Data transfer among servers is crucial for distributed data mining because many databases are distributed around the world. However, as data privacy is becoming more legally and ethically protected, it is necessary to abide by the laws and respect the ethical guidelines when transferring and utilizing data. Because information afecting legal/ethical decision making is often distributed, the data-transfer plan must be updated online when new information is obtained while transferring data among servers. In this study, we propose a dynamic hierarchical task network (HTN) planning method that considers legal and ethical norms while planning multihop data transfers and data analyses/transformations. In our knowledge representation, we show that data-transfer tasks can be represented by the task-decomposition rules of total-order HTN planning. We also show that legal norms can be expressed as the preconditions of tasks and actions, and ethical norms can be expressed as the costs of tasks and actions where legal norms cannot be violated, but ethical norms can be violated if necessary following the ethical theory of utilitarianism. In the middle of the plan execution, the online planner dynamically updates the plan based on new information obtained in accordance with laws and ethical guidelines.
ning. In other words, the data-transfer plan must be dynamically checked and updated if necessary, even in Because data privacy is respected worldwide, many laws the middle of the plan execution when new information and ethical guidelines governing the transfer and usage is found on distributed servers, which may afect the of collected data have been established. Some data can validity of the plan. only be transferred within a country or a company. Some In this paper, we present a new knowledge represendata can only be used for specific purposes. tation for dynamic HTN planning on transferring and
Because the laws and ethical guidelines for collected utilizing distributed data considering legal and ethical
data are complicated and diferent in each country, some norms. We use an extended algorithm of Dynagent [7]
researches have been conducted on the automated com- which is an online total-order HTN planner. Total-order
pliance check of norms in data transfers. In [
Planning for data transfer in accordance with legal/eth- data-transfer tasks can be represented by the
taskical norms is a new field of research. In the studies of decomposition rules of total-order HTN planning. We
[
Considering real international data transfers among tarianism. Using this knowledge and an online planning distributed servers, dynamic replanning is crucial be- algorithm, the plan of data transfer and utilization is cause the latest information necessary for planning is dynamically adapted to the new information obtained also distributed and not available when initially plan- at local servers, abiding by the laws and following the ethical guidelines.
NMR 2022: 20th International Workshop on Non-Monotonic Reasoning, We assume that the data-transfer planners and
*ACuogurrsets0p7o–n0d9i,n2g02a2u,tHhoari.fa, Israel legal/ethical checkers are separate as in [
The rest of this paper is organized as follows: In Sec- the search space is very large, such as in chess or Go.
tion 2, related work is discussed. In Section 3, the algo- This planner can also represent complicated control
prorithm of online HTN planning is explained. In Section 4, cesses such as “if-then” and “repetition” as in standard
the system architecture of the planning agent with exter- procedural programming languages.
nal legal and ethical checkers is presented. In Section 5, In the studies [
In [
HTN planners create plans by decomposing abstract tasks into more concrete subtasks. The first HTN planners were created in the late 1970s [12, 13]. Other previous HTN planners were created around 1990 [14, 15].
The most popular and well-established HTN planner is simple hierarchical ordered planner (SHOP) [8], which 3. Online HTN Planning is a simple forward-chaining total-order planner. This forward-chaining planner decomposes the subtasks in In this section, we define the syntax and sketch of the the same order of execution. Domain control heuristics algorithm of online total-order forward-chaining HTN can be expressed easily by the task-decomposition rules planning based on the algorithm of Dynagent [7]. Dyna(methods) in a manner similar to the Horn clauses of gent [7] is similar to SHOP [8]. However, in contrast to the Prolog programming language, which are used for SHOP, Dynagent is an online planner. goal/literal decomposition.
SHOP is still standard in HTN planning. For example, 3.1. Syntax HDDL [16] was used in the HTN planning track of the international planning competition held in 2020, however, In this subsection, we define the syntax of the belief and a translator from HDDL to (J)SHOP2 [17] was provided. planning knowledge that are used by the planner. Because (Note that SHOP2 is a partial-order-planner version of we implemented the algorithm in Prolog, the syntax folSHOP, and that JSHOP2 is the Java version of SHOP2.) lows its representation.
