DEVICE, COMPUTING PLATFORM AND METHOD OF ANALYZING LOG FILES OF AN INDUSTRIAL PLANT

Abstract

Device, Computing Platform and Method of Analyzing Log Files of an Industrial Plant are disclosed. The method including: determining at least one block in log entries of the log files, wherein the log entries includes one or more log messages and wherein the block represents co-occurring log messages; annotating the co-occurring log messages of the block using semantic metadata, wherein the semantic metadata defines one or more message types for the co-occurring log messages, wherein the semantic metadata is indicative of at least one of a start action, an end action, a source, an anomaly, a cause and an inspect action; generating a coherent representation for the block by representing the co-occurring log messages in a graph based on the semantic metadata; and enabling detection of at least one event in the block based on a comparison the coherent representation with template representations of predefined events associated with the industrial plant.

Claims

1. A method of analyzing one or more log files of an industrial plant, the method comprising: determining at least one block in log entries of the log files, wherein the log entries comprises one or more log messages and wherein the block represents co-occurring log messages; annotating the co-occurring log messages of the block using semantic metadata, wherein the semantic metadata defines one or more message types for the co-occurring log messages, wherein the semantic metadata is indicative of at least one of a start action, an end action, a source, an anomaly, a cause and an inspect action; generating a coherent representation for the block by representing the co-occurring log messages in a graph based on the semantic metadata; and enabling detection of at least one event in the block based on a comparison the coherent representation with template representations of predefined events associated with the industrial plant; wherein generating a coherent representation for the block by representing the co-occurring log messages in a graph based on the semantic metadata comprises: defining a graph-structure of the graph based on the semantic metadata, wherein the graph-structure comprises a block identifier, a node for each of a plurality of phrases and associated edge with the semantic metadata; and generating the coherent representation for the block based on the graph-structure.

2. The method of claim 1, further comprising: predicting an event priority of the detected event based on priority associated with a comparable template representation of the template representations.

3. The method of claim 1, further comprising: inspecting at least one of the co-occurring log messages when the annotated semantic metadata is the inspection action, wherein the inspection is performed using a digital twin of the industrial plant, wherein the digital twin is a digital representation of the industrial plant in real-time.

4. The method of claim 1, further comprising: detecting an anomalous log message in the log files of the industrial plant based at least on associated semantic metadata; and predicting an industrial event and associated event priority based on a template representation of an anomalous block.

5. The method of claim 4, further comprising: inspecting the anomalous log message when the associated semantic metadata is the inspection action, wherein the inspection is performed at least partially through manual validation by an expert associated with the industrial plant.

6. The method of claim 1, further comprising: receiving the log entries of the log files based on a common structured representation, wherein the common structured representation of the log entries comprises at least of timestamps and the log messages, and a source identifier; creating one or more batches of the log entries using a sliding window of a predetermined temporal size; identifying a plurality of co-occurring log messages based on pattern frequency analysis of the batches, wherein the plurality of co-occurring log messages comprises the co-occurring log messages of the at least one block; and determining one or more blocks in the log entries by identifying separable co-occurring log messages in the plurality of co-occurring messages, wherein the separable co-occurring log messages are determined as separate blocks and wherein the one or more blocks comprises the at least one block.

7. The method of claim 6, wherein identifying a plurality of co-occurring log messages based on pattern frequency analysis of the batches comprises: identifying unique log messages in the batches and associated message-frequency, wherein message-frequency is a number of times each unique log message has been identified; ranking the unique log messages based on descending order of the message-frequency; generating a frequency pattern tree for the unique log messages, wherein the frequency pattern tree includes at least one of a path and one or more new branches, wherein the path includes the unique log messages with common prefix and wherein the new branches include unique log messages with no common prefix; and determining the plurality of co-occurring log messages based on the path and the new branches in the frequency pattern tree.

8. The method of claim 7, further comprising generating the template representations for the predefined events in the industrial plant, wherein generating the template representations comprises: identifying at least one co-occurring log messages as a significant block when frequency of the path in the frequency pattern tree is below a frequency threshold; mapping at least one predefined event to the significant block; and generating the template representations for the significant block as a knowledge graph.

9. The method of claim 1, further comprising: generating the semantic metadata based on at least one of an input from an expert, a frequency based data analysis performed on the log files and an ontology associated with the industrial plant.

