Abstract:
A mechanism is provided to improve the availability of an ICS and an external system that uses data from the ICS by ensuring operation of the ICS and opera on of the system even if an anomaly has occurred in a device in the ICS. The mechanism receives measured data from the plurality of devices, calculates prediction data by using the measured data and correlation information used for deriving prediction data for correlated devices, and provides the measured data and the prediction data.

Description:
BACKGROUND 
       [0001]    The present invention relates to an industrial control system and, in particular, to a control system, method and program that increase availability of an industrial control system (hereinafter abbreviated as “ICS”). 
         [0002]    ICSs are being used as control systems such as water supply management systems, nuclear power plant control systems and traffic monitoring/control systems, and are playing an important role in supporting social infrastructure such as water and electricity supplies and transportation. The social infrastructure using the ICSs has a great influence on people&#39;s lives. Accordingly, a much greater availability is required of the ICSs than is required of ordinary IT systems. 
         [0003]    In the past, ICSs were isolated from external networks such as the Internet and other ICSs. However, in recent years, ICSs have been connected onto an external network so that multiple external systems use information from devices managed by the ICSs. Consequently, the ICSs have become vulnerable to attacks, such as malware attacks, through the external networks and there has been a growing demand for more enhanced availability of ICSs. 
         [0004]    One example of an ICS is a computing system disclosed in Patent Literature 1, which determines estimated average speed information of a vehicle traveling on a road on the basis of data samples reflecting the travel on the road. In the computing system, multiple sensors are embedded in the road and traffic data samples are obtained from these sensors to determine the average speed of the vehicle. 
         [0005]    Patent literature:
       National Publication of international Patent Application No. 2009-529187       
 
       SUMMARY 
       [0007]    The computing system described in National Publication of International Patent Application No. 2009-529187 obtains data samples from the multiple sensors disposed close to each other for obtaining data of the same type in order to ensure fault tolerance through the complementary use of the data samples, However, if a network failure is caused by a network attack as described above or other events, data samples can be obtained from none of the sensors connected onto the network and data samples cannot be corrected. 
         [0008]    Furthermore, if another, external system is using data samples from the computing system disclosed National Publication of International Patent Application No. 2009-529187, the availability of the external system can be impaired by the vulnerability of the computing system. 
         [0009]    The present invention solves the problems and an object of the present invention is to provide a control system, method and program that ensure operation of an industrial control system (ICS) and external system that uses data from the ICS if an anomaly occurs on the devices or the networks included in the ICS, thereby improving the availability of the ICS and the system. 
         [0010]    According to the present invention, there is provided a control system for processing data from a plurality of devices connected onto a network. The control system receives measured data from the plurality of devices, calculates prediction data by using the measured data and correlation information used for deriving prediction data for correlated devices, and provides the measured data and the prediction data. According to the present invention, the availability of the control system or the external system that uses the control system can be improved because data measured from correlated devices can be used to calculate prediction data for the devices which data cannot be correctly retrieved due to an anomaly of the devices, network or the control system. 
         [0011]    Furthermore, according to the present invention, the installation costs of sensors can be reduced and the robustness against network attacks such as malware attacks can be improved because correlated sensors of different types are connected onto separate individual networks in the ICS, and measured data from the sensors of different types are used to calculate prediction data, and sensors of the same type do not need to be redundantly installed. 
         [0012]    The present invention can provide a method and program that calculate and provide prediction data for correlated devices connected onto individual networks in the ICS to improve the availability of an ICS. 
     
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
         [0013]    Embodiments of the present invention will now be described by way of example with reference to the accompanying drawings in which like references denote similar elements, and in which: 
           [0014]      FIG. 1  is a diagram illustrating a control system according to an embodiment; 
           [0015]      FIG. 2  is a diagram illustrating an embodiment in which the control system of the present invention is applied to a nuclear power plant control system; 
           [0016]      FIG. 3  is a diagram illustrating a functional configuration of an analysis server of the present embodiment; 
           [0017]      FIG. 4  is a flowchart illustrating an embodiment if a process performed by the analysis server of the present embodiment; 
           [0018]      FIG. 5  is a diagram illustrating one embodiment of a data table storing measured data and prediction data in the present embodiment; and 
           [0019]      FIG. 6  is a diagram illustrating one embodiment of the data table storing measured data and prediction data in the present embodiment. 
