Mobility as a Service

MAAS as a mobility model leans on the idea that a gap between private and public transport systems needs to be bridged as well as on a city, intercity, national and supranational level. The current situation is felt problematic due to the fragmented tools and services often organized in silos to meet a traveler needs to undertake a trip. One of the major concerns designing any platform system like Mobility as a Service is where to start modeling and how to express the notion of the platform system in some language that is understandable for all stakeholders of the platform system. Understandability buttresses the expectation of stakeholders whether some design will probably implement the intended platform services enabling users to actually buy and or use the platform system for what ever purpose. Building on the economic theories of two-sided markets and mechanism design we introduce the concept of value nets extending the Contract Protocol Net. Value net modeling offers a precise abstract representation which provides in the detailed informational requirements in a canonical form and it connects i.e. implements the abstract notion of Service Oriented Architecture characterizing systems without loss of crucial informational elements.


INTRODUCTION
Making city governance more efficient, citizens happier, business more prosperous, and the environment more sustainable through the deployment of systematic integration of technical infrastructures that rely heavily on advanced data-processing is coined as smart city [20]. Smart mobility is one of the smart city dimensions that includes dynamic traffic-and congestion-management, cooperative intelligent transport services (C-ITS), connected autonomous driving (C-CAD) and mobility as a service (MAAS) [5] [6]. Essentially MAAS makes a multi modal lifestyle feasible from the perspective of the citizen introducing a novel transport paradigm in which it is no longer needed to own a car by offering travelers access to a range of transport alternatives packaged to personal preferences. These packages combine offerings from different transport services like public transport with shared bikes, or public transport services with on demand responsive transport, car sharing systems, car sharing in combination with sharing bikes, or car rental on a day-to-day basis or vehicle rental paying for the actual use and so on. It needs no elaboration that the notion of sharing viewed as a (business concept) is one of the key notions that underlie or even underpin smart mobility as a dimension of smart city notions and concepts. Within a governmental policy context the main question or goal is can MAAS lead to behavioral changes able to bring about (1) a better product for the citizen, (2) Social inclusion, (3) Congestion reduction, (4) Accessibility and last (5) Sustainability [9]. Indeed when we come up with a design than we have to address these questions. The key issue underlying a design that implements MAAS service providers enabling citizens to actually buy the MAAS service is where to start modeling and how to express the notions in some language that is understandable for all stakeholders of the MAAS service system. MAAS as a mobility model leans on the idea that a gap between private and public transport systems needs to be bridged as well as on a city, intercity, national and supranational level. The current situation is felt problematic due to the fragmented tools and services often organized in silos to meet a traveler needs to undertake a trip. In this paper we introduce the concept of value to model MAAS services 1 . Through the value model coined as value net modeling we have a mechanism that ensures that design decisions are made consistently safeguarding that the underlying social and technical notions are aligned, consistency is warranted and a privacy preserving mechanism is ensured by means of the design of a two-sided platform like MAAS.

RESEARCH APPROACH
In a scientific context testing a hypothesis means confronting statements about an assumed relationship between phenomena with empirical facts. In a design context the terms testing and hypothesis tends to shift in meaning, a design assumption is not a matter of being true or false but given a particular context it is a matter of being the best solution based on vision and believes [19]. As a consequence very different logics of discovery may be at work in design practices, and the way they are mixed may vary form case to case, from situation to situation, from context to context and so on. Whatever mix or configuration of elements, we will always need (good) theories to account for what happened. Theories are constitutive for every design just because we need to understand why some things do work and other things do not work or will never work. We must explain in advance why. Put in other words, we need a explicit interpretation of what is constituted as the tacit understanding, just displayed i.e. showed in practice [23]. Some authors state that "testing a design hypothesis is inextricably bound up with the (ethical) normative framework of society and with its epistemological principles" [22].

Empirical grounding
This research is initialized and inspired by an European tender convoked by the dutch Ministry of Infrastructure and Watermanagement [9] in 2017. A consortium of two professional firms in the automotive and smart card technology sector developed a commercial proposition with respect to MAAS services. This research has contributed to the tentative design idea buttressing the business model of the MAAS service proposition as one of the desired outputs of design science research process model in [38].