10. The method of claim 9, wherein annotating the co-occurring log messages of the block using semantic metadata comprises: extracting chunks from the co-occurring log messages in the blocks, wherein the chunks include one or more phrases with a distinct meaning; and annotating the one or more phrases by classifying each phrase according to the semantic metadata using a classification model.

11. The method of claim 2, wherein predicting an event priority of the detected event based on priority associated with a comparable template representation of the template representations comprises: determining the comparable template representation from the template representations based on semantic matching between the semantic metadata in the block with sematic metadata associated with the template representations.

12. (canceled)

13. A computing platform for analyzing one or more log files generated during operation of an industrial plant, the computer platform comprising: at least one device communicatively coupled to the industrial plant via the computing platform, the at least one device comprising a processor and a memory unit, wherein the memory unit comprising a log analyzer module configured to determine at least one block in log entries of the log files, wherein the log entries comprises one or more log messages and wherein the block represents co-occurring log messages; annotate the co-occurring log messages of the block using semantic metadata, wherein the semantic metadata defines one or more message types for the co-occurring log messages, wherein the semantic metadata is indicative of at least one of a start action, an end action, a source, an anomaly, a cause and an inspect action; generate a coherent representation for the block by representing the co-occurring log messages in a graph based on the semantic metadata; and enable detection of at least one event in the block based on a comparison the coherent representation with template representations of predefined events associated with the industrial plant; wherein generating a coherent representation for the block by representing the co-occurring log messages in a graph based on the semantic metadata comprises: defining a graph-structure of the graph based on the semantic metadata, wherein the graph-structure comprises a block identifier, a node for each of a plurality of phrases and associated edge with the semantic metadata; and generating the coherent representation for the block based on the graph-structure; wherein the computing platform configured as at least one of an edge computing platform and a cloud computing platform.

14. (canceled)

15. A non-transitory computer readable medium, having machine-readable instructions stored therein for analyzing one or more log files generated during operation of an industrial plant wherein the machine-readable instructions that when executed by a processor cause the processor to: determine at least one block in log entries of the log files, wherein the log entries comprises one or more log messages and wherein the block represents co-occurring log messages; annotate the co-occurring log messages of the block using semantic metadata, wherein the semantic metadata defines one or more message types for the co-occurring log messages, wherein the semantic metadata is indicative of at least one of a start action, an end action, a source, an anomaly, a cause and an inspect action; generate a coherent representation for the block by representing the co-occurring log messages in a graph based on the semantic metadata; and enable detection of at least one event in the block based on a comparison the coherent representation with template representations of predefined events associated with the industrial plant; wherein generating a coherent representation for the block by representing the co-occurring log messages in a graph based on the semantic metadata comprises: defining a graph-structure of the graph based on the semantic metadata, wherein the graph-structure comprises a block identifier, a node for each of a plurality of phrases and associated edge with the semantic metadata; and generating the coherent representation for the block based on the graph-structure;

Description

BRIEF DESCRIPTION OF THE FIGURES

[0034] FIG. 1 depicts a method of analyzing one or more log files of an industrial plant, according to an embodiment.

[0035] FIG. 2 depicts a method determining blocks in log entries of the log file according to an embodiment.

[0036] FIG. 3 depicts application of the method in FIG. 2 to log messages from an industrial plant according to an embodiment.

[0037] FIG. 4 depicts a method of analyzing co-occurring log messages in a block, according to an embodiment.

[0038] FIG. 5 depicts a Graphical User Interface (GUI) for analyzing log messages, according to an embodiment.

[0039] FIG. 6 depicts the GUI for enabling analysis of co-occurring log messages in a block, according to an embodiment.

[0040] FIG. 7 depicts a device and computing platform for analyzing one or more log files of an industrial plant, according to an embodiment.

DETAILED DESCRIPTION

[0041] Hereinafter, embodiments are described in detail. The various embodiments are described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purpose of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more embodiments. It may be evident that such embodiments may be practiced without these specific details.

[0042] FIG. 1 depicts a method 100 of analyzing one or more log files of an industrial plant, according to an embodiment of the present invention. The steps of the method 100 are performed by executing modules 125-155 stored as computer programmable instructions on a computing device/computing platform.