SHOP-like total-order HTN planners are still being stud- In the following definition, fluents (predicates whose ied to improve computational eficiency [9, 10, 11]. truth value can change) and belief rules (corresponding
Dynagent [7] is a simple SHOP-like total-order to Horn clauses in Prolog) are defined using constants, forward-chaining HTN planner. In contrast to SHOP, variables, functions (=function symbols), and prediDynagent is an online HTN planner. When the current cates (=predicate symbols). As in Prolog, constants, funcassumption is updated, the Dynagent planner modifies tions, and predicates, are represented by alphanumeric the plan, even in the middle of plan execution. Dynagent characters starting with a lowercase alphabet and Variwas applied to real robot manipulation, such as online ables are represented by alphanumeric characters starting path planning [18] and online pick-and-place planning with an uppercase alphabet or “_”. (arm manipulation) [19, 20]. In this study, we adopted and slightly modified the online HTN planning algorithm Definition 1. A term is one of the following: a constant, of Dynagent. a variable, or a complex term. A complex term is of the
Another interesting online forward-chaining HTN- following form: F(T1, · · · , Tn) where ≥ 0, F is an n-ary
like planning is also studied in [
In the following definition, belief rules are defined in the same way as in Prolog. Fluents are used to represent the states.
Definition 2. A belief rule is of the following form: belief(F, [F1, · · · , Fn])1 where ≥ 0, F is a derived lfuent called the head, each Fi (1 ≤ ≤ ) is a fluent, and the set of fluents F1, · · · , Fn is called the body. When > 0, F is a derived fluent. When = 0, the belief rule belief(F, []) can be expressed as belief(F) and F is called a fact. The belief rule belief(F, [F1, · · · , Fn]) defines the fluent G if F is unifiable with G. Fluent F is regarded as dynamic if it is declared as dy(F). The belief rule belief(F) can be asserted to or retracted from the belief after observation or action execution if F is dynamic.
The planning agent has belief and planning knowledge, which are used for planning. Furthermore, belief represents the current state, whereas planning knowledge represents the efects of actions and the methods to decompose tasks into subtasks.
Definition 6. Belief is of the following form: ⟨D, S⟩ where D is a set of dynamic fluents, and S is a set of belief rules.
Planning knowledge is of the following form: ⟨AR, TDR, COST⟩ where AR is a set of action rules, TDR is a set of task-decomposition rules, and COST is a set of the cost of each task.
We define the syntax of tasks, actions, and (total-order) Standard semantics of a plan can be used if all the tasks
plans as follows: task symbols are represented by alphanu- in the plan are actions. See the simplified version [
Definition 3. A task is of the following form: T(X1, · · · , Xn) where ≥ 0, T is an n-ary task symbol, 3.3. Sketch of the Algorithm and each Xi (1 ≤ ≤ ) is a term. When T is a 0-ary task symbol, the task T() can be abbreviated to T. A task is either abstract or primitive. An action is a primitive task. The cost C of the task T, where is a number (real number or integer), is represented as cost(T, C).
A plan is a list of tasks of the following form: [T1, · · · , Tn] where ≥ 0 and each Ti (1 ≤ ≤ ) is a task, which is called the i-th element of the plan. The cost of the plan [T1, · · · , Tn] is the sum of each cost of Ti (1 ≤ ≤ ).
In this subsection, we show the sketch of the algorithm we used in this study. We used the algorithm of Dynagent, which is defined in detail in [ 7]. However, the replanning method after cost updates is not shown in [7].
We modified the algorithm to handle cost updates, which is crucial for reflecting ethical norms in plan selection.
Because the algorithm is implemented in Prolog, it can handle rules of predicate logic by unification.
To represent the efect of an action, we use the following action rules.
