Towards trustworthy Cyber-physical Production Systems: A dynamic agent accountability approach

1.1.Motivation

Customer satisfaction is one of the factors contributing to the success or failure of a business. From a general point of view, it derives directly from the requirements explicitly defined by the customer, but the creation of a supplementary added-value in the end-product (or service) can further increase it [2]. It is hard to quantify the effective ratio between identified and unidentified needs which together determine the overall customer satisfaction. An example could be long life products in which higher profits are driven by unique extras and luxury components. Imagine for instance modern cars with all the optional extras, hard to plan for every future situation, especially if one has never heard of those options before. There are also circumstances in which customers have only an abstract idea of their own requirements. In this sort of “elastic” scenarios we aim to show that the adoption of agent-based technology, in which the accountability of agents’ action is constantly re-evaluated, can lead to a higher level of customers’ satisfaction.

Nevertheless, reports on industrial deployment of agent-based systems indicate that, despite the strong academic and industrial involvement in this field, the full potential of agent technology has not been fully utilised, yet, and that not all of the developed agent-oriented concepts and techniques have been completely exploited in industrial practice [44,45]. This is mainly due (next to other key factors like design, technology, standardization, hardware, application and cost) to the insufficient level of “trust” in the full exploitation of the paradigm, as security and safety in manufacturing require that communication and interactions among the agents be secure and trustworthy [20]. Industry is in general “concerned” about risks related to MAS behaviours emerging without any central unit, and there are no formal algorithms or procedures guaranteeing that the distributed systems would behave as desired. The usual way to verify this is to apply simulation, but it is infeasible to simulate all possible, emerging configurations.

1.2.Contribution

With centralised control and in the absence of a thoughtful survey, unidentified requirements of the customer can remain unsatisfied [6]. Keeping in mind all of the resource and technological constraints while giving more freedom to the automatised shop-floor in adding extra, not ordered values (like features or even processes) can still keep the profit within acceptable margins but generate a considerable increase in the customer satisfaction. Giving too much freedom, on the contrary, can undermine production goals.

To this end we propose the Manufacturing Agent Accountability Framework (MAAF), whose fundamental elements can be listed as follows: (i) an agent accountability model, (ii) a dynamic authorization-based mechanism to convey agent accountability into actionable decisions by agents, and (iii) the Leaf Diagram (LD) for the representation and evaluation of deviations in agents behaviours from the expected ones in the manufacturing process. MAAF merges concepts of security, feasibility and trust into a single correlated dimension, which orchestrate limitations in agent behaviours at each production step and regulate them by means of a policy-based authorization middleware, whose rules are easily modifiable by the manufacturer.

MAAF is intended to represent a possible compromise between the rigidity of production expectations and the elasticity necessary for the exploitation of agent “liberty” in pursuing a higher level of intelligent collaborations. Trust is considered essential to make agent interactions effective, and the lack thereof, is a key challenge addressed in this work. MAAF introduces a dynamic accountability based approach, in which the behavioural model of collaborating agents is identified by agent goals’ trajectories and measured in terms of acceptable behavioural “distance” within so called Confidence Region (CR). It represents the space of additional resources and technology tolerance combination within which an agent can freely act according to its internal goals but pursuit, at the same time, its manufacturing commitments. Access to resources will be linked to the authorization profiles by dynamically catalyzing the effects of behaviours emerged within the CR into accountability auditing for the agent.

1.3.Paper outline

The rest of the manuscript is organised as follows: Section 2 investigates the existence of related works with respect to trustworthy distributed control and security. In Section 3 the MAAF is presented, highlighting the targeted manufacturing scenario and its requirements, and introducing the LD. In Section 4 outcomes of the MAAF realization and application to the use-case of interest are reported. The agent interactions, the policy-based simulation, the experimental setup are also discussed. Conclusions and future work close the paper.

2.1.Distributed control and agents

As mentioned before, distributed systems with an appropriate supervisory system can improve their overall performance over rigid hierarchical systems. A thorough overview of cooperative controls enumerates possibilities for production and logistics environments, addressing multiple shortcoming [29]. Technologies and applications presented in [30] emphasise a relatively low industrial acceptance because of the risk of consistent global operations and the difficulties deriving from legacy system integrations. In accordance with requirements from the production domain, agent-based manufacturing seems to be one of the most effective theories and modeling approaches for distributed production control [41]. Agents are defined in a manufacturing environment according to their ability to autonomously select appropriate settings and find their own strategies towards the production goals. The strength of MAS based organizations (societies) is that they enable the construction of very complex systems that are nonetheless efficient in the use of resources, highly resilient to disturbance (both internal and external), and adaptable to changes in the environment in which they exist [41]. Within a society, agents may dynamically create and change hierarchies although in agent-based manufacturing models four basic types of agents can initially be found: resource, order, product and staff agent, each one representing an important aspect of production processes [42].

