Leveraging the Internet of Things

By Bob Violino

With standards for exchanging information over the EPCglobal Network being finalized, the vision of using RFID to track goods in the supply chain is about to become a reality. And it will change business as we know it.


When the Auto-ID Center, a nonprofit research organization, was developing Electronic Product Code technologies, it envisioned using radio frequency identification to create an “Internet of Things”—a network that would allow companies to track goods through the global supply chain and run many business applications simultaneously. Companies would be able to go out to the Internet and, with the right access privileges, get information about specific products and act on it or share it electronically with supply chain partners.

Major companies around the world—including Gillette, Metro, Tesco, Unilever, Visy Industries, Yuen Foong Yu Paper Manufacturing and Wal-Mart—embraced this vision. To that end, manufacturers, logistics providers and retailers have spent the past couple of years learning how to deploy EPC technologies in plants, warehouses, distribution centers and stores. Now, they’re ready to derive benefits from tagged products flowing through their supply chains, and the network needed to facilitate tracking and data sharing is taking shape.

Forget hard-charging tagging mandates and big-bang supply chain rollouts. Europe is taking a different road to RFID adoption, and some say the real ROI is at the item level.

For the past 12 months, groups, subgroups and standing committees working under the aegis of EPCglobal, the nonprofit organization set up to commercialize EPC technologies, have been finalizing the data formats, software interfaces and communication protocols that will breathe life into the EPCglobal Network—the infrastructure that will allow companies around the world to track goods in the global supply chain and find information about products associated with EPCs. The network could become a cost-effective medium for companies to share EPC information securely and for running applications that could streamline intercompany business processes, saving supply chain partners time and money.

The long-term vision for the EPCglobal Network is that it will be part of the existing Internet infrastructure—that is, it will use Internet protocols and have servers connected to the broader Internet infrastructure. The network’s physical layer consists of EPC tags, interrogators (also called readers) and the “air-interface” protocol that enables tags and interrogators to communicate.

Companies will use middleware—software that resides between interrogators and enterprise applications—to collect, filter and store EPC data in databases on local network servers for use with their own enterprise applications. This process will be facilitated by middleware interface specification standards, created by EPCglobal, called Application-Level Events (ALE).

EPCglobal is also developing standards for something called EPC Information Services (EPCIS), an interface specification for accessing EPC-related information. Companies will be able to use applications with the EPCIS interface to securely share information with external data sources (such as hosted electronic catalogs) and with external EPCISs—their own or their partners’—using both applicability statement 2 (AS2), an existing Internet electronic data interchange (EDI) system, and Web services, a standardized set of interfaces that allow application-to-application communication over the Web.

What if a company wants information about specific EPCs and doesn’t know where the data resides? EPCglobal is developing standards for applications—dubbed the EPC Discovery Services—that will query numerous EPCISs in the supply chain. The EPC Discovery Services will use standardized protocols and authentication technologies to verify and respond to requests from potentially dozens of EPCISs (see “Securing Data on the EPCglobal Network” subhead).

These standardized interfaces and protocols will enable companies to use EPCISs to share information with many trading partners in the same way. Software vendors will be able to develop applications—such as track and trace, management of new product introductions, promotions management and electronic proof-of-delivery—that provide business value (see “It’s All About Applications” subhead).

The EPCglobal Network will also have consumer uses. As currently specified, the Object Name Service (ONS) points users to manufacturers’ Web sites, where information associated with particular EPCs can be made available over the Internet, just as the Domain Name Service points computers to servers hosting Web sites. For instance, a customer in an electronics store might read an EPC tag on a product with an interrogator built into her cell phone and download warranty information.

A Single Global Extranet

Some interface specifications such as ALE have been ratified as standards, and others, including ONS and EPCIS, will be ratified early next year. These standards will facilitate the collaboration between business partners that is necessary to achieve new levels of efficiency within companies and across the supply chain.

Consider the way retailers share point-of-sale (POS) data with their suppliers today. Each retailer provides the data in a proprietary format, usually through its own extranet. That means suppliers have to log on to numerous extranets, download data in different formats and sift through it to try to determine what the numbers mean. It’s no surprise, then, that a recent AMR Research survey of consumer packaged goods (CPG) manufacturers found that only 4 percent of suppliers are using POS data as an indicator of demand for their products.

Early adopters, including Wal-Mart, are providing their suppliers with data about when tags on products are read, but the suppliers have to log on to a proprietary extranet, download the data in an Excel spreadsheet and then try to make sense of it. The EPCglobal Network could potentially reduce costs and complexity for manufacturers by acting, in effect, as a global extranet for specific industries.