The planning agent has the belief and planning knowledge defined in the previous subsection. Belief repreDefinition 4. An action rule is of the following form: sents the current state (the truth value of each fluent) of (A, C, E), where A is an action, C is a list of flu- the world, which the planning agent believes. Planning ents called preconditions, E is a list of efects , an ef- knowledge includes action rules, task-decomposition fect is either of the following forms: initiates(F) or rules, and cost information of tasks. terminates(F), and F is a fluent. The planner recursively decomposes the task into subtasks that become primitive tasks (= actions) before exeIntuitively, in the aforementioned definition, cution. The HTN planning algorithm is forward-chaining initiates(F) (or terminates(F)) represents that the and the task decomposition is conducted in the same ortruth value of F becomes true (respectively, false) after der as task execution. As shown in Figure 1, when taskA the action execution, if all the preconditions hold. in a plan is decomposed, all the previous tasks before
To represent a method to decompose a task into sub- taskA are primitive. Therefore, it is easy to evaluate the tasks, we use the following task-decomposition rules. truth value of fluents in the state shortly before task exNote that task decomposition rules are called methods in ecution. The preconditions (precond2 and precond3) of SHOP [8]. the task decomposition, which are added to the precondiDefinition 5. A task-decomposition rule is of the fol- tions of the first subtask ( taskA1), must be satisfied before lowing form: ℎ(H, C, B) where H is an abstract task the task execution. called the head, C is a list of fluents called precondi- In general, there are several ways to decompose a task. tions, and B is a plan called the body. For example, in the case of the data transfer problem, there are several routes for data transfer. When decomposing a task in a plan, multiple plans are created using 1This syntax reflects our implementation in Prolog. This belief rule can be understood as F ⇐ F1, · · · , Fn. multiple task-decomposition rules. For example, in Figure 2, the task t3 in a plan is decomposed into three subplans [a1, a2, a3, a4], [b1, b2], and [c1]. Therefore, the search space of HTN planning is an or-search-tree of plans.
When each task has the cost information, the best-first search can be conducted. In the algorithm of Dynagent, to conduct the best-first search, the planning agent maintains frontiers (alternative plans) in the or-search-tree of plans, sorts the plans in ascending order of cost, and decomposes the first abstract task in the plan with the lowest cost. If the cost of a task is always lower than or equal to the cost of its primitive subplans (subplans that have only actions), the first found plan has the lowest cost.
In the planning algorithm of Dynagent, each precondition (a dynamic fluent) of a task in a plan is recorded in association with the task in the plan if its truth value is subject to change. As shown in Figure 3, this fluent recorded as a precondition of a task serves as a protected link which must be true before the execution of the task.
Following a belief update, if the protected link in a plan is violated, the plan becomes invalid. Then, the invalid plan is removed from the frontiers of the or-search tree. As shown in Figure 4, if the current plan becomes invalid, the planning agent changes the current plan to the plan with the next-lowest cost, and continues the best-first search using the frontiers of valid plans.
When evaluating a precondition of a task in a plan in the planning algorithm of Dynagent, if the precondition is a dynamic fluent, the planning agent records the plan separately from the frontiers even if the fluent is false. During the plan execution, if the belief is updated and the precondition becomes true, the recorded plan is asserted to the frontiers as a new valid plan. Because the plans in frontiers are always sorted, if the new plan has the lowest cost, the planning agent stops the current plan execution, switches to the new plan, and continues the best-first search, which may lead to a better plan.
In the planning algorithm of Dynagent, replanning after a cost update is not explicitly shown. However, this is crucial in our planning with an ethical checker because the costs of unethical actions are dynamically set higher after the ethical check. Therefore, we added a new replanning procedure to the algorithm.
Following the cost update of an action (or a task), we reevaluate the cost of each plan in the frontiers and sort the plans in ascending order of cost. When the current plan becomes less attractive in terms of costs after the g update, the planning agent stops the plan execution, changes the plan, and continues the best-first search, which may lead to a better plan. for planning and replanning in the online HTN planner.
In addition, the online planning agent has an event Figure 6: Replan after Action Failure handler that inputs a task or a belief/cost update request to the online HTN planner when receiving an event from an external world observer that obtains new information.
Given a task or a belief/cost update request, the planner 3.3.5. Replanning after Action Execution starts planning or replanning.