Implementing architectures that analyse the behaviour of agents and, according to this analysis, deliver information can become an important component in decision making process [15]. MAS approach is suitable to support the current requirements for modern control systems in industrial domains, providing flexibility, robustness, scalability, adaptability, reconfigurability and productivity [21,38]. Works on the dynamics of industrial systems and supply chains have attempted to describe the networks of relationship that characterise contemporary businesses’ trading situations and internal functional structures [3,27]. Despite this apparent growth in interest in MAS from the manufacturing systems research community, it is clear that research has not yet been able to fully exploit the potential of MAS in the past decades. This is partially because of the difficulties in increasing the level of trust perceived in industry when dealing with autonomous intelligence, one of the major roadblocker for the current weak adoption of this technology in industry.

Trust management has been approached from two different perspectives: policy based trust and reputation based trust [5,11]. The policy based approach tries to describe trust using predefined rules while relying on strong cryptographic assurances found in security certificates. Reputation based approaches establish trust based on direct experiences, which might be shared through a community. Many reputation based trust evaluation models have been proposed and implemented in different areas [17,36,39] but most of them focused on the application of algorithms for trusters to model the trustworthiness of trustees in order to make effective decisions about which trustees to select. For this purpose, many reputation based trust evaluation models use third party information sources such as witnesses. Also in [4], after giving a comprehensive overview of trust evaluation models, the authors propose a scalable model to locate a set of witnesses and combine a suspension technique with reinforcement learning in order to improve the model responses to dynamic changes in the system.

The approach introduced in this paper, on the contrary, leverages a policy based trust management framework that extends the MAS paradigm with the enforcement of strong boundaries in which agents can freely exploit their intelligence. This framework provides strong guarantees that reputation based models cannot offer, and we will present and evaluate its application in a manufacturing use-case for the production of tools (hammers). Considering its adherence to the specific application domain, the authors of this paper referred to PROSA methodology, the Reference Architecture for Holonic Manufacturing Systems [40,42], as to the starting point for building the agent accountability model.

2.2.Trust related concepts

Concepts like responsibility and reliability in manufacturing execution environments [19] have evolved along the decades from a traditional human-oriented approach [1] to a more distributed, MAS-based society [7]. Reliability of production processes is a key issue that ensures the stability of production system operation, as it improves product quality and reduces production losses. But while reliability tries to predict the fault analysis of production process trough the provision of corrective actions for the elimination of critical faults in machinery, accountability is used as a mechanism to measure the effects of freedom granted to each single agent in making alternative decisions. In this sense accountability will be utilised to characterise MAS based CPPS systems, without the need to create explicit relationships among the involved agents [7].

2.3.Trust models, access control and policy-based authorization

Policy based trust models allow to define what evidence should be presented by an entity, in what circumstances, in order to establish a trust relationship. Blaze et al. [9] first defined the concept of trust management as a unified approach to specifying and interpreting security policies, credentials, and relationships which allow direct authorization of security-critical actions. They argued that the question answered by a trust compliance checker is not ‘Is the key that signed this request authorised to take this action?’, but rather ‘Does the set C of credentials prove that the request r complies with the local security policy P?’. Furthermore this question should not be answered by the application itself, but by a general trust compliance checker. In the following years several implementations of trust management frameworks as defined by Blaze et al. followed, such as Keynote [10], REFEREE [14] and RT [22].

Cheminod et al. [13] motivated why access control policies are fundamental in the process of securing networked industrial control systems and critical infrastructures. Liu et al. [24] raised similar security concerns particularly for collaborative manufacturing systems, and argued that configuring and enforcing an access control model in a collaborative manufacturing system is a challenging task. This concern was addressed in [34,35] with a framework that enables policy-based access control to maintain trust relationships that cross the boundaries of collaborating organizations, while lifting the burden to manually align diverse sets of authorization policies of different organizations.

In this work, we go beyond the state-of-the-art by extending such a framework to support dynamic accountability for smart collaborating agents, not only to enforce trust boundaries in which agents can operate freely under certain conditions, but also to enable accountability of misbehaving agents.

2.4.Production routing use-case

Fig. 1.

Hand tool production routing (hammer).

Fig. 2.

Realization of a product with the utilization of non-renewable resources.

The realization of this work will be demonstrated starting from an easily understandable case of hand tool production (a hammer in the specific) and then proceed by extending results to the general use-case implemented via simulation. The activities in the production routing depicted on Fig. 1 will be the base for validating the evolution of the manufacturing execution task through the MAAF.