       
    
    
     DETAILED DESCRIPTION 
       [0020]    The present invention will be described with respect to embodiments thereof. However, the present invention is not limited to the embodiments described below. 
         [0021]      FIG. 1  is a diagram illustrating a control system  100  of an embodiment. The control system  100  is connected to an industrial control system (ICS) that includes a global gateway  110 , ICS gateways  112 ,  114  and  116 , and sensors  120 ,  121 ,  122 ,  123 ,  124   125 ,  126  and  127  connected to the ICS gateways, and an analysis server  130 . In the control system of the present embodiment, data communication is performed among the devices in the control system  100  through the use of the system&#39;s own protocol. In another embodiment, data communication in the control system  100  may be performed through the use of a generally used protocol. 
         [0022]    The global gateway  110  is a communication device provided in an upper network layer above the network layer formed by the ICS gateways  112 ,  114  and  116 . The global gateway  110  provides data communication between the analysis server  130  and external systems and external devices connected onto an external network  140  such as the Internet or a WAN (Wide Area Network). 
         [0023]    The ICS gateways  112 ,  114  and  116  are communication devices that obtain data actually measured by the sensors  120  to  127  connected to the ICS gateways (hereinafter the data will be referred to as “measured data”) from the sensors and provide the measured data to the analysis server  130 . The ICS gateways  112 ,  114  and  116  form individual networks with the sensors connected. 
         [0024]    The sensors  120  to  127  sense various conditions, substances, and phenomena such as humidity, temperature, light intensity, radiation, water, the speed of an object, electric current and voltage and may be any of various sensors such as temperature, motion, humidity, radiation, water, speed, electric current, voltage, and light intensity sensors. In the control system  100 , different types of sensors in a certain correlation such as being located physically in a close distance from each other (for example the sensors  120  and  121 , the sensors  122  to  124 , and the sensors  125  and  126 ) are connected onto different ICS gateway networks. The sensors  120  to  127  provide their measured data to the analysis server  130  through their respective ICS gateways  112 ,  114  and  116 . 
         [0025]    The analysis server  130  is an information processing apparatus that collects measured data from the sensors in the control system  100 , generates data for a sensor predicted from the measured data from another sensor (hereinafter referred to as “prediction data”) among correlated sensors, and provide the data. The analysis server  130  checks whether an anomaly has occurred in the control system  100  and provides the result of the check. Furthermore, when the analysis server  130  receives a request to send measured data and prediction data from a gateway in the control system  100 , the analysis server  130  determines whether or not the sender of the request has the authority to obtain the data, and provides the data to the sender of the request that has the authority to obtain the data. 
         [0026]    The analysis server  130  executes a program of the present invention written in a program language, such as an assembler language, C, C++, Java (registered trademark), JavaScript (registered trademark), PERL, PHP, RUBY, or PYTHON, under the control of an OS such as a Windows-series program such as Windows (registered trademark) 7, Windows Vista (registered trademark), Windows XP (registered trademark) and Windows 200X Server (registered trademark), or Mac OS (registered trademark), UNIX (registered trademark), LINUX (registered trademark), or Google Chrome OS. 
         [0027]    The analysis server  130  includes a RAM providing an execution space for executing the program of the present invention and a hard disk drive (HDD) for persistently holding programs and data. By executing the program of the present invention, functions of the present embodiment, which will be described later, are implemented on the analysis server  130 . The functional units of the present embodiment can be implemented by a machine-executable program written in any of the program languages enumerated above. The program of the present invention can be stored and distributed on a machine-readable recording medium such as an HDD, CD-ROM, MO, flexible disk, EEPROM, or EPROM and can be transmitted in a format readable to other devices through a network. 
         [0028]    While the embodiment illustrated in  FIG. 1  is a control system which is applied to a single ICS system, the present invention can be configured as an external system that uses data from a plurality of ICS systems in alternative embodiment. 
         [0029]      FIG. 2  illustrates an embodiment in which the control system of the present invention is applied to a nuclear power plant control system. While the present invention will be described with the embodiment of the nuclear power plant control system, the present invention is not limited to this embodiment; the present invention can be applied to other ICSs such as water supply management systems and traffic monitoring/control systems. 