Dynagent is an online planner that updates each plan Note that the user interface that receives a command after execution of each action. It maintains all the al- from the user can be regarded as a world observer. An ternative plans so that any plan can be started from the example of the event handler is explained in [18]. current state. The online planning agent also has an action executor
As shown in Figure 5, when the execution of an action that receives an action execution command from the succeeds, if the executed action is unifiable with the first online HTN planner and controls the external controller action in a plan, it is removed from the plan. Sometimes to execute the action. an action execution in a plan invalidates other alternative To utilize external legal and ethical checkers, we need plans. Therefore, protected links are checked and invalid a norm check requester that inputs the next action to the alternative plans are removed after a successful action legal and ethical checkers. Because we need to check the execution. legal and ethical norms before executing an action, the
As shown in Figure 6, when the execution of an action action executor sends the next action to this norm check fails, if the executed action is unifiable with the first requester. action in a plan, the plan is removed from the alternative If the next action is not changed after checking the plans recorded in the frontiers. In this case, the planning legal and ethical norms, the action executor executes the agent stops the plan execution and restarts the best-first action as usual. If there is a legal or ethical problem, the search using the valid plans in the frontiers until it finds belief update requester or the cost update requester sends the plan. the belief update request or the cost update request to the online HTN planner, which triggers replanning.
In this study, we only designed and implemented the 4. Online HTN Planning Agent knowledge (belief and planning knowledge) and the alArchitecture with External gorithm of the online planning agent. In the future, we would consider to connect the planning agent to the legal
Legal and Ethical Checkers and ethical checkers.
In Figure 7, we show the overall system architecture of our online HTN planning agent with external legal and 5. Problem ethical checkers.
In this study, we focused on the knowledge represen- In this section, we define the planning problem of legally tation of beliefs and planning knowledge, which is used and ethically correct data transfer and utilization.
Nodes (servers) are connected by arcs (network lines).
The data stored in the database at a node can be retrieved from the same node. Data at a node can be transferred to an adjacent node that is connected by an arc. An analyzer at a node can analyze data for a specific purpose at the same node. Analysis output is also data and can be transferred to an adjacent node connected by an arc.
There are legal and ethical norms for data transfers. Some data can only be transferred within specific countries. Some data can only be transferred within a company. Some data can only be analyzed for specific purposes. Legal norms must be satisfied. Ethical norms should be respected if possible.
The objective is to deliver the analysis output of speciifed data to a specified node for a specific purpose.
In this section, we consider a specific network and data transfer to study the feasibility of our dynamic HTN planning framework for the planning problem of legally and ethically correct data transfer and utilization .
Figure 8 shows the whole network to be considered
as a test case. This example is adopted and modified
from the example written in [
Initially, we assumed that all data were allowed to be In this subsection, we show how to represent the domain analyzed for any purpose. However, this assumption knowledge that is used as a belief by the planning agent. is subject to change and may be corrected by the legal This domain knowledge includes node connection, loca- checker. This is represented as follows: tion of database, location of analyzers, allowed purposes for data analysis, region of nodes, allowed regions for data transfer and analysis, owners of nodes, and allowed companies for data transfer. dy(allowedPurpose(_,_)). belief(allowedPurpose(dataHabit,marketing)). belief(allowedPurpose(dataHabit,advertising)). belief(allowedPurpose(dataHabit,optimizing)). belief(allowedPurpose(dataBehavior,marketing)). belief(allowedPurpose(dataBehavior,advertising)).
belief(allowedPurpose(dataBehavior,optimizing)).
In Figure 8, there are seven nodes that represent servers. The arcs that connect nodes represent the network lines. These network connections are represented as follows: belief(arc(node1,node2)). belief(arc(node1,node4)). belief(arc(node1,node6)). belief(arc(node2,node3)). belief(arc(node3,node4)). belief(arc(node3,node5)). belief(arc(node4,node7)). belief(arc(node5,node7)). belief(arc(node6,node7)).
To represent that each network connection is bidirectional, we define the “connected” predicate as follows: belief(connected(Node1,Node2),[arc(Node1,Node2)]). belief(connected(Node1,Node2),[arc(Node2,Node1)]).
The eficiency of data transfer changes according to the line and time.
There is a database at node2 that contains data about the habits and behaviors of people, which are represented as follows: belief(dbAt(dataHabit,node2)). belief(dbAt(dataBehavior,node2)).
The location of the retrieved data from the database is subject to change, which is represented as follows: belief(dataAt(_,_)).