3.1.On the MAAF accountability mechanism

The concept of accountability proposed in the paper is aligned with the following consideration: effects deriving from an agent delegation (i.e. its freedom) in taking alternative decisions are catalysed through the implicit concept of responsibility. It is furthermore clear that this concept, for actions in CPPS, needs to be adapted as, in general, there is no human twinned with the agent, to whom the effects of responsibility could be propagated. Instead we linked them to the concept of reliability, as the capacity of an agent not only to do what it is expected to do, but also to deviate from the strict production workflows and yet being able to improve manufacturing end-results through the exploration of alternatives. Accountability aims at being a simplified aggregation of complex and dynamic modulation of agents’ behaviour, also through the ontological policies. Accountability will act, in the end, as a sort of reward-enabling mechanism in the exploitation of their autonomy.

3.2.Factory Agent Accountability Model

In manufacturing theory, production is basically the transformation of multiple resources into products according to demands from customers. Manufacturing processes take time, consume energy, cost money and have commodity and equipment needs, which can be simplified, in generic terms, into temporal, energy, financial and material resources (Fig. 2 reports a schematic view of production from the point of view of such resources). This list of four non-renewable resource examples can be further extended according to the specific manufacturing processes of the factory, but it is hereby sufficient for the general understanding of the model. In this sense, also machinery facility can be seen as a “special” resource, thanks to its capability to combine and utilise the previously mentioned cumulative resources for the specified production purposes.

The manufacturing tasks contained in the routing (know-how derived from the production order; Fig. 1) are then executed by manufacturing agents with the utilization of their own resources and capabilities. Generally, production orders also have different levels of priority: they can be resource-based, with the goal to minimise costs for instance, or target the addition of completely new features or functionalities to the products based on the customers’ and facility’s requirements.

The main objective of the system is to direct the facility towards the achievement of the primary goal: a sustainable production with maximised customer satisfaction. As introduced earlier, distributed systems with the appropriate supervisory mechanisms can improve performance over rigid hierarchical systems. In accordance with this vision and taking into account requirements from the manufacturing domain, the Factory Agent Accountability Model has been created (Fig. 3).

Fig. 3.

Factory Agent Accountability Model.

Agents represent the manufacturing staff and have the knowledge to manage and regulate parts or aspects of the facility via their own methods and the resource assignments. Namingly: Resource Manager, Production Planner, Shop-floor Manager and Manufacturing Agents.

Fig. 4.

Sequence of agent interactions in the studied production work-flow.

A Customer represents the demand of a product with both specified (explicit) and hidden (implicit) properties. The undefined demand can be a feature of the product or a priority for the Customer, and usually measures his attitude against the demand (quickness, cheapness or high quality). These unknown properties make the simulation model realistic and diverse. The main goal in the model is the maximization of customer satisfaction, which is determined by the Shop-floor Manager agent by receiving the Customers’ feedbacks on the realised product, after the completion of production. The Shop-floor Manager can discover undefined demands (or requirements) from the feedback and match them with historical information of production (logs and reports) in order to develop the accountability profile for each Manufacturing Agent. Aim of the Production Planner is to create a production order, which will be an assignment for the Manufacturing Agents of the specified product, based on the requirements identified in Customer’s demand. The order contains the actual production routing (workflow). Every product relates to a production routing and might eventually permit (from the point of view of the facility strategy) acceptable alternatives and extra steps (as graphically depicted in Fig. 1). Between two mandatory tasks (blue nodes) there is always a constraining relation defined (direct, substitutional or order-independent precedence), with the possibility to add alternative operations (green nodes). Every task has a catalogue which defines the necessary resources involved (financial, energy, material and temporal), as well as the capability required from a machine resource to execute it.

The Production Planner is in charge to forward and employ orders via the Manufacturing Agents in a profitable and terminable manner, so to keep production sustainable in the long run. To achieve this purpose, and in order to plan production schedules, it has to take into considerations also directives and resource capacity plans provided by the Resource Manager. The latter has multiple regulatory options, like restricting and/or indirectly influencing the availability of resources based on its stock level and recommendation shaped by the Shop-floor Manager. The actual manufacturing work is done by the Manufacturing agents, as they represent the resource with the necessary capabilities to fabricate the product. The Shop-floor Manager identifies the management of trust towards agents, based on the methodology presented in this section. It is its responsibility to permit or deny agent actions and evaluate their performance after the realization of a product. The Manufacturing Agents are also regulated by the Shop-floor Manager, which orchestrates the specific selection of machines in concurrent situations.