         [0030]    The control system  200  illustrated in  FIG. 2  includes an analysis server  130 , a global gateway  210 , ICS gateways  222  and  224 , and a nuclear power system  230 . The nuclear power system  230  includes a nuclear reactor vessel  232 , a turbine  234 , and an electrical generator  236 . Various types of sensors  242 ,  244 ,  246  and  248  are provided in the nuclear power system  230 . 
         [0031]    A pressure sensor  242  for measuring the pressure in the nuclear reactor vessel  232  is provided in the nuclear reactor vessel  232 . A temperature sensor  244  and a humidity sensor  246  for measuring the temperature and humidity in an outlet pipe  240  are provided in the outlet pipe  240  of a steam generator  238  in the nuclear reactor vessel  232 . A motion sensor  248  that detects a human entering the nuclear power system  230  is provided near the electrical generator  236 . 
         [0032]    The pressure sensor  242  and the temperature sensor  244  are connected to the ICS gateway  222  and the humidity sensor  246  and the motion sensor  248  are connected to the ICS gateway  224 . In the present embodiment, the temperature sensor  244  and the humidity sensor  246  measure the temperature and humidity, respectively, in the outlet pipe  240  that depend on the same steam fed into the outlet pipe  240  and accordingly these sensors are strongly correlated with each other. Therefore, the temperature sensor  244  and the humidity sensor  246  are connected to the networks  250  and  252 , respectively, formed by the different ICS gateways  222  and  224 , respectively. 
         [0033]    In the embodiment illustrated in  FIG. 2 , the sensors send their measured data to the analysis server  130  through the ICS gateways  222  and  224  at regular intervals. When the ICS gateways  222  and  224  receive measured data from a sensor, the ICS gateways  222  and  224  add information that can uniquely identify the sensor (hereinafter referred to as “sensor identification information”) to the measured data and sends the data to the analysis server  130 . In the present embodiment, a combination of information that can uniquely identify the ICS gateway (hereinafter referred to as “ICS gateway identification information”) and the port number of the ICS gateway to which a sensor is connected can be used as the sensor identification information. In an alternative embodiment, the sensors may send measured data in response to a request from the analysis server  130  and any sensor identification information may be used that can uniquely identify each sensor. 
         [0034]      FIG. 3  illustrates a functional configuration of the analysis server  130  of  FIG. 2  of the present embodiment. The analysis server  130  includes a transmitting and receiving unit  302 , a control unit  304 , a prediction data calculating unit  306 , a data storing unit  308 , and storage devices  310 ,  312  and  314 . 
         [0035]    The transmitting and receiving unit  302  transmits and receives data between the analysis server  130  and the devices in the control system  200 . The transmitting and receiving unit  302  receives a certain request and measured data measured by the sensors from the global gateway  210  and the ICS gateways  222  and  224 . When the transmitting and receiving unit  302  receives the request, the transmitting and receiving unit  302  notifies the control unit  304  of the reception of the request. The transmitting and receiving unit  302  sends and provides measured data, prediction data and the result of check, which will be described later, to a requesting device such as the global gateway  210 . The transmitting and receiving unit  302  performs data communication with the global gateway  210  and the ICS gateways  222  and  224  according to a communication protocol used within the control system  200 . 
         [0036]    The control unit  304  controls the entire analysis server  130 . The control unit  304  calls functional units, which will be described later, to perform various kinds of processing as appropriate according to the types of requests received from the transmitting and receiving unit  302 . 
         [0037]    Specifically, when the control unit  304  receives a request to record measured data from a sensor in the control system  200 , the control unit  304  calls the data storing unit  308  to cause the data storing unit  308  to store the measured data in the storage device  312 . The control unit  304  calls the prediction data calculating unit  306  to cause the prediction data calculating unit  306  to calculate prediction data corresponding to the measured data and calls the checking unit  316  to cause the checking unit  316  to check whether an abnormal condition has occurred in the control system  200 . 
         [0038]    When the control unit  304  receives a request to send measured data and prediction data, the control unit  304  calls an access control unit  318  to cause the access control unit  318  to determine whether or not the requester has the authority to obtain the data. 
         [0039]    The prediction data calculating unit  306  uses measured data stored in the storage device  312  and correlation information stored in the storage device  310  to calculate prediction data. The correlation information is information used for calculating prediction data for correlated sensors and may be a formula for calculating prediction data for each sensor. The predication data calculation formula is a formula such as a multiple regression model or a VAR (Vector Auto Regression) model derived by multivariate recurrence analysis such as multiple regression analysis or VAR on the basis of past sensor data from the sensors of the control system that are operating properly. In the present embodiment, the prediction data formula can use an objective variable such as (1) measured data from a correlated sensor, (2) prediction data for a correlated sensor, and (3) one or more previous pieces of measured data from a sensor for which prediction data are to be calculated. 
