ASR11 OI Rpt

Airport Surveillance Radar, Model 11

Operational Inventory Results Report

Conducted

June 27 – 29, 2000

Prepared by:

Randall Bowen, ARN-300

July 17, 2000

(202) 267-8404

The Air Traffic Systems Requirements, Surveillance Division, ARN-300, conducted an Operational Inventory of the Airport Surveillance Radar, Model 11 (ASR-11) at the Stockton Air Traffic Control Tower on June 27 –29, 2000. The purpose of the Operational Inventory was to provide the National Air Traffic Controllers Association (NATCA), Professional Airways System Specialists (PASS), and Air Traffic Services (ATS) with the opportunity to operationally examine the ASR-11 system prior to the ASR-11 Production Decision.

This report reflects the user input and data collected by ARN-300 during the Operational Inventory. It is not intended to be a NATCA or PASS assessment or endorsement of the ASR-11 system. The identified issues are not all encompassing. Rather, they reflect the scope and purpose of the event. The findings of this report are not intended to represent formal requirements nor are they user demands. Rather, all the issues listed represent the consensus of the group that participated in the inventory and are intended as items to consider when discussing the ASR-11 system. Attachment A contains the detailed list and disposition of all these topics.

Background

Typically, a production decision for any program is made after Operational Test and Evaluation (OT&E) has been completed. Due to delays to the ASR-11, because of the importance of replacing the existing terminal radar systems, and because of the long lead-time required to produce ASR-11 systems, it became necessary to schedule a production decision for the ASR-11 program before OT&E could be completed. As a result, the agency was placed in the position of making a production decision without structured input from radar system users (particularly the Air Traffic Control and Airway Facilities unions – NATCA and PASS). The Operational Inventory was conducted to provide the necessary information to support production decision discussions while including the users in that process.

Approach

The Operational Inventory was a structured review of the ASR-11 system. The scope of the Operational Inventory was Air Traffic (AT) functionality and human factors, Airway Facilities (AF) functionality and human factors, facilities, and system performance. Three NATCA, four PASS, and 1 Supervisory Committee (SUPCOM) participants interacted with the ASR-11 system during normal operations and simulated degraded operations. Additional ATS and ARA personnel also observed and participated in group discussions. Attachment B lists all attendees at the Operational Inventory. Targets of opportunity were used, and recorded Stockton weather was displayed to the participants. Degraded operations were simulated by the introduction of non-intrusive and non-destructive faults. Attachment C contains the list of injected faults.

The Operational Inventory focused on the three primary user interfaces to the ASR-11 system: Radar Control Panel (RCP), Video Display Control Unit (VDCU), and the Operator Maintenance Terminal (OMT). The participants used functional inventory and humans factors inventory checklists to aid them in their review. The checklists were used as a guide to promote complete review, not as a rating, or assessment device. Attachment D contains all of the checklists.

The participants received training at the beginning of the 3-day event. Training was followed by time on the system. Total time on the system was 8 hours. At the end of each day a caucus was held to discuss the group’s findings. The last day of the event was spent discussing all findings and categorizing the topics as Strengths, Weaknesses or Non-Issues. Weaknesses were further categorized using the following three definitions:

Category 1 (W1) – Significant; recommended subject for Production Decision determination discussion

Category 2 (W2) – Must be addressed prior to operational use of production system

Category 3 (W3) – Recommended for potential future system enhancement

Results

The Operational Inventory identified a total of 56 discussion topics. The participants identified a number of issues that would need to be addressed to ensure satisfactory operational use of the ASR-11 system. In general, the participants were able to interact meaningfully with the system. The radar system performed in accordance with their existing expectations. The participants did identify two unique strengths of the system:

The Air Traffic radar coverage is better than expected. Targets were consistently observed at ranges of 50 nautical miles at altitudes down to 1000 feet. This finding was supported by the observations made during the recent Site Acceptance Test flight check, which recorded coverage much better than expected.

The ASR-11 provides a digital data feed to the ARTS IIE which allows the ARTS to track primary radar targets. This feature allows full use of ARTS capabilities that were not anticipated. This was particularly evident when beacon data loss was simulated. The ARTS continued to track existing targets, relying on the existing primary radar data.

Nine Category 1 weaknesses were identified. Table 1 summarizes those weaknesses and the status of their resolution.