Production is generally followed by an evaluation phase, in which the main focus is drawn on the whole system and is based on the customer expressed satisfaction: this arises both from the production logs and from all of the requirements of the client, calculated by the Shop-floor Manager. Based on the evaluation results every Manufacturing Agent gains a new reliability (and so accountability) level, utilised by the Resource Manager in order to adjust decisions related to policies on the availability of resources, by leveraging also the recommendations from the Shop-floor Manager. The sequence diagram illustrated in Fig. 4 highlights the interactions occurring among these agents, and can be categorised in instructions, knowledge or resource transfers, and permission or resource requests.

The factory agent accountability model itself does not grant the expected feasibility of the production, but it aims at reaching such a goal in conjunction with behavioural constraints detailed in policies of the authorization middleware.

3.3.Leaf Diagram

The Leaf Diagram (LD) is a representation, visualization and thus monitoring tool of the MAAF for capturing and governing an agent’s behavioural tendency to exploit its autonomy in pursuing its goals while converging towards the manufacturing objectives of the factory. The aim of the LD is to visualise and evaluate the evolution of an agent’s behaviour in the multidimensional space of production resources: we have selected a two-dimensional representation for an easier explanation of concepts but this can be easily extended also to an n-dimensional case. Each axis represents a cumulative resource (temporal, energy, financial, material and energy), whose utilization is typically a monotone increment along the time.

Fig. 5.

Derivation of the Order Execution Space.

Every production process evolves along an Order Execution Space, between a starting and finishing point, named Order Entry Point and Order End Point (represented with crossed circles on Fig. 5(a) or 5(b)). The path connecting these two points, from a purely economical modeling point of view, tend to show a linear combination of resources (Modeled Execution routing). In reality, every production order has so-called technological steps, which are defined as routing points with the intention to create a vendible output. The prescribed Production Routing is composed of nodes representing the states of the product over the manufacturing process, while edges are the actions necessary to reach the next state (traced in blue). Edges generate trajectories, whose projection on the axis indicates the actual consumption of resources required for that specific action. It is worth highlighting how the actual execution of a manufacturing step (feasibility) usually requires a slightly different combination of production resources (manufacturing execution gap) compared to the one indicated in the prescribed route (Fig. 5(c)): this is due to the effective state of technologies and resources at that specific moment of the process (blue-filled circles on Fig. 5(c)). The union of all regions for the technology deviation generates the Technology Tolerance (TT). Considering that a production routing usually contains also alternative manufacturing steps (green-filled circles on Fig. 5(d)) the overall dimension of the TT has to be evaluated also in the light of such combinations. In the end, the Order Execution Space will be identified by the region of a LD which encompasses both the prescribed production routing and the overall space of the TT estimated for it.

Fig. 6.

Agent behavioural evaluation tool: the Leaf Diagram.

The LD has been divided into four major areas characterizing the positioning of agent actions within them (Fig. 6). They have been formalised taken into consideration the global perspective of the system, as listed below:

3.3.1.Agent CR and Accountability

Central in the LD is the definition (1) of the Agent Accountability (AAm), which is here represented as a numeric value ranging from 0 (lowest accountability) to 1 (highest accountability) for each machine agent (e.g. turning, milling, drilling machine, and so forth):

AAm∈[0,1],m(1)∈Machine agents

AAm is a value provided by the Auditor for each Machine Agent, hidden to the involved agent and recalculated at the end of a production order (see model depicted in Fig. 3). AAm plays a fundamental role in the delimitation of an agent’s CR, as detailed hereafter.

As already seen, the CR is for an agent the space of resource combinations within which it can freely exploit its autonomy and eventually decide for different alternatives in the production routing (see Fig. 7 for details). It is defined (2) as the union of two regions on the diagram: the TT (light-yellow circle) estimated for the next production step(s) and the space of Feasible Alternatives, leveraged taken into account the level of additional resources still available at the current production step (Additional resource bank). CR represents the maximum degree of freedom for an agent, in that specific step, in the selection of production resources, proportionally rescaled according to its the accountability level (AAm). In this manner, we obtain the portion of CR in which the agent goal is also eligible for the execution of the task:

Confidence Region(AAm)=acceptable Alternatives(2)∪acceptable TT

Fig. 7.

Confidence Region of an agent at a hypothetical routing step.

As AAm∈[0,1], the result of (2) is consequently a reduction of the CR, as illustrated also on Fig. 7 (darker-yellow contours within it). The CR of an agent simultaneously conveys the concepts of production feasibility, agent autonomy and agent accountability. AAm conveys on CR geometry the level of reliability of an agent, according to its past decisions and generated outcomes, and so by giving form to the concept of trustworthiness in the agent and its capability of taking alternative decisions. The agent’s CR reported on Fig. 7 is just an illustrative example of how AAm might be interpreted for the geometric re-definition of its boundary: any other shape would be eligible as well, provided that (i) it is contained within the maximal space of the CR and that (ii) its area is proportionally reduced by an AAm factor.

