networks) can be positioned in the so-called Trust Continuum as depicted in the following figures:

The blockchain as a Common-Pool Resource (CPR)

As exemplified in the Blockchain trilemma [Buterin2014], blockchain networks can be considered as a technical resource that can not be scaled easily. If we consider for example the throughput (number of transactions per unit of time that the network can process globally for all users), we can see that with a given blockchain technology this resource does not scale easily. This is in contrast with other infrastructures like the Internet backbone, where the bandwidth can be scaled by adding communication lines in parallel. Or in traditional applications, adding more machines or bigger ones can scale the number of transactions per second.

In this sense, a Public-Permissioned blockchain network can be considered as a communal resource like the ones described by Elinor Ostrom, Nobel Prize in Economics 2009 [Ostrom1990], where the resource to be managed is the transactional capability of the network, making sure at the same time that the network is safe and always available. Ostrom This governance model is different from the two standard ways of managing private goods or public goods and is the most efficient for goods that have the property of subtractability, like private goods, but they share the difficulty of exclusion with public goods. This concept is represented in Figure 5.

From natural resources to socio-technical infrastructures

Until now, the CPR model has been applied almost exclusively to natural resources, as fisheries, forests or irrigation systems. And in most cases, there are fundamental limitations in the size or scale of those resources in order to be able to apply effectively the CPR model (essentially, having to do with the required flow of information and trust. These limitations in geographic distribution of resources appear also when applied to clasical technical infrastructures (that is, non-blockchain ones), because it is very difficult to achieve the required level of trust among participants that is required for the successful implementation of the CPR model and rules. However, a unique property of a blockchain network with respect to all other Common-Pool Resources (natural resources or classical technical infrastructures) is the ability to encode some governance rules using the programmable nature of the blockchain, making the enforcement of the rules not only transparent but also automatic and immutable (actually, the rules can be modified with the consensus of the community; the word immutable is used to indicate that nobody can unilaterally modify them). This is what we call "on-chain governance".

The literature has a small number of documents describing governance models and their automated implementation based on the blockchain [DavidsonEtAl2016], but in general they are at the application (dApp) level, and they assume the existence of a blockchain network with the appropriate characteristics [RozasEtAl2018]. In this document we are instead interested on the governance model required for the management and operation of a blockchain network infrastructure which is Public-Permissioned, according to the definition above. That is, we focus on the governance of the blockchain instead of the governance based on the blockchain. And specifically, on the on-chain governance of the blockchain network infrastructure in contrast to the off-chain governance processes, even though we have to consider the whole governance process in order to derive the properties of the blockchain infrastructure.

The eight principles for managing a Commons

Before entering into the specifics of blockchain, let's summarize the eight principles for efficiently managing Common-Pool Resources, as described in [Ostrom1990]:

Principle Description

1.a User boundaries

Clear boundaries between legitimate users and nonusers must be clearly defined.

1.b Resource boundaries

Clear boundaries are present that define a resource system and separate it from the larger surrounding environment.

2.a Congruence with local conditions

Appropriation and provision rules are congruent with local social and environmental conditions.

2.b Appropriation and provision

The benefits obtained by users from a commonpool resource (CPR), as determined by appropriation rules, are proportional to the amount of inputs required in the form of labor, material, or money, as determined by provision rules.

Collective-choice arrangements

Most individuals affected by the operational rules can participate in modifying the operational rules.

4.a Monitoring users

Monitors who are accountable to the users monitor the appropriation and provision levels of the users.

4.b Monitoring the resource

Monitors who are accountable to the users monitor the condition of the resource.

Nested enterprises

When the system is very complex, appropriation, provision, monitoring, enforcement, conflict resolution, and governance activities are organized in multiple layers of nested enterprises.

The CPR principles applied to a blockchain

When applying Ostrom's CPR principles to a Public-Permissioned blockchain network, we see that there is a potential to automate the execution and enforcement of some of the principles in a way which is impossible for any other type of CPR nlike natural resources. A summary can be found in the following table.

Principle Description

1.a User boundaries

Self-Sovereign Identities (associated to legal identities)

both for natural and juridical persons.

1.b Resource boundaries

Consensus algorithms in Public-Permissioned blockchains

A blockchain is an append-only, sequential, linked, data structure replicated over a peer-to-peer network, where transactions are stored and grouped to form new blocks. Participants of the network (peers) achieve distributed consensus on the validity of and the ordering of transactions.

