8.2.1. The nature of interactions between systems

When two systems get close to each other, for any reason (mutualization and specialization of systems; pooling of resources that can be shared; fusion of companies; integration of subcontractors into the “extended” company; multinational combined operations in the case of C4ISTAR Defense and Security systems; etc.), the systemic situation of their relationships must be represented as it is in Figure 8.6.

Situations of this kind occurred towards the end of the 1980s, then became generalized in the 1990s when they changed scale with the large-scale spread of processing of all kinds arising from the development of information and communication technologies (ICTs, and from now on, in the near future, NBICs with “intelligent connected objects” and 5G).

Making systems interact with each other obviously requires organization of the interactions of the physical component with the networks, as some had already understood correctly in the 1970s, but it especially involves making the communities of users and the engineering teams interact, in other words the behaviors, uses, methods, expertise, etc. which had brought the whole semantic problem to the forefront of concerns and which had not been distinguished as such until that time. This was a true shock for many, and a true rupture for all.

If we only consider the combinatorial aspect, each of the components of a system S1 will move towards the three others for S2, and inversely, in other words a total of 18 arrows for two systems approach each other; with each arrow materializing a type of flow, which can be expressed in several physically different flows. In the case of three systems or more, all parties must be considered, which means that the combinatorial “explodes” exponentially and becomes totally unmanageable if the architect of the whole set doesn’t manage to organize the interactions by means of a suitable global architecture. However, they must accept to take on this role.

REMARK.– If a set includes N elements, the set of the parts increases by if this new set is reinserted as a part, the combinatorial becomes and so on, at each iteration .

In the example of the extended company, automobile constructors have developed an interaction with their equipment manufacturers in such a way as to operate “just-in-time”, which allows them to eliminate costly equipment storage on each side, but ties the company, in all senses of the word, to their equipment manufacturers and makes it dependent on correct operation of the transport system for logistics flows. Quality of service becomes essential. The block diagram of this interaction is represented in Figure 8.7.

Logistics flows and financial flows for payments are added to traditional information flows of paper order/billing forms, all of which become progressively totally electronic, or doubled by electronics which allows the status of the logistics flow to be visualized in real time. This is what integrated industrial management software does with high precision (PGI, MRP (manufacturing and resource planning)) in which the progression of orders/deliveries is monitored in real time by the transporter thanks to geo-localization systems. The logistics flows associated with payment flows constitute transactional flows which guarantee that for all equipment deliveries, there is a corresponding payment that balances out the transaction. The coherence of these flows is fundamental because this guarantees that the company balances its books and makes a profit.

In the case of C4ISTAR defense and security systems, the highly simplified block diagram of an air–earth operation is constructed as in Figure 8.8, where each of the represented French land army and airforce communities are themselves composed of sub-communities that represent the whole range of professions that are required for highly complex operations. One can refer to the various scenarios of projections for the armed forces that were described in the last two white papers, available on the government websites of the French Ministry of Defense.

In the real case of the French land army and airforce as physical components (PC), the systems that are specific to each of the components can be counted in dozens and totalling millions of lines of code. These are systems that equip all active units, ranging from an individual infantryman with the FELIN system, land vehicles, Rafale airplanes and others still, to the systems that equip the decision-making centers and which provide the link with political power. Since France is a senior nation in NATO, the system must be able to talk to the specific systems of the various nations that are participating in the operation. The capability logic guarantees coherence of management of resources, in the sense that a resource that has been attributed to an AU, or consumed by an AU, is no longer available for other AUs, until it is returned in the case of a temporary loan, or replaced by an equivalent resource. Capability logic therefore necessarily integrates a transactional logic which takes into account the problem of re-supply⁹.

8.2.2. Pre-eminence of the interaction

The remarkable thing about the recent evolution of systems due to the importance of ICT is that interactions that implement flows of materials and/or energy (see Figure 4.4) are multiplied by two in a set of information flows that need to be managed as such and which will constitute a “virtual image” of this physical reality.

This virtual image only has meaning if all the elements that make it up are “signs” of something in reality; speaking like a linguist, these are meaningful things of which the meaning is a very specific physical reality. Operating on one (refer to linguists’ “performative”) is equivalent to operating on the others, and reciprocally, on the condition that the signs of the virtual image remain perfectly coherent with physical reality. The interaction takes precedence over the action undertaken (a change of state, an adaptation/transformation of reality), in other words the way in which the actions carried out connect and balance each other out, in the same way as in linguistics it is the relationships between the language terms that provide a framework for the meaning of the phrase, at least in Indo-European languages.

As explained in Chapter 5, this grammar of actions, here in the context of a system of systems, is essential for the stability of the whole set that is constituted in this way. This is exactly what Wittgenstein said in his aphorism 3.328 in the Tractacus logico-philosophicus, “If a sign is useless [in other words, if it represents nothing], it is meaningless”; we note that the aphorism is an excellent definition of the semantic.

The systemic analysis of a situation must therefore indicate as clearly as possible the rules of correspondence between signs and reality, because the rules guarantee that reasoning on the basis of a virtual image is the equivalent of reasoning on the basis of a real situation. This is the condition sine qua non of the effectiveness of action. If the coherence is broken for any reason, we no longer know on what basis we are reasoning. We then risk making a ridiculous conclusion, to use the phrase of medieval philosophers, “ex falso sequitur ad quod libet” (from falsehood, anything follows); hence the importance of security/safety for all these systems, because what is real is only understood via its virtual image which can be manipulated/altered either voluntarily or involuntarily.