Fig. 8.

Agent goals and behavioural trajectories.

3.3.2.Agent goals and behavioural freedom

We see agent actions as generators of behavioural trajectories, whose end-points on the diagram represent their own goals (Fig. 8). An agent Goal has been defined, for a given machine agent, as one of the possible combinations of cumulative production resources (F, M, T and E on Fig. 2) targeted by the agent within the manufacturing organization:

(3)Gm,g=(x1,x2,…,xr)

Where:

m as defined in (1) and x1,…,r(4)∈ Non-renewable production resources

At each state of the production order there is the possibility to choose an alternative or extra step according to the agents goals and their relevance for the production routing. As already depicted on Fig. 6 the green-colored area contains additional possible operations while the red or dark-grey colored show the verdict for that action’s outcome.

On the basis of precedent definitions, a quantitative evaluation of an agent’s behavioural freedom has been introduced through the concept of Freedom Ratio (FRr,m,g), as depicted in Fig. 9. Given the triplet <resource, machine agent, agent goal>, the FRr,m,g is calculated in relation to the two different portions of the agent CR (the acceptable alternatives and the acceptable technology tolerance), depending on whether the agent goal is actually (i) a feasible alternative step after the current one (pF and green-colored circle) or (ii) the next step prescribed by the routing (pT and blue-colored circle). These two regions are mutually exclusive, as an agent goal cannot be simultaneously an alternative and a strictly prescribed manufacturing action.

Fig. 9.

Behavioural freedom ratio.

FRr,m,g is given by the exclusive evaluation of its components in pF and pT spaces:

(5)FRr,m,g=FRr,m,g(pF) or FRr,m,g(pT)

Each component of the FRr,m,g is defined as the remaining resource capacity ratio along with the specific dimension, that is the difference between the maximum available in the CR and the proportion of two segments indicating the variation of resources utilised with respect to the prescribed routing step (black segments of the CR in Fig. 9):

(6)FRr,m,g(pF)=[1−(Gm,g,pF,r)(pF,r,cF,r)]=(Gm,g,cF,r)(pF,r,cF,r)∈[0,1](7)FRr,m,g(pT)=(Gm,g,cT,r)(pT,r,cT,r)∈[0,1]if rG⩾rpT[(Gm,g,cT,r)(pT,r,cT,r)−1]∈[−1,0]otherwise

Where: rG and rpT represent the amount of resource required by the agent goal Gm,g and the prescribed routing step in the Accepted Technology Tolerance space, respectively; cF and cT∈∂rSconfidence, pF and pT∈Prescribed Routing, pF≠cF and pT≠cT.

In practice, the estimation of FRr,m,g is calculated by positioning the agent goal on the straight lines parallel to the resources axes and measuring the variation of demand (compared to the one in the prescribed route step, pF or pT) from the boundary point of the ∂rSconfidence for the given resources combination (cFr and cTr). A lower utilization of resources by an agent goal is considered as an increase of freedom, in the same resource dimension, for the next steps (this is a characteristic of pT region, only).

For instance, the illustration depicted in Fig. 9 reports an example of Behavioral Freedom Ratio in relation to two resources (namely no. 1 and 2), for the machine agent no. 4 and its goals no. 1 and 2. According to this case and simply based on proportions evidenced on the LD, estimations would report the following values (if equal to 1 indicates that the agent performance complies with the prescribed one in both spaces of the CR; in pF values cannot be negative as the agent is executing a further production step, and so demanding for additional resources):

• – FR1,4,1=−0.6 (or −60%): lower requirement of resource no. 1 compared to the prescribed routing step. The value indicates an increase of freedom for the next steps;

• – FR2,4,1=0.6 (or 60%): a higher requirement of resource no. 2 compared to the prescribed routing step. The value indicates the remaining freedom;

• – FR1,4,2≈0.17 (or 17%): the value indicates the remaining freedom with respect to resource no. 1;

• – FR2,4,2≈0.73 (or 73%): the value indicates the remaining freedom with respect to resource no. 2.