[0043] At step 110, the log files are received. In an example, the log files are received in JavaScript Object Notation (JSON) format. In another example, at step 110 the log files are received in different formats and converted into a common structured representation, such as tabular format.

[0044] The following steps illustrate the steps of the method 100 when the modules 125-155 are executed.

[0045] At step 120, a block suggestion module 125 determines one or more blocks (such as block 122) in log entries of the log files. The log entries include one or more log messages, and the block 122 represents co-occurring log messages (i.e., lines 120-123 of the block 122). In an embodiment, the block suggestion module 125 determines the blocks using a Frequency Pattern Tree (FPT). The method of determining the blocks is described in detail in FIG. 2.

[0046] At step 130, a semantic label suggestion module 135 is annotates the co-occurring log messages of the block 122 using semantic metadata 134. The semantic metadata 134 act like labels that define one or more message types for the co-occurring log messages. The semantic metadata 134 includes the following labels a start action, an end action, a source, an anomaly, a cause and an inspect action. Each of the labels may be indicated visually using color coded scheme to ease visual analysis of the log entries. The annotated block 132 indicates hatched line schemes to illustrate the different semantic metadata 134.

[0047] A basic list of the semantic metadata 134 defined for log message analysis in industrial log files is used when a custom semantic metadata is not generated. For example, Source is annotated to indicate a device, application, threat, path, file. Start or end action is annotated when the words “is starting,” “has started”, “initiated”, “completed”, “finished” and “shut down” is illustrated. Check/Inspection action is annotated when terms like “Initialization status”, “licensing status check”, “is being held in use”, “contains the new values” are detected. Problem and possible Cause is annotated when “failed”, “is missing”, “deleted”, “error”, “unexpected failure”, “set computer in FAULT”, “is not reachable” is detected in the log messages.

[0048] At step 130, the semantic label suggestion module 135 automatically assigns semantic metadata 134 to text passages belonging to the block 122. The semantic metadata 134 serve as additional contextual information for the interpretation of the co-occurring log messages belonging to the block 122. In order to automatically label the block 122 (and other blocks) a machine learning model is trained to identify the semantic metadata 134 relevant to the industrial plant. Accordingly, step 130 may further include training a machine learning model to determine the semantic metadata 134 relevant to the industrial plant.

[0049] In an embodiment, the domain knowledge is extracted from either an ontology of the industrial plant or based on input from experts. For example, the domain knowledge is collected from experts by providing a specially developed user interface that receives input on training examples. In the first phase of the training the expert may highlight words or word groups and assign them a label from a list of predefined semantic metadata. A custom list of predefined semantic metadata is created for each industry/industrial application. This may be done with the help of domain expertise, based on a frequency-based data analysis, or standards/vocabularies already available in the application domain.

[0050] In another embodiment, the semantic metadata 134 is annotated on the block 122 by extracting “chunks”, phrases that have a distinct meaning, from unstructured text in the co-occurring log messages. At step 130 a part of speech (POS) tagging on the block 122 is performed and the chunks are computed. Further, at step 130 semantic labeling task is formulated as a multi-class classification problem on the basis of a phrase/chunk. The classification is performed by the trained machine learning model.

[0051] At step 140, a sequence graph creation module 145 generates a coherent representation 142 for the block 122 by representing the co-occurring log messages in a graph based on the semantic metadata 134. The graph creation module 145 creates the coherent representation 142 for each block of the log entries. The structure of the coherent representation is given by the semantic metadata assigned in step 130.

[0052] To construct the coherent representation for the block 122, the following sub-steps may be performed at step 140. A unique identifier is generated and all phrases/chunks that do not have a semantic label assigned to them get discarded. Further, for every phrase (p) with a semantic metadata(s) a node with name (p) is created with an edge with name (s) as indicated in the coherent representation 142. With the coherent representation 142 unstructured information in the block 122 is in a structured way, not restricting the analysis to a predefined data model. Further, the graph-based representation is easily scalable if new types of log entries appear or if a more complex log file needs to be modeled.