In the case of the C4ISTAR, this virtual image has even received a name: the COP, in other words the common operational picture, in NATO jargon. Figure 8.9 gives an example of symbolic representation, in other words a virtual image, using signs taken from the situational representation standards¹⁰ that are typical of Defense and Security systems, as well as in certain strategy video games. The classifications used to code the situations comprise thousands of symbols which constitute a graphical language (literally, this is an ideography) used in all crisis management groups. We can visualize the image at different scales, and with different levels of synthesis, up to the ultimate level which corresponds to individual “atomic” actions (in the non-divisible sense, or even in the done/not done sense of the transactional sense. Note that here it is a case of pure convention between individuals). Without the development of ICT, all this would obviously be quite impossible.

A very general principle of the construction of abstractions can be drawn from these considerations, which will allow the architect of the system of systems to know exactly what they are doing and what they are not doing. This is shown in Figure 8.10. This diagram shows a construction structure with three aspects:

• – The aspect of the real world and the phenomenology that is of particular interest to us; a sub-set of phenomena that need to be characterized in order to separate out the elements to abstract; the rest, which has been eliminated, constitutes the “environment” or the outside, reusing our own terminology.

• – The abstract aspect of the phenomenology which is a world of signs¹¹ independent of all material media and all representations, although it is necessary to select one if only to communicate. Signs constructed in this way correspond to those of the theory of abstract types which can be composed and hierarchized in the same way as in the theory of languages, which we have known how to do for a long time (in computing, this is known as an “object”). These are disembodied, logical entities, “pure” in the sense used by mathematicians to refer to pure mathematics. The system of signs thus formed functions like a theory of the phenomenology that it denotes; we also say “symbolic system”. At this level, we can represent the time of phenomenology, the transformations, consumption of resources, and more generally the finite nature of the physical world, using logic procedures classed as temporal¹².
• – The virtual aspect, which is a projection of the abstract level into a logically mastered computing structure, either a Turing machine if we wish to remain independent from real machines, or a logic abstract machine in J. von Neumann’s sense of the term, that can be compiled and/or interpreted with real machines. For this aspect, the abstractions are executable, which will authorize simulations even before the system truly exists.

The rules of correspondence between these various constructions must be explicit and reversible, which is a fundamental demand of the engineering of real systems and which must be validated before implementation. The notion of process seen in Chapter 7 is going to allow a link to be made between these various aspects because it is common to all three, thereby allowing translations/transductions between them.

The systems of systems constructed according to these rules are themselves systems that are ready to enter a new construction cycle with mastered engineering. Step by step, we can therefore organize what J. von Neumann designated as ultrahigh complexity in his Hixon Lectures. We will return to this subject in Chapter 9.

However, we must not believe that this type of organization emerges from the architect’s brain at the wave of a magic wand. If we take the example of the genesis of the “computing stack” (see Figure 3.3 and Chapter 7 for more detail); almost 20–30 years of R&D began at the MIT with the MULTICS system towards the end of the 1960s, to then finish in the 1990s–2000s with transactional Middleware in a distributed environment, seen in classic works by J. Gray and A. Reuter (Transaction Processing: Concepts and Techniques) or P. Bernstein and E. Newcomer (Principles of Transaction Processing) concerning transactional aspects. The procedure to be undertaken complies exactly with what was said by A. Grothendieck (see section 1.3), where for a correct abstraction a high level of familiarity is required with the underlying phenomenologies, which requires a lot of time and a lot of effort. Without this, modeling takes place in a void, and this time Wittgenstein administers the correction (refer to aphorism 3.328 of Tractacus, already cited).

8.3.1. Limits and limitations regarding energy

Interoperability leads us back to the relationship/dependence between all systems and the sources of energy which allow them, in fine, to operate. Without energy, a system cannot function, including systems that produce energy such as an electrical system which, in order to remain autonomous, must have a source that is independent of their production. Conservation of the energy source which supplies the system is very obviously part of the system invariant which must be conserved at all costs¹⁷! Consequently, the system has the top priority of completely controlling the energy that makes it “live”. With interoperability, and the capability logic that characterizes systems of systems, this property fundamentally disappears.

The situation can be drawn up as shown in Figure 8.11.

This figure shows that the AU are now dependent on correct operation of the exchange and coordination mechanisms, which by definition are not controlled by any of them. If this system of exchanges is repositioned in a diagram in Simondon’s terms, we see: (a) that the community of users is the sum of the communities of each of the systems taken individually; (b) that it has its specific community in terms of engineering, but that this must absolutely not act independently of the engineering communities of each of the systems; and lastly (c) that it has its material and virtual resources but that the service contract for the whole (it is a system in itself whose invariant is the rules given in the model of exchanges) must not under any circumstances contradict the specific service contracts for each of the systems. This creates a set of constraints/requirements that make engineering of these devices particularly problematic because they are necessarily abstract with respect to the various businesses of which the common elements must be identified. The corresponding semantic coherence of the models is a logic problem known to be difficult and which requires deployment of temporal logic.

As for all systems that are based on cooperation, everyone, in other words the AU, plays the game; and we could say, the same game. If one of the systems does not comply with or no longer complies with the rules, in other words they have behaviors that are incompatible with survival of the whole for any reason, they must immediately and without any means of avoidance be removed from the federation or at least strictly confined. The operations carried out by the deviant system must, if necessary, be taken over by other systems in the federation. If this is not the case, the capacity of the SoS (system of systems) is necessarily reduced and the users must accept a deterioration in services.