There are three analyzers of data on the habits and behaviors of people. The analyzer at node6 is used for optimization. The analyzer at node4 is used for marketing. Another analyzer at node4 is used for advertising. This can be represented as follows: belief(analyzableAt(dataHabit,marketing,node4)). belief(analyzableAt(dataBehavior,marketing,node4)). belief(analyzableAt(dataHabit,advertising,node4)). belief(analyzableAt(dataBehavior,advertising,node4)). belief(analyzableAt(dataHabit,optimizing,node6)). belief(analyzableAt(dataBehavior,optimizing,node6)).
The region (country) of each node can be represented as follows: belief(nodeRegion(node1,countryX)). belief(nodeRegion(node2,countryY)). belief(nodeRegion(node3,countryY)). belief(nodeRegion(node4,countryY)). belief(nodeRegion(node5,countryY)). belief(nodeRegion(node6,countryX)). belief(nodeRegion(node7,countryY)).
Initially, we assumed that all data were allowed to be transferred in any region. However, this assumption is subject to change and may be corrected by the legal checker. Note that the analyzed data are also data. This can be represented for the case of countryX as follows: dy(allowedRegion(_,_)). belief(allowedRegion(dataHabit,countryX)). belief(allowedRegion(dataBehavior,countryX)). belief(allowedRegion(analysisOutput(
dataHabit,marketing),countryX)). belief(allowedRegion(analysisOutput(
dataBehavior,marketing),countryX)). belief(allowedRegion(analysisOutput(
dataHabit,advertising),countryX)). belief(allowedRegion(analysisOutput(
dataBehavior,advertising),countryX)). belief(allowedRegion(analysisOutput(
dataHabit,optimizing),countryX)). belief(allowedRegion(analysisOutput( dataBehavior,optimizing),countryX).
The case of countryY is expressed in the same way.
The owner (company) of each node can be represented as follows: belief(nodeOwnedBy(node1,companyA)). belief(nodeOwnedBy(node2,companyA)). belief(nodeOwnedBy(node3,companyA)). belief(nodeOwnedBy(node4,companyA)). belief(nodeOwnedBy(node5,companyA)). belief(nodeOwnedBy(node6,companyB)). belief(nodeOwnedBy(node7,companyB)).
Initially, we assumed that all data were allowed to be transferred in any company. However, this assumption is subject to change and may be corrected by the legal checker. Note that the analyzed data are also data. This can be expressed for the case of companyA as follows: dy(allowedCompany(_,_)). belief(allowedCompany(dataHabit,companyA)). belief(allowedCompany(dataBehavior,companyA)). belief(allowedCompany(analysisOutput(
dataHabit,marketing),companyA)). belief(allowedCompany(analysisOutput(
dataBehavior,marketing),companyA)). belief(allowedCompany(analysisOutput( dataHabit,advertising),companyA)). belief(allowedCompany(analysisOutput(
dataBehavior,advertising),companyA)). belief(allowedCompany(analysisOutput(
dataHabit,optimizing),companyA)). belief(allowedCompany(analysisOutput( dataBehavior,optimizing),companyA)).
The case of companyB is expressed in the same way.
The agent can execute three actions (primitive tasks): one action is to retrieve the specified data from a database, another action is to transfer the specified data to the specified adjacent node, and the other action is to analyze the specified data for the specified purpose.
The action getDataFromDB retrieves the specified data from the DB at a node and store it at the same node. Subsequently, the data can be transferred to another node or analyzed for a specific purpose. action(getDataFromDB(Data,Node),[ dbAt(Data,Node) initiates(dataAt(Data,Node))
The aforementioned rule specifies that the precondition of the action is that the database of Data is at Node, and that it initiates dataAt(Data,Node).
The action transfer transfers the specified data to the specified adjacent node. action(transfer(Data,NodeFrom,NodeTo),[ dataAt(Data,NodeFrom), connected(NodeFrom,NodeTo), allowedTransfer(Data,NodeTo) initiates(dataAt(Data,NodeTo)), terminates(dataAt(Data,NodeFrom))
The action analyze analyzes the specified data at the specified node for the specified purpose. The data must be at the same location as the analyzer and the purpose of the data analysis must be allowed. The analysis output is obtained as new data after the data analysis, and the original data is erased. action(analyze(Data,Node,Purpose),[ analyzableAt(Data,Purpose,Node), allowedPurpose(Data,Purpose), dataAt(Data,Node) dataAt(analysisOutput(Data,Purpose),Node), and to terminate dataAt(Data,Node).