Weakness	Status/Resolution
Point of control	Product Team (PT) committed to fixing problem via an Engineering Change proposal (ECP).
Circular Polarization/Linear Polarization functionality	PT committed to fixing problem via appropriate means.
Excessive System Alarms on RCP	PT committed to fixing problems as soon as acceptable alarms are identified.
Clutter break through on weather channel	Additional analysis necessary and will be further investigated during Operational Test and Evaluation (OT&E).
Gap in weather display	Investigation Request (IR) written during Site Acceptance Test. The FAA test organization will analyze during OT&E.
Beacon antenna as Line Replacement Unit	Current maintenance philosophy must be investigated/enhanced to ensure safety and efficiency, and to minimize down time requirements.
Sparing list	Proposed site spares may be insufficient; site spares must be reviewed.
Panic button in Engine Generator shelter	Additional analysis necessary.
Uninterruptible Power System bypass switch	Current proposed fix included in 95% Generic Facilities and Tower Design document.

Table 1: Summary of ASR-11 Operational Inventory Category 1 Weaknesses

The group also identified 30 Category 2 weaknesses and 5 Category 3 weaknesses. Most of these issues were items that had been identified previously. Twelve (12) items discussed were determined to be Non-Issues. The complete description of all of these items is contained in Attachment A.

Recommendations

The Strengths and Category 1 weaknesses noted in this Operational Inventory report are recommended as topics for any production decision discussion.
Based on the Operational Inventory discussions, ARN-300 has concluded that there were no problems significant enough to delay the production decision discussions.
Any decision made to go forward with production of ASR-11 systems should include provisions to address the problems noted in this report (and in the upcoming OT&E) prior to any ASR-11 system being accepted for installation at an operational site. All issues should be thoroughly considered and if remedies are indicated, those remedies must be implemented.

Attachment A

ASR-11 Operational Inventory Discussion Topics:

Detailed List

Strengths - S	Disposition	Cat.
Radar coverage better than expected Targets were noted at extreme distances (50 nautical miles) and low altitudes (down to 1000 feet). System Specification requires coverage at 8000 feet at 50 nautical miles.	The recent Site Acceptance Test flight check supports the finding that coverage appears much better than specification requirements.	S
ASR-11 Digital Data to the Automated Radar Tracking System (ARTS IIE). The ASR-11 system provides digital data to the ARTS IIE to provide for primary radar tracking. This was noted when beacon (secondary) information was removed to simulate a degraded mode of operation. The ARTS continued to track existing radar targets (even though there was no beacon information).	The Air Traffic (AT) participants felt that this benefit was operationally significant.	S
Weakness - W1 - Significant; recommended subject for Production Decision determination discussion	Disposition	Cat.
Point of Control. To take control of the radar at the Site Control and Data Interface (SCDI), master control must be granted via the remote Operator Maintenance Terminal (OMT), even if control is currently resident in the remote Radar Control Panel (RCP) and that device has relinquished control. When the Control and Monitoring System (CMS) is in controller mode, control of the system is still available at the RCPs, SCDIs and remote OMTs, if one of these devices requests control.	Previously identified issue. Remove the necessity to have more than two devices involved in the change of system control. This ability is inconsistent with the system design and needs to be changed. Multiple devices should not have control at the same time.
Circular Polarization /Linear Polarization (CP/LP) functionality. The ASR-11 system has both CP and LP modes. The Raytheon design uses an automatic switch to change between the two polarization modes to remove unwanted false target information under certain precipitation conditions. This design does not allow the controller to override the automatic control. Even if the controller manually selects a given polarization mode, the automatic switch can change that mode. A switch from LP to CP reduces the transmitter signal strength and can result in the loss of marginal strength targets, an operational concern.	Previously identified issue. The controller must have the ability to put the polarizer in either automatic or manual mode. The controller needs to know whether the polarizer is in manual or automatic mode. Controller acknowledgment (Radar Control Panel "ACK") of either a manual or automatic CP/LP mode selection is not required nor desired.	W1
Excessive Number of System Alarms. All System Alarms require controller acknowledgment actions (ACK) on the remote RCP (TRACON/tower). Air Traffic (AT) users get no indication of what the alarm is for and can not determine what alarms they are acknowledging. For example, alarms occur when radar site doors are opened (intruder alert), when a portion of the fire detection system has a problem or when a variety of other facility problems occur.	Remove System (facility type) Alarms from the remote (TRACON/tower) RCPs. Also limit (if possible) alarms on the RCP to types that have an operational impact or show status on the RCP.	W1
Clutter breakthrough on the weather channel. The ASR-11 system uses manually generated clutter maps within software to eliminate clutter breakthrough on both the target and weather channels. These maps have been effective in the target channel, but in the weather channel, areas of significant clutter (e.g. the windmills located near the Stockton radar site) show up as areas of weather. This is distracting and erroneous information. Further mapping to desensitize the clutter areas may serve to mask real weather in those areas. In addition, certain clutter areas result in transitory, very small areas of clutter breakthrough whose appearance is very similar to, and can be mistaken for, primary radar targets	Weather channel clutter break-through must be reduced without adversely affecting detection of actual weather. The appearance of weather must be altered so that weather can in no way be mistaken for primary radar targets.	W1
A gap exists in weather information display. The gap was seen at the short pulse/long pulse transition point (6.5 nautical miles). The ASR-11 system uses two separate radar pulses to provide both short range and long range radar coverage. At the area where the radar system transitions from the short pulse to long pulse, weather returns are being masked out or the weather level is reduced. This results in erroneous information being displayed.	Previously identified issue. Investigation is underway. The "gap" in displayed weather information must be corrected. The ASR-11 system must display weather information consistently and accurately.	W1
Beacon antenna as Line Replaceable Unit (LRU). The ASR-11 system design treats the entire Beacon Antenna as a single replaceable part. The design of this antenna is different than that on previous radar systems. The antenna was designed to require little intervention and no significant maintenance. Should there be a problem with the antenna, the design is to replace the unit rather than attempting a repair on site. The antenna is designed so that failure of part of the antenna can be masked and can remain useable until the antenna can be replaced. The users questioned whether this change in maintenance philosophy has been fully studied and validated.	Previously identified issue. A determination needs to be made whether this change in maintenance philosophy is acceptable to all appropriate offices (up to the AAF-1 level). A team should be designated and funded to replace antennas when the need arises. If a specialized team is not available and if local site technicians are expected to do the replacement, the maintenance philosophy and design probably needs to be re-examined. The replacement plan must support safe maintenance operations. The impact of this plan on air traffic operations must be acceptable to the air traffic control users. The replacement plan must also address the special needs of sites with radomes.	W1