In terms of energy, it becomes almost impossible to estimate what is necessary for correct operation of the “bus” without overdimensioning its capacities, which is generally contradictory to the very objective of the federation. In the same way, for each of the systems that are responsible for their autonomy it is possible to adopt and to ensure application of a strategy thanks to the unique C2 command–control center (see Figures 4.1–4.4); this is no longer possible for the bus, because this must manage a complexity which is the “sum”, or a combinatorial of the complexities of each of the systems participating in the federation. The only way in which to prevent the “bus” from transforming into a sort of crystal ball with unpredictable operation, contrary to all the rules of engineering when the latter is mastered and not endured, is to have a prediction/measure of the load in real time at the bus for each of the flows and unloading rules if the predicted and/or authorized load is exceeded. This is part of the exchange models which set up the rules of use. These rules “of the game” necessarily constitute the language of authorized interactions, and reciprocally those that are prohibited, which can be analyzed with all the methods available in the theory of languages and abstract machines (see Chapter 5). With interoperability and SoS, we have crossed a level of abstraction within the systemic stack, but by using the same methods to organize the complexity.

The situation is then as follows (Figure 8.12): each of the systems in the federation induces a flow that varies with time, it is up to the bus to ensure that their sum does not exceed its capacity and/or to ensure in real time that there are sufficient resources to guarantee its service contract.

In many ways, this situation is entirely similar to the situation seen by clockmakers in the 18th and 19th Centuries who manufactured the first watches and chronometers to use complications¹⁸, which were systems renowned as the most complex of those produced by the human brain until the beginning of the 20th Century and the beginning of aviation and the first telephone switchboards, or electromechanical weaving professions. In a complications timepiece, like in all mechanical astronomical watches and/or clocks, there is only one source of energy; either a spring, or a weight. Each of the complication mechanisms extracts its energy from the equivalent of a mechanical “bus”, a set of gears and cams, which thanks to the escapement is regularly liberated (a time base ensures the precision of the chronometer) until the resource is exhausted or until it is then necessary to “wind up” the chronometer without stopping it. If the samples exceed the capacities of the transport mechanism of mechanical energy (significant problems with friction, hence the diamond or ruby pivots, which are part of the rules of the model of exchanges), the watch stops and/or the escapement is irremediably slowed, which means that the watch will never be able to show the correct time.

In systems of systems such as an electrical system (see Figure 4.4), the control function is now totally virtualized thanks to ICT capabilities, but it is still necessary to have sufficient energy to supply the various organs of the corresponding information system, an energy known as control energy which, for obvious reasons of autonomy, must absolutely have its own energy source. This regulation energy is critical for the system of systems, as it also is for each of the constitutive systems. If the organ carrying this energy becomes saturated, meaning that the system no longer has enough control energy, the controlled system and its environment can put themselves at a significant amount of risk. This is because, for example, in the case of an electrical system, a quantity of energy (note: a power) of the order of 100 gigawatts (equivalent to an atomic bomb of average power, in one minute) is no longer controlled? An Ariane 5 launcher builds up an energy of around 17 gigawatts on take-off to escape the Earth’s gravity!

8.3.2. Information energy

With the rise of ICT which today is indissociable from any system that uses it, and which therefore has become its most critical resource, a new form of energy has appeared. Independent of the fact that any electronic systems, with any function, is primarily an electrical system which as such must have a suitable source of electrical energy, it must, if it is ICT, have sufficient information processing capacity to carry out what is expected of it at the right speed.

For lack of a better term, we can describe this new form of energy as information energy. Since the 1980s–1990s it has held the attention of physicists, as demonstrated in the works and symposiums published under the label “information physics” as we briefly mentioned in Chapters 2 and 4. This physics was already in development in A. Turing’s works on logic, and the work of C. Shannon on communications as we have also mentioned.

The corresponding information energy capacity has three indissociable aspects: (1) a calculation capacity expressed in millions/billions of operations carried out per second, that the wider public has seen in the imprecise form of “Moore’s Law”¹⁹; (2) a capacity for interaction of the calculation organ with the “exterior” to supply its working memory with useful information, via, for example, SCADA systems that we will mention in Chapter 9, a capacity determined by the bandwidth of the information transport network (today in gigabytes per second); and (3) a capacity to store information to memorize everything that needs to be memorized given the system’s mission. For example, for an instrument like the LHC at the CERN²⁰, this capacity can be measured in hundreds of terabytes of data coming from measurement appliances that detect trajectories when an experiment is carried out, in other words of the order of 10¹² to 10¹⁵ bytes (petabytes). The same is so for the storage required for the calculation of rates for telephone operators, or for calculation of the state of the energy transport network for the smart grids that are required for “intelligent” management of renewable energies.

To conduct an automatic control of any physical device, it is therefore necessary to ensure that the corresponding information processing system has enough “information energy”, whatever the circumstances, to accomplish its mission, complying with the temporal constraints of the phenomena to be regulated.

In a high-speed train system such as the French TGV, the signaling system on the tracks and in the carriages in circulation must be able to react and make necessary decisions given the speeds of the carriages and the braking distances. With trains that circulate at more than 300 km/h, every 15–20 minutes during rush hour, any break in service can lead to a catastrophic collision.

Hence the back-up of control of the induced load, where it becomes necessary to reveal the induced information load (see Figure 8.13). We note that this back-up obliges us to look at the detail of the coexistence of fundamentally continuous phenomena, and of discrete phenomena, and therefore asynchronous phenomena via transactional mechanisms that are specific to computing.