Consensus is a set of rules and procedures that allow a blockchain system to maintain and update the distributed ledger and to ensure the trustworthiness of the records in the ledger. This trustworthiness -often referred to as safety -is the systems' reliability, authenticity, and accuracy. For a Public-Permissioned network, the permissioning of nodes allows for the usage of consensus algorithms other than PoW or PoS, taking advantage of the well-known identities of the nodes executing the consensus algorithm.

As mentioned above, the consensus algorithm is a very important component of a blockchain network, affecting many aspects of the system like scalability, sustainability and even the governance of the technical platform:

• The efficiency and transaction throughput that can be achieved are much greater than those obtained in public anonymous networks.

• For some consensus algorithms transaction finality is deterministic which is a requirement for facilitating many legal transactions in the real-world productive economy.

• The proper governance of the nodes participating in the consensus algorithm can have a critical influence in improving the level of trust and confidence in the network.

In the research literature there are several surveys and detailed analyses of the different types of consensus algorithms for blockchain networks and their properties. See for example

[CachinVukolic2017], [NguyenKim2018] or even for specialized fields like IoT [MackenzieEtAl2018].

In this document we will focus only on the properties of blockchain consensus algorithms which are most suitable for the type of use cases that will be initially implemented in Public-Permissioned networks.

Some terminology

In a permissioned transaction ledger, in general only a limited set of nodes participate in the execution of the consensus algorithm. In order to maintain generality and independence from specific blockchain technology, we will use the term consensus nodes to refer to the set of nodes that execute the consensus algorithm. It should be noted that in some implementations the consensus nodes are called validator nodes and in other environments ordering nodes.

With this terminology, we can define two main roles of participants in a permissioned blockchain network:

Consensus nodes

are responsible for the execution of the consensus algorithm

Regular nodes

perform the maintenance of a local copy of the blockchain using the blocks generated from the set of consensus nodes.

In this discussion, in order to determine the position of a transaction within the transaction ledger we use a pair (h, i), where h is the height of the block including the transaction, and i is the position of the transaction within the block.

System model

Any discussion about a consensus algorithm assumes some properties of the network and the threat model to be true.

Network model

As is very common in related literature, we assume an eventually asynchronous network.

Failure model

We consider a Byzantine failure mode system, where Byzantine nodes can behave arbitrarily. In contrast, honest nodes never diverge from the protocol definition.

Consensus properties

The properties required from the consensus algorithm for Public-Permissioned are the following.

Proven in the field, peer-reviewed and its behaviour formally analyzed, especially with respect to resiliency

As Cachin [Cachin2017] states:

Over the recent years countless proposals for new features in distributed ledger systems and completely new blockchain protocols have appeared.

Most of them come without formal expression of their trust assumption and security model.

Instead, broad agreement on trust assumptions, security models, formal reasoning methods, and protocol goals is needed. Developers, investors, and users in the industry should look towards the established scientific methodology in cryptography and security with building trustworthy systems, before they entrust financial value to new protocols.

In other words, a Public-Permissioned network should take a somewhat conservative approach to consensus algorithm selection, and accept only the most robust systems available which are also compatible with the other project objectives. More important than the maturity of the software implementation is that the underlying consensus algorithm has been peer-reviewed by the scientific community and has been formally proven to work according to specifications.

Software bugs can be detected and fixed, but algorithm bugs can be extremely hard and costly to fix, if not impossible to fix if further theoretical analysis proves that they are not correct. Formal proofs of algorithm correctness is a critical requirement of any consensus algorithm that a Public-Permissioned blockchain network uses.

Deterministic (strong transaction finality)

Transaction finality is an indication of whether a transaction is considered final once it has been added to the blockchain. Once confirmed, transaction finality refers to the guarantee that a past transaction can never be changed.

In blockchain systems, all transactions are considered immutable. This being said, most blockchain systems only give probabilistic transaction finality which states that transactions are not immediately final, but become final eventually.

For example, in PoW temporary forks and chain reorganizations are allowed during normal operation, because more than one miner can solve the cryptographic puzzle at the same time, and generate different blocks at the same time. In this case, we say that the transaction finality is Finally, there are consensus algorithms which are designed from the ground up for strong transaction finality, like IBFT (Quorum, Besu) or BFT-SMaRt (Corda). Formal proof of strong transaction finality in IBFT can be found later in this document.