Site-sparing list. The list of site spares has yet to receive appropriate scrutiny from field personnel. The sparing philosophy appears to be one that limits the number of on site spares in favor of a quick response from a centrally located depot.	Previously identified issue. The possible solution is still under discussion. Sites should have sufficient spares to handle likely failures that would result in loss of an operational system. Regional Air Traffic and Airway Facilities offices need to be aware of time necessary to restore service if spares aren’t on site. A team of subject matter experts (including field personnel) needs to participate in the resolution of this issue.	W1
"Panic Button" in engine generator shelter. There is currently no way to shut down the electrical power to the site should there be an emergency. This could lead to severe injury or death under certain circumstances.	A determination needs to be made whether the system should provide an emergency electrical shutoff switch (panic button) to kill all Commercial/ Engine Generator power to the entire ASR-11 site.	W1
Uninterruptible Power System (UPS) bypass switch. The UPS bypass switch utilizes some design features that are unacceptable. Circuit breakers are used as switches to bypass the UPS (code violation). The UPS can be "back-fed" so that power may be fed to the UPS even when the UPS is supposedly bypassed, posing a safety hazard to maintenance personnel.	Previously identified issue. The UPS design needs to be corrected to ensure that the UPS can be safely maintained. This issue has been addressed in the most recent Facility & Antenna Tower Design (FATD). Ensure that the design meets user needs.	W1
Weakness - W2 - Must be addressed prior to operational use of production system (except as noted)	Disposition	Cat.
The number of acknowledgment actions (ACK) needed at the remote RCP (TRACON/tower) is excessive. The number of RCP alarms, in general, is excessive. The RCP alarms whenever there is a system status change and for a variety of non-operational reasons.	There is a need to review and discuss the alarm list with the appropriate group to determine what alarms are needed for remote RCP (TRACON/tower) display.	W2
The RCP audible alert is not discernible at lowest volume setting, and is not loud enough at highest volume setting.	The audible alert volume must be in compliance with the RCP B-level specification: paragraph 3.2.3.1.2, Table 2, and paragraph 3.2.9.	W2
The Video Display Control Unit (VDCU) audible tone volume controls do not operate as presented during the VDCU critical design review (CDR), e.g., 8 volume steps.	The audible tone volume controls must operate as agreed upon during the VDCU CDR.	W2
The VDCU audible tone volumes differ between the two units installed in the simulated TRACON.	The audible tone volume must be in consistent across VDCUs.	W2
When MSSR A and B are both failed, the RCP System On-line button does not turn red or alarm as it should. This same alarm failure is seen when both Primary Surveillance Radar (PSR) A and B, (only), are failed. However, when the Site Control and Data Interface (SCDI) A and B units failed the RCP System Alarms and on-line button turns red.	The system must be in compliance with RCP B-spec: 3.2.3.2, Table 4.	W2
Additional local classroom time for AT training will be required to ensure controller understanding and familiarity.	Ensure that the implementation plan specifies the requirement for training. Ensure that Back Fill Overtime funds are available to assist facilities in meeting their training needs (re: time required to train everyone in the 30 days before implementation/ cutover).	W2
Alarm/system performance items: SCDI-A is in off-line maintenance mode (status Amber). With a portion (that controls delivery of MSSR data) of SCDI-B failed, a red System Alarm and red System On-line alarm are displayed on local (radar site) and remote (TRACON/tower) RCPs. PSR and MSSR indicators are on-line (Status Green). With both SCDI-A and SCDI-B showing off-line, the proper interpretation of RCP alarms and indicators would be that there is no PSR or MSSR data being delivered to the controllers’ displays (loss of both SCDIs supposedly results in loss all data to the displays). MSSR data was missing. However, primary data was still being displayed on Radar Alphanumeric Display Subsystem (RADS). The only method to verify that PSR data was valid was via the remote OMT (in the TRACON).	This situation is confusing to the AT user. This error must be investigated to determine whether it (and similar) situations need to be covered more thoroughly in AT training. However, if the system is operating incorrectly (unknown at present) the problem must be corrected.	W2
When SCDI-A (which is the selected On-line device) is shutdown, the local site RCP SCDI-A indicator lamps are all extinguished (no status indicators). SCDI-B goes to Selected On-line status, but there is no RCP System Alarm or ACK required. Following SCDI-A reboot, the RCP SCDI-A button turns green, RCP System Alarm flashes green, and an ACK is required.	The alarm indications are not consistent. When SCDI-A went off-line, there should have been a System Alarm for a state change. When the system went to SCDI-B, there should have also been a System Alarm for a state change. The System Alarms need to function according to B-level specification: paragraph 3.2.3.2, Table 4.	W2
A) SCDI-A reboot (power off): After SCDI-A lost power, the Radar Display weather maps at the TRACON started to strobe during the second and third execution of thefault. B) The third execution of the fault also resulted in Receiver Exciter/Signal Data Processor (REX/SDP) A going into maintenance mode (amber) on the SCDI-B OMT.	A) This display strobing occurred during a system failure and reboot (the system is off-line), so the item was classified as a Non-Issue. B) This apparent error needs to be investigated to determine if there is an issue. (an Investigation Request was opened).	A) N B)W2
During a backup system power demonstration, switching the site main breaker to ON (simulating restoration of commercial power) caused the lead air conditioner unit to fail. This required a manual reset of the air conditioner unit.	Failure of the lead air conditioner unit upon restoration of commercial power could not be explained and is not acceptable. The absence of a true fault and the need for manual reset means a loss of air conditioner redundancy. This error must be corrected.	W2
