Agents preserving privacy on intelligent transportation systems according to EU law

Abstract

Intelligent Transportation Systems are expected to automate how parking slots are booked by trucks. The intrinsic dynamic nature of this problem, the need of explanations and the inclusion of private data justify an agent-based solution. Agents solving this problem act with a Believe Desire Intentions reasoning, and are implemented with JASON. Privacy of trucks becomes protected sharing a list of parkings ordered by preference. Furthermore, the process of assigning parking slots takes into account legal requirements on breaks and driving time limits. Finally, the agent simulations use the distances, the number of trucks and parkings corresponding to the proportions of the current European Union data. The performance of the proposed solution is tested in these simulations with three different distances against an alternative with complete knowledge. The difference in efficiency, the number of illegal breaks and the traveled distances are measured in them. Comparing the results, we can conclude that the nonprivate alternative is slightly better in performance while both alternatives do not produce illegal breaks. In this way the simulations show that the proposed privacy protection does not impose a relevant handicap in efficiency.

1 Introduction

Intelligent Transportation Systems (in advance, ITS) are one of the domains where Artificial Intelligence is most expected to be applied (Sumalee and Ho 2018). Inside this broad domain, how parking slots would be automatically booked by trucks endowed with intelligent sensors is a particularly interesting problem. As the survey (Vital et al. 2021) shows, many approaches have been proposed to solve it. Such intelligent sensors are supposed to contribute into the compliance of the driving legal requirements in a way that would largely surpass the current abilities of tachographs. Among the expected new abilities of these intelligent sensors would be efficiently managing the decision and communications relative to the automated booking of parking slots. This decision should jointly avoid unorthodox parking situations (which affect general road safety and facilitate merchandise thefts) and should ensure the compliance of the legal driving requirements (Parliament 2002, 2006). The previous research on this issue (Vital et al. 2021) addressed both goals. But they do not consider the privacy implications. Private information such as the position, destination and time spent driving is required in the previous contributions to this problem in order to reach the best assignment solutions.

But according to EU law (Parliament 2016; Wright 2012), privacy risks of data in any communication have to be estimated and minimized. Therefore, the privacy protection also applies to this problem. A desirable and innovative contribution in the development of Intelligent Transportation Systems in the European Union should not only optimize of the parking slot assignment satisfying the legal requirements, but also considers the data privacy protection. This is the motivation of this paper: achieving as much privacy as possible without imposing a heavy handicap in the quality of the final parking assignment reached.

The contribution of paper this paper follows these lines:

• 1. It addresses the privacy issue with an estimation of the privacy risks (showed in Sect. 3).

• 2. It also addresses the privacy issue with a minimization of privacy risks provided through the design of the amount of information to be shared, and the process of generation such information (showed in Sect. 4)

• 3. It describes the implementation of the proposed way to achieve privacy into an agent-based solution (showed in Sect. 5). Agent technology specially fits into the need of privacy and the dynamic nature of this problem. The implemented Autonomous Agents apply a logic of the decision making which is not-biased, transparent and explainable through the use of the Beliefs, Desires and Intentions (in advance, BDI) deliberative paradigm. The joint need of explanations, privacy protection and distribution justifies the use of Symbolic AI instead of using a Machine Learning alternative.

• 4. It includes several simulations (showed in Sect. 6) that test the loss of quality produced by the privacy protection comparing the proposal with an alternative that discloses all private information as the previous works in this problem do. Quality is defined by the efficiency (time taken to destination) and of avoidance of illegal parkings. The setup of the agent simulations uses the current EU regulations and the real proportions of EU number of parkings, distance and trucks in order to be as much realist as possible.

2 State of the art

This Section shows the previous works proposed to the different aspects the problem of automated booking of parking lots has: regulation, centralization, privacy protection, and use of agents.

The EU showed interest in regulating ITS with the Directive 2010/40/EU of the European Parliament (2010). This directive details the legal framework for the deployment of ITS, specifying the different actors, their abilities and involved communications. One of the priority actions of the directive is about how parking slots would be automatically booked by trucks endowed with intelligent sensors. Besides the EU law addresses the driving requirements in the Directive 2002/15 (Parliament 2002) and EC Regulation 561/2006 (Parliament 2006) where driving trucks is strongly restricted specifying the maximum length of routes and the minimum required breaking times.

Related to the issue of automated booking of trucks many centralized approaches have addressed several aspects of this problem: Haque et al. (2017) predicts (using GPS information) the use of parking lots, Bayraktar et al. (2015) studies the supply and demand of commercial trucks to optimize the use of parking lots, (Morris et al. 2017) uses cameras and Cook et al. (2014) and Suthir et al. (2022) use sensors to automatically detect free spaces to instantly inform trucks, Melo-Castillo et al. (2017) uses profiles of trucks to provide useful information about the most suitable parking lots, Nourinejad et al. (2014) simulates traffic to decide where to place parking lots in urban environments, Vital and Ioannou (2019) and Vital and Ioannou (2020) take into account legal driving restrictions to plan routes for truck drivers according to the available parking lots. Additionally, many other different automated parking mechanisms have been proposed under the denomination of smart parking, which are compiled in the survey (Lin et al. 2017).

