Figure 1 shows the proposed architecture for the described new control mechanism. At the highest level, managers are defining processes ① using any of the existing process description technologies, such as BPMN or YAWL. Industrial production processes are usually very large and complex, including many activities and tasks which may be partially related (or not). Besides, some technologies enable defining quality indicators for tasks’ outputs, so the activity execution may be rejected if those indicators are not met. Process definitions at this level (named as prosumer level, as managers act as producers and consumers in the proposed technology) are typically graphic, and only relations among tasks and quality measurements are described.

The process model based on standard technologies (hereinafter we are considering YAWL language) is then analysed and decomposed ② to “soft” and relax the model. The idea is to transform a hard or rigid process definition where deformations and variations are not expressed (and, then, not accepted by the control solution) into a soft model ③ where global quality and organization restriction are equivalent but dynamic changes, variations and deformation are admissible.

To perform this transformation, a specific engine ② analyses the YAWL process model and identifies the key branches or subprocesses whose exterior structure cannot be modified. For example, a subprocess generating a subproduct as output which is the input of a second subprocess must be executed strictly before the second subprocess. However, tasks inside both subprocesses could be executed in any order, and the same subproduct is created.

After this analysis and decomposition procedure, two different soft process descriptions are generated. The first one is a global description based on logic rules ③. To generate this description, each subprocess is represented by a discrete state. And the global state map is regulated by a set of logical rules extracted and instantiated from a logic predicate repository ④, where different general conditions are stored (temporal order, necessary conditions, etc.). Those logical rules represent the minimum restrictions that the production process must fulfill, but all additional restrictions artificially introduced by the limitations or graphic process representations are removed. The second one is a set of reports ⑤ where deformation metrics about each subprocess are indicated. Quality indicators about each task are considered together and three global metrics for the whole subprocess are obtained: stiffness, strength and ductility.

The global soft description is transferred to a verification engine ⑥, where logical rules are validated (or not) at real-time. This global understanding about the process takes place at business level, where information from managers (process models) and from autonomous hardware platforms are matched to determine if production processes are being correctly executed or not. This verification engine takes as input two information sources: events directly generated by hardware devices ⑦ following an event-driven paradigm; and events generated ⑧ by control component in lower layers (the production layer). These events are employed to validate logical rules and determine if minimum conditions to consider the process execution is valid are being met.

All reports about subprocesses ⑨ are transferred to a lower level (the production level), where low-level (physical) information is collected to evaluate if process deformation is above the proposed global metrics. To do that, information from different recognition technologies (human-oriented, device-oriented, etc.) is collected ⑩. These recognition technologies are not addressed in this paper, as any of the previously existing mechanisms may be integrated (Bordel et al., 2019; Bordel and Alcarria, 2017). All information sources are integrated ⑪ to perform a global evaluation of process deformation. To obtain those global metrics a mathematical algorithm ⑫ is employed. This algorithm is deducted by understanding production processes as discrete flexible solids in a generalized phase space. Dynamic behaviour of autonomous devices is represented as external forces acting on the solid (process) and deforming it. Using different deformation functions (and the provided deformation metrics), it is evaluated if the final process execution is similar enough to the model to be considered as a valid execution or not. A decision-making engine ⑬ performs these functions. A report ⑭ and event-like result (whose format may be adapted in an event generation module) is sent to the rule verification engine ⑥ (as one of the information sources described before).

Using YAWL language, managers may define processes in a very easy manner with graphic instruments (see Fig. 2). At the highest level (prosumer level) managers (prosumers) are defining a complex production process or workflow W. This workflow is an ordered sequence T of MT tasks, connected through ME oriented edges, E (1). Each task ti∈ is labelled with a discrete timestamp ni indicating the planned temporal order for the workflow. On the other hand, each edge ei∈E is labelled with a collection SPi indicating the list of subproducts flowing (as input and/or outputs) between tasks along the edge (2). Labelling applications λT and λE are employed to relate labels and edges and tasks. To learn which tasks ti are connected through oriented edges ei , and incidence application γW is defined (3). This application relates each edge ei with the order pair of tasks ti,tj this edge connects. The edge is outgoing from ti and incoming in tj : (1) W={T,E},T={ti,i=1,…,MT},E={ei,i=1,…,ME}, (2) λT(ti)=ni,λE(ei)=SPi={spij,j=1,…,MSP}, (3) γW:E→T×T,γW(ei)={ti,tj}.