The two mechanisms that can appear as separate or independent form a single one that must be analyzed and integrated as a single block. These are correlated mechanisms because one cannot be designed/organized without reference to the other, including in non-nominal situations which are always at the origin of service breakdowns, or disasters. This mechanism is transactional, in the strongest sense of the term, because coherence requires that what happens in reality is the exact reflection of what happens in the virtual information world, and inversely. The fact that the physical–organic mechanisms are backed up by an information mechanism allows a trace to be generated which is a true image of all the interactions between federated systems, which will allow post mortem analyses in the event of failure. We note in passing that the spatio-temporal synchronization of these traces requires availability of a unique universal time for all federated systems, analogous to what exists for constellations of GPS satellites and/or Galileo fitted with atomic clocks that are themselves synchronized.

In the case of large breakdowns suffered by the electrical system, for example, breakage of a high voltage transmission line, an event that affects physical resources, in this case loss of an EHV line, the energy transported is instantaneously transferred to other available physical connections, in application of electromagnetic laws: the laws of Ohm and Kirchhoff.

The information system which controls everything must analyze the capacities of the available physical resources that remain and decide in a few seconds whether the transport system will “retain” the load or whether unloading must be organized. The information system must therefore be perfectly informed of the situation, in real time, and itself have the processing capacity for all the information that comes from the organic/physical resources that constitute the transport network, to make the right decision with the help of the human operators that use the network. This feedback loop that manages considerable amounts of energy is the critical element of the system which in a certain manner determines its size.

8.3.3. Limitations of external origin: PESTEL factors

Many external factors, the “outside”, are going to constrain the system, and therefore limit its “normal” growth, up to certain intrinsic limits that are presented above. By convenience we use the PESTEL sign (in other words political, economic, social, technical, ecological, legal), which has already been mentioned²¹, to describe the environment. An entire book would be required in order to present them in detail. Here, we are going to provide a few analysis clues to show how to go about figuring out this type of external limitation, because for SoS, these factors become fundamental.

Politics, in the Greek sense of the term, meaning the organization of the City, and more generally of the State and the Nation, intervenes directly in the development and the “life” of a great number of systems, in particular those that provide a service to the public (police, army, energy, post and telecommunications, health, education, etc.). For example, the electrical system in the case study is completely constrained by the energy policy decided on by successive governments, and by European directives, which have deregulated the energy market. The energy transition that we find ourselves at the center of is political in nature, rather than technical, at least for the moment. EDF and RTE are not allowed to make their own decisions about what prices they are going to apply for distribution of the energy resource to their clients, in other words all of us. The decision made in 1988 to stop experiments at the power plant prototype at Creys-Malville²² in France was not EDF’s decision, and the dismantling of the facility will be finished in 2027. As a regulator, the State decided that this type of reactor cooled with melted sodium as a heat transfer fluid was dangerous and that the engineering was not mastered to a sufficient degree, in particular regarding the impossibility of putting out a sodium fire.

REMARK.– Water cannot be used, which makes an explosive mixture, and sodium burns spontaneously in the air.

In the United States, the American government has decided to dismantle certain monopolistic companies that are considered to be dangerous, which violate the American constitution and the liberty of American citizens, hence the anti-trust laws with the latest, AT&T, of which parts are to be found in Alcatel-Lucent, with a part by Alcatel, distant heir of CGE Energy, which itself is a result of the various restructurings of French industry, both nationalization and privatization.

A company such as France Télécom was for a long time a national company under the guardianship of the ministry for Post and Telecommunications, with a national level laboratory, the CNET, to guarantee its mission of service to the public whose research fed into the entire telecommunications industry. Privatization of the company led ipso facto to the disappearance of the CNET, replaced by a classic R&D type structure typical for large companies but which, due to the privatization, no longer needed to play a national role. This led to some question of systemics posed to the regulator State: who was then going to take on the mission at a national scale? The CNRS? The INRIA? Or a new structure that needed to be created from different entities? How can the transition be guaranteed without a loss of skill, when we know that direction of a research team of 40–50 people often relies on leadership from two or three people?

Economic policies described as liberal have the role, at least in theory, of organizing economic competition between the companies in compliance with the rules, which is another way of limiting growth of certain systems. Here, we refer back to the previously cited works of M. Porter.

The economic factor characterizes the capacity of a country, of its companies and its banks, its State structure, to mobilize resources to create infrastructures, goods and services, which are required for the well-being of its citizens. In the United States, since World War II, the Department of Defense (the DoD) has fulfilled the mission of providing American technological leadership. As everyone knows, the United States does not have a research ministry, because it is primarily the DoD that takes care of it, in close collaboration with the large American universities, and with a few large agencies such as NASA and research organisms such as RAND or MITRE which are FFRDCs²³. President Reagan’s Strategic Defense Initiative (SDI), better known as “Star Wars” financially supplied American universities and created many research projects which were fully beneficial to American industry, which now enjoys an obvious competitive advantage.

In France, a country with a tradition of centralizing and a strong State, large projects that have given rise to large systems such as the electronuclear program and the “Force de Frappe” or strike force, the plan for modernization of the telecommunications, motorways, TGV high speed train, space program, etc. all arose from the voluntarist action of public powers supported by large organizations such as the CEA, or by national companies like the SNCF or France Télécom, which themselves played the role of project managers or project owners of an entire network of industry in charge of “the action”.

An English colleague pointed out that a system like the TGV high speed train is almost impossible to set up in Great Britain because the financing capacity that must be obtained is virtually inaccessible to private companies, even large ones, which in addition do not have the same degree of guarantee as the State.

Dissolution of the CNET due to privatization was a tragic loss for the telecommunications industry in France and for industrialists who did not see the situation looming on the horizon, in particular Alcatel. A research center is not simply about patents, it is also a way of training high level professors, engineers, and scientists who are required for the development of sectors of industry. It is a center of excellence which reaches out to its environment, hence the importance of the social factor about which we are now going to say a few words.