Jointly with the ITS domain, Data Privacy is also a major general concern of EU, as Regulation 2016/679 of the European Parliament shows (Parliament 2016). According with this regulation, any processing operations are likely to result in a high risk to the rights and freedoms of natural persons requires a proper privacy impact assessment (Wright 2012). This outcome of the assessment plays a key role in determining whether (and which) appropriate measures have to be taken in order to comply with Regulation 2016/679. Privacy is also a concerning issue of research in the general ITS domain as the surveys (Ali et al. 2018; Butt et al. 2019; BelMannoubi et al. 2023) showed. There are also in the literature, many specific applications that address privacy protection in the ITS domain, for instance the very recent ones (Kumar et al. 2022; Gao et al. 2023) which apply reinforcement learning and blockchain to this issue. The specific problem of protecting privacy of the automated dynamic remote booking of parking lots by truck drivers was theoretically addressed by Erdogan et al. (2016) and Ma et al. (2017) but, to the best of our knowledge, no practical research have been made to protect privacy in this problem. The key-point of the privacy protection in this problem is deciding with what information a conflict is solved between agents asking for the same parking slot. There, we can observe that the centralized alternatives mentioned before rely upon the assumption that agents shared all the knowledge of truck drivers (their current position, destination and information relative to their legal driving requirements). Then, no data privacy would be obtained but the (almost) best possible solution is likely to be achieved. This idea has also been extensively applied to urban parking problems cars, as for instance did (Lu et al. 2021; Pereda et al. 2020.

On the other hand, if no knowledge was shared between the parts, data privacy would be fully protected but the quality of the booking results could then become highly uncertain for all the participants as research from Ayala et al. (2011) showed. There, drivers decide without booking the slots in advance, and without knowing the distances of other drivers to the parking sites guessing the right parking site according to the expected historical probability of finding there an available parking slot.

So, in opposition to both extremes, a solution in the middle ground looks desirable. It could jointly achieve two goals: quality in the solution (but not reaching the optimal one that only could be reached through complete knowledge) and data privacy protection (but not a total privacy protection that could be only reached by sharing no information at all). In order to reach both goals, instead of implementing a centralized solution as almost all the previous works did, Autonomous Agents may address the dynamic and private nature of this problem in a distributed way. Agents by definition are, in broad terms, abstractions of pro-active computational entities that encapsulate and autonomously decide with private information while they interact with a dynamic environment (Wooldridge 2009). The concept of Agent as autonomous software acting on behalf of its human user (in our case, truck drivers) has also been addressed from a legal perspective (Dahiyat 2021; Andrade et al. 2007) before. Although intelligence of agents can be achieved by simplistic (action-reaction impulses) or subsymbolic (data-based) approaches, in problems such as the automated parking, where explainability plays a major role (Manger et al. 2023) cognitive approaches tend to be more suitable to provide not biased, explicit and transparent explanation to users. The internal model of cognitive agents includes explicit beliefs about themselves and the environment and goals that will determine their behavior. The most extended paradigm to implement cognitive agents is the Beliefs-Desires-Intentions model (BDI) which is inspired in human rationality (Rao and George 1995). This BDI modeling has been, for instance, applied to represent how Agents may act identifying and following social norms according to conventions, contracts and privacy obligations (Dignum 1999).

The Agent platforms with most extended use in any application domains are Netlogo,¹ JADE,² JADEX,³ and JASON⁴ according to Kravari and Bassiliades (2015) (Balke and Gilbert 2014). The last two platforms are specifically dedicated to BDI Agents. Programming a JASON agent (Bordini et al. 2007) is achieved by both a Java and an AgentSpeak (Rao 1996) code. The internal reasoning of the agent that rules its behaviour is written AgentSpeak, while the actions launched by the AgentSpeak code, that updates the perceptions from the environment and the effects of such actions, is written in Java. AgentSpeak makes clear the representation of beliefs, goals and plans isolating the high level reasoning from the low-level details of the action implementation in Java.

Specifically with the technology of agents, some authors addressed the dynamic pricing of booking the parking slots (Jioudi et al. 2019) and the optimization of path finding according to the driver priorities about parking (Okoso et al. 2019). But the previous work with more similarities to the solution proposed in this paper is García et al. (2014). There, the authors used an agent system, programmed in JADE, that addresses the automated booking of parking slots for trucks in road traffic using the legal requirements. They also included simulations to show in different traffic conditions the corresponding delay and the number of illegal parkings produced. But their approach, although similar in these ways, differ from the solution proposed here in two aspects. First, distances, number of trucks and parking sites are quantified according to the EU proportions and agents comply the specific driving restrictions of EU law. And second, and more importantly, García et al. (2014) did not include any privacy concern which is the original innovation of the research contribution proposed here.

As a final summary of this review of the state of the art, Table 1 shows the focus and lacking issues that previous authors have applied into this problem.

Table 1 Link between the mentioned references and the addressed and lacking issues of the problem

3 ITS in UE as an application domain of agent technology

As it was described in in Sect. 2, this contribution is focused on how the EU legally frames the problem. Both, the directive (Parliament 2016) and the publications (Wright 2013; Stewart 2012) highlight the need of an estimation of the involved privacy risks. Additionally, Mobility and Transport (2013) describes the roles conflicting interests and both, Parliament (2002; 2006) detail the legal restrictions. In this Sect. 3, first, a Privacy risk estimation is performed. Next, the legal terms of roles, conflicting interests and driving restrictions are transformed into an agent-based approach. And finally, using these terms, four realistic scenarios are defined where different levels of data privacy take place in them.

3.1 Estimation of privacy risks involved in ITS

Using the Regulation 2016/679 (Parliament 2016) and the guidelines to assess privacy impact in a more efficient (Wright 2013) and optimized (Stewart 2012) way, we have analyzed the problem of automated remote booking of parking lots. Table 2 summarizes the associated privacy risk factors of these communicated data concluded from such analysis. Such impact and probability values of High, Medium and Low are not numerical since they come from a rough estimation. Fields of the Table 2 with a—as value denote impacts and probabilities where the analysis of them is not applicable. This Table 2 remarks the relevance of privacy in the ITS domain due to: the joint presence of factors with high impact such as the high number of subjects involved, the use of geolocalization data and, finally, the use of automated means and processing.

