Jin-Hee Cho
email: jinhee.cho@us.army.mil

Ananthram Swami
email: ananthram.swami@us.army.mil

Ing-Ray Chen
email: irchen@vt.edu

Modeling and Analysis of Trust Management Protocols: Altruism versus Selfishness in MANETs

Keywords: Trust, trust metrics, trust management, mobile ad hoc networks, demand and pricing theory, altruism, selfishness

Mobile ad hoc and sensor networks often contain a mixture of nodes, some of which may be selfish and non-cooperative in providing network services such as forwarding packets in order to conserve energy. Existing trust management protocols for mobile ad hoc networks (MANETs) advocate isolating selfish nodes as soon as they are detected. Further, altruistic behaviors are encouraged with incentive mechanisms. In this paper, we propose and analyze a trust management protocol based on the demand and pricing theory for managing group communication systems where system survivability is highly critical to mission execution. Rather than always encouraging altruistic behaviors, we consider the tradeoff between a node's individual welfare (e.g., saving energy for survivability) versus global welfare (e.g., providing service availability) and identify the best design condition so that the system lifetime is maximized while the mission requirements are satisfied.

Introduction

Most existing trust management protocols in mobile ad hoc networks (MANETs) encourage cooperative behaviors while discouraging selfish behaviors of participating nodes, so as to achieve a prescribed system goal such as high service availability. A common approach is to isolate selfish nodes as soon as they are detected and to reward altruistic nodes with incentives to encourage cooperation. However, in MANET environments where resources (e.g., bandwidth, memory, computational power, and energy) are severely constrained, only encouraging altruistic behaviors may adversely shorten the system lifetime. This is because altruistic nodes may die quickly due to energy depletion, thereby possibly resulting in loss of connectivity and system services.

Thomas et al. [START_REF] Thomas | Cognitive networks: adaptation and learning to achieve end-to-end performance objectives[END_REF] studied system performance in such a scenario, and noted that there is a tradeoff between energy saved by selfish nodes and service availability provided by cooperative nodes. However, no analysis of the tradeoff was given. Papadimitriou [START_REF] Papadimitriou | Algorithms, games, and the Internet[END_REF] coined the term the price of anarchy to describe the two conflicting goals of individual welfare versus global welfare, i.e., the local goal of a selfish node to save its energy versus the global goal of an altruistic node to provide high service availability. Similar issues arise in routing in MANETs (e.g., a local goal through selfish routing versus a global goal for service availability) [START_REF] Roughgarden | Selfish routing and the price of anarchy[END_REF]. The price of anarchy was defined as the performance difference between a system run by an all-knowing benign dictator who can make the right decisions to optimize system performance, versus a system run by a selfish anarchy. We postulate that there should be a tradeoff between system survivability and service availability in terms of these two conflicting goals. As Thomas et al. [START_REF] Thomas | Cognitive networks: adaptation and learning to achieve end-to-end performance objectives[END_REF] indicated, each node can make a decision for its own benefit as well as for global interest by considering the dynamics of the network as well as its own conditions (e.g., energy level).

We propose and analyze a trust management protocol that trades off node altruism for system survivability for mission-driven group communication system (GCS) in MANETs based on the concept of cognitive networks. In a cognitive network, each node has intelligence to adapt to dynamically changing MANET environments through a learning process, by adjusting its altruistic and selfish behaviors in response to network dynamics. We seek to identify the optimal design settings that maximize system lifetime while satisfying performance requirements such as service availability.

Our trust management protocol adopts demand and pricing (DP) theory originally derived from economics [START_REF] Case | Principles of Economics[END_REF]; under DP a node decides whether it should behave selfishly or altruistically based on the balance between individual welfare (i.e., saving energy) and global welfare (i.e., providing services). A node's decision may depend on its own energy level, 1-hop neighbors' selfishness levels (i.e., to judge whether the system still has sufficient resources such as an adequate number of cooperative neighboring nodes), and the degree of node importance to mission success (e.g., to judge whether a node's selfish behavior would have a significant detrimental impact on the mission success rate). Social scientists have addressed the tradeoff between local/individual utility and global/collective interest in the area of collaboration theories using the concept of trust in groups, teams, and organizations [START_REF] Falcone | Social trust: a cognitive approach[END_REF]. However, no prior work addresses this tradeoff in the context of trust management in MANETs. A number of prior studies have also taken economic perspectives in modeling communication networks [START_REF] Aldebert | Telecommunications demand and pricing structure: an economic analysis[END_REF][START_REF] Li | Pricing to stimulate node cooperation in wireless ad hoc networks[END_REF][START_REF] Marbach | Cooperation in wireless ad hoc networks: a market-based approach[END_REF][START_REF] Rappaport | Household demand for wireless telephony: an empirical analysis[END_REF][START_REF] Yilmaz | Elastic threshold-based admission control for QoS satisfaction with reward optimization for servicing multiple priority classes in wireless networks[END_REF]. Unlike these prior studies, our work concerns trust management and we specifically adopt DP theory.

Many routing protocols for MANETs have been developed to isolate selfish nodes and to encourage collaborations among participating nodes [START_REF] Miranda | Friends and foes: preventing selfishness in open mobile ad hoc networks[END_REF][START_REF] Wang | Truthful multipath routing for ad hoc networks with selfish nodes[END_REF][START_REF] Yan | Designing incentive packet relaying strategies for wireless ad hoc networks with game theory[END_REF][START_REF] Zhao | Access control in ad hoc networks with selfish nodes[END_REF][START_REF] Zhang | Impact of selfish nodes on route discovery in mobile ad hoc networks[END_REF]. Wang et al. [START_REF] Wang | Truthful multipath routing for ad hoc networks with selfish nodes[END_REF] devised an efficient incentive mechanism to encourage cooperative behaviors in multipath routing. Zhao [START_REF] Zhao | Access control in ad hoc networks with selfish nodes[END_REF] investigated the optimal transmission probability and Yan et al. [START_REF] Yan | Designing incentive packet relaying strategies for wireless ad hoc networks with game theory[END_REF] developed incentive mechanisms using game theoretic approaches. Miranda et al. [START_REF] Miranda | Friends and foes: preventing selfishness in open mobile ad hoc networks[END_REF] proposed an algorithm in which routing behaviors are monitored; selfish nodes are penalized (their packets are not forwarded) so as to discourage selfish behaviors, and nodes making heavy demands for services are also penalized to ensure faire allocation of resources. Different from the above work, Zhang et al. [START_REF] Zhang | Impact of selfish nodes on route discovery in mobile ad hoc networks[END_REF] considered the positive aspect of having selfish nodes in terms of traffic reduction, and established bounds on the probability of a node being selfish to optimize system metrics. Our work in this paper is different in that we investigate and identify the best balance between individual welfare via selfish behaviors versus global interest via altruistic behaviors so as to prolong the system lifetime.

Routing protocols have also been proposed based on the concept of trust (or reputation) to isolate selfish nodes [START_REF] Adams | Calculating a node's reputation in a mobile ad hoc network[END_REF][START_REF] Moe | TSR: Trust-based secure MANET routing using HMMs[END_REF][START_REF] Soltanali | An efficient scheme to motivate cooperation in mobile ad hoc networks[END_REF] using incentive mechanisms that discourage selfish behaviors. However, the trust metric used often does not adequately consider important properties of trust in a MANET environment, including subjectivity, asymmetry, incomplete transitivity, dynamicity, and context-dependency [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF]. Our work takes these properties into consideration by adopting a composite trust metric that incorporates both social trust and QoS (quality-of-service) trust. The QoS and social components capture different aspects of trust that are important from the perspective of the user and the endgoal of the mission.

The contributions of this work are as follows. First, we propose a novel composite trust metric encompassing social trust explaining the aspects of internal, interpersonal, and mental aspects of an entity [START_REF] Falcone | Social trust: a cognitive approach[END_REF] and QoS trust indicating competence for task performance. Second, we develop and analyze a trust-based protocol for a mission-driven GCS in MANETs where nodes may behave selfishly. We use DP theory to quantify the conflicts between individual welfare and global welfare and identify the conditions that best prolong the system lifetime for successful mission execution while satisfying performance requirements. Third, we develop a mathematical model to describe the behaviors of a GCS based on hierarchical stochastic Petri nets (SPN), allowing optimal conditions to be identified to answer what-if type of questions in response to changing operational and environmental conditions. Lastly, through numerical data, we demonstrate that our trust management protocol based on DP theory is capable of maintaining an acceptable trust level for successful mission execution while prolonging system lifetime, when compared with a traditional all-altruistic system.

The rest of this paper is organized as follows. Section 2 describes the system model including the assumptions, trust metric, and energy model. Section 3 develops a performance model to describe the behaviors of a GCS based on hierarchical stochastic Petri nets. Further, Section 3 describes DP theory being applied for the formulation of trust management. Section 4 presents numerical data obtained from the evaluation of our performance model. In particular, we compare the performance of a GCS operating under our proposed trust protocol versus a solely altruistic GCS. Finally, Section 5 concludes the paper and outlines future work.

System Model

Due to the unique characteristics of MANETs and unreliable communication in wireless networks, trust management for MANETs should encompass the following trust concepts. Trust should be dynamic to account for uncertainty. Trust should be contextdependent, and subjective, and cannot be assumed to be transitive or reciprocal. To address these unique trust properties, trust management for MANETs should consider the following design features: trust metrics must be customizable, evaluation of trust should be fully distributed without reliance on a centralized authority, and trust management should cope with dynamics and adverse behaviors in a tactical MANET [START_REF] Cho | Towards trust-based cognitive networks: a survey on trust management for mobile ad hoc networks[END_REF].

Cognitive networks are able to reconfigure the network based on past experiences by adapting to changing network behaviors to improve scalability (e.g., reducing complexity), survivability (e.g., increasing reliability), and QoS (e.g., facilitating cooperation among nodes) [START_REF] Thomas | Cognitive networks: adaptation and learning to achieve end-to-end performance objectives[END_REF]. We use this concept to indicate a node's ability to adapt to changing network conditions, such as a node's selfish behavior, node failure or mobility, energy exhaustion of a node, or voluntary disconnection for energy savings.