Purpose and process
Following Lewis [3,31] good representations of meaning are only possible when at the same time a statement is made on how the representation of the meaning is used in for example communication and inference. Structure defined as an assembly of components should always be studied in tandem with an associated process, whatever this process may be. The same duality seems valid for the notion of information or enterprise systems design. What does information do for each process, and can we find one abstract level of representation that stays away from the details of implementation [3]? This research is in the realm of Design Science Research [30] and is to be characterized as Design Theory. Our aim is how to come up with a design of MAAS services without fully answering why the prescribed model as actions should work. In this respect this research coined as design relevant explanatory/predictive theory (DREPT) augments the "How" part or question with explanatory information on "Why" one should trust the proposed design actually will work.The key point is that the explanatory information is obtained using kernel theories. Kernel theories are established theories form social sciences, economics, mathematics, computer science, logic and so on. We are interested in theory building on how to design effective and efficient MAAS services, of which this may be interpreted as experimental scientific investigation. In this paper we develop as a first step a methodological construction of the MAAS artifact as the object.

MAAS 3.1 The notion of Mobility-as-a-Service
There are many ideas, concepts and definitions for describing MAAS services. Intelligent Transport Systems Finland (ITS Finland) view Mobility as a Service (MAAS) as a mobility distribution model implemented as a single platform by a single service provider that orchestrates each individual transport service component to meet "customer's end-to-end service expectations" [27]. The dutch Ministry of Infrastructure and Watermanagement define MAAS as "the provision of multi-modal, demand-driven mobility services, whereby customers are offered tailor-made travel options via a digital platform (e.g. Mobile Apps) based on real-time information, including payment and the handling of transactions [9]. Kamergianni et al define MAAS as a user-centric, intelligent mobility distribution model in which all mobility service providers' offerings are aggregated by a sole mobility provider, the MAAS provider, and supplied to users through a single digital platform [28]. Intuitively these definitions are precise enough for a rough understanding of the notion. It is less clear which concepts buttress MAAS precisely, but there is one aspect that concerns us most. In the definitions aforementioned it is expected or assumed that MAAS is implemented by some sort of single platform by a single service provider. We think this monolithic view is too limited and neglects the distributive nature of the notion of MAAS and therefore limits design and solution space as we will address later on in this paper. MAAS as a mobility model leans on the idea that a gap between private and public transport systems needs to be bridged as well as on a city, intercity, national and supranational level. The current situation is felt problematic due to the fragmented tools and services often organized in silos to meet a traveler needs to undertake a trip. So to speak MAAS can be coined as a bridge defined as a type of computer network device i.e. a mechanism that provides interconnection with other bridge networks that use the same protocol. More specifically technically a bridge network works at the data link layer of the Open System Interconnect (OSI) model, connecting two different networks together and providing communication between them [42]. Conceptually the role of data evolved from a syntactical representation of an object to an economic valuable representation of an object. In the situation data can be decoupled from specific hardware and software implementations, then data turns into an independent economic good. This shift opens up new opportunities and facilitates i.e. enables digital business models like MAAS [8]. Here we see the novelty of MAAS in creating value for end users like customers, travelers, or other participants in the smart-mobility system. The novelty consists of linking networks to create network effects by performing a bridge function between two or more separate networks. In summary two aspects are paramount to understand MAAS namely the decoupling of data from specific hardware and software implementations and the coupling of networks