Table 2 Probability and impact of the risk involved in the ITS scenarios according to Parliament (2016) (Wright 2013; Stewart 2012)

3.2 ITS roles according to the European Commission and their equivalent agents

The ITS Action plan of the European Commission states (Mobility and Transport 2013) that in the ITS domain several roles exist for Truck Parking Areas (TPAs): Users, Operators, Reservation Service Operator and Reservation Brokers. The Action Plan describes how these roles keep and provide information, and from this description, the agents who play these roles can be defined:

• Truck agents play the User role, which represent truck drivers. They keep the current location, estimated time of arriving to parking sites, and the estimated length of parking stays.

• Parking Site agents play the Operator role, which represent the parking sites. They keep an updated list of the status (freeblocked for a given time) of each one of their parking slots.

• Central Booking agents play the Reservation Service Operator role. They manage an extensive region of parking sites, they may even have international scope. They keep and provide an updated network of parking sites (distances, connections, capacity and freeblocked spaces).

• Broker agents play the Reservation Broker role. They act as facilitators between truck and the parking site agents.

3.3 Conflicting interests according to the goals of agents

From the goals of parking site and truck agents of above, several potential conflicts can arise between agents:

• The parking site agents pursue the goal of maximizing the use of its parking slots.

• The truck agents pursue the goals of: minimizing the lengths of its routes, avoiding more parking breaks than necessary while complying with the legal driving requirements.

3.4 Legal driving restrictions according to the EU regulation

In the ITS domain, according to the EU regulation (Parliament 2002, 2006), truck drivers have to comply with the next requirements:

• Working Breaks: Generally all employees (including truck drivers) are not allowed to continuously work (in our case, drive) for more than 4.5 h without any break, this break is required to be at least of 45 min.

• Minimum daily resting period: Drivers require at least 11 consecutive hours of daily rest.

• Maximum daily driving period: If the journey of drivers involves several days, they can daily drive at most 9 h.

3.5 Scenarios according to the European Commission

The ITS Action plan of the European Commission also states (Mobility and Transport 2013) four possible scenarios to book parking slots that are expected to be provided by future ITS advanced devices that would overcome the current capabilities of current GPS and tachographs. They are:

• 1. Users have to individually book each parking slot from the trucks they drive.

• 2. Users book in advance the parking slots sending the whole route information to a third party acting as a broker.

• 3. Users demand the booking of parking slots dynamically sending partial route information to a third party acting as a broker.

• 4. Bookings are offline requested without the use of the embedded devices of the truck.

3.6 Analysis of the scenarios

For each of these four scenarios, there are assumed pros and cons of using them in terms of the involved data privacy risks, flexibility and global view:

• 1. If a legal requirement is detected to be soon broken by the truck, then the corresponding user agent (representing the truck) will send a booking request to directly to a parking site agent. No information about the route, nor the specific position nor legal requirement met that caused the booking request is shared with any agent, so data privacy risks are low in this scenario. However, this scenario should be dismissed as desirable due to both, the lack of any information about the reasons involved in the booking request and the absence of a global view from the parking sites point of view in the decisions taken. See Fig. 1.

• 2. If user agents send in advance the whole route to drive and legal requirements to the broker agent, then the broker agent will compute the future assignment of the corresponding parking slots to the users. In this scenario, all the private information is shared with the broker, so data privacy risks are high in this case. Although no private information is directly shared with parking sites, privacy then completely depends upon how much can be trusted the broker agent. Furthermore, although this scenario provides a global view, sending all the information in advance avoids any flexible adaptation that could be required in real time. See Fig. 2

• 3. If user agents demand the booking of parking slots to the broker agent as in the previous scenario, but now only some of the private information is provided to the broker, then this scenario will cause less data privacy risks than scenario 2 (a medium instead of high level) and it provides flexibility jointly with a global view of the situation. See Fig. 3

• 4. If the breaks are booked offline in advance, then everything is decided before the route is driven. This scenario corresponds with the current situation of Transportation Systems that ITS approaches look to overcome soon. Data privacy risks (from the computer communications view) are even less than the three previous scenarios, since estimations and no actual (real-time) knowledge about routes, positions and legal requirements are shared offline, and additionally (as in scenario 1) no broker is involved (and therefore there is no need of trusting this third party). The problems of this scenario are the lack of global view and the lack of flexibility in the assignments. Both of them are supposed to decrease the quality of the resulting solution.

Fig. 1

General outline of agents and messages in scenario 1

Fig. 2

General outline of agents and messages in scenario 2

Fig. 3

General outline of agents and messages in scenario 3

4 Design objective

Using the description of the four scenarios outlined by the European Commission in the ITS Action plan (Mobility and Transport 2013), an analysis of them was done in the previous section. From this analysis, it seems that scenario 3, Users demand the booking of parking slots dynamically sending partial route information to a third party acting as a broker, is the most desirable one. This decision is relevant, since optimization models often applied to assignment problems does not adopt the assumptions of this scenario. Therefore, the solutions they provide are of very different nature by definition. This is the case of Game Theory, Constraint Satisfaction or even Train Scheduling, which assume complete knowledge collected in advance by a central entity. They instead fit into the definition of scenario 2: Users book in advance the parking slots sending the whole route information to a third party acting as a broker. Although agent systems are distributed by nature, an instance of scenario 3 can be considered at most as partially distributed, since the broker and central booking agents play in this scenario a central role.

The objective of this work is to compare two instances of scenario 3 where the meaning of the partial route of information differs. One of them downgrades data privacy risks through a reduction of the amount of private data shared respect to the other. The same initial setup and conflicting interests are taken into account in both of them. The differences between them would be based on:

• 1. Which is information is to be shared with the broker agent.