In the initial network deployment, we assume that there is no predefined trust. Without prior interactions, the initial bootstrapping will establish a shallow level of trust based only on indirect information (e.g., reputation from historically collected data or recommendation by third parties) and authentication by a challenge/response process (e.g., public key authentication). Over time, participating nodes will establish a stronger trust level with more confidence based on direct or indirect interactions. Our trust management protocol allows each node to evaluate the trust levels of other nodes as well as to be evaluated by other nodes based on two factors, social trust and QoS trust. Social trust includes trust properties for "sociable" purposes (e.g., intimacy) while QoS trust includes trust properties for mission execution purposes (e.g., energy level or cooperation) [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF].

Trust decays over time without further updates or interactions between entities. Node mobility also hinders continuous interactions with other group members, lowering the chances of evaluations of each other in the group. This includes cases such as a node moving to other areas causing its disconnection from the current group, leaving a group for mission reasons, voluntary disconnection for saving power or involuntary disconnection due to physical terrain or low energy. We use the concept of a trust chain [START_REF] Capra | Toward a human trust model for mobile ad-hoc networks[END_REF] to describe propagation of trust. For example, when A trusts B, B trusts C, C trusts D, and D trusts E, then, A may trust E over a trust chain of length 4. However, the longer the trust chain is, the more is the decay in the degree of trust [START_REF] Capra | Toward a human trust model for mobile ad-hoc networks[END_REF].

Our target system is a mission-driven GCS in tactical military MANETs where a symmetric key, called the group key, is used as a secret key for group communications between group members [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF]. Upon a node's disconnection from the group, the system generates and redistributes a new key so that non-member nodes will not be able to access a valid secret group key. Nevertheless, each group member keeps old trust information even for non-member nodes so that the information can be reused for future interactions, possibly preventing a newcomer attack.

Assumptions

We assume that the GCS is in a MANET environment without any centralized trusted authority. Nodes communicate with each node through multiple hops. Nodes have different levels of energy, thus reflecting node heterogeneity. Each node periodically beacons its id and location information so that node failure is easily detected and accordingly rekeying is done immediately upon every membership change.

We assume that mobile devices are carried by human such as dismounted soldiers. A node dynamically adopts selfish or altruistic behavior depending on the remaining energy level, difficulty level of the given mission (i.e., a tougher mission requires a higher workload), and selfishness level of 1-hop neighbors. That is, a node will behave selfishly when it has low energy, the mission assigned to it is not difficult, and/or there is a sufficient number of cooperating 1-hop neighbors. We consider a node to be selfish when the node drops group communication packets transmitted by other nodes. Even though the node is selfish, we assume that it cooperates to perform rekeying operations upon a membership change. The energy level of each node is adjusted depending on its status. For simplicity, we only consider energy consumption due to packet transmission and reception. Thus, if a node becomes selfish, the rate of energy consumption is slowed down.

We consider a redemption mechanism by which a selfish node can become a normal cooperative node again. Specifically, a selfish node reevaluates its status at the end of each trust update interval and decides whether it will become altruistic or stay selfish. This is described in Section 3.2. A non-member will not consume as much energy as a member because of less involvement with group activities. Upon every membership change due to group join/leave, a rekeying operation will be performed to generate a new group key based on a distributed key agreement protocol such as GDH (Group Diffie-Hellman) [START_REF] Steiner | Diffie-Hellman key distribution extended to group communication[END_REF].

We assume that a node's trust value is evaluated based on direct observations (e.g., packet dropping) as well as indirect observations. Indirect observations are recommendations obtained from 1-hop neighbors whom the evaluator trusts the most. If enough recommenders cannot be found, recommendations from all 1-hop neighbors can be used. A node's trust value may be updated after each status exchange period. A status exchange packet includes a node's own information as well as information of nodes on its trust chain for possible use as recommendations on distant nodes to its 1-hop neighbors.

We assume that existing prevention techniques such as encryption, authentication, or rekeying inhibit outsider attacks. We consider the presence of selfish nodes among legitimate group members. We model the selfish behaviors of a node by DP theory as described in Section 3.2.

Trust Metric

We consider a trust metric that spans two aspects of the trust relationship [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF]. First, we consider intimacy (or friendliness) for social trust where intimacy is measured by the degree that two nodes are 1-hop neighbors. Second, QoS trust accounts for the capability of a node to complete a given mission. We consider the energy level and degree of unselfishness (or cooperation) to estimate the QoS trust level of a node. A node's trust value changes dynamically to account for trust decay over time due to node mobility or failure, as the trust chain becomes longer, as the node's energy level changes, and as the node becomes selfish or cooperative.

We define a node's trust level as a continuous real number in the range of [0, 1], with 1 indicating complete trust, 0.5 ignorance, and 0 complete distrust. The overall trust value is calculated based on three components: energy level, unselfishness, and intimacy. As will be evident, other components could be added if desired. Based on the trust value calculated by 1-hop neighbors, the trust value can be calculated by n-hop neighbors over a trust chain.

The information used for trust evaluation of a particular node j includes probability of being alive, e.g., remaining energy > threshold, ( 𝑃 𝑗 𝑒𝑛𝑒𝑟𝑔𝑦 𝑡 ), probability of being unselfish (𝑃 𝑗 𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠 𝑡 ), and probability of being located in a particular area (𝑃 𝑗 𝑙𝑜𝑐 =𝑘 (𝑡))

where k indicates area id, and t is time. These three values are obtained from SPN subnets shown in Fig. 2 and the technical method for obtaining them from the SPN subnets is explained in Section 3. We use the term "probability" in a loose sense; one should interpret "probability" here as "value associated with a particular aspect" rather than in the frequentist or Bayesian interpretation. Now we address how the trust value is calculated. The three trust components, namely, energy level, unselfishness, and intimacy, capture MNAET dynamics. The trust value (𝑇 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 ) of node j as evaluated by node i where n indicates the trust chain length used by a node is given by: 𝑇 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 = 𝑒 -𝛾 𝑃 𝑖,𝑗 𝑛-𝑜𝑝 ,𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠 𝑡 + 𝑃 𝑖,𝑗 𝑛-𝑜𝑝 ,𝑒𝑛𝑒𝑟𝑔𝑦 𝑡 + 𝑃 𝑖,𝑗 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 /3

(1)

The n-hop trust component X, where X represents unselfishness or energy, is calculated based on the trust values obtained from the trust chain with lengths 1 to n-1 and is given by:

𝑃 𝑖,𝑗 𝑛-𝑜𝑝 ,𝑋 𝑡 = 𝛽 𝑃 𝑖,𝑗 𝑚 -1 -𝑜𝑝 ,𝑋 𝑡 + (1 -𝛽) 𝑃 𝑖,𝑗 𝑚 -𝑜𝑝 ,𝑖𝑛𝑑𝑖𝑟𝑒𝑐𝑡 -𝑋 𝑡 𝑛 𝑚 =2 (2)
𝑤𝑒𝑟𝑒 𝑃 𝑖,𝑗 𝑚 -𝑜𝑝 ,𝑖𝑛𝑑𝑖𝑟𝑒𝑐𝑡 -𝑋 𝑡 = (𝑃 𝑖,𝑘 𝑚 -1 -𝑜𝑝 , 𝑋 𝑡 𝑃 𝑘,𝑗 𝑚 -1 -𝑜𝑝 , 𝑋 𝑡 )

𝑘𝜖 𝑆 𝑖 𝑘 𝑟𝑒𝑐𝑜𝑚 (3)
Here β is used as a weight for the node's "self-information" and (1-β) is a weight for "other-information." The self-information (𝑃 𝑖,𝑗 𝑚 -1 -𝑜𝑝,𝑋 𝑡 ) can be obtained recursively by using Equation 2. In Equation 3, S i is the set of 1-hop neighbors of node i, excluding node j, that forward recommendation of node j and 𝑆 𝑖 = 𝑘 𝑟𝑒𝑐𝑜𝑚 the number of recommender nodes that have the highest trust values among all 1-hop neighbors on the trust chain of the evaluator. Notice that when calculating the trust value of node j via node k's recommendation, node i's trust value on node k is used as a weight; this causes trust to decay as the trust chain increases. Since the n-hop trust values are computed based on the basis of (n-1)-hop trust values as shown in Equations 2 and 3, the 1-hop trust values are the basis of all trust values and are computed by:

𝑃 𝑖,𝑗 1-𝑜𝑝 ,𝑋 𝑡 = 𝛽 𝑃 𝑖,𝑗 𝑑𝑖𝑟𝑒𝑐𝑡 -𝑋 𝑡 + (1 -𝛽) 𝑃 𝑖,𝑗 1-𝑜𝑝 ,𝑖𝑛𝑑𝑖𝑟𝑒𝑐𝑡 -𝑋 𝑡 (4) 𝑃 𝑖,𝑗 1-𝑜𝑝 ,𝑖𝑛𝑑𝑖𝑟𝑒𝑐𝑡 -𝑋 𝑡 = 𝑃 𝑖,𝑘 1-𝑜𝑝 , 𝑋 𝑡 -∆𝑡 𝑃 𝑘,𝑗 1-𝑜𝑝 , 𝑋 𝑡 -∆𝑡 𝑘𝜖 𝑆 𝑖 𝑘 𝑟𝑒𝑐𝑜𝑚 (5)
𝑃 𝑖,𝑗 1-𝑜𝑝 ,𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠 0 = 0.5, 𝑃 𝑖,𝑗 1-𝑜𝑝 ,𝑒𝑛𝑒𝑟𝑔𝑦 0 = 0.5

The direct information for the trust component X of node j evaluated by node i (𝑃 𝑖,𝑗 𝑑𝑖𝑟𝑒𝑐𝑡 -𝑋 𝑡 ) is obtained, by dividing node j's trust component by node i's trust component, 𝑚𝑖𝑛 𝑃 𝑗 𝑋 𝑡 𝑃 𝑖 𝑋 𝑡 , 1 ; it is thus a subjective relative evaluation. Note that 𝑃 𝑖 𝑋 𝑡 for all i where X indicates a trust component obtained from our SPN model as explained in Section 3.3. We assume that the local trust component value of a node at time t = 0 are set to ignorance (i.e., ignorance value 0.5 in the trust range of [0, 1]) during the network bootstrapping period, as shown in Equation 6.

