The Thirty-Year Experiment We Never Looked At

In 1999 an agent-based control system called Production 2000+ is installed on a cylinder-head line at the Mercedes-Benz engine plant in Untertürkheim. Its architect is Stefan Bussmann. Behind it stand a reference architecture, an international consortium and a standards track, and in front of it a literature that will accumulate something like fourteen hundred citations.

It passes its performance test. It is deployed for day-to-day operation. It works.

Bussmann’s own page records what happened next, in a sentence that repays a second reading: “despite its success during the performance test and during the day-to-day operation, no second production system based on these concepts has been deployed until today.”

It runs for five years, until the engine it makes parts for goes out of production and the line is torn down. More than a quarter of a century after the installation it is still the only one.^[1]

An experiment that ran alongside us

The installation in Untertürkheim is the visible end of a research program that ran for three decades alongside our own, on problems we have always claimed as ours: how to decompose a working system into parts that hold together without a central schedule, how to keep local autonomy from dissolving the whole, and what happens when the coordinating part is taken away. The program has a reference architecture, a conference series, industrial sponsors and a standards track. We did not read it.

Several literatures reached our components without us, and this is the one that went furthest into practice. Its result is also the least comfortable, because it is largely negative and was published by the people who produced it, under their own names, in their own venues. Nothing that follows criticizes that literature. It did what we did not: it specified the architecture tightly enough to build, built it, ran it in a plant, and then wrote down that the thing did not spread.

Two looser versions of the charge against ourselves would be wrong. Holonic manufacturing did not succeed where the Viable System Model failed; by the ordinary measure of industrial diffusion it did not succeed either. Nor are holonic architectures the VSM under another name. They descend from Koestler and from control engineering, not from Beer, and their concerns are narrower than ours. The charge is this: a neighboring field ran a long, well-documented and partly negative experiment on architectures with our shape, and organizational cybernetics has no recorded engagement with the outcome. In the sources checked for this chapter we found no cybernetic reading of the holonic deployment record at all. Thirty years of evidence about the fate of architectures like ours sat one journal shelf away, and we did not go and look.

The architecture

Chapter 5, The Ladder Without a Ruler, introduces PROSA in passing, as a modeling vocabulary that fixes what its own terms may be applied to. Here the account can be given in full.

Holonic manufacturing systems took Koestler’s word^[2] into factory automation in the nineteen-nineties. In 1998 Van Brussel and colleagues published PROSA, a reference architecture with a small fixed vocabulary of holon types: product, resource, order, and an advisory staff holon whose failure degrades the holarchy to a heterarchy instead of killing it. Beer has no equivalent design commitment; the VSM’s metasystem↗ is not optional in the same way.^[3]

We tend to admire two properties of that design together and inherit neither. The first is the closed vocabulary. PROSA offers no open-ended list of things a holon might be. It names a small set of types and requires every element of a plant to be assigned to one of them. That constraint is what lets two engineers modeling the same production cell produce descriptions that can be compared. The VSM has a closed set of types too: “There could not be a ‘System Six’,” Beer wrote, “because the five-fold system is a closed system, in logic,” and he assigned familiar functions to them, market research and corporate planning to System Four, most management accounting to System Two.^[4] What our practice lacks is the rule that makes two modelers converge. Beer declared that there is “no ‘correct’ interpretation of the VSM” and left the assignment to the observer.^[5] The second is the specified failure mode. PROSA states in advance what is lost when the advisory element is removed: performance and predictability degrade, and execution continues in a heterarchical mode. The degradation story belongs to the specification; nobody added it afterward as commentary.

Here the difference is narrower than we used to say. Beer derives each subsystem from what fails without it: System Two is “logically necessary” because without it System One “would go into an uncontrollable oscillation”; System Four is “a necessary condition of viability”; “There has to be a System Five.”^[6] He also describes the degraded mode. Without System Four “the whole metasystem collapses into System Three,” and what is left is a decerebrate cat that still lives: “If you prod its leg, it kicks back.”^[7] So insight is not what separates us, and the failure logic is in the derivation. What Beer did not do is state it as a requirement that a design must meet, with the performance that remains specified in advance. The engineers wrote the degradation into the architecture as a requirement a candidate design must satisfy; we wrote it into our diagnoses as something a consultant may notice. A requirement can be tested against an implementation.

PROSA had about fourteen hundred citations when checked on 12 August 2026.^[8] The figure matters for one purpose: it removes obscurity as an excuse. A diligent reader could not reasonably have missed this literature. It was a well-cited reference architecture in a field with its own conferences and standards work, using a word we also use, for a structure we also describe.