Characterizing Mobility-as-a-Service
It needs no elaboration to see that when data also become economic goods that MAAS services are both technical as economical and sociological. One way to describe MAAS as a mechanism bridging networks is to use service oriented architecture (SOA) as an architectural paradigm to describe for decision purposes the abstract architectural elements in the domain of interest, here smart-mobility, independent of the technologies, protocols and products to use to implement a specific solution for the domain [34]. MAAS services as a system can not be fully understood by simply decomposing the system in its parts and subsystems. This is certainly the case when many autonomous parts of the system are governing the interactions among them. By understanding the situational context in which MAAS, as a bridge, functions and the participants using the MAAS services involved in making the MAAS bridge function work, then we can come up with a design and proposed governing design principles of which we are confident that the proposed design of MAAS services will actually have the potential to work in an appropriate manner. Hence this view on MAAS can be conceptualized as an ecosystem viewed as a whole defined as a network of discrete processes interacting with communities (one of more peoples), creating, using and governing specific services. In short the SOA is a paradigm for(1) exchange of value between independently action participants, (2) participants have a legitimate claim to ownership of resources that are made available within the MAAS ecosystem and (3) the behavior and performance of the participants are subject to rules or engagement which are captured in policies and contracts [14,34]. Conceptually a SOA ecosystems model is depicted in fig1 From a smart-mobility point of view we are interested in the right part of the model where actors interact with SOA based systems with some goal in mind. MAAS services implement the means to attain the actors goal, which is to be able to travel from A to B.

One sided versus two sided markets
The mechanism bridging networks is often addressed as platform. We will use the term platform exclusively to address two-sided markets opposed to traditional one-sided markets. The notion of two-sideness relate primarily to the theories of network externalities that borrows the assumption that there are non-internalized externalities among end-users. More formally the market for interactions between two sides (i.e. the buyer en the seller) is one-sided if the volume V of transactions realized on the platform depends only on the aggregate price level a, where a is the total price of the price a buyer pays a B and the price the seller pays a S using the platform. The market is said to be two-sided when volume V varies with a B while keeping a constant. The utility of a buyer U i is equivalent to the difference of the average benefit b i per transaction and the usage fee a i per transaction times the number of members, i.e. the sellers, on the other side plus the fixed benefit for the buyer B i minus the fixed benefit for the seller A i [35]. Now it is easy to see that coupling networks generate value by internalizing the externalities by means of a pricing mechanism i.e. a value function complementing the pricing mechanism buttressing the service exchange mechanism itself. Indeed a platform reduces uncertainties relating to transaction costs [37] and due to the volume effect one can expect that service prices themselves will drop. For example sharing taxi's will reduce the price per trip per customer. The user-customer can have a plethora of motivations to share a cab, take a bicycle, use public transport systems or a combination of two or more modalities. One of them is simple we feel that we have to contribute in lowering our CO2 footprint. Indeed MAAS is usercentric and demand driven. These behavioral aspects need to taken into account designing smart-mobility systems like MAAS as an SOA ecosystem.

MAAS mechanistically viewed
The platform bridging networks viewed as a mechanism is a mathematical structure that models institutions through which for example economic activity is guided and coordinated. When we design a platform like MAAS than we need to know what the problem of mechanism design is [26]: Given a class Θ of environments, an outcome space Z, and a goal function F, find a privacy preserving (i.e. a decentralized) mechanism π = (M, µ, h) that realizes F on Θ, where M is the message space, µ denotes the (group) equilibrium message correspondence µ : Θ → M and h denotes the outcome function h : M → Z . The key insight of [25] was that information about the environment, facts that enable or constrain possibilities are distributed among agents. But pay attention when an agent is not able to observe some aspect of the prevailing environment, than the agent does not have the information to guide his or her actions, unless the agent is communicated to by another agent who was able to observe. Notably an agent is not able to observe the private information of another agent so trust must be accounted for. By means of a verification scenario which separates the process of finding an equilibrium from recognizing an equilibrium it is possible to design incentive compatible mechanisms which occurs when the incentives that motivate the actions of individual participants are consistent with following the rules established by the group or set by the institution like the MAAS provider. Simply put, in a verification scenario each agent reads the announced message by saying yes or no. The proposed outcome is judged acceptable if and only if the agents' responses are affirmative. The message exchange process consists of three elements first a message space M, second a group equilibrium message correspondence µ, denoted µ : Θ → M and third outcome function h, denoted as h : M → Z . A message space M consists of the messages available for communication. Messages may include formal written communication like contracts among buyers and sellers, accounting reports, production statistics, emails and so on.