In Equation 1, 𝑒 -𝛾 represents a function of 𝑃 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 , the probability that nodes i and j are within n hops. 𝑃 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 is computed as:

𝑃 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 = 𝑞 𝑖,𝑗 𝑘-𝑜𝑝 𝑛 𝑘=1 (𝑡) 𝑤𝑒𝑟𝑒 𝑞 𝑖,𝑗 𝑘-𝑜𝑝 (𝑡) = 𝑃 𝑖 𝑙𝑜𝑐 =𝑙 𝑡 𝑃 𝑗 𝑙𝑜𝑐 =𝑚 𝑡 (𝑙,𝑚 )𝜖𝑆 𝑘 (7)
Here 𝑃 𝑗 𝑙𝑜𝑐 =𝑚 𝑡 is the probability that node j is in location m at time t, and 𝑆 𝑘 is a set covering all (l, m) pairs with the distance between l and m being k hops. Assuming that nodes move independently, we can verify that 𝑃 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 is the probability that nodes (i, j) are within n hops of each other at time t.

In 𝑒 -𝛾 , we define  by:

𝛾 = 1 𝑎 * 𝑃 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 ( 8
)
where 𝑎 is a positive constant. The decay factor 𝑒 -𝛾 increases monotonically with

𝑤𝑒𝑟𝑒 𝑃 𝑖 𝑚𝑎𝑥 -𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 = 𝑚𝑎𝑥 𝑃 𝑖,1 1-𝑜𝑝 , … , 𝑃 𝑖,𝑛

1-𝑜𝑝 (10)
In Equation 9, the normalization by 𝑃 𝑖 𝑚𝑎𝑥 -𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 (𝑡) provides relative weights to intimacy, now ranging from 0 to 1. Note that 𝑃 𝑖,𝑗 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 0 can be calculated based on the location information preloaded in the initial network deployment. We also derive the objective trust values of each node in order to compare it against the trust value calculated by each node, called subjective trust. The objective trust is calculated without considering any network dynamics such as node mobility, trust decay over time, and trust decay as the trust chain becomes longer. The objective trust of node i is calculated by:

𝑇 𝑖 𝑜𝑏𝑗 𝑡 = 𝑃 𝑖 𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠 𝑡 + 𝑃 𝑖 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 + 𝑃 𝑖 𝑒𝑛𝑒𝑟𝑔𝑦 𝑡 /3 (11)
𝑃 𝑖 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 = 𝑃 𝑖,𝑗 1-𝑜𝑝 (𝑡) 𝑗 ∈𝑆 𝑁 𝑃 𝑎𝑣𝑔 -𝑜𝑏𝑗 -𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 (12)
Here 𝑃 𝑖 𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠 𝑡 , 𝑃 𝑖 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 , and 𝑃 𝑖 𝑒𝑛𝑒𝑟𝑔𝑦 𝑡 are the three components of trust derived from the SPN subnets explained in Section 3. Ideally, the objective trust value 𝑇 𝑖 𝑜𝑏𝑗 𝑡 , of node j, would be known to all other nodes. In practice, node i estimates the trust value via the subjective trust value 𝑇 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 as discussed earlier in Equation 1. As discussed by Josang et al. [START_REF] Josang | Analyzing the relationship between risk and trust[END_REF], it is desirable that the subjective trust value is below the objective trust value; this ensures that agents are not exposed to unnecessary risk, but clearly there will be missed reward. We will consider objective intimacy based on the average intimacy degree on node i evaluated by all other nodes divided by the average intimacy probability (i.e., the average probability that two nodes will be located as 1-hop neighbors in the operational area). See Section 3 for a specific numeric example. We can then evaluate how accurately subjective trust values are calculated by varying the length of the trust chain through Equation 1, and comparing them with the objective trust shown in Equation 11. Note that the objective trust is not known in real situations, and so it is predicted and used to conservatively evaluate the validity of the proposed scheme.

In Equation 1, we derive a in order for a trust-based system lifetime based on subjective trust to be at least equal to or less than one based on objective trust. Here by the system lifetime, we mean the the accumulated ime period over which the system trust values are above a certain system drop dead trust level, say 𝑇 𝑣𝑎𝑙𝑢𝑒 , as used in Section 4.

Energy Model

We associate the energy level of a node with its state: selfish or group member. Depending on its remaining energy, a node acts differently. The degree of energy consumption is also affected by the node's state. Thus, these parameters are interwoven and affect a node's lifetime significantly.

A GCS in MANETs must handle events such as beaconing, group communication, rekeying, and status exchange. In particular, after a status exchange event, trust evaluation of 1-hop neighboring nodes as well as of distant nodes is performed. Each node may transmit its own status (e.g., information providing the trust values) as well as status of other nodes (i.e., trust values) on its trust chain. Recall that we use recommendations from 1-hop neighbors for trust evaluation and each status message is disseminated periodically. Due to space constraints, we omit the detail of the energy consumption model and refer the reader to [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF].

Performance Model

This section describes how our analytical model is developed using SPN and how trust values are obtained from the SPN models.

Hierarchical Modeling using SPNs

SPN subnet: each node's information on the 3 components of the trust metric is collected upon every trust update interval

Trust value is computed from the last round of iterations that has met convergence conditions upon every trust update interval Run for each node

MPD < threshold YES NO

We develop a mathematical model based on SPN to analyze a GCS with nodes switching between selfish and altruistic behaviors based on the theory and identify design conditions under which the selfish versus altruistic behaviors can be balanced. With system lifetime and mission success probability as our reliability metric, we show that our trust management protocol operating under identified design conditions outperforms one that only encourages altruistic behaviors. We use SPN due to its efficient representation of a large number of states where the underlying models are Markov or semi-Markov models. We develop a hierarchical modeling technique to avoid state explosion problems and to improve solution efficiency for realizing and describing a large scale GCS.

We use an SPN subnet to describe each node's lifetime. The square-shaped operational area consists of m×m sub-grid areas with the width and height equal to wireless radio range (R). Initially the location of each node is randomly distributed over the operational area based on the uniform distribution. A node randomly moves to one of four locations in four directions (i.e., north, west, south, and east) in accordance with its speed. The speed of each node 𝑆 𝑖𝑛𝑖𝑡 is chosen uniformly over [0, v max ) m/s where v max is the maximum possible speed, and S init is then fixed during the node's lifetime. The boundary grid areas are wrapped around (i.e., a torus is assumed) to avoid end-effects. The SPN subnet for node i computes the probability that node i is in a particular grid area j at time t. This information along with the information of other nodes' location at time t provides the information about a node's n-hop neighbors at time t, which we will use to compute the trust metric (see Section 2.2). Since node movements are assumed to be independent, the probability that two nodes are in a particular location at time t, is given by the product of the two individual probabilities. The SPN subnet also describes a node's lifetime and can be used to obtain each node's information (amount of energy, unselfishness, and intimacy) to derive the trust relationship with other nodes in the system. This process is done by running the SPN subnet N times for the N nodes in the network.

In the first round of iteration, since there is no information available about 1-hop neighbors, it is assumed that each area has an equal number of nodes and all nodes are unselfish. In the second round of iteration, based on the information collected (e.g., number of unselfish or selfish 1-hop neighbors) from the first round, each node knows how many nodes are 1-hop neighbors that can directly communicate with it, and whether or not they are members of the GCS or selfish. A node also knows how many n-hop neighbors it has at time t. It then adjusts its perceived status of 1-hop neighbors at time t with the output generated from the j th round of iteration as input to the (j+1) th round of iteration. This process continues until a specified convergence condition is met. The Mean Percentage Difference (MPD) is used to measure the difference between critical design parameter values, including a node's energy level, the selfish probability, and the unselfish probability of a node at time t in two consecutive iterations. The iteration stops when the MPD is below a threshold 1 percent (%) for all nodes in the system. The calculation of the MPD of parameter X for node i is given by:

𝑀𝑃𝐷 𝑖 𝑋 = 𝐷 𝑖 𝑋 𝑡 𝑚𝑎𝑥 𝑡 𝑁 𝑖𝑛𝑡𝑒𝑟𝑣𝑎𝑙 𝑤𝑒𝑟𝑒 𝐷 𝑖 𝑋 (𝑡) = 𝑋 𝑖 𝑗 +1 𝑡 -𝑋 𝑖 𝑗 (𝑡) 𝑋 𝑖 𝑗 (𝑡) ( 13
)
where 𝑋 𝑖 𝑗 (𝑡) indicates the value of parameter X of node i at time t in the j th round of iterations, max is the maximum time measured, and 𝑁 𝑖𝑛𝑡𝑒𝑟𝑣𝑎𝑙 the number of time points. We compute MPD for each node's probabilities of being alive, selfish, and unselfish. The node SPN subnet after convergence yields the trust probabilities for three trust components (i.e., unselfishness, energy, and intimacy). The trust metric is then calculated as explained in Section 2.2.

Fig. 2. SPN subnet for describing the status of a node.

Fig. 2 shows the SPN subnet. The subnet describes a node's mobility behavior, join and leave events (i.e., GCS membership status), energy consumption, and selfish behaviors with a redemption mechanism provided. The transition T_LOCATION is triggered when a node moves to a randomly selected area in one of four different directions from its current location with the rate calculated as 𝑆 𝑖𝑛𝑖𝑡 𝑅 based on an initial speed (S init ) and wireless radio range (R). We assume that inter-arrival times of a node's join and leave requests are exponentially distributed with rates λ and μ respectively. Place energy represents the current energy level of a node.