Standards for data formats and EPCIS interfaces are being designed to allow maximum flexibility, so companies in different industries can use the same standards but in ways that meet their needs. EPCglobal has set up business action groups (BAGs) to define the business requirements for specific industries. So far, the Fast-Moving Consumer Goods (FMCG) and Healthcare and Life Sciences (HLS) business action groups are making headway in defining industry-specific requirements for the exchange of EPC data. BAGs define their industry’s needs and then EPCglobal’s Hardware Action Group and Software Action Group create the standards needed to meet each industry’s needs. The Software Action Group (SAG) set up the EPCIS Work Group to draft the EPCIS standards.

The FMCG business action group set up a subcommittee, the Data Exchange Working Group, about a year ago to define such things as what data companies within the retail/CPG industry need to share, what format it should be in and how often it needs to be shared. The group defined some 50 “use cases” for EPC data. It looked at the entire supply chain from end to end, determined where it made sense to interrogate EPC tags—at a manufacturing plant’s shipping dock, a distribution center’s receiving bay, the back of a store and so on. It’s now working to establish a common vocabulary that defines each step in the supply chain.

Based on this information, the group is adapting the EPCIS XML schema—codes in the extensible markup language used on the Internet—to include data specific to its industry. The schema might indicate, for example, that the information being shared is an EPCIS document related to an FMCG company and includes XML tags for “event time” (when an RFID transponder was read), the EPC number or numbers, “location” (a Global Location Number or Serialized Global Location Number; both are existing UCC standards for identifying business locations), “business step” (such as shipping, receiving at a retail distribution center or shelf replenishment) and “disposition” (available for sale or in transit).

In September, the Data Exchange Working Group launched the first live trial in which EPC data is being exchanged over the Internet. Wal-Mart and Target are pushing information in this standardized format to 13 of their suppliers. They are using AS2 to exchange information over the Internet because EPCglobal’s EPCIS framework doesn’t exist yet. But they believe the pilot can help to determine what value both suppliers and retailers could get from sharing the data. That is, could the retailers and manufacturers use the standardized data to improve replenishment of products, reduce out-of-stocks and streamline their business processes? (Once the EPCIS standards are finalized, the trial will likely move to the EPCglobal Network.)

The HLS business action group has examined its supply chain from end to end and developed 42 use cases (many are similar to those developed by the FMCG group) around forward logistics, including tracking pharmaceuticals that must be kept refrigerated. It’s now formulating requirements for EPCIS implementations in the pharmaceutical industry. “Industry knowledge is not embedded in the EPCIS standard,” says Bob Celeste, director of product management for EPCglobal US, “but any industry can use the standard for its needs.”

Exploring the Benefits

Some companies are eager to learn how the EPCglobal Network might benefit their operations, so they are not waiting for the EPCIS standards to be finalized. Either they are running pilots that use the basic network components—EPC tags, interrogators and ALE—or they are simulating the network’s function to see what data needs to be exchanged and how often, to create business value across the supply chain.

The University of Florida’s Center for Food Distribution and Retailing (CFDR) is running a pilot with Publix, a supermarket chain in the southern United States. Del Monte Fresh Produce will tag shipments of pineapples in Florida. Duda & Sons will tag celery in Florida, and Tanimura & Antle will tag shipments of cauliflower in California. The tags will be interrogated as they leave the suppliers’ facilities, and again when they arrive at Publix‘s Lakeland, Fla., distribution center, which has been outfitted with four RFID portals.

Data will be shared over a network hosted by VeriSign. “Our goal is to see what are the challenges to moving all the information between the players,” says Jean-Pierre Emond, codirector of CFDR and the lead investigator of the pilot. “The second part is to see what kind of value people can realize by sharing data and creating visibility of the flow of goods.”

Tagging began in October, and Emond expects to have the initial results by year’s end, but the trial will be ongoing. It will examine what data needs to be shared among retailers and suppliers of perishable products. For instance, can EPC data and other information be used to maximize sales when a retailer expects shipments but several days of rain delay the picking of fruit?

Procter & Gamble (P&G) and Gillette (which was recently acquired by P&G and is now one of its divisions) are participating in an eight-month trial in Australia that is supported by the Australian Food and Grocery Council (AFGC). Tagged goods will be monitored to determine what benefits can be derived from identifying and tracking shipments in a supply chain and sharing information with retail partners.