A Public-Permissioned network requires a consensus protocol with strong transaction finality.

Resiliency-optimal

The algorithm used should be resiliency-optimal, meaning that the resources required by the algorithm to achieve the stated safety guarantees are equal to the theoretical minimum requirement. In the case of an eventually synchronous network with Byzantine actors this means that the relationship of the total number of consensus nodes n with respect to the maximum tolerated byzantine ones f is:

n = 3*f + 1
This lower limit has been proven by the scientific community to be the theoretical minimum number of nodes needed to provide Byzantine resilience in eventually asynchronous networks, like the one we are assuming for a Public-Permissioned network.

Latency-optimal: efficiency of communication among consensus nodes

There are many factors that can affect the efficiency and performance of a consensus algorithm.

However, one of the most critical factors for a resilient Byzantine consensus, especially on a widearea network, is the total number of messages exchanged among the consensus nodes in order to achieve agreement.

It is known that deterministic resiliency-optimal Byzantine consensus protocols cannot use less than three communication steps [DuttaEtAl2005], [MartinAlvisi2006]. This means that latencyoptimal protocols for BFT consensus that use 3f + 1 nodes to tolerate f Byzantine faults (e.g., PBFT

[CastroLiskov2002]) require at least three communication steps for the consensus (without taking into account the messages required for the client to inject the transaction into the network, the propagation of the transaction across the network and the reception of the reply).

Energy efficient, computationally-optional and sustainable

Taking advantage of the permissioning of nodes and avoiding the excessive computation required for algorithms like PoW. The energy consumption required should be reasonable for the transaction workload that the network supports.

Transparent execution (efficient monitoring by all users)

There should be enough information about real-time consensus algorithm execution which is visible to all participantes in the network. In many implementations, if a consensus node behaves in a Byzantine way, the consensus algorithm continues working keeping the network safe, that is, the consensus algorithm is "masking" the bad behaviour. In EBSI, however, it is not enough to mask the error (or byzantine behaviour) but instead it should be reported in a way that all network participants can be aware of that specific node bad behaviour.

Enable accountability (responsibility) of consensus nodes

Requires unforgeable digital signatures of messages and seals during the process of consensus. Any action performed by the consensus nodes can not be denied if an ex-post analysis is performed.

Auditability of the consensus algorithm execution is a required property for proper accountability of execution by each consensus node. In other to maximise throughput, many proposed BFT consensus implementations eliminate digital signing of messages exchanged across consensus nodes. Even though many still use different techniques for message authentication, they may prove extremely difficult to be audited ex-post. We believe that digital signatures where the public keys of each consensus node is well-known by the participants is the most simple and robust method to provide audibility and accountability for the proper behaviour of consensus nodes.

Fair

Each member of the network should be able to run its own node or set of nodes. It is also understood that the members can participate if they wish in the execution of the consensus algorithm by operating a consensus node. With PoW, the probability of a node to have the opportunity to create a block (and so decide the transactions included in it) depends on the total computational power that a given entity has (the so-called hashing power). In addition, PoW opens the possibility of several nodes collaborating and joining forces to achieve enough computational power to have a higher probability of creating blocks (mining pools). This is clearly not "fair" because the mechanism favours those with more power. As far as possible, the consensus algorithm should allow that anybody can participate in consensus, subject to some fair and transparent rules, and not only the most powerful.

The Consensus algorithm and On-chain Governance

The consensus algorithm is one of the most important components of a blockchain network, affecting many aspects of the system like scalability, sustainability and even to the governance of the technical platform. In addition, governance of the consensus set is critical to the level of trust that this network has for the rest of the participants (the so-called ``regular nodes'').

The current Alastria network, Red T, uses Istanbul Byzantine Fault Tolerance (IBFT) as consensus algorithm, which belongs to a family of PBFT consensus algorithms sharing many of the properties heavily discussed and formally proven during the last decades [CastroLiskov1999], and its properties are very well known.