The social factor, in the widest sense of the term, is everything that relates to human development of the citizens of a country and, in a first instance, education. The analysis of technical objects/systems using Simondon’s method has shown the importance of the communities of users and of engineering for the “life” of systems. The human factor, namely the average level of education of these communities (the “grade” in the graduate sense), obviously plays a major role. A well-educated, responsible, motivated and entrepreneurial population, is an essential competitive advantage; this is the condition required for the appearance of socio-economic phenomena such as the development of Silicon Valley in California since the 1980s, and prior to that around “Route 128” which surrounds Boston and its large universities (MIT, Harvard, etc.); the birthplace of the computing industry. Implementation of sensitive technologies such as nuclear power demand a highlevel of maturity, both at the user level (so, in the case of the nuclear sector, this relates to the service industries involved) and at the level of the engineering teams (who develop the technology) (in France, the CEA, the constructor AREVA, also in charge of fuels, and the EDF operator in addition to their direct sub-contractors), in other words the entire nuclear sector and all the workers, technicians, engineers and directors who are involved as actors, without forgetting the parties concerned.

In the case of the systems that we focus on in this book, training in systems sciences at the level of an engineer (Baccalaureate + 5 years, or more) is essential, on the one hand to avoid leaving each of the engineering teams to reinvent the wheel several times, each in their own way, and on the other hand to create transversality, a common language from which all the sectors that implement systems will benefit (here we refer back to section 1.3); the “Babel” effect, as we have seen, is fatal to interoperability. In all artificial systems created by humankind, there is always knowledge and expertise that is specific to the phenomenology of the system such as electricity or nuclear, but also knowledge and general expertise which characterize a class of systems. This category of knowledge must come from teaching at a higher level, but the difficulty is of presenting it simultaneously in a specific and abstract manner.

For the technical factor, we have highlighted throughout the book the importance and all-pervasive nature of ICT in the design, development and operation of systems, which are integrated into the rather more vast context of NBICs. The “digital” sector has been recognized as a great national cause in many countries, including France, slightly late if we compare it to the United States or Israel, taking two extremes on the spectrum of States. The information component which is now present in all systems needs to be assessed properly, and prepared for. It is essential to understand that the “physics of information”, to use the terminology introduced by physicists themselves, will play the same role for ICT/NBIC that electronics played in its era, or that physics of condensed matter and particle physics played for the entire energy sector.

While the engineering teams were “not up to standard”, this does not mean that they cannot be effective. It just means that productivity will be lower, that the rate of errors will be higher, breakdowns will be more frequent with a higher level of risk (e.g. nuclear power plants such as Chernobyl, without a safety enclosure!), and that the quality in general will not be what users should expect, etc.

Quality is a fundamental component of the technical factor and, in France at least, it is not taken as seriously as it should be, in particular by the education system and by many industrialists, including among the greats of the CAC 40. Financialization of industrial activities has been accompanied by uncontrolled (and uncontrollable?) risk-taking whose deleterious effects are beginning to appear.

Is the technical capacity to be effective dependent on the capacity to carry out system development projects of all kinds? Here again, we should avoid delighting in hollow words which are never a substitute for competence. Since the 2000s we have talked a lot about “agility” in systems engineering environments, a hollow word selected from a good collection of them, because what should be done is not only to name and/or define, but to specifically explain what it is for, how to go about it, in other words the what and what for, or the objective, taking into account the phenomenology of the project. This was indicated to us a very long time ago by Wittgenstein in his Tractacus logico-philosophicus (Routledge & Kegan Paul Editions, translated by B. Russell), when he said: “If a sign is useless, it is meaningless”, (aphorism 3.328).

Here again, we see that the technical factor can only develop if individual and collective actors (that we have called “active units”) are humanly up to standard, as much in terms of the knowledge required and/or to be acquired, collective expertise within projects, but also interpersonal skills, in other words the ethics that in fine determine the cooperation capacities within the teams themselves²⁴. This truly is a symbiosis, and it cannot be bought like a pocket watch or a hamburger.

Concerning the ecological factor, we will only say a few words, remaining at a very generalized level, because for any system that is constructed, its dismantling must also be included. The dismantling is the normal terminal stage of the life of a system (it is the equivalent of the programmed “death” or biological apoptosis), but in order for it to be carried out in good conditions, it must be integrated as a demand right from the start in the design phase of the system. In the case of nuclear energy, reactors under construction will have an estimated lifetime of one hundred years, in other words the teams in charge of the dismantling will know those that designed it only through the documents that they have been left.

All systems are traversed by flows of energy and materials that will be transformed by the system and delivered to the users. As for the system itself, it must be possible for objects manufactured in this way to be recycled once they are no longer being used. These flows are moreover never totally transformed; there is always waste of all kinds: unused materials, thermal, sound, electromagnetic pollution, etc. Ideally, it must be possible to recycle everything in order to avoid the hereditary term of the growth model of the Lokta–Volterra equation becoming dominant. This is the necessary condition for general equilibrium of the terrestrial system in the long term.

The ecological component is a vital requirement for future generations and a true technological challenge to be met for engineers in the 21st Century who must now reason in a world of finite resources. All waste that is not compensated for and left to the goodwill of natural processes is a mortal risk whose importance we are beginning to measure. The additional devices need to be taken with the same level of seriousness as operational devices, and to be honest, one never happens without the other.

Concerning the legal factor, all advanced countries have a diversified legislative arsenal and standards to be complied with, with agencies to control them, and finally tribunals to judge those who violate the law. This is not without its difficulties, as we all know, with multinational companies who can offshore certain production activities to countries which pay less attention to this aspect.