Besides, in YAWL, tasks may be labelled with a list Ii of MI quality indicators ∐ij , employed to accept or reject the actual tasks execution (4). These indicators may refer maximum delays, jitter, errors in physical dimensions, etc. A labelling application λind is employed to relate indicators and tasks (5). This list must be exhaustive: every possible indicator must be present in every task. If an indicator does not apply to a particular task, this value in the list should be empty but still present. (4) Ii={∐ij,j=1,…,MI}, (5) λind(ti)=Ii, (6) Ci={cij,j=1,…,MC},λcond(ei)=Ci.

Moreover, bifurcation conditions can be considered in YAWL process definitions (see Fig. 2). These conditions are modelled as lists Ci of semantic annotations associated to edges through a label application λcond (6). These annotations cij are logical predicates referred to output characteristics, time, etc. This whole process description (including all labels), then, is analysed and decomposed in a specific engine. The first step is to calculate the key process branches or subprocesses ωi (7): (7) W=⋃iωi.

A key subprocess is characterized by only one input point (only one task receives inputs from the physical world) and only one output point (only one task generates a physical service or product). Besides, relations among tasks within the subprocess do not have associated subproducts SPi=∅ , but input and output edges to the subprocess do have associated subproducts. Inside a subproduct, then, the temporal order is artificially induced by YAWL language, as it requires all tasks to be connected in sequences. But the process does not require tasks to be executed in that order and it could be altered. When a key subprocess is detected, it is extracted to an independent report to be analysed separately using deformation metrics, and in the global description the subprocess is replaced by a state sj , taken from a set ΣW of possible states for this workflow. And a transaction relation ρW is built to connect all states sj according to restrictions in the original process (8). Algorithm 1 describes the proposed mechanism to calculate subprocess and new states and the transaction relation.

On the other hand, annotations Ci must be transformed into logic predicates referred to states sj and/or the discrete timestamps ni . To do that, a semantic algorithm may be employed. This algorithm is not described in this paper, but similar solutions may be found in the state of the art [8]. To do that, a repository of generic logic predicates is considered. These generic predicates are instanced according to annotations Ci to generate a set R of atomic propositions ri or logical rules. An interpretation function LW is finally defined, indicating what predicates from R are true for each state sj (8).

The set of states ΣW and both the interpretation LW and the transaction ρW applications define a Kripke structure K (9) which is transferred to the business layer for further processing. This Kripke structure is formally defined if only one additional element is considered: the set of states from which the workflow may be initiated Σinit . (8) ρW(si)=si+1,LW:ΣW→R,LW(sj)={ri}, (9) K:⟨ΣW,Σinit,ρW,LW⟩.

A second element is generated in the analysis and decomposition engine. For each key subprocess ωi , each task ti is labelled with an exhaustive set of indicators Ii . These indicators are split into two different vectors Iia and Iir (10). On the one hand, absolute indicators Iia referring state variables (such as time, temperature, etc.) are preserved (including empty positions). On the other hand, relative indicators Iir referring tolerances, errors, etc. are processed to calculate three basic and global deformation metrics: stiffness, strength and ductility. (10) Ii=Iia∪Iir,Iia={∐i−ajj=1,…,MI−A},Iir={∐i−rjj=1,…,MI−R}.

Stiffness is related to security margins and safeguards between consecutive tasks in the process model (11). As these security margins are larger, it is easier for the process to resist to global deformations, as the effect of inputs on the first tasks are absorbed by security margins. Function calculating the stiffness of a process σf must, then, be strictly increasing: linear, logarithmic or exponential functions could be employed depending on the scenario.