The task deliverAnalytics is the top-level task for obtaining the specified data from a DB at a node and delivering the analysis output for a specific purpose to the recipient at another node. htn(deliverAnalytics(Data,NodeFrom,NodeTo,Purpose),[ dbAt(Data,NodeFrom) getDataFromDB(Data,NodeFrom), multiStepTransfer(Data,NodeFrom,NodeAnalysis), analyze(Data,NodeAnalysis,Purpose), multiStepTransfer(analysisOutput(Data,Purpose),
NodeAnalysis,NodeTo)
This rule specifies that to deliver the analysis result of Data for Purpose to the destination (NodeTo), the agent obtains Data from the DB at NodeFrom, transfers the data to NodeAnalysis via multiple steps, analyzes the data for the purpose, and transfer the analysis output to the destination via multiple steps.
We set a specific value for each task and cost. The cost The agent needs two abstract tasks to recursively decom- information is used for planning. The best-first search pose to primitive tasks (actions) before execution. One will always find the lowest-cost plan if the cost of each task is for transferring the specified data to the specified abstract task is less than or equal to the total cost of its node via multiple nodes. The other task is the top-level primitive subtasks (actions), which we obtain by task task for delivering the analysis output of the data for the decomposition. specific purpose to the specified node.
The task multiStepTransfer is a compound task for transferring data to another node via multiple nodes. This task is recursively decomposed until the decomposed subtasks include only the transfer actions.
The first rule specifies that no action is required for the transfer task multiStepTransfer(Data,Node,Node) when Data is already at the destination (dataAt(Data,Node)). The second rule specifies that when the data is at NodeFrom and Node is an adjacent node, the transfer task multiStepTransfer(Data,NodeFrom,NodeTo) can be executed by ifrst transferring Data to the adjacent Node, then transferring Data to the destination NodeTo via multiple steps.
We assume that the costs of abstract tasks are static and set at the minimum value of 1. cost(deliverAnalysis(_,_,_,_),1). cost(multiStepTransfer(_,_,_),1).
Furthermore, we assume the costs of the getDataFromDB action and analyze action are static and the values are set at 1. cost(getDataFromDB(_,_),1). cost(analyze(_,_,_),1).
The data transfer costs are subject to change. We assume that the agent is aware that the line between node2 and node3 and the line between node3 and node5 are normally slow. The data transfer costs become double if these lines are used. These costs are set at 2. cost(transfer(_,node2,node3),2). cost(transfer(_,node3,node5),2). cost(transfer(_,node3,node2),2). cost(transfer(_,node5,node3),2).
The data transfer costs of the other lines are set at 1. This cost information is expressed in the same way.
The specific task we consider in this case study is deliverAnalytics(dataHabit, node2,node5,marketing). As shown in Figure 9, the objective of this task is to deliver the analysis output of dataHabit, which is stored in the database at node2, to node5. The purposed of the analysis is marketing.
Considering the task, the planner creates the initial plan as follows: 1. getDataFromDB(dataHabit,node2) 2. transfer(dataHabit,node2,node1) 3. transfer(dataHabit,node1,node4) 4. analyze(dataHabit,node4,marketing) 5. transfer(analysisOutput(dataHabit,marketing),node4,node7) 6. transfer(analysisOutput(dataHabit,marketing),node7,node5)
As shown in Figure 10, according to the aforementioned plan, dataHabit is retrieved from the database at node2, transferred from node2 to node4 via node1, and analyzed for the purpose of marketing at node4. The analyzed output is transferred from node4 to node5 via node3.
There are two data-transfer routes from node2 to node4. Similarly, there are two data-transfer routes from node4 to node5. The planner selects the route with the lowest cost using the best-first search. Note that the data-transfer cost from node2 to node3 is set higher because the transfer speed is slow. We assume that dataHabit has been retrieved from the database at node2. The next action is to transfer the data to node1. Then, the legal checker indicates that it is illegal to transfer dataHabit to countryX. Subsequently, the agent removes the following from its belief: belief(allowedRegion(dataHabit,countryX)).