• 2. How that partial information could produce a joint agreement (that takes the form of final parking assignments).

Next, this contribution is going to address these two issues in the next corresponding subsections.

4.1 Information to be protected and shared information

Several agents are assumed to act as providers (parkings) and clients (trucks) of a given number of (booking) services of the same type. Several of these agents desire to reach an agreement (parking assignment) on one of several possible alternative implementations of a single type of service, since each provider/client offers a particular different implementation (for instance, time range of the parking to be used). As these client agents are the ones which initiate the interaction protocol, they will be noted as the requesting agents, while the provider agents in the interaction will be the requested agents. The set of possible implementations of the service and its characteristics are assumed to be of public knowledge. But the evaluation of the interest that a requesting agent has in each possible alternative service (requested agent) depends upon how much cost/benefit provides the particular (domain-dependent) characteristics of each alternative service to this agent. These costs or benefits provided by the characteristics to a requesting agent are the hidden knowledge that this agent wants to be privacy-protected in any general problem of this type. Next, a generic formulation of this problem is described in terms of services, characteristics and weights (Fig. 4).

Fig. 4

General Framework: requester ($R^{er}$) and requested ($R^{ed}$) agents, public services (S) and private valuation of characteristics (C)

Therefore, a list of services is represented such as Eq. (1) shows.

$$\begin{aligned} \{{S_{i}}\}_{i=1}^{n}=S_{1},S_{2}. . . S_{n} \end{aligned}$$

(1)

Where each service, $S_i$, is composed by a collection of characteristics $c_j$ that may be different for each service, as it shows Eq. (2).

$$\begin{aligned} S_{i}=\{{C_{j}}\}_{j=1}^{m} \end{aligned}$$

(2)

In this way, each characteristic represents a different issue of the service that each agent weights in a different way. So the relevance of a service (can be also seen as a weight noted as $w_{S_{i}}$) is computed from the sum of the weights of the m characteristics (Eq. 3).

$$\begin{aligned} w_{S_{i}}=\sum _{j=1}^{m}\{{w_{C_{j}}}\} \end{aligned}$$

(3)

The weights of the characteristics (noted as $w_{C_{j}}$) represent the reasons why a given service is preferred over other service. These reasons form the information that any requesting agent wants to be privacy-protected. So, the solution proposed in this paper intends to reach agreements through a more indirect way, using hints that may act as the weights of the services ($w_{S_{i}}$) the requesting agent gives to the requested agent. While the specific valuation of the weights of the characteristics ($w_{C_{j}}$) the requesting agent internally remains as much protected as possible. Therefore, in the proposed solution, the weights of the characteristics are not directly shared between requesting and requested agents. Instead of sharing them, requesting agents share an ordered list of services. The weights of the characteristics play just an internal role in the computation of such list: the order is computed privately and internally by the requesting agent using the protected weights. This is how the solution proposed here differs from the classic generic definition of the problem. Each list is provided by a different requesting agent and it represents the compared priority each provider agent gives to the services included in the list. Each service instance is assumed to be able to appear only once in the list, and requested agents are assumed to provide their service to a given number of requesting agents.

Nevertheless, there is another important private data that is being shared and that has not been considered yet: the identity itself of the participant agents. An unique and verifiable identification of each agent is required in order to effectively link agreed services with the corresponding user. The protection of real identity through the use of secure authenticated pseudonyms or any other cryptographic mechanisms could be applied to provide an accurate identification while providing privacy of such identification. But this issue as the security of the communications between agents is out of the scope of this paper. How, both, secure identification and communications, could be provided is far away from our expertise in AI and Law, we just assume that this problem is somehow solved. A proper security analysis and the corresponding solution belongs to the Information Security research community.

4.2 Assignment process with the shared information

The lists of services ordered by the preference of requesting agents are going to be evaluated jointly in order to provide a globally satisfying solution. This solution consists of a collective assignment of the services to the requesting agents computed by a trusted third party (the broker agent). This third party generates a solution iteratively assigning the i-th (from first to the last one) preferred option of requesting agent to the corresponding requesting agent. So first, it evaluates the first choice of every requesting agent. And it starts assigning the requested agents that provide more instances of the service it provides. Next, the third party proceeds with the second choice of the lasting requesting agents that are not assigned a service yet and so one with the third one until the assignment of all requesting agents is completed. While doing this, the third party keeps record of the order in which requesting agents received an assignment. It also computes which is the worst level of satisfaction received by a requested agent: the greater position in its list had the finally assigned service. Furthermore, it computes the total sum of the list positions assigned. These two last numbers are used to measure the improvement from the first solution reached.

Next, the broker agent will try to improve the initial solution reached, generating a new one. In the new solution, the requested agents who were the last ones to be served with an assigned service are the first ones to be assigned a service, instead of starting with the requested agents who provides more instances of its service. This process is repeated until a full new assignment is reached.

The broker agent keeps generating new solutions until the order in which requesting agents were served is repeated, or until a number of solutions greater than half the number of requesting agents is already generated. Then, it promotes the solution that has the less resulting sum of the positions assigned. This value stands for a collective quality measure of the solution: good-for-all enough. In the case of a draw between several solutions according to this criterion, the solution with a better worst level of satisfaction received by a requested agent is preferred. This value stands for an individual quality measure of the solution: less-bad-for-anyone. This process of computing a balanced assignment solution is summarized in Fig. 5 particularized to the terms of trucks and parkings corresponding to the ITS domain.

Fig. 5

Assignment process executed by the broker agent in terms of parkings and trucks corresponding to the ITS domain

Once the information to be shared and the process of transforming it into a solution are defined, next section is focused on how they are implemented as agents.