An initial energy level is assigned according to node heterogeneity information. In our analytical model, we randomly generate a number 𝐸 𝑖𝑛𝑖𝑡 in the range of [𝐸 𝑚𝑖𝑛 , 𝐸 𝑚𝑎𝑥 ] based on the uniform distribution. A token is taken out when transition T_ENERGY fires. The transition rate of T_ENERGY is adjusted on the fly based on a node's state; it is lower when a node becomes selfish to save energy or when a node changes from a member to a non-member, following the energy consumption model in [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF]. We assume that T seconds will be taken to consume one energy token when a member node has no selfish 1-hop neighbors. We use this energy consumption model for adjusting the time taken to consume one token in place energy based on a node's status. Therefore, depending on the node's status, its energy consumption behavior is dynamically changed.

Place SN represents whether a node is selfish or not. If a node becomes selfish, a token goes to SN by triggering T_SELFISH. When a node becomes altruistic again, transition T_REDEMP is triggered. A node switches between selfish and altruistic following the demand and pricing theory described in Section 3.2 below. The SPN model in Fig. 2 yields the trust components 𝑃 𝑗 𝑋 𝑡 where X = energy, unselfishness, and location (to derive intimacy), from which the n-hop trust components and the trust metric can be computed via Equations 1-10.

Demand and Pricing Model

The basic formula to represent the relationship between demand and pricing in a market is given by [START_REF] Case | Principles of Economics[END_REF][START_REF] Aldebert | Telecommunications demand and pricing structure: an economic analysis[END_REF]:

𝜆 𝑖 = 𝛼 𝑖 𝑣 𝑖 -𝜀 𝑖 𝑤𝑒𝑟𝑒 𝜀 𝑖 > 1, 𝛼 𝑖 > 0 (14)
where 𝜆 𝑖 is the demand arrival rate and 𝑣 𝑖 is the pricing of service i while 𝛼 𝑖 and 𝜀 𝑖 are constants correlating 𝜆 𝑖 and 𝑣 𝑖 . Service demand is affected by pricing changes where the elasticity constant 𝜀 𝑖 is a key determinant. A market is said to be elastic if 𝜀 𝑖 > 1, as assumed here. In such a case lowering the price leads to increase in demand. The elasticity 𝜀 𝑖 can be obtained from statistical data describing past market conditions. We adopt DP theory to decide whether a node should behave selfishly or altruistically based on both individual benefit (i.e., saving energy) and global interest (i.e., serving tasks). We use transition T_SELFISH in our SPN model (described in Section 3) to model a node's changing behavior from altruistic to selfish. Note that remaining energy of a node, mission difficulty, and degree of unselfishness of 1-hop neighbors are used for the place of "price" to apply DP theory in Equation 14. The transition rate to transition T_SELFISH is modeled by:

𝑟𝑎𝑡𝑒 𝑇_𝑆𝐸𝐿𝐹𝐼𝑆𝐻 = 𝑓 𝐸 𝑟𝑒𝑚𝑎𝑖𝑛 𝑓 𝑀 𝑑𝑖𝑓𝑓𝑖𝑐𝑢𝑙𝑡𝑦 𝑓 𝑆 𝑑𝑒𝑔𝑟𝑒𝑒 𝑇 𝑔𝑐 (15)
where 𝑓 𝑥 = 𝛼𝑥 -𝜀 , 𝐸 𝑟𝑒𝑚𝑎𝑖𝑛 is the level of current energy (indicated as 𝑚𝑎𝑟𝑘 𝑒𝑛𝑒𝑟𝑔𝑦 in SPN model of Section 3), 𝑀 𝑑𝑖𝑓𝑓𝑖𝑐𝑢𝑙𝑡𝑦 is the difficulty level of a given mission where a higher value indicates a tougher mission, and 𝑆 𝑑𝑒𝑔𝑟𝑒𝑒 is the degree of selfishness where a higher number refers to more selfishness. We define 𝑆 𝑑𝑒𝑔𝑟𝑒𝑒 as the ratio of selfish nodes to unselfish nodes among 1-hop neighbors (refer to [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF] for the calculation of the number of selfish/unselfish 1-hop neighboring nodes). 𝑇 𝑔𝑐 is the interval for disseminating a group communication packet where a node's selfishness can be observed. In the context of DP theory, residual energy, mission difficulty and neighborhood selfishness are the prices, and the transition rate from altruistic to selfish is the demand. Equation 15implies the following:

 𝑓 𝐸 𝑟𝑒𝑚𝑎𝑖𝑛 : If a node has a higher level of energy, it is less likely to be selfish.  𝑓 𝑀 𝑑𝑖𝑓𝑓𝑖𝑐𝑢𝑙𝑡𝑦 : If a node is assigned a tougher mission, it is less likely to be selfish.  𝑓 𝑆 𝑑𝑒𝑔 𝑟𝑒𝑒 : If a node observes high selfishness among its 1-hop neighbors, it is less likely to be selfish.

Similarly, we use a transition T_REDEMP in the SPN model (shown in Fig. 2 of Section 3.1) to model the redemption of a node, changing its behavior from selfish to altruistic. The rate to transition T_REDEMP is modeled as:

𝑟𝑎𝑡𝑒 𝑇_𝑅𝐸𝐷𝐸𝑀𝑃 = 𝑓 𝐸 𝑐𝑜𝑛𝑠𝑢𝑚𝑒𝑑 𝑓 𝑀 𝑒𝑎𝑠𝑖𝑛𝑒𝑠𝑠 𝑓 𝐻 𝑑𝑒𝑔𝑟𝑒𝑒 𝑇 𝑠𝑡𝑎𝑡𝑢𝑠 (16)
where𝑓 𝑥 = 𝛼𝑥 -𝜀 , 𝐸 𝑐𝑜𝑛𝑠𝑢𝑚𝑒𝑑 is the level of consumed energy (𝐸 𝑖𝑛𝑖𝑡 -𝐸 𝑟𝑒𝑚𝑎𝑖𝑛 ) where 𝐸 𝑟𝑒𝑚𝑎𝑖𝑛 refers to the remaining energy, 𝑀 𝑒𝑎𝑠𝑖𝑛𝑒𝑠𝑠 is the easiness level of a given mission where a higher number indicates an easier mission (e.g., 𝑀 𝑚𝑎𝑥 -𝑑𝑖𝑓𝑓𝑖𝑐𝑢𝑙𝑡 𝑦 -𝑀 𝑑𝑖𝑓𝑓𝑖𝑐𝑢𝑙𝑡𝑦 ), and 𝐻 𝑑𝑒𝑔𝑟𝑒𝑒 is the degree of unselfishness where a higher number means more unselfishness among 1-hop neighbors. We define 𝐻 𝑑𝑒𝑔𝑟𝑒𝑒 = 1/𝑆 𝑑𝑒𝑔𝑟𝑒𝑒 as the ratio of unselfishness to selfishness (refer to [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF] for the calculation of the number of selfish/unselfish 1-hop neighboring nodes). A node is given a chance to be redeemed (from selfish to altruistic) in every reevaluation period 𝑇 𝑠𝑡𝑎𝑡𝑢𝑠 corresponding to the status exchange interval for trust evaluation. Equation 16 implies the following:

 𝑓 𝐸 𝑐𝑜𝑛𝑠𝑢𝑚𝑒𝑑 : If a node has consumed more energy, it is less likely to redeem itself. This means that if a node has low energy, it may want to further save its energy by staying selfish.  𝑓 𝑀 𝑒𝑎𝑠𝑖𝑛𝑒𝑠𝑠 : If a node is assigned an easier mission, it is less likely to redeem itself.

 𝑓 𝐻 𝑑𝑒𝑔𝑟𝑒𝑒 : If a node observes high unselfishness among its 1-hop neighbors, it is less likely to redeem itself and may continue to stay selfish in order to save its energy.

Calculation of Trust Components

The trust value of node j by node i is calculated based on the information on nodes collected from the SPN subnet upon convergence. We calculate the trust probabilities for the three components (i.e., 𝑃 𝑗 𝑋 (𝑡)) of trust based on a reward assignment technique described below. Specifically, the average value, 𝑋 𝑡 , of a physical property at time t, is the state probability weighted sum of the values at various states, i.e.,

𝑋 𝑡 = 𝑟 𝑖 * 𝑃 𝑖 (𝑡) 𝑖∈𝑆 ( 17
)
where S is a set of states that meet particular conditions, 𝑃 𝑖 (𝑡) is the probability that the system is in state i at time t, and 𝑟 𝑖 is the reward or value assigned to the physical property in state i.

Numerical Results and Analysis

This section shows the results obtained through the evaluation of our hierarchical SPN model. Table 2 summarizes the parameters and their default values used in this case study. As shown in Table 2, we set the elasticity constant ε to 2. To maintain a sufficient number of active nodes in the network, the ratio of node join and leave is set to 4:1. The energy level assigned to each node has an average value of 9 hours, representing a reasonable average battery life for mobile devices. Fig. 3 shows the average trust values of all nodes evaluated by all nodes (hereafter called "system trust") over time parameterized by the length of the trust chain (labeled as TC) under M1. We notice that the maximum trust values are obtained with TC = 3. The effect of using different lengths of TC on trust levels is already examined in our prior work [START_REF] Cho | Modeling and analysis of trust management for cognitive mission-driven group communication systems in mobile ad hoc networks[END_REF]. Note that objective trust predicted via Equation 11 is always larger than the subjective trust computed via Equations 1-10. Thus units are not exposed to unnecessary risk (as noted by Josang et al. [START_REF] Josang | Analyzing the relationship between risk and trust[END_REF]); but this also implies that there is some missed reward. Fig. 4 depicts the maximum system trust values identified by TC = 3. We compare the demand and pricing based system (labeled as DP) with the solely altruistic system (labeled as ALT) when different missions are given (labeled as M1, M2, and M3, where M3 requires the highest workload in this case study). As expected, the system assigned M3 has the lowest trust values while the system assigned M1 performs the best, showing the highest trust values. Further, DP significantly performs better than ALT for the same mission M1 or M2 and its effect is more pronounced as time progresses. Our composite trust metric takes into account both the energy level as well as the degree of unselfishness (or cooperation). As a result, the use of DP yields higher trust values. Under M3, the mission difficulty is increased; hence, nodes do not behave selfishly in the beginning. Thus, we note that DP performs only slightly better than ALT in the beginning. Because of the increased workload, energy consumption is larger, and the system lifetime is correspondingly shorter under M3 when compared with M1 and M2. Selfish behaviors can increase system lifetime by saving energy; on the other hand, if too many nodes are selfish, there will be not an adequate number of cooperative nodes, and the mission will fail. Next we examine the maximum degree of selfishness that can be allowed in order to improve successful mission completion. Suppose the mission can be executed successfully as long as there is at least one cooperative node in an area and a node maintains its trust level at least above the ignorance level, 0.5. Table 3 shows the percentage of cooperative nodes when the system drop dead trust value (T value ) is at least above 0.5 under DP and ALT for various types of missions. Table 3 also shows the system lifetime, the total time when T value is above 0.5. ALT has a larger number of cooperative nodes; but unlike DP, it does not take into account energy, and thus it is unable to maintain a high trust level. We also see that as the mission difficulty decreases, the system is able to prolong its lifetime under DP, maintaining at least the minimum required number of cooperative nodes.