[0053] At step 150, a comparison and labeling module 155 provides for detection at least one event in the block based on a comparison the coherent representation with template representations of predefined events associated with the industrial plant. In an embodiment, the comparison and labeling module 155 is an inference module configured to determine a comparable template representation 152 from the template representations based on semantic matching between the sematic metadata 134 in the block 122 with sematic metadata associated with the template representations and predict the criticality 154 of the event in the block 122. Further, at step 150 an event priority of the detected event is predicted based on priority associated with the comparable template representation 152.

[0054] FIG. 2 depicts a method determining blocks in log entries 110 of the log files from the industrial plant. At step 110 of FIG. 1, the log entries are received by the block suggestion module 125 to determine blocks in the log entries to enable analysis of the log messages in the log entries. The block suggestion module 125 is configured to perform the steps disclosed hereinafter.

[0055] At step 210, a predetermined temporal size of a sliding window is received. In an embodiment, the predetermined temporal size may be determined at step 210. The determination of the temporal size of the sliding window is based on a sampling rate input by a domain expert associated with the industrial plant. For example, the temporal size 20 with overlap 5 is used to sample the log entries. Further, at step 210 batches are created from the log entries using a sliding window.

[0056] At step 220, frequency pattern analysis/mining is performed on the batches to identify a plurality of co-occurring log messages in the log entries. Accordingly, at step 220 unique log messages in the batches are identified and associated message-frequency is determined. The message-frequency is the number of times each unique log message has been identified.

[0057] At step 230, a frequency pattern tree is generated based on the message-frequency. In an embodiment, the frequency pattern tree is generated by ranking the unique log messages based on descending order of the message-frequency. Further, the frequency pattern tree includes a path and/or one or more new branches. The path includes the unique log messages with common prefix and wherein the new branches include unique log messages with no common prefix. As shown in FIG. 2, there are two branches “F” and “c”. An example path will be messages “FEA” which has message-frequency of 3. Another example is “CDZ” with message-frequency of 1.

[0058] In an embodiment, after constructing the frequency pattern tree, the patterns (such as FEA, CDZ) identified are presented to a domain expert for labelling which patterns are significant/meaningful and which ones are insignificant. In an embodiment, a specially developed user interface as shown in FIG. 6 provides for an expert to view examples of the identified patterns. In other words, the expert gets a block of messages that correspond to one of the identified patterns with the option to accept or reject the block. The patterns are presented to the domain expert from the largest to smallest (from the root of the FP-tree downward). If a pattern gets accepted, its sub-patterns have the same frequency, they get discarded. This way, the expert only has to label a subset of all candidate patterns.

[0059] The expert involvement at this stage is optional. At step 240, all identified patterns could be considered significant or a custom frequency threshold could be applied to consider patterns significant that have a higher frequency than the frequency threshold. At step 250 the patterns which satisfy the frequency threshold or which are labeled by the expert are extracted from the frequency pattern tree and stored as significant patterns.

[0060] As used herein “patterns” have the same meaning of blocks according to the present invention. The term pattern is used with reference to the frequency pattern tree. This is to enable a person skilled in the art to draw understanding of how the blocks are determined using the frequency pattern tree.

[0061] In operation the method disclosed in FIG. 2 is applied to log files from an industrial plant. The log messages include event identifiers and event frequency.

[0062] FIG. 3 depicts application of the method in FIG. 2 to log messages from the industrial plant. The block suggestion module 125 is configured to output a combination of the event identifier 310 and the event frequency 320. Accordingly, an analysis of both more frequent and less frequent blocks may be performed to determine the significant blocks. The determination of the significant blocks provides for generation of template representations which further enable detection of events in a newly identified block.

[0063] In an embodiment, after constructing the frequency pattern tree, the blocks are presented to a domain expert for labelling which blocks are valid segments of co-occurring log messages, which blocks are significant/meaningful and which ones are insignificant. FIG. 4 depicts a method of analyzing co-occurring log messages in a block, according to an embodiment.

[0064] As shown in FIG. 4, three entities 410, 420 and 430 may be involved in the determination of blocks in the log entries. A domain expert 410 interacts with a block suggestion module 420 and a semantic segment module 430. A person skilled in the art will appreciate that the entities 410, 420 and 430 may be implemented purely as computer programable instructions with the digital twin of the industrial plant serving as a domain expert. In the present example, the inputs of the domain expert are received manually.