In conclusion, all these external constraints are going to play a full role when it is necessary to cooperate in order to grow, as has become the rule in globalized economies; the PESTEL factors which then become deciding factors for the choice of a country in which to organize growth and invest, either for the quality of its workforce, of its infrastructure, or for its taxation, or for its lack of legislation, etc.

8.4.1. The individuation stage

Initially, systems are born from the conjunctural requirements expressed by the users, both individually and collectively, or by anticipation from the R&D teams that are internal and/or external to the company or to the administration. At this stage, it is often technology, a source of new opportunities, that takes control. Defense and security, strategic leadership, have been at the origin of a great number of systems in the United States and in Europe. Development of the electronuclear sector in France in the immediate after-war period is typical of this situation. Progressively, the company is going to host a whole array of systems which each have their own individual dynamic and which are going to organize their growth as a function of the specific requirements and demands of the community that has led to their creation.

In Figure 8.15, we see systems that are born and develop at dates T1, T2, … and mono-directional connections that are established case by case at dates that are compatible with dates of birth of the systems and/or of their stages of development. All this is initially perfectly contingent and almost impossible to plan globally. Individual dynamics mean that at an instant T_x, a function will be added in the system S_i, whereas this is not its logical place, because the system which should host it has simply not been created, or even, as frequently is the case, the director of system S_i wishes to keep its technical and decisional autonomy. If on the contrary the function to be developed exists elsewhere and the two directors are in agreement to cooperate because they see a win-win reciprocal interest, then an explicit connection is born which will allow an interaction.

The logical functions which answer a user’s semantic will take root wherever this is possible, with possible redundancies in different systems in which they will exist in various ways that are more or less compatible. At a certain stage of this anarchical development without a principle of direction, but anarchical by necessity because it is unplannable, the situation will become progressively unmanageable, which was the case of the electrical system in the 1940s–1950s.

After the time taken for action and disordered development without cooperation nor coordination, we have the time to return to an energy-economical optimum where the interactions will be considered as a priority, such as the first data of a global system that will have to optimize itself on the network of interactions (see Figure 8.5 and the comments). This is an illustration of the implementation of the MEP principle.

REMARK.– In the world of strategic systems, known in the 1990s–2000s as network-centric warfare, accompanied by many publications by the institutes and think tanks working in the world of defense and security. The SDI project, “Star Wars”, is an emblematic example of this.

A few words about the evolution of the nature of the connections are represented by arrows in Figure 8.15. At the very beginning of the industrial revolution, the connections that existed between the various pieces of equipment in a factory were purely mechanical. With gears, cams, belts/chains, steel cables, etc. it was possible to organize workshops such as those in Figures 8.1 and 8.2 for machines; but it was very rigid, extremely fragile, and also not very reliable. Mechanics was the queen of engineering sciences, along with the strength of materials²⁷. Airplanes from World War I had flight commands that were entirely mechanical, with cables more or less everywhere. Very quickly, in particular thanks to the implementation of electrical energy on a large scale, it was possible to distribute the energy using cables that conduct electricity towards electric motors and/or hydraulic circuits to distribute the pressure to the valves. During World War II, the first flexible hydraulic circuits and electrical cables to carry electronic signals appeared, which could be processed/transformed by suitable analog devices; cables for the telegraph had already been in existence for a while, with the first transatlantic cable in 1858 (4300 km, 7000 metric tons, communications in Morse code). Transducers came into use at that time. The end purpose of all these mechanisms whose function is to operate a coupling between the equipment of a system in such a way as to inform some of what others are doing, and transmit commands, was generalized in the 1970s–1980s: the computer progressively took charge of all the analog functions of coupling, whether they are electronic, mechanical or human. The computer therefore becomes the central machine of the integration operator. The connections become virtual and are carried by information transmission networks made up of wires, with fiber optics whenever this is possible, or electromagnetic waves of various magnitudes (Bluetooth, Wi-fi, 4G, 5G, etc.); the information is no longer transmitted in the form of analog signals, but in coded form, with robust codes chosen as a function of specific noises in a given environment, including space and the interstellar environment for very long distance waves for satellites and interplanetary robots/probes.

The entire “information” function that is specific to all systems, as the inventors of these technologies had perfectly noted (Wiener, von Neumann, Shannon, etc.) but for which they did not have the technical means, given the technologies at the time, is today entirely “digested” in the form of digitalized multimedia connections, to such a point that the digitalized connections device provides “intelligence” to the equipment and in fact to the systems. Hence the all-pervasive nature of what we have called information energy (see section 8.3.2) and the central role that information plays today in all systems, small in size (like our smartphones) but complex or enormous (such as electrical systems) where the energies that need to be controlled are colossal.

8.4.2. The cooperation/integration stage

The dynamic of interconnections which began with the apparent ease and tranquility offered by ICT from the 1980s onwards, quickly transformed into a digital nightmare, at least for those who did not see the rise in concomitant complexity of “chains of connections”, as they were known in the 1980s–1990s, and of industrial networks.

Potentially, if we interconnect N systems point to point, the number of physical connections increases like the square of the number of systems, in other words: Number_of_connections = N×(N−1), because the flows carried by these connections can be bidirectional. In terms of engineering, this means that validation of the connections will require an effort which increases, at a minimum, as the square of the number of systems, hence the material impossibility of mechanical solutions.