Conclusions

In this paper, we developed and analyzed a trust management protocol for a missiondriven GCS in MANETs; we used demand and pricing theory to model selfish and altruistic behaviors to balance individual welfare (i.e., saving energy) versus global welfare (i.e., serving tasks and completing the mission). Our trust management protocol based on DP theory allows each node to dynamically decide if it should stay selfish or altruistic in response to changing environmental conditions so that the overall system trust level can be maximized. We developed a probability model based on SPN to describe the behavior of a large scale GCS operating under the proposed trust management protocol. The results show that our trust management protocol outperforms one that only encourages altruistic behaviors, especially when the mission assigned to the GCS demands light to medium workloads; under these cases our protocol can best explore the tradeoff between energy saved due to selfishness versus quick energy drainage due to altruism.

As future work, we plan to (1) examine the sensitivity of the results obtained with respect to α and ε which are two important parameters in the demand and pricing theory underlying our trust management protocol; (2) develop a more sophisticated mission model considering the effect of mission attributes such as risk, deadline, and workload requirements; (3) analyze the impact of imperfect detection of node failures and attacks; and (4) consider group-based mobility models.

Fig. 1 .

 1 Fig. 1. Hierarchical modeling using SPN subnets.

Fig. 3 .

 3 Fig. 3. System trust value versus time, for various trust chain lengths.

Fig. 4 .

 4 Fig. 4. System trust value over time under DP and ALT, and for various missions with TC = 3.

  𝑃 𝑖,𝑗 𝑛-𝑜𝑝 𝑡 , implying that the trust evaluation is higher if it is more likely that the nodes are closer. The value of the constant 𝑎 (𝑎 < 1 versus 𝑎 > 1) dictates whether the decay function is convex or concave increasing in 𝑃 𝑖,𝑗 𝑛 -𝑜𝑝 𝑡 . The value of the constant a affects the propagation of trust; guidelines for choosing this parameter will be discussed elsewhere. Note that we use Equations 2-6 to compute trust component values of unselfishness and energy. 𝑃 𝑖,𝑗 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 , the third component of Equation1, can be obtained without the help of other nodes' recommendations since each node can detect and keep track of information on who has been with them as 1-hop neighbors through the beacon messages disseminated by each node periodically. 𝑃 𝑖,𝑗 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 , the degree that nodes i and j are 1-hop neighbors,

	is computed by:
	𝑃 𝑖,𝑗 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 𝑡 = 𝑃 𝑖,𝑗 1-𝑜𝑝 (𝑡)/𝑃 𝑖 𝑚𝑎𝑥 -𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 (𝑡)

Table 1 .

 1 The reward assignment technique allows us to compute a node's trust component values, say 𝑃 𝑗 𝑋 where X can be unselfishness and energy, and location information 𝑃 𝑗 𝑙𝑜𝑐 =𝑚 to derive intimacy trust component values at time t. We use the same reward assignment technique to obtain 𝑃 𝑗 ,𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠 𝑙𝑜𝑐 =𝑘 (𝑡) and 𝑃 𝑗 ,𝑠𝑒𝑙𝑓𝑖𝑠 𝑙𝑜𝑐 =𝑘 (𝑡), the probability that node i is located in area k as being selfish or unselfish. Reward functions.

	Component	Conditions Satisfied in S
	𝑷 𝒆𝒏𝒆𝒓𝒈𝒚 𝒕	𝑚𝑎𝑟𝑘 𝑒𝑛𝑒𝑟𝑔𝑦 > 0
	𝑷 𝒖𝒏𝒔𝒆𝒍𝒇𝒊𝒔𝒉 𝒕	(𝑚𝑎𝑟𝑘 𝑚𝑒𝑚𝑏𝑒𝑟 > 0) & (𝑚𝑎𝑟𝑘 𝑆𝑁 == 0) & (𝑚𝑎𝑟𝑘 𝑒𝑛𝑒𝑟𝑔𝑦 > 0)
	𝑷 𝒍𝒐𝒄=𝒌 (𝒕)	𝑚𝑎𝑟𝑘 𝑙𝑜𝑐𝑎𝑡𝑖𝑜𝑛 == 𝑘 & 𝑚𝑎𝑟𝑘 𝑚𝑒𝑚𝑏𝑒𝑟 > 0 & (𝑚𝑎𝑟𝑘 𝑒𝑛𝑒𝑟𝑔𝑦 > 0)
	𝑷 𝒖𝒏𝒔𝒆𝒍𝒇𝒊𝒔𝒉 𝒍𝒐𝒄=𝒌	(𝒕)	(𝑚𝑎𝑟𝑘 𝑚𝑒𝑚𝑏𝑒𝑟 > 0) & (𝑚𝑎𝑟𝑘 𝑆𝑁 == 0) & 𝑚𝑎𝑟𝑘 𝑒𝑛𝑒𝑟𝑔𝑦 >
			0 & (𝑚𝑎𝑟𝑘 𝑙𝑜𝑐𝑎𝑡𝑖𝑜𝑛 == 𝑘)
	𝑷 𝒔𝒆𝒍𝒇𝒊𝒔𝒉 𝒍𝒐𝒄=𝒌 (𝒕)	(𝑚𝑎𝑟𝑘 𝑚𝑒𝑚𝑏𝑒𝑟 > 0) & (𝑚𝑎𝑟𝑘 𝑆𝑁 > 0) & 𝑚𝑎𝑟𝑘 𝑒𝑛𝑒𝑟𝑔𝑦 > 0
			& (𝑚𝑎𝑟𝑘 𝑙𝑜𝑐𝑎𝑡𝑖𝑜𝑛 == 𝑘)

Table 1

 1 specifies the conditions to be satisfied for states in set S in calculating 𝑃 𝒆𝒏𝒆𝒓𝒈𝒚 𝑡 , 𝑃 𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠 𝑡 , 𝑃 𝑙𝑜𝑐 =𝑘 𝑡 , 𝑃 𝑢𝑛𝑠𝑒𝑙𝑓𝑖𝑠

	𝑙𝑜𝑐 =𝑘	𝑡 , and 𝑃 𝑠𝑒𝑙𝑓𝑖𝑠 𝑙𝑜𝑐 =𝑘 (𝑡). When the specified
	conditions are satisfied, a reward of a 1 is assigned. Based on 𝑃 𝑗 𝑙𝑜𝑐 =𝑘 (𝑡) so obtained,
	various k-hop trust probabilities can be computed. For example, the trust value for the
	intimacy component when i and j are 1-hop apart, 𝑃 𝑖,𝑗 𝑖𝑛𝑡𝑖𝑚𝑎𝑐𝑦 , can also be obtained as
	described in Section 2.2.

Table 2 .

 2 Default parameter values used.

	Param	Value	Param	Value	Param	Value
	k recom	3	N	150	α, ε	0.01, 2
	R λ	250 m 1/(60*60)	T status T beacon	60*10 s 60*2 s	𝐸 𝑖𝑛𝑖𝑡 𝑇 𝑔𝑐 𝑀1	[6, 12] hrs 60*10 s
	µ	1/(60*60*4)	T	60*60 s	𝑇 𝑔𝑐 𝑀2	60*5 s
	β	0.8: 0.2	𝑆 𝑖𝑛𝑖𝑡	(0, 2) m/s	𝑇 𝑔𝑐 𝑀3	60 s

Table 3 .

 3 Percentage of cooperative nodes versus system lifetime when T value > 0.5.

(

M1, DP) (M1, ALT) (M2, DP) (M2, ALT) (M3, DP) (M3, ALT) % of cooperative nodes when T value > 0.5

		> 27%	> 65%	> 35%	> 54%	> 25%	> 78%
	Lifetime when T value > 0.5	26400 s	17400 s	14400 s	9600 s	3200 s	1800 s

Acknowledgement

This project is supported in part by an appointment to the U.S. Army Research Laboratory Postdoctoral Fellowship Program administered by the Oak Ridge Associated Universities through a contract with the U.S. Army Research Laboratory.


Claire Berchet
email: berchet@esia.univ-savoie.fr

Georges Habchi
email: habchi@esia.univ-savoie.fr

The Control Centre: a Basic Concept for Modelling and Simulation of Industrial Control

Keywords: Modelling, simulation, control centre, information, manufacturing systems

In the first part of this paper, a review of the main potentials, of some applications and the major limits of simulation are presented. In order to find solution of some limits, we propose in the second part the introduction of the control process into simulation, thanks to the concept of Control Centre (CC). The CC is then described by giving its definition, its components and their organisation in a simplified manner, as well as a typology of the information defining the relations between CCs and the controlled system. These relations correspond to the warning messages circulating between CCs, the base of co-operation and co-ordination relations of the proposed model. Finally, a formalisation of the internal behaviour of the CC is proposed in a detailed way, for its integration in a PPS (Product Processing System)/CC network.