Next to the evaluation of single agent actions, the LD also aims at providing an estimation of freedom for the entire system, or otherwise said, the level of freedom (in terms of resources) left by the agents for the achievement of remaining production objectives. This has been specified, for a given machine agent and its goals, by the System Freedom value (SFm,g), which defines to what extent each agent goal (i.e. its sequence of actions) might influence the entire manufacturing strategy. It is the difference between 1 (maximum freedom) and the average of FRr,m,g for a given agent:

(8)SFm,g=1−FR1,m,g⋮FRr,m,g‾

Negative values indicate an increase, while positive ones produce a decrease of freedom in the orchestration of production resources. Continuing with the previous example, SFm,g can be calculated as the mean of all FRr,m,g values, as follows:

(9)SF4,1=1−−0.600.60‾=1−0.0=1(100%)(10)SF4,2=1−0.170.73‾=1−0.45=0.55(55%)

In this illustrative example values of the System Freedom indicate that the freedom still available in the system for the orchestration of the remaining manufacturing process after the execution of agent goals G4,1 and G4,2 is respectively 100% and 55% (compared to the prescribed routing, i.e. 100%). G4,1, despite its deviation from the prescribed routing, leaves the overall system freedom unaltered. On the contrary, a general decrease of 45% in the system freedom is caused by the execution of G4,2: this will influence the decision strategy of agents in the remaining routing path. It is worth recalling that a given order can have (or is influenced by levels of) priorities: if they are resource-based (temporal, financial and material), such as cost minimization for instance, then the framework can leverage the FRr,m,g as it can focus on single dimensions of interest. On the contrary, if the priority dictates the addition of new features or functionalities (which are referred to as an implicit combination of all production resources) then the proposed approach can utilise the SFm,g as a more effective, global performance indicator.

3.4.Dynamic authorization as a boundary in smart manufacturing

The previous section discussed the LD and the computations behind the degrees of freedom that an agent can have in selecting and completing the next task of the workflow. Note, however, that the mathematical background of the LD expresses only necessary but not sufficient constraints. For example, consider a production routing with a paint job. In such a scenario, the LD models time as any other resource. According to the LD, an agent would be allowed not to wait – i.e. do not spend any of the time resource – to achieve a higher freedom ratio. However, it is clear that an agent should wait for the paint to be dry before continuing with the next task. These additional constraints between tasks and their execution order are enforced by the authorization metamodel described in this section. It is this metamodel that provides the foundation for the dynamic accountability.

Within the frame of this manufacturing use case, the scope of authorization extends to all the actions undertaken by any entity in the system, including human operators and manufacturing agents. The authorization decisions are governed by the roles, responsibilities, permissions and other attributes associated with these entities. Our authorization middleware not only enforces authorization policies to constrain access to production information (including read, write, update and delete operations), but also evaluates access control decisions to permit or deny agents of undertaking certain manufacturing operations. The former goal addresses information security concerns which we implemented with contemporary and state-of-practice identity and access management (IAM) software solutions, such as RedHat Keycloak.11 The latter goal of our authorization middleware aims to prohibit manufacturing agents of overstepping their trust boundaries, and this is the scope of the remainder of this section. To achieve this objective, the middleware builds upon an authorization meta-model that interacts with the manufacturing meta-model.

This authorization metamodel maps with concepts and properties of the manufacturing meta-model describing workflows and production routings, such as the one depicted in Fig. 1: for each step in the production order advancement the illustration highlights the capability required to perform the step, as well as the requirements related to all of the resource types (previous Fig. 2). To simplify the mapping, both the manufacturing and authorization meta-models are formally grounded in separate ontologies, and the description logic foundation of ontologies allows us to reason about the implicit order of tasks, permissions, resource boundaries, and other process execution constraints.

The example authorization rules depicted below are merely used to explain the overall authorization concept, and are by no means representative of the more sophisticated access control policies of the manufacturing use case. The authorization policies reuse semantic concepts from other external domain-specific ontologies that, for example, define concepts to instantiate workflows. This ontology declares how a workflow can be instantiated and composed from individual tasks, whereby each of these tasks declares its own restrictions (dependencies on other tasks, mutual exclusion, etc.). These details were omitted from the following examples as the authorization policies and meta-models are semantically grounded, and the underlying OWL 2 ontology reasoner takes care of inferring all implicit relationships to semantically evaluate the authorization rules.

In the examples below, we assume a scenario where multiple agents with different capabilities can work on production orders following a particular production routing as depicted in Fig. 1. In a separate ontology we model the different agents and their capabilities, as well as the different production steps required to complete the order. Even if an agent has a certain capability, the task associated with that capability is only allowed to be carried out under certain conditions which are specified in authorization policies. The authorization policies are expressed in the Semantic Web Rule Language (SWRL) specification, such that inferences of allowed tasks can be done with rules like the following:

This is a simplified rule which states that an agent a with a capability to execute task t is allowed to pursue that task for a product if required according to the production routing p. Contrary to what is common in most policy based access control languages, the evaluation of this rule does not result in a single permit or deny decision for a particular task. Instead, it infers a list of all the agents and their respective capabilities that they are allowed to perform on any of the products that need to be manufactured. Indeed, traditional policy-based access control policies typically decide whether a subject is permitted or denied to execute a specific task on a resource. By leveraging the inferencing capabilities of the OWL 2 reasoner, our framework instead infers all tasks an agent is permitted to pursue. This is much more effective compared to an exhaustive search of every possible combination and checking whether each combination is permitted or denied.