PSR failure alarm item (#1). With PSR-A in maintenance mode, transmitter driver B power supply was failed. The local (radar site) OMT displayed a red transmitter indicator. The transmitter status button on all RCPs stayed green and did not turn red, as per specification.	With no transmitter available (PSR-A in maintenance mode and PSR-B transmitter failed) the transmitter status indicator must change status in compliance with RCP B-level specification, paragraph 3.2.3.2, Table 4.	W2
PSR failure alarm item (#2): With PSR-A in maintenance mode, transmitter driver B power supply was failed. At SCDI-A OMT, on the transmitter status screen, the driver A box turned gray (no status indication), while at the SCDI-B OMT, on the main screen schematic, all boxes stayed green.	This item needs to be investigated to determine if this situation is repeatable and if the item needs to be corrected. If there is an inconsistency, it needs to be corrected.	W2 (if the error is valid)
At the OMT, with the transmitter amplifier module faulted, the failed amplifier modules turn amber on the OMT Equipment Status screen and Equipment Control screen, rather than red.	The problem needs to be investigated and corrected if error is valid (as appropriate).	W2 (if the error is valid)
With one transmitter failed, manually turning off the second transmitter amplifier module (which puts the system in an unusable condition) at the SCDI-A OMT results in the amplifier module box turning gray, rather than amber, then red.	The failure of more than one transmitter makes the PSR system unusable and must be indicated as such.	W2
RCP transmitter amplifier module faults item. When the transmitter amplifier modules dropped below 7/8 (more than one PSR transmitter failure), the RCP showed a red System Alarm and red Transmitter status, but there was no System On-line alert. Beacon and primary data continue to be displayed, but the PSR should be treated as operationally unusable (according to system design).	The system is not meeting current system specification. The loss of more than one PSR transmitter module must be treated as a loss of PSR data. There must be a System Alarm and the System On-line status must show red. NOTE : The AT users wanted to know if it is possible to use the radar data that exists when the system falls below 7 of 8 transmitters. If it is possible to validate the reliability of that radar data at some future time, they want to be able to use the radar even if more than one transmitter fails.	W2 W3
When Ethernet-A power was removed, the system changed to the standby Local Area Network (LAN), system control was released, and the TRACON RCP was able to take system control. SCDI-B still indicated that it had control (though it really didn’t). Control was then release from the TRACON RCP to SCDI-A. Now both SCDI OMTs showed that they had control. Reconfiguring the SDCIs was the only way to clear this error.	Release of system control is normal when a LAN fails and is normal. The taking of control by the TRACON RCP was acceptable. (Non-Issue). The fact that system control is made available to any device on LAN failure has a safety implication that needs to be fully covered in training. The indication that SCDI-B retained system control after the LAN failure, after the TRACON RCP assumed system control and after system control was released to SCDI-A are all system indications that are erroneous and need to be corrected.	A) N A2)W2 B)W2
In reporting weather information, once a certain volume of data is exceeded, the data are "compacted" thereby reducing the amount of data that the communications channels must handle. The effect of this compaction is a loss of detail in the weather displayed to the controller. This loss of detail is generally applied to lower levels (levels 1 & 2) of weather. Detailed weather presentation is retained on the higher levels of weather (3 and above). The small detailed weather cells that could be confused with radar targets are evident under some conditions.	The users had no issue with the loss of detail created by the weather compaction. They felt that the smoother contours produced by the compaction were actually of some benefit. (Non-Issue). In keeping with the weather channel clutter breakthrough issue (discussed above as a W1 issue), the appearance of weather must be altered so that weather can not be mistaken for primary radar targets.	N B)W2
Do the local OMT (radar site) and remote OMT (TRACON) receive the same alarms? This question was raised but the answer was not immediately known.	An investigation is necessary to determine the answer. If both receive the same alarms, this is a Non-Issue. If alarms are different, any corrections should include input from the team examining the alarms issue.	N B)W2
Emergency lighting at the radar shelter is inadequate. When there is a commercial power failure at the radar site, the only emergency lighting is over the entry doors (while the UPS is supplying power). The level of lighting is insufficient to perform any tasks and may be insufficient even to safely find a way out of the radar shelter. This lack of lighting remains until the Engine Generator can supply power.	Assess the lighting level needed for safe activity in the radar shelter and exit from the building. Supply that level of emergency lighting.	W2
There is a concern that the amount of space in the pedestal room is insufficient to perform necessary tasks. The size of the room may result in its classification as a confined space, which could result in hazardous duty pay for Airway Facilities (AF) technicians.	Previously identified issue. Explore the options to increase the size of the room.	W2
Ventilation in the antenna pedestal room is poor. The room is fully enclosed with only a small vent window. There is also a concern about the need for heat in the room in colder climates.	Previously identified issue. Assess options for increasing ventilation. Forced ventilation and a louvered wall should be evaluated. The possibility of adding a heater to the room (as a site-specific option) should be explored.	W2