5 Implemented agent system to provide privacy in ITS

This section addresses the step from the design to the implementation of the solution. It first explains the role agents may adopt in the system, and the communications they share between them. Next, it details the structure of the internal reasoning of the agents. And finally, the section concludes with a brief explanation of the interface and setup parameters of the implementation.

5.1 Agents and communications

Three types of agents form our system, so called Private, that provides partial privacy: trucks, parkings and broker. In order to hide private information, trucks send an ordered list of preferred parkings to the broker and a time range. Time range corresponds to the arrival times jointly plus the duration of the staying. The broker agent then, waits for all possible requests from trucks in the current time step. After that, it computes the corresponding assignment while it consults the availability of parking slots for the given time range. It consults just those time ranges required by the chosen assignment previously computed by the broker agent, the broker does not ask for the general availability of the parking site in any time. Once a final assignment is possible, the broker agent informs about each assigned parking just to the corresponding truck. And finally, the truck agent books the parking slot for the given time range. All these interactions corresponding to our Private agent system are shown as a sequence of messages in Fig. 6.

Fig. 6

Communications when privacy is partially protected: Private agent system

Additionally, for each same initial setup of parking positions in a map of a given number of cells, an alternative agent system, so called ”Nonprivate”, does not provide partial privacy and runs in parallel jointly with the Private agent system (see Fig. 7). It will be used as benchmark to evaluate the consequences of partially protecting privacy. This evaluation measures the cost of providing partial privacy in terms of increase of the taken detours from the straight (assumedly perfect) trajectory to destination, and the number of illegal breaks that trucks were forced to take. In the Nonprivate agent system, there is no broker, trucks directly book slots with parking agents (as the Fig. 8 shows), and it is assumed a complete knowledge of the trucks and parkings internal states: current position and legal requirements to make a break/rest for the trucks, and complete availability of parking sites.

Fig. 7

Summary of how both agent systems run in parallel over the same initial parking positions

Fig. 8

Communications when privacy is not protected: Nonprivate agent system

In the Private agent system, a broker agent knows all the time range asked by a truck about all parking agents, not the internal state of the truck (legal requirements to break/rest). In spite of this, the broker could estimate roughly from the joint time ranges some of the internal state of any truck. Therefore, privacy protection is not complete, it is just partial. But if the broker agent is trusted enough, parking sites would only know just the data required to complete the parking service: arrival time of the corresponding truck and the duration of the break. And no more data would be known, even if all the parking sites would conspire together. And, from the point of view of the parking site, its complete availability is not known even by the broker agent. Additionally, the truck agent only knows about the availability of the parking site that corresponds to its demanded parking break, no more. In the Nonprivate agent system, parking agent is assumed to know all the state of the truck (destination, current location, and legal requirements) of not just one but all the trucks. Additionally, all truck agents know the complete availability of parking sites. A summary of these differences in data access is shown in Table 3.

Table 3 Knowledge of private data in Private and Nonprivate agent systems

5.2 Beliefs, goals, actions and plans of agents

As agents are implemented using JASON, they are programmed in AgentSpeak language. In AgentSpeak, the behaviour of agents is determined by the achievement of goals, through the execution of plans (composed by actions or subgoals). Plans are fired by certain conditions (beliefs expressed in the way of predicates). Actions can be predefined in JASON, or internals when they are ad hoc coded in JAVA by the programmer. Next, the goals, plans and actions that agents use are shown.

On one hand, truck agents have an initial goal of reaching the destination (reach, Fig. 9) and it has associated several plans:

• When the destination was directly reachable from the current position of the truck (beliefs at and reachabledest), a new plan would be fired. This plan is composed of two steps: a subgoal at (that causes the agent to move towards the destination) and the internal action of dropping the load of the truck.

• When the destination was directly unreachable from the current position of the truck, and no parking slot was requested yet (beliefs unreachabledest(D) and notparkingrequested), a new plan would be fired. This plan is composed of three steps: a predefined action that finds all the instances of parking IDs composing them into a list (findall), an internal action that orders such list (ordering) and a subgoal that looks forward sending such list to the broker (sendparking).

• When the destination was directly unreachable from the current position of the truck, and any parking slot was previously requested with no success (beliefs unreachabledest(D) and parkingrequested), a new plan would be fired. This plan is composed of just one step: the internal stopping action, which forces the truck into taking an illegal break.

Fig. 9

Simplified explanation of reach goal of a truck agent

Among the internal actions mentioned before, the ordering action implements how trucks particularly generate the ordered list of parkings. This list is composed of three sublists:

• 1. A sublist of reachable parkings that are in the way to the destination and where the truck did not stay there before.

• 2. A sublist of reachable parkings that are not in the way and the truck did not stay there before.

• 3. And finally, the rest of the parkings.

Inside the first sublist, parkings are ordered by the shortest distance from the parking to the destination. In the second sublist, parkings are ordered by the shortest distance from the current position of the truck to the parking site. And in the third one, parkings that are reachable, are positioned first.

The previously mentioned goal sendparking sends the message containing the list of ordered parkings to the broker, while at goal cyclically executes the internal action movingtowards that moves the truck one cell towards a particular place (the final destination or an already booked parking). After that, dropping and stopping actions end the execution of the truck agent keeping track of its particular performance (succeeding and failing respectively).

Another previously mentioned goal of the truck agent is booked (see Fig. 10). When the agent is not already parked (belief notparked), but a parking was requested (belief parkingrequested) and the broker agent answered with the parking to book in, then a new plan would become fired. This plan is composed of 4 steps: first the truck moves to the parking site (subgoal at), second it executes the internal action of parking, staying there the number of time steps legally required, third the truck informs the parking site of the end of the stay, and forth it again adopts the subgoal of reaching the final destination.