Note that in the above rule we do not take any additional constraints into consideration, such as task dependencies in the production routing and the use of temporal, financial, material or energy resources. In practice, there are multiple rules to account for the fact that each task requires resources (temporal, material, financial, energy, etc.) and these constraints must be taken into consideration as well:

This second rule restricts the results of the first rule to those products, agents and tasks that require a financial resource of less than 17 units. This means that the agents responsible for production will be excluded due to the demand for a financial resource of 20 units.

Similar rules are required to model constraints that enforce dependencies, such as a task that can only be started whenever all the previous tasks are completed. The hasTask(?p,?t) predicate is further extended in the above rule to:

Furthermore, additional rules must account for alternative tasks that are mutually exclusive. They must check that all previous tasks are finished and that no alternative task (Exclusive OR) has already begun. This is illustrated for two mutually exclusive tasks polishing and varnishing.

Additional description logic inference rules will guarantee that the permitted task set and unfeasible task set are mutually exclusive. This way, a task can not be present in both sets at the same time.

Beyond the inferencing capabilities, our authorization framework offers querying capabilities. For example, with the following simple SQWRL query [32], an agent a can request all allowed tasks t and corresponding freedom ratio r, and then decide on its own which strategy it will pursue:

In fact, the above query will return an overview of all agents and their allowed tasks, thereby representing the CR of each agent. The strategy of the agent will depend on the Freedom Radio as discussed in the previous section. Two such strategies are:

At runtime, our framework leverages the HermiT OWL 2 reasoner [16] – also used in Protégé – and an SWRL reasoner to process the semantic models and rules. By modelling task dependencies and leveraging the inference power of the HermiT ontology reasoner, any implicit dependencies and constraints are automatically derived whenever an agent wants to initiate a task.

In addition to the semantic rules presented in Section 3.4, accountability-specific rules were used to infer tasks that would lead to ending up in the Unacceptable Space, the Ill-intentioned Space and the Unfeasible Space:

By using OWL 2 primitives to model these spaces of the LD, we can define these task classes as mutually exclusive so that an agent can evaluate for each task that it is capable of, whether it would end up in any of the spaces.

Whenever an agent continues with a particular task, the task and resources consumed are logged so that in a next iteration the thresholds of acceptable behaviour can be updated.

4.1.LD application to the industrial use-case

As mentioned in Section 2.4, we started from an simpler case of hand tool production – hammers to be more specific – and then proceed by extending results to the general use-case. The implementation was initially supported only by simulation but we are currently proceeding with the physical deployment and demonstration of the MAAF in an excellence research lab for manufacturing, a learning factory and an open ecosystem for students and researchers to perform research on such topic (Fig. 10). It is an ideal place to study the challenges and to understand the benefits of elevating CPPS to a mature level of interoperability in a production context. The different illustrations of Fig. 11 guide over the conceptional evolution of the LD.

Figure 11(a) depicts both views of the production planning and the manufacturing execution paradigm of a hammer production. The former shows a linearised connection between the used resources. The requirements for a hammer is one handle and one head on the material demand side, which are consumed during the manufacturing process. Next to this, there is an expected preparation time and cost, which are derived from the calculated average. This cost consists of work labour, equipment and tool amortization and also energy consumption tariff. A wider perspective can be achieved closer to the shop-floor in the manufacturing execution view, where the production gets more details in respect the manufacturing operations. After the acquisition of materials, transforming tasks can start, followed by the assembling and packing ones. Every single task has an average production cost and execution time. The activities in the production routing depicted in Fig. 1 are in tune with the production tasks reported on Fig. 10(a).

Figure 11(b) presents a new representation of agents trustworthiness in manufacturing. Every production state has prescribed goal(s) and, if the routing permits it, alternative goals intended by the machine resources. The Order Execution Space is shaped as the region encompassing every possible routing alternatives and considering the technological tolerances of every task. The green-boundary curve will accepts (agent) operations if the tolerance area is partially or fully contained within the maximum resource limits, while sorting all the feasible variations into a set for a better visual representation. This means, in practice, that one goal is unacceptable if it is located in the Unacceptable Space or if it is outside the acceptable CR of the agent (based on its current accountability level) in the current production state.