[0065] At step 450 a Graphical User Interface (GUI) for analyzing log messages is launched on a computing device used accessed by the domain expert 410. The launch of the GUI triggers the block suggestion module 420. At step 451, the block suggestion module 420 suggests one or more blocks, with co-occurring messages, to the domain expert 410. At step 452, the domain expert views the block/blocks and checks whether to modify at step 453. If modification is required, the block(s) are modified at step 454. The feedback regarding the modification is sent to the block suggestion module 455. At step 456, the feedback is saved or learnt by the block suggestion module 420. At step 457, the block(s) is accepted and sent to the semantic segment module 430 or rejected and sent to the block suggestion module 420 at steps 458 and 457, respectively. The feedback including the acceptance or rejection of the blocks are used to confirm the modification or request a new block suggestion. By confirming and saving the feedback, block(s) having with the same frequency get automatically accepted if no modification is required. Or get modified automatically based on the modifications performed at step 454. Accordingly, the domain expert 410 only has to label a subset of all the blocks generated.

[0066] At step 460, the domain expert 410 views a semantic segmentation suggested at step 459 by the semantic segment module 430. The semantic segmentation refers to annotation of the block(s) based on the semantic metadata. At step 461, the domain expert 410 determines whether the annotation is to be modified, if yes, the annotation is modified at step 462. The modification is saved at step 463. Further, feedback regarding the modified semantic segmentation is sent to the block suggestion module 420 and the semantic segment module 430 at step 465. Through the feedback the block suggestion module 420 and the semantic segment module 430 are trained based on the modification of the semantic segmentation performed by the domain expert 410. Further, at step 466 the modified annotation is accepted and a new block may be suggested by the block suggestion module 420.

[0067] FIG. 5 depicts a Graphical User Interface (GUI) 500 for analyzing log messages, according to an embodiment of the present invention. The GUI 500 may be used to receive input from the domain expert 419.

[0068] The GUI 500 includes two main sections 510 and 520 i.e., a suggested block section 510 and manual block section 520. As shown in FIG. 5, the suggested block section 510 has been selected. The suggested block section 510 depicts the log messages received with timestamp 512, event identifier 514, event name 516, source 518 and message content 515. In an embodiment, the log message 519 may be annotated as inspection action. Accordingly, the domain expert 410 may select the log message 519 if the log message 519 is considered not to below with the displayed block. Further, block identification field 530 is used to give the block a label, according to the level of severity: green, yellow and red. Further, possible cause and possible solution may be input by the domain expert 410. After that you may get a new suggestion for a block may be requested by clicking “next block” in the field 530.

[0069] FIG. 6 depicts the GUI 500 for analyzing log messages, according to an embodiment of the present invention. The manual block section 520 may be selected by the domain expert 410 to label manually defined blocks. The domain expert 410 inputs the industrial plant and device details in the field 540. The GUI 500 is configured to illustrate the frequency distribution of the log messages in the field 550 to enable the domain expert to define and label the blocks. Using the manual block section 520, the domain expert 410 is provided a tool to allow exploration of the log messages by selecting time period in field 550. In addition, a list of log messages may be displayed similar to the view in FIG. 5. The log messages may be filtered based on event identifier or name of the event.

[0070] A person skilled in the art will appreciate that the GUI 500 is merely an example GUI to enable a domain expert/an operator/a user to view how the blocks are determined and annotated. Accordingly, embodiments provide for analysis of the steps performed by the different software modules and thereby avoiding black-box effect.

[0071] FIG. 7 depicts an apparatus 720, 760 and computing platform 750 for analyzing one or more log files of an industrial plant 710, according to an embodiment. The industrial plant 710 includes a plurality of industrial assets (such as automation devices and systems) 712-718.

[0072] The industrial plant 710 may further include the apparatus 720 to analyze log files generated from the operation of the industrial plant 710. The apparatus 720 include an edge computing device 730 or a SCADA system used to monitor operation of the industrial plant 710, or a part of the industrial plant 710. The apparatus 720 may also include a Human Machine Interface (HMI) used to enable interaction with an operator of the industrial plant 710. The device to analyze log files may also be a device 760 outside the network of the industrial plant 710 communicatively coupled to the industrial plant 710 the cloud computing platform 750. In an embodiment, the cloud computing platform 750 hosts a log analyzer module 740 that analyzes the log files when executed.