Strength is related to the number of restrictions and indicators in the list Iir (12). As more restrictions are considered, the process is more probable to generate an unsatisfactory execution. Besides, if we consider all restrictions as independent effects, the probability of unsatisfactory executions grows up exponentially with the number of restrictions. Then, function calculating the process strength σf is exponentially decreasing.

Finally, ductility is obtained from the tolerances and relative errors in the list Iir (13). As tolerances go up, processes can be deformed at a higher level, but the process execution is still valid. Then, the function calculating the ductility of the process σd is strictly increasing: linear, logarithmic or exponential functions could be employed depending on the scenario (11) Fi=σf(|∐i−aj+1−∐i−aj|j=1,…,MI−A), (12) Gi=σg(MI−R), (13) Di=σd(|∐i−rj|j=1,…,MI−R).

Then, the subprocess descriptions {ωi} together with the vector {Iia} and the deformation indicators {(Fi,Gi,Di)i} are transferred to the production layer for further processing.

At business level, a Kripke structure (9) describing the process model is received. On the other hand, from this level, the control solution is viewed as a discrete event system (DES), Z (14). Where X is the set of possible states in the system; E is the finite set of events; f is the transition function indicating the next state for a given current state and a received event (15); Γ is the function indicating what events are active for a given state (16) and P(E) is the power set of E ; X0 is the initial state of the system and Xm is the set of market states (of allowed final states). (14) Z=(X,E,f,Γ,X0,Xm), (15) f:X×E→X, (16) Γ:X→P(E).

In this DES, E∗ is the Kleene closure of E which is the set of all possible string in the system (including the empty string); being a string the juxtaposition of states in X describing the evolution of the system; i.e. E∗ is the set of all possible evolutions the system may follow. Two different languages (sets of strings) can be defined, then. The language marked (17) Lm contains all strings that finished with a marked state. The language generated (18) Lg contains all possible strings, i.e. all possible system evolution although they may be not acceptable. In traditional supervisory control systems, the underlaying event-driven infrastructure is assumed to be fully controllable (all events are controllable) or partially controllable (where only some events are uncontrollable). However, in future Industry 4.0 all events tend to be uncontrollable (as devices and people are totally dynamic and autonomous). In that case, common supervisory control theory is not applicable, as its objective is to avoid certain undesired controllable events (and, in Industry 4.0, they are all incontrollable). On the contrary, the objective of the proposed supervisory mechanism is to create reports when undesired states are reached. (17) Lm(Z)={ℓm}={ε∗∈E∗|last element inε∈Xm}, (18) Lg(Z)={ℓg}={ε∗∈E∗}.

Moreover, in this scenario, events and states in the low-level platform are unknown and, probably, infinite. Then, supervisory control cannot be performed directly over the workers and hardware devices, but over the Kripke structure. Actually, this structure is a fair Kripke structure are two additional conditions are met in every process model:

In that way, a two-level verification is performed in the “rule verification engine” (see Fig. 3). In this solution, states E in DES Z and in the Kripke structure K are the same, although the state set ΣW in the Kripke structure includes a special state snull to represent unknown states (19). This state snull does not activate any logical predicate (20). The initial states are the same (21). Discrete events ε in the DES Z are words ℓg of the language general Lm(Z) (where the empty string corresponds to the unknown state in the Kripke structure), describing the states the Kripke structure has reached (22) before the current state scurrent . Then, the transition function in the DES may be easily constructed from the transaction relation in K (23): (19) E=ΣW∪snull, (20) LW(snull)=∅, (21) Σinit=X0, (22) εi=ℓgi={si|si∈ΣW∧si∈ρW−1∘⋯∘ρW−1(scurrent)}, (23) f(si,ϵi)=ρW(si)=si+1.