Fig. 10

Simplified explanation of booked goal of a truck agent

On the other hand, the broker agent has no initial goal, it just reacts. It has a goal book Fig. 11 that will be launched when a message from the truck agent with the list of ordered parkings is received, and such truck is in the current iteration time. The corresponding plan is composed of the internal action of choosing the parking assigned to the truck and the subgoal to answer the truck. The action of choosing implements the assignment method explained in Sect. 4.2. The subgoal answer has three different possible associated plans: The first one takes place when a parking was already chosen, and its execution would send a book message to the parking agent. The second one takes place when a parking was not chosen yet but an assignment was still possible in the current timestep, and this plan would be composed by a temporal runtime delay followed by an additional trial of the action choosing. The third one takes place when no parking could be chosen for the truck and its execution would send an impossible message to the truck.

Fig. 11

Simplified explanation of book goal of a broker agent

Finally, the parking agents are the simplest, they have no initial goal and act reactively. A parking agent has three goals avail, book and unpark. The avail goal (Fig. 12) is triggered by the reception of a message from the broker asking for the slot availability in a given arrival time and length of stay. The execution of its corresponding plan has two steps: first, the internal checking action that verifies the availability, and second the parking agent sends the corresponding response to the avail request. A book goal that is triggered by the reception of the message from the broker agent and the execution of its corresponding plan has two steps: first, the booking action that updates the internal state of the parking, and second, the parking agent sends the booking confirmation to the truck agent. There is no possible failure in such booking since the availability of the slots was previously verified by the broker. An unpark goal would be fired when the message from the truck informing about the end of the stay was received. The corresponding plan just executes a single internal action of freeing the parking slot.

Fig. 12

Simplified explanation of avail, book and unpark goals of a parking agent

The complete (JAVA and AgentSpeak) code of all the three agent types (truck, broker and parking) and the environment and setup files are publicly available in the Sourceforge repository⁵ in order to provide transparency and to facilitate the complete replicability of all the simulations included in this manuscript.

5.3 Showing the graphical user interface of the agent system

The initial parameters of the setup for launching each simulation are easily configured in a text file (Fig. 13). The parameters relative to the size of the problem to be launched are:

• Number of Trucks

• Number of Cells of the grid

• Number of Parking sites

The parameters relative to the execution itself are:

• Number of consecutive simulations to execute

• Name of the output file

• Privacy protection applied, valued as 0 standing for the no private alternative, 1 standing for private alternative, and 2 standing for both executed jointly |item Sleep time (in ms) after each execution cycle (to show movements smoothly in the GUI)

And at last, the parameters that rule the initial values corresponding to the legal regulations are:

• Maximum consecutive driving period

• Daily rest period

• Maximum daily driving period

In this way the code facilitates adapting the system into a possible change in the regulation, the application of the regulations of other countries, or even testing a what-if scenario with an alternative hypothetical sizes and regulations. The specific values of them used in the simulations are specified in subsections 6.2, 6.3 and 6.4.

The agent system is complemented with an User Interface that shows the routes that the trucks are following (see Fig. 14), the evolution of the accumulated delays of each truck in each timestep (Fig. 15).

Fig. 13

Parameters setup of our implemented agent system

Fig. 14

Routes followed by trucks (noted as t) from origin to destination (noted as D) through a sequence of parkings (noted as P)

Fig. 15

Evolution of inefficiency in a simulation

6 Simulations

Section 5 has explained the details of the implementation: roles, communications and internal reasoning of the agents, jointly with the setup parameters and the graphical interface. Now, section 6 first justifies the values used as parameters to reflect the situation of the EU. Next, it describes the performed tests on short, medium and large distance trips. And finally, section 6 ends with an analysis of the experimental results.

6.1 Defining simulation setups proportional to UE real data

In order to test the agent alternatives, simulations include meaningful setups of distances, number of trucks and number of parking slots focused in the context of EU proportions, since all this research is motivated by the public aims and requirements that EU Committees and Parliament agreed (Parliament 2002, 2006, 2016; Wright 2012). Although a completely realistic approach based on real routes, maps and travel logs is possible, it would involve an effort much superior to our available capacities. Therefore, a generic grid is used with a size, number of trucks and parking slots proportional to the real figures of the European Union (described in detail in Mobility and Transport (2018)). The use of these figures proportional to the real EU ones, it is not just an illustrative example, it is the intended use of this contribution. But any possible way between two points is possible (no real routes), parkings are allocated in the grid uniformly distributed to cover as much space as possible, in real traffic, parkings are not uniformly distributed, and trucks do not start all their trips at once.

As the comprehensive mapping report of the UE study on Parking Places and Trucks (Mobility and Transport 2018) showed:

• The 28-UE has a total area of 4,476 million km$^{2}$.

• 35,114 trips and 121,900 parking slots of short distance (below 1,000 km).

• 10,721 trips and 74,400 parking slots of medium distance (between 1,000 km and 2,000 km).

• 1,949 trips and parking slots of long distance (between 2,000 km and 6,000 km).

Then the simulations adopt the same three type of trips the UE report (Mobility and Transport 2018) showed.

On the other hand, the legal restrictions Sect. 3.4, according to the EU regulation (Parliament 2002, 2006) are:

• 45 m of breaks are required for each 4.5 h driving.

• 11 h consecutive hours of daily rest are required.

• Maximum daily driving period is 9 h.