One of the most ambitious projects is being undertaken in Asia, where the government of Hong Kong put up HK$14 million (US$1.8 million) to develop the EPCglobal Network infrastructure needed to track goods manufactured in southern China’s Pearl River Delta as they pass through the border checkpoint between Shenzhen and Hong Kong, onto ships at the port of Hong Kong and finally to their destination overseas. This will be one of the first large-scale deployments of the EPCglobal Network.

The project began in April and will take two years to complete. The reason the group is building out the network infrastructure before the standards are complete is that EPCglobal Hong Kong wants to get input from end users on how they will use the network and what their requirements will be. This information will be communicated to the EPCglobal groups working on the standards and on an overall architecture for the network.

“The findings from our project will help drive the direction of standards development, as well as the EPCglobal Network architecture, in a more industry-focused way,” says Anna Lin, chief executive of EPCglobal Hong Kong. “It will also help standards developers give consideration to regional business practices in the United States, Europe, Asia and other areas, which might deploy the network architecture in different ways.”

Once the EPCIS standards are complete, companies will be able to share data over the EPCglobal Network, but there are issues that remain. What network protocols will be used to allow an EPCIS run by one company to exchange information with an EPCIS run by another? What security-access control and authentication mechanisms will EPCISs use to protect confidential data? How will an EPC tag be tracked from one EPCIS to another to another for the purposes of track and trace? How will EPCIS interface with EDI networks and global data synchronization networks to retrieve product data? How will the network efficiently manage massive amounts of data moving among many suppliers and many retailers simultaneously?

“Based on the overall vision of creating an Internet of Things, we’re still in the early phases of proving out what this network should look like and how it will be adopted by different industries,” says Stephen Miles, who leads the Auto-ID Network Research special interest group (SIG) at the MIT Auto-ID Lab.

EPCglobal has appointed Miles’ group to investigate and test scenarios for many-to-many EPC communications. Among the specific issues the SIG is researching are security, scalability, reliability and interoperability for applications, including track and trace and electronic pedigree. The SIG’s research findings, including real-world pilot data, could be used to develop future standards for the EPCglobal Network.

The group is using a software simulation tool built for the U.S. Department of Homeland Security to model the entire public infrastructure of the United States. John Williams, director of the MIT Auto-ID Lab and Miles’ colleague, led the creation of the simulation model, which harnesses the power of many computers linked in a grid and integrates data from many sources using Web services. The goal was to determine the impact of a terrorist attack on one element of the public infrastructure, such as the phone system or the Internet.

This powerful tool will be used to develop a model of the EPCglobal Network. It will simulate EPCISs, reflecting companies’ data exchange requirements. The idea is to anticipate the growth in data over the network, simulate different implementation models that may be proposed in the EPCglobal standardization process and determine where choke points might occur. The SIG will then provide the results of those tests to the appropriate EPCglobal standards groups, so they can determine how best to design the interfaces so that the EPCglobal Network can support the many-to-many communication of EPC data.

Miles’ SIG includes technology vendors and end user companies, such as Altria Group, the parent company of Kraft Foods and Philip Morris. “The objective in the early stages is to get visibility into the EPC data we currently have and to help EPCglobal validate its EPCIS and data exchange standards,” says Brian Schulte, director of data and information management at Altria. “By next year, we would like to test application scenarios and at the same time help EPCglobal and the Auto-ID Labs harden message-level standards over the EPCglobal Network. We expect to do this with other companies so we can share information.”

The Road to Adoption

The software standards will enable vendors to create applications that run on the EPCglobal Network, including feedlot tracking, asset management, promotions management and a broad range of track-and-trace applications for locating products in manufacturing facilities and warehouses and in transit.

One of the most eagerly anticipated track-and-trace applications is the electronic pedigree—a complete digital record of the movement of drugs from pharmaceutical manufacturers to distributors and wholesalers to final sale to pharmacies, hospitals or clinics. Laws in several U.S. states, Italy and elsewhere require a paper pedigree for drugs in the retail and hospital supply chains, and e-pedigrees could greatly reduce the paperwork and manual labor. The HLS business action group is looking at the business requirements for creating an e-pedigree. The technical requirements will have to be worked out and standards will need to be agreed on before such a system can become a reality, but the first proof-of-concept trials are likely to begin next year.