         [0040]    The correlation information stored in the storage device  310  can be updated with time as the control system is operated. The accuracy of prediction data can be improved with time by using more up-to-date correlation information. 
         [0041]    The data storing unit  308  stores measured data and prediction data of the sensors in the control system  200  in the storage devices  312  and  314  along with the time at which the measured data and prediction data were obtained or stored. The measured data and prediction data will be described later in detail with reference to  FIGS. 5 and 6 . 
         [0042]    The analysis server  130  includes the checking unit  316 , the access control unit  318 , the storage device  320  and an authentication information database  322 . 
         [0043]    The checking unit  316  checks whether an anomaly has occurred in the control system  200 . The checking unit  316  uses measured data received from sensors, prediction data calculated by the prediction data calculating unit  306  and an error event to check whether a failure has occurred in a device or on a network in the control system  200 . 
         [0044]    Specifically, when the checking unit  316  has not received measured data that it Should have received from a sensor at regular intervals, the checking unit  316  can determine that a failure has occurred in the sensor that should have generated or sent the measured data not received, or a network device such as a network cable or an ICS gateway that is connected to the sensor. 
         [0045]    In this case, the checking unit  316  stores setting information in which sensor identification information of senders from which measured data are received at regular intervals is written in a storage device in advance and compares sensor identification information added to measured data actually received with the sensor identification information contained in the setting information. If measured data having the sensor identification information contained in the setting information have not been received, the checking unit  316  can determine that a failure has occurred in the sensor identified by the sensor identification information or a network device connected to the sensor. Alternatively, if a failure has occurred in a sensor, the sensor or the ICS gateway may issue an error event and the checking unit  316  may detect the occurrence of the failure through the error event. 
         [0046]    Furthermore, if measured data have not been received from multiple sensors that are connected to the same ICS gateway, the checking unit  316  can determine that a failure has occurred in the ICS gateway or a network device such as a cable. In this case, the checking unit  316  compares sensor identification information contained in the setting information described above with sensor identification information added to actually receive measured data. If multiple pieces of measured data have not been received and the checking unit  316  determines, from the ICS gateway information contained in the sensor identification information, that the measured data not received should have been sent from the same ICS gateway, the checking unit  316  can determine that a failure has occurred in the ICS gateway or a network device such as a cable. Alternatively, if a failure has occurred in a network device, the ICS gateway may issue an error event and the checking unit  316  may detect the occurrence of the failure through the error event. 
         [0047]    Furthermore, if a measured data sample received from a sensor is abnormal, the checking unit  316  can determine that a failure has occurred in the sensor. In this case, the identification information of each sensor is associated with an acceptable range of its measured data and is stored in a storage device as setting information in advance. The checking unit  316  can refer to the setting information and determine whether measured data received from a sensor are in the acceptable range associated with the sensor identification information added to the measured data to determine whether or not the measured data are abnormal. Alternatively, the checking unit  316  can compare measured data received from a sensor with prediction data calculated by the prediction data calculating unit  306  that corresponds to the measured data and, if the difference between the data is beyond a predetermined acceptable range, the checking unit  316  can determine that the measured data are abnormal. 
         [0048]    The checking unit  316  stores the check result indicating which measured data are abnormal in the storage device  320 . In the present embodiment, the sensor identification information of the sensor from which the measured data found to be abnormal was received and the date and time of the measured data are used as the result of check. The result of check is provided to a device such as the ICS global gateway that has requested the measured data and prediction data along with the measured data and the prediction data. The requesting device can refer to the result of check to determine which of measure data are abnormal and can selectively use either the measured data or the prediction data according to its policy. 
         [0049]    While the checking unit  316  is configured as functional means in the analysis server  130  in the present embodiment, a control system including a checking server that is an information processing apparatus having the checking function may be configured in other embodiments, instead of providing the functional means in the analysis server  130 . 