Contracts and value-nets
From a behavioral point of view a contract can be defined as a statement of intent to regulate behaviors among agents [11]. Thus a contract provides in a comprehensive set of both constitutive and regulative rules (i.e. norms) to construct a social reality [12].
Constitutive rules introduce abstract classifications of facts and entities or they describe the (legal) consequences of actions on the normative system, where regulative norms provide notions of conditional obligations with an associated sanction (or reward). In essence a contract depicts the content, structure, and governance of transactions [4,43]. The transaction content refers to the goods, services or information that is to be exchanged and the resources and capabilities that are required to enable the exchange of goods, service or information delivery. The transaction structure refers to the collaborating organizations participating in the exchange and describes how collaborating organizations are interlinked, inclusive the sequencing in which delivery will take place en the adopted mechanism for enabling transactions. Transaction governance depict the way in which information flows, resources, goods and services are controlled by participating organizations in the exchange as well as other stakeholders like regulators and societal agencies. Transaction governance embodies the legal and other regulatory aspects of organization as well as the incentive structure for the participants in the transactions engaged.
Contracts are a legal,sociological and economical devises to align goals, intentions, desires and obligations among participating organizations engaged in a exchange of goods, services, information and money. If we accept the behavioral view of a contract, than we need to address all three transaction aspects of a contract simultaneously. So if we change the transaction content, we have to address the transaction structure and the transaction governance, if we change the transaction structure we need to address the transaction content and transaction governance, if we change the transaction governance we have to address the transaction structure and the transaction content. Needless to say that balancing the three aspects is a complex endeavor. Consequently a contract is not just a set of clauses earlier for convenient purposes defined as a set of clauses C = {C1, . . . , Ck}, but contains specific interrelated sets of clauses referring to content, structure and governance buttressing the transaction agreed upon between agents as users, organizations and institutions. As such a contract serves as a legitimate institution in organizations of agents [11,12,18]. Normative systems, like a design of MAAS, prescribe how the agents ideally should and should not behave. Norms in general provide in the possibility that actual behavior may at times deviate from the ideal situation. Given the notion of constitutional and regulative rules, regulative rules i.e. norms can be mapped onto the transaction structure, whereas constitutive rules covers the transaction content and the transaction governance. The transaction structure provide in the notion of conditional obligations (or permissions and prohibitions) with an associated sanction (or reward). The associated sanctions (or rewards) refer to the pre-conditions depicted in the transaction content and or to the post-conditions depicted in the transaction governance. Economically and thus computationally the price mechanism actually serves as a balancing mechanism across the transaction content and the transaction governance on one side and the transaction structure on the other side. Stated otherwise, if the transaction content and the transaction governance are equal to the transaction structure than the outcome of the price mechanism, that is the agreed upon market price, actually reflects the mutually agreed upon conditions between participating organizations reflected by the actual public communication flow. Stated otherwise, if we use the mutually agreed upon price between participating organizations than it must be the case that the transaction content provides in the necessary specifications of the pre-conditions, and that the transaction governance specifies the necessary postconditions in the case the conditional obligations (and permissions and prohibitions) and or preconditions are not met in such a way that the specifications are actually equal to the drawn upon transaction structure described as conditional obligations (and permissions and prohibitions) upon which the participating organization must comply with.
We stated that from a economically and computational point of view that the price mechanism it self or the outcome of the applied price mechanism actually serves as a balancing mechanism across the transaction content and the transaction governance on one side and the transaction structure on the other side. This stance needs further clarification. Transactions coined as economic events effect the financial position of an enterprise and stem per definition from contractual arrangements between agents. Agents in the marketplace agree upon the conditions the goods and or services to be delivered and the market price to be paid in return. Economic transactions as described above can be formally modeled as a value cycle which is interlinked to the business model of the enterprise i.e. the revenue model [15,16]. When used in computer science, often the purpose of these models is to analyze the representations of actions and events in a business process, and study their well-formedness. Consequently an intra-organizational communication flow i.e. business processes can be modeled as a value net which provides a top-level view of an enterprise that focuses on the economic events equivalent to the value cycle of an enterprise.