Therefore, for an easy computation of proportions, a cell in the grid represents the time of the minimum break (45 min). And as (Mobility and Transport 2018) mentioned, the average speed of trucks is 85 km per hour. Both numbers lead to 63,75 km represented by each cell, assuming each truck moves a cell per iteration time of an agent. Then a day corresponds to 32 iteration times, a break is an iteration time for each 6 iteration times driving, the maximum daily driving period is of 12 iteration times, and the daily rest period corresponds to 15 iteration times. Also, each of the 3 types of distances corresponds to the diagonal of the grid. Therefore, the resulting grid size of each type of trip respectively corresponds to $12\times 12$, $24\times 24$ and $68\times 68$ cells. Finally, the proportion of operating trucks and available parking slots in such spaces corresponding to the proportion of these areas relative to the total 28-UE area results into:

• 4 trucks and 16 parking slots in the grid corresponding to short distance trips (12$\times$12).

• 12 trucks and 60 parking slots in the grid corresponding to medium distance trips (24$\times$24).

• 48 trucks and 316 parking slots in the grid corresponding to short distance trips (68$\times$68).

These dimensions are then applied to the three setups that represent the actual density of EU trips according to citeMappingTask.

Simulations are just agents running in a JASON platform, there is not an independent simulator, just agents programmed in JAVA and AgentSpeak being executed in a JASON platform. Since the code and the platform are publicly available, all the simulations are easily replicable. Although these proportions show the current density of actual EU trips, such trips do not take place in perfectly split geographic zones of these three sizes. Even if it could be conceivable that a single broker would take charge of zones of these big sizes, splitting the responsibilities into several brokers according to smaller geographic zones seems to be justified enough. Managing the borders between such zones could become problematic, since there would be some kind of overlapping between zones, and therefore some kind of cooperation between brokers that are neighbours would be required. This is in fact a non trivial issue, that should be taken into account, and it is a planned future extension of this work.

6.2 Testing short distance trips

With the setup that corresponds to the proportions of short distance EU trips, 100 simulations were run when privacy is partially protected and when no privacy is considered. As it is the simplest simulation (with less trucks, parkings and space to travel through), there is no evolution to show graphically, Table 4 just shows the next resulting variables:

• The average and standard deviation of the produced inefficiency (relative delay of truck agents over their hypothetical perfect straight journey).

• The average number of illegal breaks that the trucks were forced to do.

• The average number of iteration turns spent in regular breaks.

• The average number of iteration turns spent in night breaks.

• The average distance traveled.

Table 4 Simulation results of short distance EU trips (4 trucks, 16 parkings in 12$\times$12 cells)

From the results shown in Table 4, the next statements can be concluded:

• The method that does not partially protects privacy is slightly more efficient than the private method.

• This difference in efficiency ($1186 - 1169 = 0.017$)is significantly smaller than the variance in efficiency that the different random initial positions of parkings produce (shown as the Standard Deviation of both methods $0.18374 > 0.017$ and $0.17984 > 0.017$).

• No illegal breaks took place, since the total space (12$\times$12 cells) is small enough to avoid any big zone with no parkings in it in any of the random setups of positions of parkings.

• Traveled distances are very similar.

• Complete knowledge produces better efficiency through a smaller number of night breaks balanced with a bigger number of regular breaks than those produced by the private method.

6.3 Testing medium distance trips

With the setup that corresponds to the proportions of medium distance EU trips (60 parkings in 24x24 cells), another 100 simulation were again run, progressively increasing the number of agent trucks by 4 (from 4 to 12 trucks) to observe the evolution of the average and standard deviation of the inefficiency (accumulated delay of truck agents) and the number of illegal parkings when privacy is partially protected and when no privacy is considered (Figs. 16 and 17).

Fig. 16

Delay of trucks with and without privacy in medium distance trips

Fig. 17

Illegal parkings with and without privacy in medium distance trips

From the Figs. 16 and 17 the next statements can be concluded:

• Inefficiency increases slightly when the number of involved trucks increases.

• Again, the method that does not partially protects privacy is slightly more efficient than the private method.

• Again, this difference in efficiency is significantly smaller than the changes in efficiency that the different random initial positions of parkings produce (shown as the standard deviation of inefficiency in both methods).

• Now both methods require a very small number of illegal breaks when the initial random setup of positions of parkings (very infrequently) produces a big enough zone with no parkings in it.

• The method that does not partially protects privacy produces a slightly small number of illegal breaks than the private method.

• This difference in the number of illegal breaks is significantly smaller than the changes in the number of illegal breaks that the different random initial positions of parkings produces (shown as the standard deviation of illegal breaks in both methods).

6.4 Testing long distance trips

With the setup that corresponds to the proportions of long distance EU trips (316 parkings in 68$\times$68 cells), another 100 simulations were again run, progressively increasing the number of agent trucks by 16 (from 16 to 48 trucks) to observe the evolution of the average and standard deviation of the inefficiency (accumulated delay of truck agents) and the number of illegal parkings when privacy is partially protected and when no privacy is considered (Figs. 18 and 19).

Fig. 18

Delay of trucks with and without privacy in long distance trips

Fig. 19

Illegal parkings with and without privacy in long distance trips

From the observation of Figs. 18 and 19 we can conclude:

• Inefficiency decreases when the number of involved trucks increases: first with the private method involving 32 trucks, later with the nonprivate method involving 48 trucks.

• If we would attend only to inefficiency, the method that protects privacy apparently was slightly more efficient, which is counterintuitive.

• But this difference in efficiency seems to be achieved through an extensive use of illegal parkings, which avoids the detours that available (but distant) parkings produce: illegal parkings increases first with the private method involving 32 trucks, later with the nonprivate method involving 48 trucks.

• Now both methods require larger number of illegal breaks than the setups of medium and short distances. It can be explained because bigger empty (of parkings) spaces occur more frequently, and the high population of trucks produces less availability of parking lots.

• The difference in the number of illegal breaks and the inefficiency between both methods is smaller than the standard deviation of both measures. This means that even in long distances, changes in the number of illegal breaks and in efficiency caused by the different random initial positions of parkings are bigger than the changes produced by using either the private method or the non private one.