Only EPCglobal subscribers will be able to access and use the EPCglobal Network. Subscriber fees are based on each company’s revenue, and range from $750 to $200,000 for an initial fee. The annual renewal fee is 20 percent of the initial fee. How many companies sign on to use the network will likely depend on how secure, reliable and robust the system is. It will also depend on how much value the network creates for companies. If the major players in an industry agree to share data in a standard format over the EPCglobal Network, it will likely be cost-effective for suppliers to sign up. Suppliers might even be required to share data via the EPCglobal Network.

The value of the network will depend on whether the applications that run on it for the sharing of data deliver benefits to multiple parties across the supply chain. “The RFID industry still has to demonstrate the ROI from EPCglobal Network technologies,” says Miles. “That’s not a foregone conclusion. To a major manufacturer, it looks like an awful lot of cost, and getting data from different parts of the same company—never mind from trading partners—is a real challenge. The only way to get from here to there is by exchanging the data. The good news is that the data exchange is starting in a very real way.”

It’s All About Applications

Software vendors are not waiting for EPCglobal Network standards to be finalized. They’ve been developing applications that will take advantage of Electronic Product Code data and the ability to share it over the network. OAT Systems, an RFID software startup, has developed applications for managing and analyzing RFID data. Gillette analyzed EPC data from a retail partner and found that better promotions management could lead to a 48 percent increase in sales. It plans to launch a pilot using OAT’s software early next year to determine when product is not being moved from the back of a store to the shelves and then work with the retailer to correct the situation. The potential benefits for large manufacturers could be tens of millions of dollars annually, says Marc Osofsky, OAT’s vice president, marketing and product management.

Gillette will not use the EPCglobal Network to share data initially, but the company sees applications such as promotions management moving to the network over time. “We don’t see the EPCglobal Network as being critical in the short term,” says Jamshed Dubash, director of Auto-ID technology for Gillette. “Working with only a handful of partners, we can manage the sharing of data the way we are right now. As adoption scales, sharing data over the network becomes more and more critical.”

TrueDemand Software, another startup, has developed software applications that combine conventional forecasting models with data from EPC systems to try to better predict impending out-of-stocks and better manage promotions and product introductions. They’re designed to take advantage of EPC data shared over the EPCglobal Network (or the Internet, until standards are final).

Today, manufacturers use retailers’ orders and point-of-sale data to forecast demand. But when a retailer places an order for a certain amount of soft drink or liquid detergent, the manufacturer typically takes a week to send replenishments to the store. The manufacturer doesn’t know whether the retailer has one day’s or one week’s inventory on hand, so it can’t respond to a potential out-of-stock situation.

Manufacturers that receive near-real-time EPC data from retail partners will be able to use TrueDemand applications to respond more quickly to demand at individual stores. By monitoring what cases a retailer shipped from a distribution center to specific stores and which cases were consumed, the manufacturer knows what inventory is on hand in the store. The software also uses the consumption of cases and POS data to forecast retail replenishment orders more accurately, so the manufacturer is better able to allocate goods to fulfill the orders that come in.

Securing Data on the EPCglobal Network

Security is likely to emerge as a major issue that needs to be resolved before companies start sharing data over the EPCglobal Network. “It will be in the interest of all trading partners that we have a highly secure exchange of data,” says Brian Schulte, director of data and information management at Altria Group. “Things like new product launches and promos will be very sensitive. We have to ensure that we have a rock-solid security mechanism in place, and we’re working toward that.”

Companies, of course, will be responsible for securing their own databases behind a firewall. As the EPC Information Services develop, companies will also have to develop ways to manage different levels of access for different trading partners, the way they currently manage access for internal employees. For instance, Unilever might be willing to share inventory levels with its third-party logistics provider, but it might not want to share that data with retailers Metro and Tesco. That’s because knowing inventory levels could give the retailers an upper hand in negotiating prices for Unilever products.

In the future, as the EPCIS matures, access will often be automated. For instance, a retailer’s middleware would request access to a supplier’s database to confirm the Electronic Product Codes on products received. Then the supplier’s system would authenticate the request to ensure that it really is a customer, and not a competitor, who is trying to access the data.

Over the next several months, EPCglobal’s Software Action Group will work to develop methods to protect data on the network. One of the first network services to emerge from the EPCIS standardization process is an X.509-based certificate authority, which will help companies authenticate trading partners on the network. This is an important first step, says Stephen Miles, who leads the Auto-ID Network Research special interest group at the MIT Auto-ID Lab. But he adds that a significant amount of work needs to be done to make the EPCglobal Network as secure as financial services or telecommunications networks.