If in addition, since the connections are digital, the systems store details of past interactions (which is both very easy and very tempting because this opens an entire set of new possibilities and optimizations) research work to validate a physical link is accompanied ipso facto by consideration of the possible states related to the history of interactions that have taken place in the systems. The combinatorial of these states therefore evolves in the following way: Combinatorial_of_states = E[S1] × E[S2]×…×[SN], in other words an exponential²⁸, the worst kind of situation for an engineer. The integration effort is out of our control, more so than quadratic as we had initially believed we would restrict it.

To extract ourselves from this predicament, intelligence will be required, and as David Hilbert recommended, we will generalize to make a simplification. The structure that emerged progressively in the 1990s–2000s, was named a pivot structure, shown as a flow chart in Figure 8.16.

The pivot structure of the organizing center of interoperability of systems is fundamentally a model of exchanges where all flows have been virtualized. This abstract center is linked to the elements of the system by exactly N bidirectional connections. The global system is perfectly symmetrical and none of its elements play a particular role, which only makes the whole set more fragile from the point of view of the exchange model. A connection between two systems S_i and S_j passes necessarily via the pivot, which has the useful additional property of physically uncoupling the communication between S_i and S_j, in other words S_j ↔ Pivot ↔ S_i, which has led some to say that the pivot played the role of an “expansion joint” which is well-recognized in mechanics (gimbals, differentials, enveloping worms, etc.) and in civil engineering in large engineering structures; a rather pertinent metaphor. Others have talked about orchestration or choreography, doubtful metaphors chosen for media purposes.

For the detail of this logic and its implementation, refer to the document “Technologies pour la mise en oeuvre des NCS” on the authors’ website.

We are going to concentrate on the fundamental properties of this new abstraction that will radically simplify the engineering of connections and provide systems with a virtually unlimited growth capacity, which is indeed virtually unlimited notwithstanding a few simple rules.

In order for the pivot to have a meaning, it must: (1) concentrate all and nothing but the information that is strictly necessary for coherence of the whole, including in the event of an error and/or abnormal behavior; and (2) have a representation, in other words the language that expresses this coherence, which is independent of the representation modes adopted in each of the systems.

In Chapter 5, we have formally established the requirement for the distinction between the internal language and the external language, and the respective grammars of these two languages, GL_Int and GL_Ext. The interoperability pivot is necessarily manipulated and expressed by a well-formed sub-set of L_Ext and GL_Ext for each of the systems that wish to cooperate, in other words L_Pvt and GL_Pvt.

The semantic coherence of these various sub-sets must therefore be guaranteed, possibly along with any required re-adjustments in each of them to improve this coherence. But the existence of a pivot must not tie the systems to each other (spatio-temporally) which would be expressed mechanically as:

Any modification of one leads to a synchronized modification of the others, which would be equivalent to simultaneously synchronizing all the elements in the SoS, therefore a “fatal” rigidity for the evolution of the system because everything would need to be stopped.

Figure 8.17 shows how things should be done progressively so that everything is done correctly without destabilizing the entire system. This is a modification of Figure 5.2.

In the diagram, the model _Ext ↔ pivot translators/transducers take the place of “expansion joints”; they are indispensable for autonomy of the system S even though S is a member of a federation with which they cooperate. As a consequence, it is not even necessary for the descriptive formalisms of each of the systems to be the same, although the semantic of the exchanges is, itself, perfectly invariant.

The semantic of the exchanges is a fundamental invariant, but the representation of this invariant can be numerous, in other words all the representations used can be expressed reversibly, with no loss or addition of information, into each other. The pivot representation, known as “pivot language” or L_Piv, plays the role of a neutral element in this whole, in such a way that (strict equivalence) is always true, meaning explicitly stating the translations and inversely . The existence of the pivot, and conformity of the representations used in relation to the pivot, guarantee that in all cases the external languages of all system couples S_i and S_j are semantically equivalent, in other words .

REMARK.– The implementation and detail of the engineering of pivots is a significant and difficult problem in engineering but which will not be tackled here (refer to our book Architecture logicielle, 3rd edition, published by Dunod).

We have seen that command–control systems all evolve towards remote control and/or remote operation devices, which involves deporting ergonomic engineering functions (operation, exploitation, maintenance) to outside the site where the system is located. In at-risk technologies such as the nuclear or petrochemical industries, we thus improve the safety of people by minimizing presence on site, which will only be necessary if the physical elements of the system are affected.

This means that the geographical sites where systems are located must be linked to each other by a communications infrastructure, either wired, or Hertzian, or optical, or satellites or a mix of these for reliability, to manage and organize all interactions from a distance, infrastructure which was first seen in the 1970s for remote diagnosis and remote maintenance of the first mainframe²⁹ computers. This is also the date of the discovery, thanks to optical fibers, of a method for isolating the disks required for mass storage in secure rooms at a distance of several kilometers from the central unit disks. In the field of C4ISTAR, automatic motors such as drones are completely remote-controlled, at distances of thousands of kilometers thanks to satellite connections.

In the 1990s–2000s, it became clear that all these communications infrastructures are destined to merge together to create a single one, in charge of all exchanges, whether these are for remote-control or for MMI in a wider sense (remote operation), and those concerning mutualization of services/resources that are shared among the various equipment in the system of systems. Hence, the final diagram of this evolution, which was carried out over around 30 years (Figure 8.18).

In an architecture of exchanges of this type, all sharing is potentially possible. Only external constraints, like safety or performances, are going to allow a choice of organization that is best able to fulfill the service contract. In systems engineering jargon, this is known as the FURPSE constraints (function, use/ease of use, robustness/reliability, performance, serviceability, evolutivity), in line with the ISO-9126³⁰ standard.