The deployment record

And after thirty years the count of holonic architectures that have actually run a production line is close to one.^[9]

The genuine case is Production 2000+. Its first prototype was installed in 1999 at the Mercedes-Benz engine plant in Stuttgart-Untertürkheim, controlling workpiece transport for cylinder-head manufacture, and it did run in day-to-day operation; its own architect records that no second production system built on those concepts has been deployed since.^[10] The vendor literature is candid. Rockwell’s own compendium describes a steel-mill application used only to recommend configurations to an operator, a naval system tested on a scaled demonstrator, and a packing cell that was a university laboratory test bed.^[11] A 2020 review of holonic control for Industry 4.0 lists a handful of cases and devotes its conclusions entirely to research directions still to be pursued.^[12]

Each of those is real engineering, and calling them non-deployments passes no judgment on their quality. They are simply not production installations, and that distinction matters when the question is whether an architecture reaches the floor and stays there.

What the count is, and what it is not

The count of one is ours, and it is a count of a negative. We assembled it from the three sources that would have reported a further deployment had there been one, and we know of no systematic census to check it against. By the standards this book asks of others, that is a weak evidential base, and we would rather say so than let the number harden.

The criterion also does work that should be visible. We counted systems described as running in day-to-day production, which is demanding. A looser criterion that counted pilots, advisory installations and demonstrators would return a larger number and a different chapter. The claim therefore has a conditional form: on the strictest reading of deployment, and on the sources we have checked, the record contains one case, and the field’s own reviews do not point to others.

The architect has given his own reason. The system, Bussmann writes, performed well and “lived up to all its technical promises”; the trouble was economic. Flexibility “is a future advantage which requires an immediate investment,” so the business case was weak: “You must be convinced that you require the flexibility - you cannot prove it.” Gantry loaders gave comparable productivity gains with little flexibility and at lower cost, and nearly all the systems Daimler installed afterwards were of that type. He adds that the assessment is “strongly biased towards the automotive industry.”^[13] That is one account of one plant, and other explanations remain open. The installed base of conventional control systems is large, and whoever admires the new architecture does not pay the replacement cost. Procurement, maintenance skills and liability all favor the incumbent. The problems holonic control solves may not be the problems these plants were losing money on. The advantage may be real but visible only at disruption rates ordinary plants do not experience. Nothing we have read settles among these beyond the one plant, and a chapter that picked one would be doing what we accuse ourselves of elsewhere in this book: preferring a satisfying account to a tested one.

What the record removes

That is a thirty-year controlled experiment, and cybernetics has not looked at it. Holonic manufacturing had what the VSM never had: assignment rules that make two models of the same plant comparable, an international program, industrial partners, a conference series, a vendor research laboratory and a standards track, and it still did not ship.^[14] Whatever explains why cybernetic architectures do not reach production, “we never wrote it down properly” is not it.

The inference is narrow and should stay narrow. It does not show that specification is worthless. A field that had not specified could not have produced the record we are reading, and only formalization made the graceful-degradation property statable. Nor does it show that our own defects, cataloged in Part One, are harmless. It removes a single explanation we have leaned on for years: that the model’s limited industrial reach is a writing-up problem, and that a tighter notation or a proper reference architecture would convert interest into installations. A neighboring field did the writing up, to a standard we have never reached, and the installations did not follow.

The transfer is not automatic. Holonic architectures are software control systems for physical plant. The VSM is a model of regulation in any viable system, applied mostly to organizations of people, and a failure to diffuse might have causes in the first case with no analog in the second. The contrast is less clean than it looks, because the VSM’s own built case was also a network and software control system. That is why the right response is a comparative study rather than a conclusion, and the receipt below buys one.

The case we built ourselves

The comparison so far leaves out the one case in which a VSM-based architecture was specified, built and run. Chapter 8 tells the story of Project Cybersyn. Here only its record is needed, set beside the holonic one.