Prerequisite training for AF technicians is needed. Known training required includes radar system regression training for Stockton technicians, as well as UNIX, Ethernet, and UPS training for all technicians.	Identify the training required, schedule the classes and get the necessary students into the training queue.	W2
The antenna maintenance ladder does not have a fall protection device. The design accepted by the government (installed at Eglin AFB) does not include fall protection that is necessary during the climb up the ladder.	A third rail should be added to the antenna maintenance ladder for safety. This would allow continuous fall safety during the climb up the ladder.	W2
The antenna pedestal maintenance cart lacks necessary safety features. The cart does not have a locking pin, a safety guard around the winch and perhaps other necessary additions.	Assess the safety features that need to be added to the cart design and modify that design as appropriate.	W2
Fluorescent fixtures are used on the tower. Are they low temperature fixtures and tubes so they will continue to work even in low temperatures? Have the Stockton tower stairway light fixtures been modified so that they are accessible for maintenance?	Assess if fluorescent fixtures are low-temperature ones. Replace if necessary. Assess the status of retrofit at Stockton for accessibility of stairway fixtures and retrofit if necessary.	W2
When the Engine Generator is shut off manually at any RCP, the EGEN green indicator light flashes briefly and then goes steady green during the 5-minute cool-down. During the cool-down period there is no indication of the status of the Engine Generator. The user is unable to ascertain whether the Engine Generator is on or is in cool-down. Also, the user is unable to issue an RCP command to start the Engine Generator if it is in cool-down.	An indication that the Engine Generator is in the cool down period is needed for AT status monitoring. A command to restart the EGEN while it is in the cool-down state is needed at any RCP or OMT. (Future enhancement).	A)W2 B) W3
The radar tower obstruction light is not on critical power.	This may be in the 95% generic Facility Antenna and Tower Design (FATD). If so, retrofit the Stockton system. If not, include in the generic FATD.	W2
The existing UPS battery monitor does not check the output and status of each battery cell. A weak or defective cell can go undetected until there is a power failure, at which point it could cause a failure of the entire UPS.	Previously identified issue. Determine if the desired UPS battery-monitoring system can be added to the ASR-11 contract through existing means or if a contract modification is needed.	W2
Anecdotal evidence and figures from SAT indicate that system reliability and quality control are perhaps not as advertised.	Determine if system reliability and quality control issues are valid, and correct as necessary.	W2
Weakness - W3 - Recommended for potential future system enhancement (except as noted)	Disposition	Cat.
RCP buttons are small size and sometimes hard to activate. Some users felt that the "active" portion of the touch sensitive membrane panel could be larger to avoid errors in using the panel.	Determine if the button size meets human factors guidelines. Propose change to size as appropriate if panel is redesigned in the future.	W3
When putting PSR, MSSR, and SCDI into maintenance mode via any RCP (especially in rapid sequence), the system must complete the command for one subsystem change prior to accepting a command for the next subsystem. AT users had a concern on length of wait if they needed to execute several commands.	Determine if multiple commands can be easily accommodated. If the change is no a major impact to the program, implement with other fixes/changes. If there is a larger impact, include this as a candidate future enhancement.	W3
There are two shades of gray used on the OMT. Light gray indicates that the status of SCDI was never was known (since system restart). Dark gray indicates that the SCDI status was once known, but that status was lost and current status is no longer known.	This use of two shades of gray does not have any value and should be changed when possible.	W3
Non Issues – N	Disposition	Cat.
When lead air conditioner unit fails it requires a manual reset at the site.	There should not be the ability to reset the unit remotely. If the unit fails, it should be inspected before a manual reset.	N
Each air conditioner unit at the radar shelter runs 12-hours a day. Can the 12-hour period be changed so that the 2 air conditioner units do not run at the same time every day?	A timer switch on the equipment can be set manually.	N
EGEN does not stop after the command to stop has been input. Command to stop was input from all points of control and did not work anywhere.	Problem corrected on Day 2. Problem on first day was due to an incorrect setting in the SCDI-A adaptation.	N
The local RCP ( radar site) is assigned to one or the other SCDI and there is no indication of which SCDI is providing status.	Normal operation.	N
The OMTs define the PSR components as transmitter, REX/SDP A and REX/SDP B. The RCP has a transmitter status button and a PSR-A and PSR-B button. Is this inconsistency confusing? Further, is the inaccuracy of the RCP labeling a problem?	AT users do not want the level of detail that the OMTs provide. Designation as PSR-A and PSR-B is appropriate.	N
The UPS status button goes red if the UPS fails. It also goes red if the UPS is supplying power when commercial and/or engine generator power fails. If the UPS is supplying power (normally), should the indicator be red?	Red status is appropriate, for even if the UPS is operating normally in supplying power, this is a critical situation that needs to be addressed immediately.	N
RCP lost all indicator lights when SCDIs switched.	Normal operation.	N
RCP panel failure audible alarm can not be acknowledged. The volume of alert can only be turned down.	Normal operations. When the panel fails, the only active control is the volume control. All other functions are dependent on full panel operations.	N