6.5 Analysis of the results of the tests

The two first tests (short and medium distance simulations) show the same trend: the nonprivate method is very slightly better in performance, while both methods address the trips without almost producing any illegal breaks. On the other hand, the third test, which simulates long distance trips in EU shows that the high number of trucks and larger spaces to travel through impact severely in the illegal breaks produced with both methods, although the private method generates more illegal breaks before. This joint explanation of the results shows that, as expected, a complete knowledge of the private information helps trucks to be more effective (reach the destination earlier) and be lawful (fewer illegal breaks taken). The main support coming from the results of the tests to the private proposal is the so small amount of improvement due to this complete knowledge, and that this improvement is smaller than the perturbations that the different random position of the parkings generates (shown by the standard deviation). This supportive contribution of the private method is however relative: although the same proportions of real data (space, number of parkings and trips) from EU documentation were used, no real map was applied. There is no accurate representation of where such parkings are placed in real life, or how big empty spaces (of parkings) take actually place in EU geography. And this issue may be relevant, since the tests show that the initial position of parkings in the space is an important factor that influences the both evaluation criteria measured (efficiency and illegal breaks). The effort of representing the real map with the actual setup of parkings where European transportation takes place is beyond our capacity, but is an interesting way to prove in a stronger way that the extra cost incurred using the private method is small enough to be worth.

7 Conclusions

Even if the legal restriction, particular conditions and prospective vision of other regions of the world may differ from the EU’s ones, the funding and research line we as authors follow is linked to the current norms, views and figures of the European Union. So, we defined and implemented a solution focused on the EU regulation, dimensions, activities and policies. In them, trucks are expected in the next future to privately book parking slots in real time using advanced intelligent devices to be embedded in trucks through the use of mediators (brokers). The achievement of a good enough parking slot assignment while maintaining as much privacy as possible is considered in the UE a key process to the widespread adoption of ITS. This contribution represents an innovative approach that pursue that European goal. Complete knowledge of all relevant private data of other agents would produce more efficient parking assignments (avoiding all possible illegal breaks and detours from a straight trajectory) but it should not be of general acceptance because of privacy concerns. And, on the other extreme, no knowledge at all of relevant private data would become a too heavy burden to reach satisfactory enough parking assignments (too much illegal breaks and detours). So middle way solutions like this one seem to be the desirable path to follow yet to be more explored and tested. The particular balance suggested here consists of trucks sharing with the broker an ordered list of parkings instead of explicit information about current location, destination and legal restrictions -which determine the urgency to stop driving. In the proposed private method, the broker agent only knows such ordered lists of parkings sites, while the alternative nonprivate method knows the details of the routes. In that sense, results show that this improvement (the privacy protection) does not impose a relevant handicap compared to the mentioned non private alternative. Therefore, the justification of the proposed private alternative is not derived from an improvement in the final assignment itself. It is, instead, derived from trucks not sharing anything but a list of ordered parking sites. BDI agents, programmed in AgentSpeak language, apply such privacy protection acting on behalf of trucks, parkings and broker. With those implemented agents, different simulations were run in JASON platform based on the proportions of driving trucks, parkings and distances of the UE. In them we compared the proposed private solution versus an alternative one where trucks reveal all the information directly to the parking sites. The results of such comparison showed some extra inefficiency (resulting routes become a bit longer). However, this extra cost seems to be worthy of the privacy protection provided. As the effective level of privacy protection is not complete, the proposal described in this paper can be considered a step forward to the goal of providing privacy but not a definitive final solution. As a final summary, we provide a list of contributions of this paper:

• We have explained the EU norms in ITS and data privacy that show the relevance of any way of protecting the privacy of data to be provided in the future by intelligent sensors in the transportation domain.

• We have outlined the privacy risk factors (in the form of an impact assessment table) involved in the problem of remote automated booking the parking slots with advanced intelligent sensors.

• We have addressed the parking problem from an agent-based view due to the distributed nature of them helps achieving the privacy protection goal we pursue.

• We have framed and justified the need of a method of reaching joint agreements while protecting data privacy in the problem of automated remote booking of parking slots.

• We have proposed the use of an ordered list of services (parkings) instead of revealing explicit private data to reach a joint agreement (parking slots assignment). This can also be expressed in domain independent terms as we did.

• We have implemented such solution to the ITS problem with autonomous agents, programmed in AgentSpeak, that reason with BDI logic and run in any JASON platform.

• We have defined different setups that correspond to the proportions of distances, driving trucks and parking slots in the UE.

• We have tested, through the execution of simulations in JASON, with these agents and setups, our proposed method versus an alternative that discloses all private information to parkings, in order to measure how far the solution obtained from our approach is from such alternative.

• We have observed from the results of these tests that although the non private method obtains better results (in terms of efficiency and avoidance of illegal parkings), this advantage is small, and furthermore, the effect of using a private method is smaller than the changes in the number of illegal breaks and in efficiency caused by the different random initial positions of parkings.

In summary, the novelty of this research is the consideration of data privacy protection in the specific problem of the automated remote booking of parking lots. No previous work proposes a practical way to address this particular issue from the privacy perspective. We propose a way to do it that do not significantly harm the assignment results using an innovative method of assignment and the distribution and explainability provided by BDI agents. Trying to achieve as much realism as possible we focus on EU laws and dimensions to define the corresponding simulations with which we tested our private method.

Future extensions of this work would address the relevant issue of coordinating a pair of brokers which are responsible of neighbour subzones of EU trips and to use real maps (with the actual roads and the actual parking locations and capabilities) in other agent-based simulations. For instance, platforms oriented to the use of GIS maps such as GAMA (Taillandier et al. 2010) or Anylogic⁶.⁷