Inspiration
We started out building drones for spotting wildfires. Along the way we kept running into the same weak spot: every drone needed a signal. As soon as it lost contact with the base, it stopped being useful.
Drones are needed most in valleys, forests, flood zones and disaster areas, which is exactly where radio fails. A search that stalls when the link drops stalls when it matters most. So when we read the Neptune North challenge, "design a system where multiple agents keep working toward a shared goal, even when communication fails", we threw out our old design and started again. The result is Vanta.
What it does
Ten drones search a 1.3 km × 1 km area for eight missing people. Partway through, the radios get jammed, a ridge splits the swarm in two, the base station goes off the air, and drones crash. Vanta's drones never stop searching and never wait for orders. When they get back in contact, they bring everything they learned back into agreement in a single exchange.
A live dashboard runs Vanta side by side with a conventional central command swarm on the same mission, with the same faults at the same moment, so you can watch the difference.
How we built it
Every drone carries its own copy of the mission. We call it a notebook, and it has four parts:
| Part | What it records | How two copies merge |
|---|---|---|
| Searched map | a 64 × 48 grid of 20 m cells | union |
| Sector leases | who is searching which sector, until when | agreed winner |
| Last sightings | when each drone was last heard of | latest |
| Survivors | where each person was found, and by whom | earliest |
Each part is a state-based CRDT. The merge $\sqcup$ is commutative, associative and idempotent:
$$ a \sqcup b = b \sqcup a, \qquad (a \sqcup b) \sqcup c = a \sqcup (b \sqcup c), \qquad a \sqcup a = a $$
That means it doesn't matter what order messages arrive in, how late they are, or whether they're lost or repeated: every drone that has heard the same news ends up with the same picture. The searched map, for example, is just a bitwise OR of 3,072-bit maps:
$$ C_{\text{merged}} = C_a \lor C_b $$
and a survivor's record keeps the earliest find, $\min\big((t_a, \text{id}_a), (t_b, \text{id}_b)\big)$.
Gossip, not orders. Every second, each drone broadcasts its notebook to anyone within radio range (320 m between drones, 700 m to the base) and merges whatever it hears. News hops from drone to drone, so information reaches the base even from drones that are out of its range.
Leases, not assignments. A drone claims a sector with a lease lasting $T_{\text{lease}} = 20\,\text{s}$ and keeps renewing it while it works. If a drone crashes, its lease expires once
$$ t_{\text{now}} > t_{\text{last renewal}} + T_{\text{lease}} $$
and another drone takes over the half-searched sector. Nobody has to declare the drone dead. If two cut-off drones grab the same sector, both apply the same ordering when they meet again: a takeover beats the claim it replaced, then the earlier claim wins, then the lower drone ID. Both reach the same answer independently, and the loser moves on.
The stack:
- Simulator in pure Python 3.10, standard library only: 1-second ticks, drones flying at 5 m/s, a lossy range-limited radio, and the faults (jamming, ridge split, base down, radio shadows, crashes).
- Three strategies: Vanta, central command, and no coordination at all.
- Benchmark: 7 scenarios × 10 seeds, run in parallel, written to a results table.
- Dashboard: a small built-in HTTP server and a plain JavaScript canvas. You can break things live and switch the map to show what any single drone believes.
- Tests: 15 unit tests, including random checks that the merge rules hold.
- Explainer video: rendered frame by frame from real simulation runs.
Results
| Scenario | Vanta | Central command |
|---|---|---|
| Clear skies | 13.5 min | 14.2 min |
| Total blackout (3 min) | 15.3 min | 17.1 min |
| Radio shadows + 30% message loss | 13.8 min | 17.5 min |
| Base station down 15 min | 16.0 min | 28.7 min |
| The gauntlet (everything at once) | 16.1 min | 25.8 min |
Times are medians over 10 runs. Vanta completed all 70 missions. With the base down, Vanta's drones had searched every cell by 11.8 minutes, but couldn't report until the base came back at 16. In the gauntlet, Vanta's drones spent about 10× less time sitting idle.
Challenges we ran into
- Making the rival fair. Our first central command swarm never finished: drones that lost contact simply waited forever. That made Vanta look good, but it was a straw man. We gave central command a sensible rule (after 30 s without the base, fly back toward it to reconnect). Now it's within a minute of Vanta on clear days, and the comparison means something.
- A tie that broke the maths. The random tests caught a subtle bug: when two "last seen" records had the same timestamp, the merge gave different answers depending on order. That breaks commutativity, so drones could disagree forever. We fixed it by comparing the whole record, not just the time.
- Double searching in the dark. Drones that can't talk tend to pick the same sectors. Early versions wasted around 15% of their effort searching areas twice during blackouts. A simple territory rule, steering away from sectors next to another drone's recent work, brought that down to 7–9%.
- Ordering takeovers. A takeover has to beat the claim it replaced, otherwise a dead drone's old lease can win back its sector. We added an epoch number to each claim that goes up on every takeover.
What we learned
- Design for disconnection as the normal case, not as an error. Once losing contact is expected, a lot of complexity disappears: no leader election and no resync protocol, just merge.
- CRDTs are a great fit for robot swarms. Getting the merge rules right up front means correctness doesn't depend on the network behaving.
- A fair baseline matters. Beating a straw man proves nothing. The honest result, that Vanta pays a little extra double searching in return for never stalling, is more convincing.
- Test the maths, not just the code. Random tests of the merge rules found a bug that no hand-written example would have.
What's next
Vanta is a simulation: it doesn't model wind, obstacles or batteries. Next we'd run it on real drones with cheap short-range radios, and talk to search and rescue and wildfire teams about trials. Because Vanta is software, it can run on drones teams already own, licensed per drone.