Value-nets: a value centric approach to two sided platforms
More formally the canonical form of a value net is modeled with a dimensioned Petri Net, extended with a place sign and a valuation, with some special structural characteristics that make it a good representation of the intra-organizational process structure [15,41]. For completeness purposes we give the following definition. Additionally a value net has the following structural properties: • The net is cyclic in the following sense. There is a special place labeled money from which it is possible to reach every other node in the model and that can be reached from every node in the model. Put differently, every node in the model is on a path from money to money. We use subscripts to differentiate the money and the flow of part. So, partitioning P = P mon ∪ P f lowof splits the places into the money part and the flow of part. Transitions in event money are between places the money part and transitions in event flow of between places in the flow of part. A event buy transition consumes value from the money part and produces value in the flow of part. An event sell transition consumes value from the flow of part and produces value in the money part.
As we have seen in 3.3 a distinction is made in one sided and two sided markets. To model two sided markets we have to model one-sided markets first. To model a one-sided market we extend the value net as depicted in figure 2 with a duplicate. The result is depicted in figure 3 coined as the Double.
On the left-hand side we have the original value net representation of the intra-organizational process structure of an organization. On the right-hand side we see the duplicate of the left-hand side representing the intra-organizational process structure of the buying organization. This makes the left-hand side the selling organization or agent and the right-hand side the buying organization. Markets separate sellers and buyers. In the case the seller and buyer agree upon the contract; that is seller and buyer agree about the price of the goods, service or information, agree of the quality of the goods, service or information and agree about the conditions like user rights, warranty en ownership and so on; than money is transferred and goods are delivered. The former depicted in the top arrow from money to money and the latter depicted as a bottom arrow from good to good transferring owner, user rights and obligations. Now we can model the two sided market by adding a value net model similar to the value nets of the seller and buying organizations except we have to model the notion of a platform coupling networks as defined in 3.2 and 3.3. The key characteristic of platforms are search and find capabilities. The result is depicted in figure 4.
As we see in figure 4 coined a the Triple the right-hand side buys search and find capabilities. Mobile apps for example instantiate these capabilities to accomplish specific tasks. Notice that two top level arcs are added representing the money flow from the left-hand side the seller is willing to pay the price a S using the platform and the money flow from the right-hand side the buyer is willing to pay the price a B Remember that for interactions between two sides (i.e. the buyer en the seller) the market is said to be two-sided when volume V varies with a B while keeping a constant. At the bottom side of figure 4 two dashed arcs are added representing the found request of the buyer. This result is precisely the model treated in section 3.4. specifically the notion of trust and the necessary verification scenario. The key question is who governs the verification scenario and how to do we guarantee or secure the agents' privacy.