         [0050]    In this case, the checking server can obtain measured data and prediction data from the analysis server or can obtain measured data from an ICS gateway and obtain prediction data from the analysis server and can use the measured data and the prediction data as well as the setting information described above to determine whether or not an anomaly has occurred in the control system  200 . Alternatively, when a failure occurs in a sensor or a network device, the sensor or ICS gateway may issue an error event and the checking server may detect the occurrence of failure as described above. Alternatively, if the analysis server has not received measured data that it should have, the analysis server may notify the checking server of that fact and the checking server may detect the occurrence of failure through the notification. The checking server provides the result of the check to the analysis server  130 . 
         [0051]    The access control unit  318  determines whether or not the sender of a request to send measured data and prediction data has the authority to obtain the data. In the present embodiment, the ICS global gateway and the ICS gateways in the control system  200  may request measured data and prediction data. These devices send their own identification information, that is, global gateway identification information and ICS gateway identification information, along with the requests. 
         [0052]    The access control unit  318  can refer to the authentication information database  322  in which the ICS global gateway identification information, the ICS gateway identification information and information indicating whether the ICS global gateway or the ICS gateways identified by the identification information have the authority to obtain data to determine whether the requesting device has the authority to obtain the measured data and the prediction data. 
         [0053]    While correlation information, measured data, prediction data, the result of check, and the authentication information database are stored in the storage devices in the analysis server  130  in the embodiment illustrated in  FIG. 3 , these items of information may be stored on an external storage device accessible to the analysis server  130  in an alternative embodiment. 
         [0054]      FIG. 4  is a flowchart illustrating an embodiment of a process performed at the analysis server of the present embodiment. The process performed at the analysis server  130  will be described below with reference to  FIG. 4 . 
         [0055]    The process in  FIG. 4  starts with step S 400 . At step S 401 , the control unit  304  of the analysis server  130  determines whether it has received a request from a device in the control system  200 . If not, (no), step S 401  is repeated to wait for a request. On the other hand, if the control unit  304  determines that it has received a request (yes), the process proceeds to step S 402 . 
         [0056]    At step S 402 , the control unit  304  determines the type of the request received. If the control unit  304  determines that the request is a request to record measured data, the process proceeds to step S 403 . The control unit  304  calls the prediction data calculating unit  306 , which then uses correlation information stored in the storage device  310  and measured data received along with the record request to calculate prediction data corresponding to the measured data. At step S 404 , the control unit  304  calls the data storing unit  308 , which then stores the received measured data and the prediction data calculated by the prediction data calculating unit  306  in the storage devices  312  and  314 . 
         [0057]    At step S 405 , the control unit  304  calls the checking unit  316 , which then checks whether an anomaly has occurred in the control system  200 . At step S 406 , the checking unit  316  stores the result of the check in the storage device  320  and then the process returns to step S 401 . 
         [0058]    On the other hand, if it is determined at step S 402  that the type of the received request is a request to send measured data and prediction data, the process proceeds to step S 407 . At step S 407 , the control unit  304  calls the access control unit  318 , which then determines whether or not the sender of the request has the authority to obtain the data. If the sender does not have the authority (no), then the process returns to step S 401 . On the other hand, if the sender of the request has the authority (yes), the process proceeds to step S 408 . At step S 408 , the control unit  304  obtains the measured data, the prediction data and the result of the check from the storage devices  312 ,  314  and  320  and sends these items of data to the sender of the request. Then the process returns to step S 401 . 
         [0059]    While the control unit  304  in the present embodiment sends measured data and prediction data to the request sender without merging these items of data, the control unit  304  may replace measured data that cannot be obtained or the prediction data which are abnormal with corresponding prediction data and merge the data and may send the merged data. In this case, the requesting device can refer to the result of check received along with the merged data to determine which measured data have been replaced with prediction data. 
         [0060]    While prediction data are calculated when a request to record measured data is received in the present embodiment, the analysis server  130  may calculate prediction data when the checking unit  316  or checking server detects an anomaly in a sensor or a network device through reception of an error event as described above or by not having received measured data. In this case, the analysis server  130  sends the result of the detection to the sender of the request along with the measured data and the prediction data. 
         [0061]      FIGS. 5 and 6  show embodiments of data tables in which measured data and prediction data of the present embodiment are stored. Data tables  510 ,  520 ,  610  and  620  will be described below with reference to  FIGS. 5 and 6 . 