The last two illustrations (Fig. 11(c) and 11(d)) aim at depicting possible evolutionary stages of the LD in the manufacturing use-case. After each production state, the CR is recalculated on the basis of the additional resource bank still available and on the machine agent’s accountability value. The acceptance of an alternative operation generates an overall shift of the production routing, as it probably requires a consumption of additional resources. This expendability of resource requirements necessitates the introduction of a well synthesised accountability value, as the execution of precedent alternative tasks (despite their feasibility) might preclude this possibility for later ones, and so for the entire manufacturing order execution. The choice made by the policy-based trust manager takes into consideration the constantly recalculated overall System Freedom.

Fig. 10.

Physical environment of experiment.

Fig. 11.

Evolution of a LD during an order execution process.

4.2.Experimental setup and results evaluation

The relevance of hammers production in the overall production use-case can be unfolded if focusing on bigger batch sizes. With high fluctuation in the personnel staff of a construction company, identifying tools and toolsets can be mandatory for safety reasons and regulations. Adding a mid-quality RFID tag to a hammer (which does not really increases the cost of the product and keeps its usability unchanged) and so determining personnel responsibility can help significantly improve work conditions, safety and ethics. The construction company’s procurement probably never thought about this possibility but if they start using the augmented tool, and the customer satisfaction feedback is positive, then the production company can think of standardizing this customization in future productions; otherwise it will be ignored. In both cases, the MAAF will be able to learn it.

The production company of the simulation use-case is a high quality hand tool producer. Its product portfolio consists of multiple kind of hammers, screwdrivers, saws, wrenches and electric screwdrivers. The ordered batch sizes range from one to several thousands and in order to serve all the different demands and keep the stock level low, they modularised their product part set (e.g. different tools with the same handle). The shop-floor consists of multiple human operated assembler stations, automatised manufacturing facilities and surface treatment machineries. The insular process oriented layout provides an opportunity of flexibility in the production control required by distributed control mechanisms.

The setup of our experimental environment starts with one hundred sets of randomised orders containing both defined and undefined demands in the ratio of four to one of the customer for one year ahead. Both the agents and the policy system were fine-tuned and optimised to the maximum production service level. Based on the defined expectations and the fixed policy rule sets each experiment runs for one year with eight hours work shifts a day. Table 1 reports the diversity of products in Small- to Medium-size Enterprises (SMEs). The shop-floor consist of thirty machines, each directed by a corresponding agent. The configuration is listed in Table 2. The execution progress of our experiments was basically measured by iterating over the permissible maximal Agent Accountability value granted by the policy-based trust manager from zero to one, with an incremental step of one-hundredth.

Fig. 12.

Effect of agent accountability on the collective customer satisfaction.

Collective customer satisfaction has been represented as the sum of its components derived form both the defined and undefined requirements, whose ratio was preset as four to one. In the first experimental setup (Fig. 12(a)) we simulate thirty agents, with all of them well-behaved, which means that they try to achieve a positive self-goal from the system’s perspective. After ten thousand experimental runs we were able to pinpoint the ideal value for the Agent Accountability to 0.31 for the featured environment. A first observation is that the system performance in relation to customer satisfaction can increase with satisfactory freedom given to the agents. A second observation is that there is a huge drop in the satisfaction after a definite freedom (before that the variation is not so significant) which would indicate that it is not advisable to tune too precisely the maximal accountability value to reach the beneficial zone in the utilization of this framework.

In the second experimental setup (Fig. 12(b)) we set the number of ill-intentioned agents to five, with the constraint that no task could be exclusively performed by ill-intentioned agents. The malicious agents try to initiate tasks out of order, or consume too many resources for the tasks at hand. As a consequence, even well-intentioned agents may be denied to execute certain tasks if the assets available to complete them are not sufficient, as an indirect effect of the propagation of malicious agents’ behaviour. The goal of this experiment was also to measure the impact, from a performance point of view, for the requests submitted by the well-behaved agents. First observations indicate that the response times from the trust manager for ill-intentioned agents are lower than those for benign agents. This can be explained by the fact that finding a violation against a set of rules and constraints is usually faster than verifying that all conditions have been met. The second conclusion is that the trust manager is able to identify the ill-intentioned agents and reduce their accountability to zero, thus practically excluding them from production.

Examining the two charts together we conclude that even at zero maximal Agent Accountability the second setup performs worse, because of the increased unacceptable attempts of the ill-intentioned agents. The optimal freedom is lower also at the value of 0.22, which derive from the transitional time necessary to find and eliminate the malicious agents, during which they can harm the systems performance. The lower the maximal freedom, the shorter the period they work independently. Concluding it can be stated that, even in presence of malicious agents, from the point of view of customer satisfaction, the system’s overall performance can benefit from the usage of the MAAF.