In those conditions, the proposed supervisory control algorithm operates as follows. First, physical events Ephy (obtained through the event generation module from physical information and reports) are employed to determine in the Kripke structure which states sj are allowed in the production process (several of them, because of the justice and compassion requirements). This action is performed using the interpretation function (24). If only one state is allowed, a new DES event εi is generated, juxtaposing the new event to the previous string prefix ℓgi (25). This information is introduced as strings’ prefix in the DES  Z , and the supervisory control module determines which future states A(E) are allowed by the business model (26) and, eventually, reports if the executed process is incompatible with business requirements (27). Algorithm 2 describes the proposed control solution. (24) {sj}=LW−1({rj}), (25) εi+1=εi|scurrent=ℓgi|scurrent=ℓgi+1, (26) A(E)={εi∈Esuch thatεi+1|εis prefix ofℓm∈Lm(Z)}, (27) A(E)=∅.

Different solutions to validate logic rules have been reported (Leucker, 2017), any of them may be integrated into the proposed mechanism.

Finally, at production level, a collection of labelled key subprocess {ωi} and deformation metrics {(Fi,Gi,Di)i} are received. At this point, every task ti in any subprocess ωi is totally defined by the set of absolute quality indicators Iia . This set is a MI−A -dimensional vector which, eventually, can be represented as a point in a generalized MI−A -dimensional phase space. To do that, it is enough to consider the position vector xi→ of that point (28) in a general Euclidian space. Besides, in the most common case, every subprocess ωi is composed of a very large set of tasks, so if the same procedure is repeated for every task, finally the whole subprocess is represented as a point cloud in the phase space. This point cloud may be understood as a discrete solid Ωi in the phase space (29). This solid, moreover, is flexible, as from the beginning we have assumed that tasks inside each subprocess may be altered (see Fig. 4). In this context, Mωi is the number of tasks in the subprocess  ωi . In those conditions, the subprocess execution may be understood as a function TD (30) applied over the solid Ωi to be transformed into a new and deformed solid Ωi∗ in the original phase space (see Fig. 5). Rotations, extrusions, and any other deformation could appear.

The question to address, then, is if the suffered deformation is high enough to consider whether the execution is unsatisfactory or not. (28) xi→=IiaO→=(∐i−aj,j=1,…,MI−A), (29) Ωi={IiaO→,i=1,…,Mωi}, (30) TD:Ωi⊆RMI−A→Ωi∗⊆RMI−A.

In the proposed model, a set of external forces Δi−k (31) is actuating on the solid Ωi in the point tk . These forces represent the dynamic, variable, and anarchic behaviour of autonomous devices and humans, which tend to deform the original process model (see Fig. 6). If forces were acting only in one dimension δi−kj , the global deformation suffered in that dimension Φi−kj could be easily calculated through the Hook law (32); where Fi is the stiffness parameter calculated in the prosumer layer. Although it is not completely correct in terms of physical meaning, we are generalizing this law by taking modular functions, so the global aggregated deformation in all directions of the phase space may be also estimated through the Hook law (33) and, even, the global deformation for the entire solid, by integrating along the entire solid’s surface (34). Considering, now, ductility Di and strength Gi we can extend the common Hook law to include inelastic areas and break zones (where executions are considered unsatisfactory). This new deformation function includes three different branches (35), see Fig. 7. (31) Δi−k=(δi−kj,j=1,…,MI−A), (32) δi−kj=Fi·ϕi−kj, (33) ‖Δi−k‖≈Fi·‖Φi−k‖, (34) Δi=∑Ωi‖Δi−k‖=1Mωi ∑k=1Mωi‖Δi−k‖Δi=Fi·∑Ωi‖Φi−k‖=Fi· ∑k=1Mωi‖Φi−k‖=Fi·Φi. (35) Δi=Fi·Φi,ifΦi⩽GiFi,Gi,ifGiFi<Φi⩽Di,breakotherwise.

As can be seen in Fig. 7, it is not necessary to evaluate the external forces Δi to learn if global subprocess deformation is too high to consider the execution is valid. These forces are extremely complicated to analyse, as almost no data about them is available. On the contrary, global deformation Φi can be evaluated through the absolute quality indicators Iia , which are monitored through the recognition technologies at low-level. For every deformation value Φi in the break area, the execution is considered unsatisfactory. Otherwise, it is considered valid. For deformation values in the elastic area, external forces are only deforming the process in a transitory manner, i.e. only some tasks are affected (those which are directly affected by forces). Security margins are absorbing the secondary effects over other tasks, and no permanent global deformation is suffered. On the contrary, when deformation values are in the inelastic area, security margins are not enough to compensate the external forces, and permanent and global deformation appear. Nevertheless, executions are still valid although deformed. Moreover, two contradictory situations must be considered before deformation calculation.