INTRODUCTION

Nowadays computer simulation of manufacturing systems is limited to representation, validation, and performance evaluation of complex processes. As we can not react, in a structured and organised way, on the system results during simulation, it's role is somewhere "passive". Then, to enhance the capacity of this technique and to make it more "active", the goal of our actual research corresponds to the introduction of some basic concepts concerning the industrial control into the field of simulation. Some existing research works concerning these aspects, are called "reflective simulation" or "external and internal" models of simulation [Kosturiak et al. 97].

THE SIMULATION

At first, this paper will consider an overview on the state of the art of production simulation, namely: its potentials, its use in industrial companies, its principal contributions concerning production systems and its limits.

Potentials of simulation

The potentials of simulation are very large (figure 1). The simulation can help users by contributing in design, in management and in decision making of production systems. Its capacities allow the modelling of all kinds of company flows: the informational flow, the physical flow and the decisional flow. This modelling could be made, on various hierarchical levels (strategic, tactic, operational) [Bakalem et al. 95] [ Cumenal 97] and abstraction levels (levels depending on the resource states): machine, workshop, production line, factory, busy, idle, breakdown, set-up, etc. Moreover, all the manufacturing system life cycle phases could be covered by simulation: the design, the realisation [Chau et al. 94] [Khalfoun et al. 95] and the exploitation [Habchi et al. 95] of the system.

Use of simulation

The simulation is widely used in the field of production systems and applications are very numerous. Abundant literature is available on this subject, particularly on the simulation use of manufacturing systems [Gardiner et al. About this subject, Gregor and J. Kosturiak [Gregor et al. 97] establish a state of the art on the use of simulation in this field. They present studies: on the FMS (Flexible Manufacturing Systems), on a comparison between various management models, on some management parameters, on stocks evolution of a production line… However today, concretely all possibilities of computer simulation are not used. Then the simulation is limited in its use and its applications.

Limits of simulation

The mane limits of simulation could be explained by the fact that the decision-making and its impact on the production system are not taken into account during simulation because the major existing tools are not adapted for decision and control modelling.

In addition, today simulation tools use complex concepts for the potential user, and this does not support the "democratisation" of this technique.

Companies managers often ask simulation specialists to carry out models, then the use of simulation in industrial circle remains specific and limited.

At present time, it's impossible to apply simulation modelling to the production system and to its control system without difficulties. However, in order to have a successful study, the system must be modelled according to all its components (flows): operational, informational and decisional.

Thus, in order to use almost the all capacities of simulation and to make it more "active", our goal is to conceptualise and model the industrial control by the use of a generic object, in order to integrate it in a simulation support tool: the Control Centre (CC).

Other researchers work on these aspects [Castagna et al. 99]. Kindler [Kindler 99] writes about "reflective simulation" or about "internal and external" models of simulation.

Even if the modification of a parameter is possible during simulation running, it is not done according to control logic. This logic must imply the introduction of loops of feedback around each resource to be controlled. Currently, because of lack of these feedback loops, the action of controlling requires many experiments to have an optimisation of the results. Before defining the Control Centre (CC), it is important to know which structure and which type of industrial control we choose.

THE CONTROL CENTRE

Structure and type of industrial control

The selected type and the structure of control are

Potentials of simulation

specified: an "interpreted control" in a "coordinated hierarchical structure" [Le Moigne 74] [Trentesaux 96] [Grabot et al. 96]. The interpreted control and the co-ordinated hierarchical structure are considered in order to take into account the reality of evolution of the industrial system and of its control process, according to the modification of management methods and the introduction of new concepts. In the contemporary enterprise, individual decision-maker is "responsabilised" and has the capacity of interpretation at each hierarchical level (operational, tactical, and strategic). The decision-making process becomes more interactive, non-linear, complex, etc. du to the exponential increase of decision-makers. So the control is based on a personal interpretation of the actors: each actor has an individual capacity of interpretation [Bitton 90] [ECOSIP 90] [ Pellegrin 97] [Kindler 99].

Moreover, the decision-maker must use, manage and control his system in coherence with the other actors, to answer together to the target objectives. Then, in one hand, the decision-making process and the internal organisation of CC must be relevant and in the other hand, the bonds between these various CCs, must be coherent, co-ordinated and organised.

The framework of our research being established, the Control Centre (CC) is then described by giving its definition, its components and its internal behaviour.

Definition

We define the Control Centre (CC) as "an autonomous structure, depending on the enterprise global strategy, having a decisional authority, associated with an entity and having necessary resources to apply actions and to achieve the defined goals within the global framework of the enterprise".

Components

The components (figure 3) of a CC are the following: actors, referents, objectives, intrinsic and extrinsic information, decisional tools (performance indicators…), measures and performance evaluation, decision, actions and resources for their implementation. Then we present the components organisation in a simplified way corresponding to three main phases (figure 4):  the first phase concerns the gathering of event and periodic measures from the controlled system,  the second phase concerns the decisionmaking process,  the third phase concerns the application of the decided action plan on the controlled system.

These three phases are used as a basis for more detailed internal behaviour process of the CC.

Internal behaviour process of the CC

Finally, to formalise the decisional system, we describe the internal behaviour process of the CC (the precedent simplified global behaviour and the components organisation are presented in a detailed way) (figure 5). Indeed, after having obtained the measure from the controlled system, concerning the PPS state and its flow, by the help of result and process indicators, our objective is to describe the decision-making process of the CC. This process is divided into three steps.

Actions variables

Intrinsic information -referent -local objectives -drive rules

Decisionmakers -actors

Resources

a) Performance evaluation of the controlled system and its physical flow. This step consists to analyse the measure obtained from the controlled system (PPS), to compare it with the CC local objective, and then to conclude if a deviation exists. During this evaluation the information is taken into account for the cooperation relations between CCs. This formalisation is available in order to integrate the CC in a PPS (Product Processing System)/CC network.

b) Evaluation of the inductors responsible of

the deviation. The second step concerns the identification of the inductor responsible of the deviation from a list of inductors. The choice of inductor is realised according to a history of the controlled system. Each inductor corresponds to a performance process indicator or a performance result indicator of a lower level of the decision global structure. As each inductor is associated to an objective, the evaluation at this stage consists on the determination of the deviation of each one and its impact on the controlled system. c) Evaluation of the action plan using "internal simulation". The third step of the decision-making process consists of testing the actions determined at the preceding step, by internal simulation using the controlled system (the PPS is simulated at the moment when the measure is gathered). This is a performance evaluation using internal simulation, in order to define the adequate action plan. If the deviation is always reached after simulation of the action plan, other possible actions are tested, until the deviation is eliminated. If the target level of performance indicator is not reached any more (no deviation), the action plan to be adapted is found and can be applied "really" to the controlled system. This is the last step of the simplified control process.

COOPERATION AND COORDINATION BETWEEN CCs

We propose in a no exhaustive manner a typology of information concerning the existing links, between the CCs in the one hand and between the CCs and the controlled system on the other hand [Berchet et al. 99]:  structural information (concerning products, resources, customers),  decisional information (objectives emitted by a CC, towards one or several CCs of the same level or of a lower hierarchical level),  control information (state of the controlled system at the operational level),  state information (obtained from the controlled system with an event measure),  feedback information (obtained from the controlled system with a periodic measure),  environment information (concerning CCs at a higher hierarchical level, in the case of strategic decisions).

The goal of this typology is to structure the information used during de CC internal process.

The coherence of the whole enterprise system depends on this information, and then, a global hierarchical co-ordinated structure organises CCs between them according to three dimensions (hierarchy, time and space). This typology is the base support of the coordination and co-operation relations. Following this first analysis of information necessary to analyse the relations of exchange between the CCs, we can formalise the co-operation and coordination relations between CCs: these information are in fact, warning messages which are circulating between CCs (figure 6).

These messages could be vertical (bottom up or top down), or horizontal. Let us see now which type can be these messages, and which are their points of emission and reception by the CC [Habchi et al. 99]. The figure 6 shows these various points of reception and emission which are then detailed in the following part.

Emission of warning messages by the CC a) Emission of horizontal messages  "my objective is not reached"

In the case of deviation following the performance evaluation of the controlled system, the CC informs the concerned CCs on its deviation. These CCs could then anticipate action if necessary and a problem appears on their controlled system.

 "I determined the causes of my deviation" Following a deviation, the CC knows his inductors, then evaluates them to know which one is in deviation. Then the CC informs the other CCs about these inductors. The concerned CCs could then anticipate if necessary a problem on their controlled system.  "I found the action plan restoring my situation" By evaluating its action list, the CC found the action plan that restored the situation of "nodeviation": the behaviour awaited initially. It informs the concerned CCs about this action that will be applied to the controlled system. The CC have to give the parameters of the action, its reaction time (RT) and the result awaited at the end of this RT.

b) Emission of ascending vertical messages

"my objective is not reached or my objective is achieved" Following a request for statement, the CC gives to its supervisor CC the result of his performance evaluation: deviation or not. "I tested all possible action plans, but no one restores the situation"

The CC evaluated all possible actions (corresponding to the inductors having a deviation), but no one of them restores the situation. It informs its supervisor CC about its conclusion. This CC have to analyses the whole of the results of its CCs, perhaps to determine the origin of the problem (it is necessary to reexamine the objectives of the last CC).

 "My objective is restored"

The CC found, in its possible action list, that which restored the situation of not-deviation: the behaviour awaited initially. It informs its supervisor CC its objective will be achieved following this action (within its reaction time).

c) Emission of downward vertical messages

 "I modify some parameters of my controlled system -I modify the objective of my CC" Following an action, the CC modifies parameters on its controlled system at the operational level. If it is about a CC of higher hierarchical level, it will modify the objective of the controlled CC.

 "What is your current situation?"

The supervisor CC can require a report of the situation of a CC, which will become for it, a measure to be evaluated and compared to its own objectives.