Infrastructure constructed in this way is a common good of the communities that have decided to federate to be more effective overall in their respective missions, mutualizing all or part of their resources. Infrastructure that is created in this way can therefore not only guarantee the exchanges with a quality of service that can be measured by an overall average availability (this is a statistical measure) weighted to reflect uses (this is a flow), but it can also provide transverse functions like those guaranteeing the autonomy of the systems, each taken individually. Functions known as “autonomic”³¹ (see Figure 4.15) can thus be moved up a level in the hierarchy of federated systems, and manage/have available specific equipment: measurement probes, various sensors and effectors, devices to monitor the environment (refer to building management systems for secure buildings³²), decision aids, etc.

In doing so, we have defined two categories of systems within the federation of systems that have decided to cooperate because this presented an obvious competitive advantage:

1. 1) Functionally dominant systems: they carry out the actions/transformations that are required by the users (performance aspect; this is the “action” of the system). In Figure 8.18, these are specific functions of the various system blocks.
2. 2) Service dominant systems: carried out for the benefit of the former, either as a supplier of mutualized resources (such as the infrastructure of exchange networks), or as functions that are transverse to the federation (e.g. the safety, autonomic management of the environment, etc.). These are common functions of the system blocks that are dedicated to providing a service common to all. They are seen as black boxes by the specific functions.

At this stage of their evolution, it is perfectly possible for some of the systems in the federation of the system of systems to relinquish some of their functions with full knowledge of the consequences, if they have an absolute guarantee that the function is available elsewhere in another system of the SoS, with the same guarantee of service as if this function had remained within the system.

Savings made in this way will allow investment to be made in the transverse functions/services which will improve the robustness and the resilience of the federation. With the development of the electrical system, we have seen an example of implementation of this capability logic which globally improves the guarantee of service, because the breakdowns become extremely rare.

Thus, this leads us to a specialization of systems taken individually, an individuation using G. Simondon’s terminology, hence the rule: each of the systems is more efficient when it is hosted in a well-constructed and well-organized federation, rather than if they were left to themselves when facing a “hostile” or risky environment whose hazards they would not be able to or would not know how to compensate for (in the language of physicists, this corresponds to a break in symmetry). Complexity organized in this way is the price to pay for better efficiency.

It therefore becomes imperative to filter the inside/outside frontier of the SoS federation in order to avoid the individual systems being subject to hazards that they can no longer control. Engineering is based on cooperation.

The diagram in Figure 8.18 gives an overview of this new logic known as capability. In all cases, what is essential is maintenance of the coherence between the virtual digital world and the real world of the physical–organic component of the system. Coherence of actions, on the one hand, which is a fundamental transactional coherence, must comply with the classic properties of transactions (properties known as ACID) which are typical of the informational world and of transformation quantas, and, on the other hand, temporal coherence because clocks in both worlds are set to different time scales, it being understood that the scale of the real world sets down the semantic, in other words the “real time” in the strict sense of the term complying with a schedule no matter what the duration of the operations carried out in the real world was.

When all this is in place, we can envisage the last stage of growth, the opening of the system or of the system of systems.

8.4.3. The opening stage

It is firstly necessary to specify correctly what the question relates to when we refer to “opening”, because interoperability is in itself a form of opening, perfectly controlled by the acceptance of common rules.

Opening is something different whose requirement we observe in a certain number of systems. We give a few examples:

• – The electrical system, for its own requirements, manages statistics to fill various holding lakes for the hydraulic part of the system which plays an important role because hydraulic energy can be immediately mobilized. It is simply a case of opening the sluice gates, in terms of control purposes. No other energy has this capacity. These statistics are of interest to various ministers or territorial bodies, for example, municipalities that have these installations within their perimeters; a holding lake can be used as a leisure base. This is an example of opening, and in this case, it is what we call, or would call, open data. Inopportune use of this data can create dependent relationships which in the end will be detrimental to the capability logic of the electrical system. The user of the “opening” must accept certain rules. This is necessarily the case for a user of the system who has an energy source (solar panels, etc.) and who wishes to interface with the electrical system.
• – In air traffic control, not only an airport zone, but also “en route”, airlines that also have their own systems request hosting services within the air traffic control system of certain functions, to stay in contact with their airplanes, or with the personnel on board. In this case, there is an interpenetration of functions, but this must not under any circumstances be expressed as a risk in terms of safety. All the more so that various airline companies can ask for services that are not necessarily coherent and can even be contradictory. Here again, there are rules.
• – In C4ISTAR defense and security systems, each of the nations participating in an operation arrives with their own systems, and the responsibility falls to the “governing nation” (in NATO jargon) to host everyone. Here again, rules are required, and this is the reason why, during the first Gulf War, French airplanes were not able to participate in night operations orchestrated by the American airforce – due to a lack of suitable equipment. This was not the case for naval forces.

In all configurations, a function, in the broad sense, of a system outside the SoS federation is deported within the hosting SoS, without being part of it. The block diagram of opening an SoS to another SoS is represented in Figure 8.19.

For an architecture of this kind to be viable, a reciprocal level of confidence between the host and the hostee is required, which will guarantee the effectiveness of the common action, without damaging the host including in the event of anomalies. However, it is a level of confidence that does not extend to making exchange models of the SoS host available, which would be purely and simply an integration of the two SoS. This is not sought in the “opening” in which each one maintains their own full and total liberty, while accepting a few minimal constraints; as a consequence, ethics begins at the heart of the engineering process, or PESTEL factors. The minimum level of safety required for the opening is non-refusal of the actions of the hostee, which it must be possible to trace in order to guarantee if it is needed that both the host and the hostee have done the expected work. The connections are fundamentally asynchronous.