On the one hand, in the inelastic area, small variations in the estimated global deformation Φi may cause the subprocess execution to be rejected. So, high precision algorithm to perform those analyses are needed. On the other hand, Industry 4.0 scenarios present real-time requirements, so algorithms must be fast and efficient, and complex high-precision mechanisms must be employed.

Thus, we proposed a two phases deformation evaluation: in the first step, a very simple algorithm where all state variables and quality indicators are considered independent is employed; only if this algorithm places the global deformation in the inelastic area, a second step where a complex and much more precise algorithm is employed would be triggered.

To calculate the first and approximate global deformation Φiind of the subprocess ωi after an execution, we are considering all quality indicators Iia to be totally independent. Then, deformation ϕi−kj along each indicator and on each task can be calculated independently. This calculation is based on the ratio between the planned value for each quality indicator ∐i−aj , and the final obtained result ∐i−aj,∗ (36). Using this radio, deformation ϕi−kj can be obtained through different expressions: unitary deformation (37), Almansi deformation (38), Green deformation (39), Hencky deformation (40) or any other application specific algorithm. Each one of these expressions is adequate for a range of deformation values (see Table 2). Then, we are always initially calculating the unitary deformation, and, after that, we can recalculate the value using a more adequate expression if needed. (36) μi−kj=∐i−aj∐i−aj,∗, (37) ϕi−kj=μi−kj−1, (38) ϕi−kj=12(1−1(μi−kj)2), (39) ϕi−kj=12((μi−kj)2−1), (40) ϕi−kj=ln(μi−kj).

As can be seen in Table 2, using the unitary deformation we can evaluate the subprocess rotation and absolute deformation. Then, for processes where rotation and large deformation values are present, Hencky function is the most precise calculation method. Equally, for null rotation and large deformation values, specific logarithmic algorithms and expressions may be proposed depending on the scenario. Finally, for small values of deformation we can use the Green or Almansi function (as desired) if rotation is present, or the unitary deformation if no rotation and small deformation values are observed.

After calculating the global deformation Φi for the subprocess, if this value is in the elastic area, the execution is accepted. If the subprocess execution is in the break area the execution is rejected; and if the value is in the inelastic area, a more precise evaluation is needed. In this more precise calculation mechanism, we are assuming the realistic scenario, where quality indicators are dependent on each other. Then, deformation parameters are obtained through the deformation tensor Ψi−k (41), where differential expressions are approximated using numerical expressions (42). Basically, for initial task we are employing the previous expressions (37)–(40) to start the calculation algorithm. Other tasks are evaluated through the backward differences. There exists also a tensor expression for Almansi deformation (43) and for Green–Lagrange deformation (44) which can be employed for depending on the scenario under study (selecting that which is closer to reality in all cases).

Module calculation (34), in this case, will refer to the tensor module calculation; contrary to the previous case where vector module was employed. (41) Φi−k=Ψi−k=∇TD=∂∐i−a1,∗∂∐i−a1…∂∐i−a1,∗∂∐i−aMI−A…∂∐i−aMI−A,∗∂∐i−a1…∂∐i−aMI−A,∗∂∐i−aMI−A, (42) ∂∐i−ak,∗∂∐i−ar=∐i−ak,∗−∐i−ak−1,∗∐i−ar−∐i−ar−1,forr,k>1, 1,\end{aligned}\]]]> (43) Φi−k=12(1−Ψi−k−TΨi−k−1), (44) Φi−k=12(Ψi−kTΨi−k−1).

With this much more precise value, the caused deformation is finally evaluated. If it remains in the inelastic area, the execution is approved. In the contrary event, the execution is rejected. Algorithm 3 describes the entire described solution at production level.