Reception of warning messages by the CC a) Reception of horizontal messages

 "Are there any messages of my near CCs?" Following warning messages from the nearest CCs as: "my objective is not achieved", "I determined the causes of my deviation", "I found the action restoring my situation".

If these messages could have an influence on the behaviour of the controlled system of the concerned CC, the CC can decide to apply a preventive action to its system.

b) Reception of ascending vertical messages

 "Are there any messages of my lower CCs?" Following the warning messages of the lower CCs as: "my objective is not achieved or is achieved", "I tested all the possible actions plan, but none restores the situation", "my objective is restored". The supervisor CC evaluates its performance according to this new information (state, and feedback information) and to its own objective.

c) Reception of downward vertical messages

 "Are there any messages of my supervisor CC?"

The CC must take into account these messages coming from of its supervisor: "I modify the objective of my CC": In this case, the CC has to update its objective to do the next evaluations according to this new data.

"What is your current situation?": In this case, the CC has to evaluate the performance of its controlled system and give an account of its state of deviation or not-deviation.

CONTROLLED SYSTEM

Application of the action plan Measure Some authors [Camalot et al. 97] formalise interactions between computer agents using the principle of communication by messages sending. This approach that will be used in our model to formalise the interactions between CCs, makes it possible to give to each message sending the statute of an act of language answering an objective and a context given from which a logic of the conversations is built. Thus, the agents' exchange messages answering using the same format.

These messages contain the information described below:  Action; (desired action selected by CC among the list of pre-established possible actions),  (source of message corresponding to the CC which sends the message),  Receiver; (target CC corresponding to the CC for which the message is intended),  Message identifier; (the identifier or name given to the message),  Date of emission; (date at which the message was transmitted),  Limit date; (date at which the message does not take place any more to be or is not valid),  Matter; (contents of the message, the parameter of the system to be controlled for example),  Objective; (event that processing is at the origin of the interactions).

CONCLUSION

The research presented in this article will complete precedent works of our research team on the physical flow modelling and simulation of manufacturing systems using the PPS concept (Product Processing System). Indeed, the behaviour of the PPS was being already formalised in precedent work. This generic concept called PPS has the same structural and behavioural characteristics as a resource (machine, stock, operator, etc.). It carries out mainly the three basic functions: "reception", "transformation" and "supplying". In addition, it is able to model the different resource states: idle, busy, blocked, broken down, etc.

We propose the modelling of the informational and physical system using the PPS concept in one hand, and the modelling of decisional system using the CC concept in the other hand.

Then, our actual research work lies the CC to the PPS, formalises the CC behaviour and the links between CCs and PPSs. This formalisation allows us to introduce reactive control into simulation at the operational level of manufacturing systems, and then:

 to make simulation more "active",  to react in a structured way on the system in the case of deviations with respect to its expected behaviour during the simulation,  to widen and benefit more from the potentials of simulation.

Lastly, the different objects which form the "PPS/CC network" (PPSs, CCs, entities, generator of orders, etc.) are modelled using Unified Modelling Language (UML).

Figure 1 .

 1 Figure 1. Potentials of simulation.

  93] [Wagner et al. 94] [Bouchez et al. 95] [Perona 96] [Claver et al. 97], etc. Figure 2 gathers a list of the mane contributions of simulation in the field of the production systems [Berchet et al. 00].

Figure 2 -

 2 Figure 2-Use of simulation in the field of manufacturing systems.

Figure 3 -

 3 Figure 3-Components of the CC.

Figure 4 -

 4 Figure 4-Global internal behaviour of the CC.

Figure 5 -

 5 Figure 5 -Detailed internal behaviour of the CC.

Figure 6 -

 6 Figure 6-Emission and reception points of warning message of the CC.

SIMULATION USE IN THE FIELD OF MANUFACTURING SYSTEMS

	1-Accelerated application.	2-"A priori" performance evaluation
		3-Anticipated
	8-Tool for data	design,
	formalisation	evaluation and
		dimensioning.
		4-Comparison
	7-Macroscopic	of various
	and microscopic	management
	tool.	policies.
	6-Mediation	5-Learning
	tool.	tool.

Hierarchical levels Enterprise flows Manufacturing system life cycle phases

	Operational	Informational	Design
	Tactic	Physical	Réalisation
	Strategic	Decisional	Exploitation


Claire Berchet
email: berchet@esia.univ-savoie.fr

Georges Habchi
email: habchi@esia.univ-savoie.fr

MODELING FOR SIMULATION OF MANUFACTURING SYSTEMS CONTROL

Keywords: Modeling, simulation, control center, information, manufacturing systems

This article presents basic concepts regarding the modeling for simulation of production systems and in particular the concept of Control Center (CC). The CC is defined then formalized, for its integration in a simulation model. After an overview of the simulation current state of the art, the type of the selected control and structure are specified: an "interpreted control" in a "hierarchical coordinated structure". The CC is then described by giving its definition, its components and their organization in a simplified manner, as well as a typology of information defining the relations between the CC and the controlled system. Finally, we formalize the internal behavior of the CC in a detailed manner, for its integration in a PPS (Product Processing System)/CC network.

Introduction

The simulation is a powerful tool for manufacturing systems modeling and imitation [START_REF] Fishwick | Computer simulation: growth through extension[END_REF]. The reproduction of physical flows using simulation is nearly perfect. It is also an ideal tool for the follow-up and tracability of the informational flows associated with the physical flow [START_REF] Ballot | La Simulation Industrielle : Aide Réelle ou Virtuelle à la Prise de Décision ?[END_REF]. Thus, the capacities of simulation are broad and make it possible to contribute to the design, management and decision support of industrial systems. It is largely used in the design phase of a production system. Starting with the launching of a project and the analysis of the needs, it is used for validating, justifying and quantifying the necessary investment [START_REF] Chau | Decision-Support for the Design of a New Production Plant Using Visual Interactive Simulation[END_REF] [START_REF] Habchi | Study of Modeling and Simulation for a Chemical Production System[END_REF]. But it can also be used during the production system execution, either to modify it (diagnosis, weaknesses detection, implantation,…), or to anticipate the application of decisions and to contribute to the system control [START_REF] Habchi | Study of Lot Sizes on Job Shop Systems Performance Using Simulation[END_REF].

However, the current weaknesses of simulation lie on the one hand in the complexity of the concepts which it applies, and on the other hand in its incapacity to model decisions and consequently, the control system associated with a manufacturing system. In fact, it is almost impossible at the present time to model the pair production system / control system. Nevertheless, in order to have an acceptable system model, the studied system should be modeled according to all its components: operational, informational and decisional. That's why we wish to propose simple concepts dedicated to the introduction of control into simulation. We speak thus about "active simulation".

In the first part of this article, we describe the fields currently covered by simulation, its potentials, and its limits. In the second part, we present the framework of industrial control we are using, and the typology of control we adopt. Then, we define the concept of the Control Center (CC), by specifying the organization of its components, and by proposing a typology of the information circulating between the CCs on the one hand, and a CC and the controlled system on the other hand. Before concluding, we propose a formalization of the CC by a detailed specification of its internal behavior, and to form: the "PPS/CC network" [START_REF] Bakalem | Modélisation et simulation orientées objet des systèmes manufacturiers[END_REF].

The simulation and its limits with respect to the reactivity-issue

A synthesis of various definitions of simulation is proposed in [START_REF] Bakalem | Modélisation et simulation orientées objet des systèmes manufacturiers[END_REF]: "simulation is a method of measurement and study consisting in replacing a phenomenon or a system to be studied by a simpler data-processing model but having a similar behavior". Simulation is a tool still little mastered by companies. However, many are those who are concerned by the design or the evolution of manufacturing systems, and are faced with issues like: how to be sure that management applied on this production line is well adapted? How to convince the person in charge of the budget that it is essential to invest in such or such machine, or to take on the personnel? Are the selected parameters of management the best? Etc. Simulation is one of the tools that can help to answer these questions, and others. Its capacities allow the modeling of all flows of the company (physical, informational and decisional), and that, on various hierarchical levels: machine, workshop, production line or factory. Moreover, all the manufacturing system life cycle phases could be covered by simulation: the design, the realization and the exploitation of the system. Abundant literature is available on this subject, particularly on the simulation use in the field of manufacturing systems. Gregor and Kosturiak [START_REF] Gregor | Simulation : strategic technique for the Factory's future[END_REF] establish the state of the art in simulation, using various examples of simulation application: studies on FMS (Flexible Manufacturing Systems), a comparative study between a push flow management and a pull one, tests on the reduction in stocks on a production line, etc. We gather here a list of some contributions of simulation in the field of production systems:  an accelerated implementation,  an evaluation of profitability by advance (possibility of measuring and of evaluating performance by the help of various performance indicators),  a design, a modification and a dimensioning by "anticipation",  a solution of comparison between different alternatives of management,  a study of the influence of some management parameters; for example, the influence of the variation of management parameters (lot sizing) in the production planning [START_REF] Habchi | Study of Lot Sizes on Job Shop Systems Performance Using Simulation[END_REF] or in the MRP (Materials Requirement Planning) [START_REF] Gardiner | The effects of lot sizing and dispatching on customer service in an MRP environment[END_REF] [10],  a tool for training; the assistance of a simulator can sensitize the user with a new functioning logic of the workshop,  a tool for mediation; it can be used as a tool for negotiation, a basis for discussions between speakers, by illustrating the consequences of the assumptions under discussion,  a role of "macroscope"; simulation provides a global vision of the studied system, which is particularly interesting when the system is complex and/or when the actual size is very important,  a role of "microscope"; it makes it possible to produce important zooms related to the adapted detail level. However, concretely today, all possibilities of simulation are not used. The simulator often plays a "passive" role that is limited to the representation, the validation or/and the evaluation of a process of production. This is explained by the fact the decision-making and its impact on the production system are not taken into account during simulation. The existing tools are not adapted to model decisions and thus the control process of a production system. It's necessary to wait for the end of the simulation execution to modify a parameter, and then to remake a simulation, and this, until the results are acceptable. All these cases of application imply many tests before arriving at a certain optimization of the result. It is in fact almost-impossible to react in an automated way on the controlled system, when the simulation is running: we speak thus about "passive" use of simulation. In addition, simulation uses complex concepts for the potential user. This does not support the "democratization" of this tool, but rather the contrary. Thus, industrial people often ask for the help of specialists external to the company in order to model their systems. Consequently, the use of this tool remains specific and limited. Thus, in order to use all the capacities of simulation and to make it more "active", our objective is to introduce the generic concept of the Control Center (CC) into simulation. Other researchers work on these aspects, which they name "reflective simulation" or "internal and external" simulation [START_REF] Kindler | Nested Simulation of Container Yards[END_REF]. Before the definition of the CC, it is important to know which type of control and which structure of control we are using.