Trust in platforms or privacy preserving mechanisms in MAAS
The Contract Net Protocol (CNP) is a task allocation protocol that facilitates negotiation between bidders and an auctioneer in a Multi Agent System to form a contract. Bidders for example, here the buy-side want to interact with one or more sellers, to update their bids until their bids are accepted. In this respect it is important that the Contract Net Protocol terminates correctly [10]. Time sequence diagrams are often used for depicting the communication flow a like activity diagrams and so on. The CNP covers the communication between buy and sell and counts as an instantiation that works at the data link layer of the Open System Interconnect (OSI) model, connecting two different networks together and providing communication between them [42]. From a design point of view is is easy to extend the Double with communication as depicted in figure 5.
It is easy to see that the CNP facilitates the process of bidding or dealing with quotations which buyer and seller eventually agree upon. From a control point of view CNP like protocols are limited because the actual payment and delivery are not part of the the CNP model. This is why the value net modeled in the canonical form with a dimensioned Petri Net gives us the correct insight. After agreement of the contract the credit department of an organization needs to know what has to be paid and what has been bought at what conditions. On the other side the organization needs to know what is to be received in what quality. The same reasoning is also applicable for the seller. A verification scenario fulfills these type of checks and balances. The interfaces (API) to creditor, debtor and order need to be accounted for otherwise the verification scenario will become unduly costly [17]. Potentially it will deteriorate the data quality of the system and addresses concerns about the completeness and the accuracy of the data in the accounting, control and audit domain. It needs no elaboration that trust in platforms are interlinked with the data quality and the representational faithfulness of the data registered with a platform as defined in 3.1.  [13] Closely related to the data quality concerns in terms of completeness and accuracy is the notion of privacy of the agents using information systems like platforms as MAAS. From a regulatory point of view one needs to take into account the GDPR on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). In this paper we assume that the non-functional requirements will be met. There is one aspect which is very relevant for maintaining the privacy of users and this concerns the necessary identification, authentication and authorization procedures which buttress all security standards. Additional to the verification scenario the verifier needs to validate whether a user is authorized i.e. has the permission to act upon the data he or she has access to [24]. As we have addressed in section 3.5 it must be the case that the transaction content provides in the necessary specifications of the pre-conditions, and that the transaction governance specifies the necessary post-conditions. This is why attribute-based policies needs to be integrated with Role-based Access Control (RBAC) [21,39]. In section 3.1. we addressed our concern to the expectation or the assumption that MAAS is implemented by some sort of single platform by a single service provider. We stated that this monolithic view is too limited and neglects the distributive nature of the notion of MAAS and therefore limits design and solution space. We need to clarify this. As we have seen  [7,40]. It cannot be debated that trust and justice needs to be established and maintained. In communication networks receivers of information want to ascertain its origin when needed, they want to verify whether a message or some other information has not been modified during transit and they want to be sure that senders of the message are not able to deny that the message was send at all [36]. These are vital requirements known as authenticity, integrity and non-repudiation. Recently crypto currencies like bitcoin are implemented with block-chain technology are on the rise because of the combination of being a currency and a payment system as well it has some attractive features enabling local privacy preserving properties. Nakamoto observes that no mechanism exists to make payments over a communications channel without a trusted party [32]. Nakamoto states that an electronic coin can be defined as a chain of digital signatures. Each owner of the coin transfers the coin to the next owner (to be) by digitally signing a hash of the previous transaction (from the viewpoint of the owner to be) with his private key (current owner) and the public key of the next owner (the owner to be) and adding these (the hash plus signature and keys) to the end of the coin. A payee can verify the signatures to verify the chain of ownership. Because of the public nature one problem had to be resolved in the case users of the crypto currency payment scheme is that users face the risk of double spending. A user (the payee, that is the owner to be) needs a way to know that the previous owners (the current owner and their successors) did not sign any earlier transactions. So the design of the payment scheme has to provide in a mechanism that (positively) confirms the absence of âĂĲdouble spend coinsâĂİ in the former transaction (chain). The mechanism must be aware of all transactions and provides in the need due to the absence of a trusted third party like banking institutions. The key idea buttressing the bitcoin is based the notion of a time-stamp server, proof-of-work and an incentive mechanism. The transactions to be confirmed are placed in a hashed time stamped block which includes the previous time-stamp in its hash, forming a chain coined as the blockchain. Notice that the implementation of crypto currencies covers the actual payment of the services, as the CNP protocol only covers the bidding over services for the best price.
Combining digital signatures with public-key cryptography we get a protocol that combines the security of encryption with the authenticity of digital signatures. The protocol is as follows, where A and B denotes the agents, S denotes signing, Pka denotes the private key of A, Pkb denotes the private key of B, D denotes decrypt, Pua denotes the public key of A, Pub denotes the public key of B and M is the message containing the conditions of the contract. Notice that the contents of M itself can be encrypted to some standard. The main design question is what should be the contents of the message and for what purpose is the data exchanged and registered in information systems. Exchanges are by definition reciprocal in nature and come in a large variety of what we coin as means like signed contracts, shaking hands et cetera. For example signing a contract by both parties is performative in nature; by the act of signing, we communicate that the exchange is done. Hence a signed contract affords exchanging. An affordance establishes the relationship between an object or an environment and an organism here a (human) agent through a stimulus to perform an action. In our example the stimulus is the signed contract and the detectable change in the external environment. It needs no elaboration that our protocol as given above needs to be extended by a second massage to make the protocol reciprocal. Indeed the given protocol is one-sided i.e. unilateral by nature. We need a bilateral contract in which the parties exchange mutual promises. Bilateral contracts are commonly used in business transactions; a sale of goods is a type of bilateral contract. The seller promises to deliver the goods or services where the buyer promises to pay for the goods by providing the seller with the indebted amount of anything parties have agreed upon. Hence we need two signatures one of the seller and one of the buyer. Logically the information flow of a bilateral contract can be depicted as a directed graph partitioned in two separate flows. Mathematically a value net is a bipartite graph so the bilateral contract modeled as information flows i.e. the canonical model for the communication protocol has the same properties as the intraorganizational process structure as depicted in figure 2 and the Double depicted in figure 3. This result is graphically depicted in figure 6.
As a result we have a precise picture and definitions how a CNP can be extended. Indeed we recognize the concept of a smart contract. âĂĲA smart contract is a computerized transaction protocol that executes the terms of a contract. The general objectives of smart contract design are to satisfy common contractual conditions (such as payment terms, liens, confidentiality, and even enforcement), minimize exceptions both malicious and accidental, and minimize the need for trusted intermediariesâĂİ [1, 2]. In our model DialogDoubleExtended the reach of the smart contract is the dotted rectangle. As for MAAS services it is easy to see how the communication dialog can be modeled extending the Triple.
By executing the smart contract per transaction for as well the left hand side as the right hand side we have the correct information in the platform about what is to be received by the buyer and what is to be delivered by the seller. The same is true for the money part of the transaction between buyer and seller mediated by the platform. What is to be delivered by the seller. What has to be received by the seller. What is to be received by the buyer has to be paid by the buyer or what has been paid by the buyer has to be received by the buyer.