Because the precondition of the next action becomes false, the planner modifies the plan as follows: 1. transfer(dataHabit,node2,node3) 2. transfer(dataHabit,node3,node4) 3. analyze(dataHabit,node4,marketing) 4. transfer(analysisOutput(dataHabit,marketing),node4,node7) 5. transfer(analysisOutput(dataHabit,marketing),node7,node5)
The modified plan is shown in Figure 11. We can confirm that dataHabit is transferred only within countryY, rather than via countryX. This indicates that the legal norm is satisfied. Note that the action getDataFromDB(dataHabit,node2) is erased from the plan because it has been executed.
We assume that dataHabit has been analyzed at node4 for the purpose of marketing. The next action is to transfer the analysis output to node7. We assume that the ethical checker indicates that it is not ethical to transfer the analysis output to companyB. Then, the agent takes the position of utilitarianism and updates the cost of the next action as follows: cost(transfer(analysisOutput(dataHabit,marketing),node4,node7), 10).
The cost of the next action is now set at 10. Because the cost of the next action has become much higher, the planner dynamically modifies the plan as follows: 1. transfer(analysisOutput(dataHabit,marketing),node4,node3) 2. transfer(analysisOutput(dataHabit,marketing),node3,node5)
The modified plan is shown in Figure 12. In the modified plan, we can confirm that the analysis output (analysisOutput(dataHabit,marketing)) is transferred within companyA, rather than via companyB. This indicates that the ethical norm is respected, although it is not illegal to transfer it via companyB. Note that the planning agent does not abandon the plan to transfer the analysis output via companyB. It is maintained as an alternative plan and will be used only if there are no other options.
We implemented the planning agent, belief, and planning knowledge in SWI Prolog for Windows 64-bit, version 8.2.4, which was installed on the Windows 10 Home PC equipped with Intel(R) Core(TM) i7-1065G7 CPU and the 32GB of RAM. We measured the CPU times for initial planning, dynamic replanning after legal check, and dynamic replanning after ethical check five times each, and the average CPU times were 0.003, 0.006, and 0.003 seconds, respectively.
Therefore, this planner is adequate for practical use
for the test case scenario in this study. In future, we
would like to evaluate the scalability for diferent types
and sizes of networks. One way to tackle the scalability
problem is to use stratified multi-agent HTN planning
techniques [
In the test case scenario, in initial planning, neither legal norms nor ethical norms were ignored. In other words, dataHabit was planned to be transferred to countryX, which is against the legal norm, and analysisOutput(dataHabit,marketing) was planned to be transferred to companyB, which is against the ethical norm.
When the dynamic replanning algorithm was applied after legal check, dataHabit was planned to be transferred only within countryY. Therefore, the legal norm was complied with. However, analysisOutput(dataHabit,marketing) was still planned to be transferred to companyB, which is against the ethical norm.
When the dynamic replanning algorithm was applied both after legal check and ethical check, dataHabit was planned to be transferred only within countryY, and analysisOutput(dataHabit,marketing) was planned to be transferred only within companyA. Therefore, not only the legal norm was complied with but also the ethical norm was respected.
From the case study, we can understand that the legal norm of an action can be expressed as the precondition of the action. This indicates that the illegal action cannot be executed because its legal norm (precondition) is not satisfied.
By contrast, the ethical norm of an action can be expressed as the cost of the action. The higher the cost is, the more unethical the action is. Even if an action is unethical, it is still legal to execute the action. If the planner can find the lower-cost plan, the agent can avoid unethical action execution if possible. However, unethical actions can still be executed if there is no other option. Even in that case, it is possible to stop the action execution when its cost is too high, which means that the action is too unethical.
Ethical norms of action can be expressed as the soft constraints of the precondition, which should be satisfied if possible but are not required. However, many planners do not support soft constraints. Therefore, it is easier to express ethical norms of action as the costs of the actions.
It is not always possible to collect all the necessary information at the time of initial planning, especially when the latest information is distributed across multiple servers. In the case study scenario in this paper, the planning agent obtains new information regarding the next action shortly before its execution. Legal and ethical norms are checked at this time. Therefore, it is important to dynamically check and update the plan while executing it. Therefore, an online planning algorithm is used in this paper.
We have shown how to represent knowledge about legal and ethical norms using an online total-order forwardchaining HTN planning algorithm in the domain of data