         [0062]    The data table  510  is a data table in which measured data from the sensors of the control system  200  are stored. The data table  510  is built in a storage device accessible to the analysis server  130 . The date and time on which measured data were obtained or stored is recorded in a date and time data field  511  of the data table  510 . Measured data from the pressure sensor  242 , the temperature sensor  244 , the humidity sensor  246  and the motion sensor  248  are recorded for each date and time in data fields  512 ,  513 ,  514  and  515  for the sensors. 
         [0063]    The data table  520  is a data table in which prediction data calculated by the analysis server  130  are stored. The data table  520  is built in a storage device accessible to the analysis server  130 . As in the data table  510 , the date and time on which prediction data were calculated or stored is recorded in the date and time data field  521  of the data table  520  and prediction data for the pressure sensor  242 , the temperature sensor  244 , and the humidity sensor  246  are recorded for each date and time in data fields  522 ,  523  and  524  for the sensors. 
         [0064]    In the embodiment illustrated in  FIG. 5 , the temperature sensor  244  and the humidity sensor  246  are in a strong correlation and prediction data calculated using measured data from the correlated sensors are recorded in the data fields of these sensors. For example, prediction data (temperature “28.1° C.”) for the temperature sensor  244  on the date and time “2011/1/11 10:10” can be calculated by using correlation information including, as an objective variable, a measured data sample (humidity “60%”) that was measured by the humidity sensor  246  correlated with the temperature sensor  244  on that date and time. Similarly, a prediction data sample (humidity “61%”) for the humidity sensor  246  on the date and time “2011/1/11 10:10” can be calculated by using correlation information including, as an objective variable, a measured data sample (humidity “28.2° C.”) that was measured by the temperature sensor  244  on that date and time. 
         [0065]    Furthermore, a prediction data sample (pressure “980 hPa”) for the pressure sensor  242  on the date and time “2011/1/11 10:10” may be calculated by using correlation information including, as objective variables, measured data (temperature “28.2° C. and humidity” 60%) measured by the temperature sensor  244  and the humidity sensor  246  on that date and time. 
         [0066]    The data tables  610  and  620  shown in  FIG. 6  are data tables resulting from recording additional measured data and prediction data in the data tables shown in  FIG. 5 . 
         [0067]    In the data table  610 , measured data of temperature sensor  244  from “2011/1/11 10:40” to “2011/1/11 11:00” are not recorded. This shows that an anomaly has occurred in the control system and measured data could not be obtained from the temperature sensor. In the data table  620 , on the other hand, prediction data for the temperature sensor  244  calculated by using measured data measured by the humidity sensor  246  at those dates and times are recorded. Prediction data for the humidity sensor  246  at those dates and times can be calculated by using correlation information including prediction data for the temperature sensor  244  at those dates and times as objective variables, instead of correlation information including measured data of the temperature sensor  244  at those dates and times as objective variables. 
         [0068]    While measured data and prediction data are stored in the form of a data table in the embodiment illustrated in  FIGS. 5 and 6 , the measured data and the prediction data may be written and stored in a log or a journal. 
         [0069]    While the foregoing has described the present embodiments, it should be understood that the present invention is not limited to the embodiments described above. Changes such as modifications and omissions of functional means of the embodiments and addition of other functional means to the embodiments that will occur to those skilled in the art can be made within the scope of the present invention. Any embodiments that have the functions and effects of the present invention are included in the scope of the present invention. 
       DESCRIPTION OF SYMBOLS  
       [0070]      100  . . . Control system 
         [0071]      110  . . . Global gateway 
         [0072]      112 ,  114 ,  116  . . . ICS gateway 
         [0073]      120 - 127  . . . Sensor 
         [0074]      130  . . . Analysis server 
         [0075]      140  . . . External network 
         [0076]      200  . . . Control system 
         [0077]      210  . . . Global gateway 
         [0078]      222 ,  224  . . . ICS gateway 
         [0079]      230  . . . Nuclear power system 
         [0080]      232  . . . Nuclear reactor vessel 
         [0081]      234  . . . Turbine 
         [0082]      236  . . . Electrical generator 
         [0083]      238  . . . Steam generator 
         [0084]      240  . . . Outlet pipe 
         [0085]      247  . . . Pressure sensor 
         [0086]      244  . . . Temperature sensor 
         [0087]      246  . . . Humidity sensor 
         [0088]      248  . . . Motion sensor 
         [0089]      250 ,  252  . . . Network