Which control to introduce into simulation?

Since the beginning of the Eighties, we assist at an evolution of the industrial systems, according to the modification of the management methods, the arrival of concepts like "Just In Time", "Supply Chain Management", "Concurrent Engineering", "Kaîzen", "Total Quality Management", etc. The control process effectiveness resides in its adaptation to these evolutions. These later result partly in the passage from an "authorithed" model in the traditional control (based on Taylor philosophy) into a contemporary model of "interpreted" control (based on the interpretation of the actors). This "enterprise of the real time" [START_REF] Kindler | Nested Simulation of Container Yards[END_REF] [START_REF] Bitton | Ecograi : Méthode de conception et d'implantation de systèmes de mesure de performances pour organisations industrielles[END_REF] responsalise indeed the individual decision maker -because of the interpretation capacity of each -and then the control model moves towards an open and integrated model [START_REF] Kindler | Nested Simulation of Container Yards[END_REF] [13] [START_REF] Ecosip | ouvrage collectif), Gestion industrielle et mesure économique[END_REF]. By extending the control process with new actors (then with new control centers), new variables, we get a richer one but a more complex also. Thus, the decision-making process, approached by some authors [START_REF] Ecosip | ouvrage collectif), Gestion industrielle et mesure économique[END_REF] [15] [START_REF] Lemaître | La décision, Les Editions d'Organisation, collection Tormaction[END_REF], becomes more interactive, nonlinear, due to the multiple decision-makers actors. The individual interpretation, unexploited at the operational level within the framework of Taylor philosophy, is requested today in an environment where the management of an event implies real time decision-makings. We take into account this reality and this "interpreted" control in our work.

The decision-maker actor has to use, manage and control his system in coherence with the other actors, in order to meet the fixed objectives. The traditional control process and the traditional hierarchy of the decision system are revised. Indeed, the control process requires a perfect enterprise organization and depends on its type of organization: the information system must be coherent with the physical system, and the decisional system must be coherent with the information system. Finally, the triptych "physical-information-decision" must be organized and operated in real time. Then the decision-making process, which is reflecting the internal organization of the CC, must be relevant and the links between these different autonomous and multiplied centers must be coherent, coordinated and organized, according to a hierarchical axis. Then, among a lot of existing architectures of control [START_REF] Moigne | Les systèmes de décisions dans les organisations ?[END_REF], we have chosen to work with hierarchical coordinated structures [START_REF] Trentesaux | Conception d'un système de pilotage distribué, supervisé et multicritère pour les systèmes automatisés de production[END_REF]. The framework of our research being established, we describe now the concept of Control Center (CC).

The Control Center (CC)

Definition

We define the concept of control center (CC) as "an autonomous structure, depending on the enterprise global strategy, having a decisional authority, associated with an entity and having necessary resources to apply actions and to achieve the defined goals within the global framework of the enterprise".

Components

The components of CC are: actors, referents, objectives, intrinsic and extrinsic information, decisional tools, measures and performance evaluation, decision, actions and resources for their implementation. These components are organized according to the simple diagram presented in figure 1, which is the base of the CC internal process. We detail the specifications and the modeling of this behavior in the following part.

Typology of information circulating between CCs

We propose in a no exhaustive way a typology of information, which is exchanged between these CCs or between a CC and the controlled system. The coherence of the whole system depends on this information. The goal of this typology is to structure the information used during the CC internal process. The information which is not used for control will not be represented in this typology.

 Structural information is related to products, resources, customers, etc. To avoid redundancies, it can be stored on a common data-base. It is available for the CC which might need it (purchase, planning management,…), and the qualified CCs are responsible for its update and its reliability.

Controlled system extrinsic information

Decision

Action plan Resources intrinsic Information

CONTROL CENTER

Decisional tools

Measure Evaluation

Performance indicator Captors

Decision process

DECISION-MAKERS

ACTORS

 Decisional information corresponds to decisions emitted by a CC following a decision-making process, in the form of objectives, towards one or more CCs of the same level or of lower hierarchical level. Thus, in an "interpreted" control, it's the CC receiving this information which have to achieve the given goal by setting action variables, and building itself its performance indicators. Decisional information can come only from one CC.  Control information (management priorities in a queue, lists of Product Order for MRP, tickets for Kanban, etc.) generally relates to the controlled system at one operational level. It is stored by each CC, because it can be different from one CC to another one, and can change according to the system state.  State information (breakdown, set-up, stop, etc.) informs the CC in real time about the state of the controlled system (resource and physical flow) according to time. It is induced by events and is used in a "reactive control by anticipation". It has process indicators as a support.  Feedback information is obtained from the controlled system (resource and physical flow) in a periodic way. It has result indicators as a support and are useful in the case of an "a posteriori control".  Environment information relates to the CC of the higher hierarchical level, in the case of strategic decisions (market research, launching of a new product, etc.).

The research presented in this article will complete precedent works of our research team on the physical flow modeling and simulation of manufacturing systems by the help of the PPS concept (Product Processing System) [6] [7]. The current work lies the CC to the PPS, formalizes the CC behavior and the links between CC and PPS. This formalization enables us to integrate industrial control in simulation at the operational level of manufacturing systems.

Modeling of the Control Center

Modeling the physical and informational systems

Let us take the simple example of a production process composed of a raw material stock, a welding operation, a correction operation and a finished product stock (see figure 2). The physical flow is modeled by a generic structure called "entity" and the resources by another one called "PPS" (Product Processing System). The PPS has the same structural and behavioral characteristics as a resource (machine, stock, operator, etc.). It carries out mainly the three basic functions: "reception", "transformation" and "supplying". In addition, it is able to have the different resource states: idle, busy, blocked, broken down, etc. For more information on the physical process modeling, readers could refer to other articles [START_REF] Bakalem | Modélisation et simulation orientées objet des systèmes manufacturiers[END_REF] [7].

Modeling the decisional system

According to the definition suggested above, the CC is associated with the controlled entities (PPS), and allows to represent the control of a manufacturing system, like in the example below.

Fig.2. Using PPS-CC network for manufacturing systems modeling

In order to formalize in more detail the PPS-CC network, we describe the internal behavior of the CC. Indeed, the behavior of the PPS being already formalized in precedent work [START_REF] Bakalem | Conceptual Frames for Physical and Control Systems Modelling in Manufacturing Simulation[END_REF], our research tries to formalize the decisional system with the CC. As we described previously, the CC components organization is a simplified one. In figure 3, we look further into this internal behavior process of the CC. We find in this diagram, the principal phases of figure 1  at "exit" of the controlled system: event or periodic measure;  the decision-making process;  in "entry" of the controlled system: the application of the action plan on the system.

Fig.3. Detailed internal behavior of a Control Center

After having obtained the measure concerning the PPS state and its flow, by the help of process or result performance indicators [START_REF] Berchet | Pilotage et Prise de Décision Industrielle, 3 ème Congrès International de Génie Industriel[END_REF] (according to the type of selected control [START_REF] Berrah | Une approche d'évaluation de la performance industrielle-Modèle d'indicateur et techniques floues pour un pilotage réactif[END_REF]), our objective is to describe the decisionmaking process of the CC [START_REF] Berchet | Intégration du processus de pilotage à la simulation des systèmes de production, 2ème Congrès MOSIM'99 d[END_REF]. This process is divided into three stages: a) Performance evaluation of the controlled system and its physical flow This stage consists to analyze the measure obtained from the controlled system (a PPS), to compare it with the CC local objective, and then to conclude if a deviation exists. During this evaluation the information (referred in § 3.3) is taken into account for the co-operation relations between CCs.

b) Evaluation of the inductor responsible of the deviation

The second stage concerns the identification of the inductor responsible of the deviation from a list of inductors. The choice of inductor is realized according to a history of the controlled system. Each inductor corresponds to a performance process indicator or a performance result indicator of a lower level of the decision global structure. As each inductor is associated to an objective, the evaluation at this stage consists on the determination of the deviation of each one and its impact on the controlled system. c) Evaluation of the action plan or "internal and external simulation"

The third stage of the decision-making process consists of testing the actions determined at the preceding stage, by internal simulation using the controlled system (the PPS is simulated at the moment when measurement was made). This is a performance evaluation in a simulated manner, in order to define the adequate action plan. If the deviation is always reached after simulation of the action plan, other possible actions are tested, until the deviation is eliminated. If the target level of performance indicator is not reached any more (no deviation), the action plan to be adapted is found and can be applied "really" to the controlled system.

Conclusions and perspectives

We have proposed in this article the concept of CC which allows to introduce "reactive control" into simulation. Also, this research work permits:  to make simulation more "active",  to react in a structured manner on the controlled system in the case of deviation with respect to its expected behavior during the simulation,  to widen and benefit more from the potentials of simulation.

Actually, we are working on the performance evaluation phase concerning the behavior of the CC, by developing the cooperation and coordination relations between CCs. We will propose in future articles a UML (Unified Modeling Language) model of the different objects composing "PPS-CC network": the PPS, the CC, the entity, the generator of order, etc. A prototype implementing the proposed concepts is actually under development and will be tested at Alcatel. This prototype will be used as an assistance tool for the industrial control of a production line.

Fig. 1 .

 1 Fig.1. Internal structure of CC