When applied to the blockchain, the PBFT variants comply with the Robustness property

[Saltini2019] when the maximum number of Byzantine validator nodes t follows the well-known relationship with n, the total number of validator nodes:

n = 3t + 1.
However, standard implementations of PBFT and in particular IBFT, tend to focus on masking failures. That is, they make failures transparent to the users, but they do not manage those failures in a way that proactive or reactive measures can be taken to ensure the long-term health of the network. This is the reason why Alastria is implementing a set of tools surrounding the base IBFT consensus algorithm, which together with complementary off-chain governance processes allow the realization of the the principles of the governance of the blockchain as a Common-Pool Resource.

An example of on-chain governance of the Consensus set

The subject is too complex to be thoroughly treated in a reduced space, but the following figure describes a summary of an example of on-chain governance of the blockchain network. The following aspects can be observed:

• This could be considered a generalization of the proactive recovery mechanism described in Even though it is not shown in the figure, in addition to the automated reaction, the events are reported in a way that any participant in the blockchain network (not just the consensus nodes). This is required to implement the high levels of transparency and collaborative monitoring that are required for the effective management of CPR resources.

• Depending on the severity of the fault detected (crash or byzantine), the system reacts automatically applying a graduated set of sanctions, as per the principle 5 of CPR governance.

For example, when the fault is byzantine, the consensus node affected is put in quarantine, effectively stopping the node from participating in the consensus execution. If the owner is willing to continue participating, a manual process (off-chain governance) is required, with sufficient explanation and justification to the other members in order to be accepted again.

Figure 1 .

 1 Figure 1. Blockchain taxonomy

Figure 2 .

 2 Figure 2. Best of both worlds

Figure 3 .

 3 Figure 3. A country blockchain network

  's studies focused on how communities manage to successfully govern communal resources by revisiting Hardin's influential article on The tragedy of the commons [Hardin1968].

Figure 5 .

 5 Figure 5. Common-Pool Resources

  Appropriators who violate operational rules are likely to be assessed graduated sanctions (depending on the seriousness and the context of the offense) by other appropriators, by officials accountable to the appropriators, or by both. 6 Conflict-resolution mechanisms Appropriators and their officials have rapid access to low-cost local arenas to resolve conflicts among appropriators or between appropriators and officials. appropriators to devise their own institutions are not challenged by external governmental authorities.

  Decentralized permissioning of nodes via Smart Contracts connected to Trusted Third Parties (TTPs) and other official Registries and Regulatory bodies in the country (eg. the Spanish Business Registry for normal businesses, or the Ministry of Education for Universities).4.a Monitoring users Using Gas to control resource usage by accounts (selfmonitoring).Need transaction origin traceability (enode that injected tx) 4.b Monitoring the resource Monitor the Consensus execution (eg. report detectable Crash and Byzantine behavior) in a transparent way 5 Graduated sanctions Automated proactive and reactive management of the Consensus set via Smart Contracts complemented with off-chain sanctioning. level of the operation of the network, the same mechanisms used for monitoring and graduated sanctions are used for automated arbitration of conflicts arising among members (eg. non-compliance to the Service Level Objectives defined in the operational policies of the network).

  Consensus mechanisms are implementations by which consensus is achieved in blockchain systems. There are many alternative consensus mechanisms in use in different blockchain systems. Examples of consensus mechanisms include Proof-of-Work, Proof-of-Stake, Delegated Proof-of-Stake, Paxos, Practical Byzantine Fault Tolerance, Proof-of-Authority, Proof-of-Burn, Proof-of-Capacity, and Proof-of-Ownership.

  probabilistic and clients will have to wait until several confirmations are submitted and confirmed before they can consider the probability of transactions being reverted is sufficiently low for the application domain being implemented. There are other consensus algorithms, that are not probabilistic during normal operation (no Byzantine attacker), but because they are still longer chain wins, an attacker with enough resources can rewrite history. These algorithms are called Deterministic Longest-Chain Protocols in [Shi2018]. PoA algorithms like Aura (Parity) and Clique (Ethereum) are two notable examples of these "longer chain wins" algorithms. The transaction finality assurances of these algorithms are higher that in PoW, but still they do not have full transaction finality, what we call strong transaction finality.

Figure 6 .

 6 Figure 6. On-chain governance of Consensus set

•

  The consensus nodes in the Active state (that is, executing the base IBFT algorithm) are being monitored, as per principle 4.b of the CPR governance principles • The events signaling different types of faults are used for the reactive governance of the nodes.