Causal model for eliciting requirements
A model is considered to be a representation of some object, behavior, or a system that one wants to understand [33]. In everyday life we are on a day to day basis involved in making decisions about what should a model should look like to become meaningful and therefore useful. In the end you want to make sure that people you work and communicate with understand your goals and your wants. A model is always the result and the start of a design process. "A design process is an abductive sensemaking process, a step of adopting a hypothesis as being suggested by the facts ... a form of inference, albeit inference of "best guesses" leaps [..]. A logic of what might be. It is not entirely accurate, âĂę it is the argument to the best explanation, the hypothesis that makes the most sense given observed phenomena or data and based on prior knowledge" [29]. The purpose of the TripleExtended depicted in figure 7 fulfills this purpose. In 3.5 and 3.6 we specified the causal model of a bilateral contract in its canonical form coined as a value net with a precise mathematical structure in terms of a dimensionalized Petri Net. In section 3.7 we extended the model with secure privacy preserving communication flows. Notice that coulouring of the Petri Net model was not necessary. As addressed in the introduction the key issue underlying a design that implements MAAS providers enabling citizens to actually buy the MAAS service is where to start modeling and how to express the notions in some language that is understandable for all stakeholders of the MAAS service system. The first step is to identify the business model of the platform here MAAS services as an instantiation of smart-mobility services. The business functions as a result are Buy → Search → Find → Sell. Than we reason from right to left. The result is that the value net of the platform is the first model we have to elicit that is modeling the Search → Find mechanism. Than we model the Buy → Sell mechanism. As a result we have the TripleExtended.

CONCLUSION
Structure defined as an assembly of components should always be studied in tandem with an associated process, whatever this process may be. The same duality seems valid for the notion of information or systems design. What does information do for each process, and can we find one abstract level of representation that stays away from the details of implementation [3]. In this paper we introduced the notion of value net to model MAAS as a platform as a foundation to elicit requirements in a principled way. Value net modeling offers a precise abstract representation which provides in the detailed informational requirements in a canonical form and it connects i.e. implements the abstract notion of Service Oriented Architecture characterizing systems as defined in section 3.2. without loss of crucial informational elements.