Between late 1971 and September 1973 Beer and a Chilean team built a telex network, Cybernet; a suite of statistical programs, Cyberstride, “needed to provide statistical filtration for all homeostatic loops at all levels of recursion”; and an operations room that was “in experimental working order on 10th January 1973.”^[15] By Beer’s count, “something like seventy percent of the socio-industrial economy was operating this system, involving about four hundred enterprises”; in The Heart of Enterprise he gives seventy-five percent at the time of the coup.^[16] Both figures are his own, and they are not the same figure. Eden Medina’s archival history records a smaller working state: at the end of November 1972 the temporary suite was checking seventy-four production indicators for anomalies, twenty-six were ready for the permanent suite and a hundred and eighty more were in preparation.^[17] The network carried the government’s distribution of essential goods through the strike of October 1972, on Beer’s account and on Medina’s, and, on Beer’s, through a second strike in August 1973.^[18]

The end is documented; the performance is not. After the coup of 11 September 1973 the military stopped work on the project and abandoned or destroyed what the team had built.^[19] Beer, asked why the design could not accommodate the pressure from outside Chile, compared the question to complaining that a man “cannot adapt to a bullet through the heart.”^[20] Five months before the coup he had written his own assessment. The technical objectives had been met, the technocratic ones might yet be, the social outcome was ambiguous and the political objective would not be reached; each member of the team weighted the four differently, which “would explain some current confusion, and the disagreement about success.” In the same paper he recorded that the Chilean establishment was “lauding and gladly incorporating” some components, Cyberstride and the operations room among them, and ignoring others, algedonic metering among them.^[21] No criterion of success was stated before the system ran, so there is nothing to test its record against. Medina met people who thought the project did not warrant historical attention because it “never reached completion.”^[22]

Three records now sit side by side. Production 2000+ was specified, built, passed its test, ran, and was not repeated. The sociotechnical designs of Chapter 13 were built many times and did not diffuse. Cybersyn was specified, built in part, ran for less than two years and was ended by force, after its designer had watched it being taken up piecemeal. None of the three stopped for want of a specification. The causes differ on their face, and whether they share anything beneath it is the question the receipt below prices.

Four more literatures on the same shelf

The holonic case is the largest of the fields we did not read, and the others share its shape: mature work, adjacent to a claim we make, available for decades, unengaged.

Qualitative comparative analysis is the clearest instance. Its foundational statement appeared in 1987, and its central finding is that configurations of conditions can be jointly effective while no single condition is necessary or sufficient on its own. Our five-system claim is stronger than that. Beer holds each subsystem necessary, System Two “logically necessary to any viable system”, System Four “a necessary condition of viability”, “There has to be a System Five”, and the set sufficient: “a cybernetic model of the necessary and sufficient conditions of any viable system.”^[23] He also holds that the functions are always performed somewhere. System Two “is always present, or the organization would shake itself to pieces”, and “System Four exists — it has to: but it is disseminated.”^[24] A necessity claim of that kind can be tested only once absence has been coded in advance, and the coding in Chapter 28 separates a function performed by a designated role, a function performed unofficially, and a function nobody performs. QCA’s necessity and sufficiency analyses are built for exactly such claims. The method has existed throughout the period in which we have been asserting ours, and we have tested ours by illustration.^[25]

Measurement shows the same pattern. Chapter 14 describes the published coding manual behind Ostrom’s program and prices a ten-archive pilot against it. The pilot is cheap; the expensive path is the alternative. Building a new VSM questionnaire of our own before adapting an instrument already validated on comparable material would repeat, in the present tense, the neglect this chapter documents about the past.

Sociological systems theory is the third. Chapter 16 carries the full citations to Achterbergh and Vriens (2009), Schwaninger and Groesser (2012), and Johnson and Leydesdorff (2015). What matters here is narrow: “the traditions cannot be combined” is no longer an inference available without first reading the attempts, and the attempts exist.

The fourth entry is the cheapest and the least developed. Troncale’s system process theory and its linkage propositions offer an explicit way to pair recurring processes with pathologies and channels, which is close to something we need.^[26] The negative search is itself dated: the material was absent from every manuscript draft checked on 12 August 2026.

Receipt — a three-way comparative post-mortem. Compare three records: holonic manufacturing (Bussmann’s account, the Rockwell compendium and the Derigent review, followed by targeted checks for a second production deployment), the sociotechnical designs of Chapter 13, and Cybersyn (Beer’s account in Brain of the Firm and Medina’s archival history). Budget twelve researcher-days for the holonic record and about six more for the other two. Pre-register rival explanations for non-diffusion, including Bussmann’s weak business case for Production 2000+; Beer’s own for Cybersyn, the piecemeal incorporation of components by an existing establishment; and Beer’s own general explanations, paradigm closure, which he called the “Noah’s Ark Syndrome,” and the view that the battle for Cybersyn’s reputation had been “lost in advance.”^[27] Record for each case which explanations its sources can test and which they cannot. If one explanation fits all three, retire “write it down better” as the remedy; if none does, state the differentiating mechanism. The holonic count is explicitly falsifiable and must be rechecked before print.