[0073] The apparatus 720 includes the edge computing device 730 and the HMI panel 722. The edge computing device 730 includes a processor 732, a communication interface 734 and a firmware module 736. The firmware module 736 is a dedicated computing unit with a dedicated memory used to perform the steps of the present invention. The processor 732 and the communication interface 734 are used to enable the edge computing device 730 to perform other functions in the industrial plant 710, such as gateway operations of connecting the industrial plant 710 to the cloud computing platform 750.

[0074] The firmware module 736 includes the log analyzer module 740. The log analyzer module 740 further includes a block suggestion module 742, a semantic label suggestion module 744, a graph creation module 746 and a comparison and labeling module 748. The operation of the modules 742, 744, 746 and 748 are comparable to the modules 125, 135, 145 and 155, respectively.

[0075] The HMI 722 is configured to display the GUI 724 and a coherent representation 726 of blocks determined during the operation of the present invention. The operation of the GUI 724 is comparable to the GUI 500 in FIGS. 5 and 6. The coherent representation 726 may be displayed interactively to enable input from an operator or domain expert using the HMI 722.

[0076] In an embodiment, the device 760 includes a processing unit 762, a communication interface 764, a memory 766 and a display unit 770. The device 760 is communicatively coupled to the industrial plant 710 via the cloud computing platform 750. The device 760 may be a hand-held computing device or an AR/VR device that is capable of communicating with the cloud computing platform 750. The memory 766 includes the log analyzer module 740 and is executed by the processor 762 to perform the steps of the present invention.

[0077] In an embodiment, the log analyzer module 740 on the device 760 acts as a client application of a server application 740 hosted and executed on the cloud computing platform 750. In addition, the cloud computing platform 750 may include a template database 752 with template representations of events that could occur in the industrial plant 710. The template database 752 may be generated based on historical log files or based on operation of a comparable industrial plant.

[0078] The template representation may relate to anomalous conditions that require to be detected in the industrial plant 710. The comparison of the coherent representation 726, 774 with the template representation in the template database 752 provides for identification of anomalous conditions in the industrial plant 710. In an embodiment, the template database 752 includes a mapping of the anomalous conditions, priority/criticality and the template representation. Accordingly, by comparing the coherent representation 726, 774 a priority/criticality for the coherent representation 726, 774 may be determined.

[0079] Embodiments provide for a computer program product including program modules accessible from computer-usable or computer-program product/computer-readable medium storing program code for use by or in connection with one or more computers, processors, or instruction execution system. For the purpose of this description, a computer-usable or computer-readable medium may be any apparatus that may contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium may be electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or de-vice) or a propagation mediums in and of themselves as signal carriers are not included in the definition of physical computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, random access memory (RAM), a read only memory (ROM), a rigid magnetic disk and optical disk such as compact disk read-only memory (CD-ROM), compact disk read/write, and DVD. Both processors and program code for implementing each aspect of the technology may be centralized or distributed (or a combination thereof) as known to those skilled in the art.

[0080] While the embodiments have been described in detail with reference to certain embodiments, it should be appreciated that the present invention is not limited to those embodiments. In view of the present disclosure, many modifications and variations would be present themselves, to those skilled in the art without departing from the scope of the various embodiments of the present invention, as described herein. The scope of the present invention is, therefore, indicated by the following claims rather than by the foregoing description. All changes, modifications, and variations coming within the meaning and range of equivalency of the claims are to be considered within their scope. All advantageous embodiments claimed in method claims may also be apply to system/apparatus/device claims.

[0081] It is to be understood that the elements and features recited in the appended claims may be combined in different ways to produce new claims that likewise fall within the scope of the present embodiments. Thus, whereas the dependent claims appended below depend from only a single independent or dependent claim, it is to be understood that these dependent claims may, alternatively, be made to depend in the alternative from any preceding or following claim, whether independent or dependent, and that such new combinations are to be understood as forming a part of the present specification.

[0082] While the present embodiments have been described above by reference to various embodiments, it may be understood that many changes and modifications may be made to the described embodiments. It is therefore intended that the foregoing description be regarded as illustrative rather than limiting, and that it be understood that all equivalents and/or combinations of embodiments are intended to be included in this description