Attachment B

ASR-11 Operational Inventory:

List of Participants and Attendees

NATCA participants

Steve Boyer, Eugene, OR

Andy Chalot, Erie, PA

Perry Doggrell, Pensacola, FL, ASR-11 National Representative

PASS participants

Herman Brown, Stockton, CA

Kevin Conrad, Indianapolis, IN, National Safety Liaison

Eddie Narvarte, Stockton, CA

Mike Perrone, Washington, DC, ARS Liaison

SUPCOM participant

Jim Harris, Portland, OR

Sierra Nevada SMO

Denise Knight, Sacramento, CA

Training

Gary Gallant, AMA-450

Jessie Horn, AMA-513

Other Attendees

Geoff Blackman, AND-440 TAC/AOS-230

Randall Bowen, ARN-300

Bob Garnett, AOS-200

Luis Guzman, ATQ-3/EER

Tom Healy, ACT-310

Jim Linney, AND-440 TAC

Thann McLeod, NCT AT

Gary Nigro, AWP-510

Ted Phillips, ACT-310

Lisa Stewart, ARN-300/CTA Government Systems

Ron Weber, ACT-310

Attachment C

ASR-11 Operational Inventory:

Faults to Simulate Degraded Operations

MSSR FAULTS

1. MSSR A Transmitter Power Supply Unit 1 (PSU1) Failure

Purpose

Simulate a MSSR channel A Transmitter PSU1 failure. This test will show that the MSSR, upon detection of a failed channel, will automatically swap online channels to provide continued service to the controller.

Fault Type

Fault is automatically detected and isolated to single failed LRU.

Procedure

Verify that both MSSR channels are running without any alarms and that MSSR channel A is online selected. Verify that all alarms have been acknowledged on the local OMTs and remote and local RCPs.
Position observers at the local OMTs and local and remote RCPs and at the RADS. Ensure normal operation at the RADS display.

Remove Fuse FS1 from the front panel of the Fan and Power Supply Unit 808363/000 in MSSR channel A.

At the radar site, verify that the RF Changeover (RFCO) switch reconfigures from MSSR channel A to MSSR channel B. The switchover will be heard as a loud click at the top of the MSSR cabinet.

On the local OMTs, observe that the ACK button turned red indicating the failure. Observe that the MSSR A block on the OMTs turned red indicating the channel failure. Verify that the MSSR A Maintenance Action Required and MSSR A Information icons appear at the local OMTs.

On the local and remote RCPs, verify that the System Alarm indicator turns red and flashes. Verify that SSR A turns red and flashes. Verify that the SSR Selected, A indicator goes out and the Selected, B indicator turns green and flashes. Verify that the ACK indicator turned orange and flashes.

On the RADS, observe that MSSR data is still being supplied to the controller after the channel switch.

Position the SCDI/CMS data switch to "CMS". At the MSSR CMS, verify that automatic fault isolation has identified the Tx Power Supply, Fan Tray, 808316 and Tx Interface Assembly, Tx Assembly, 807890 as the failed LRUs. Perform a manual fault isolation using the technical instruction book procedures to achieve the same result. Position the SCDI/CMS data switch to "SCDI".

At the MSSR Control and BITE PEC, observe the following indicator values:

D26	D23	D21	D20	D19	D18	D17	D16
0	0	0	0	0	0	1	1

D26	D23	D21	D20	D19	D18	D17	D16
0	0	0	0	0	1	1	1

MSSR FAULTS

2. MSSR B Driver Module Failure

Purpose

Simulate a Driver Module / Low Duty Power Amplifier failure. This test will demonstrate the effect of failures to both MSSR channels. This fault will be injected into MSSR channel B while MSSR channel A is already in a failed state.

Procedure

Verify that MSSR channel A is in a faulted state (as indicated on the RCPs and local OMTs) as a result of injection of MSSR Fault #1. Verify that MSSR channel B is online selected with no alarms.
Position observers at the local OMTs and RCPs and at the RADS. Ensure that beacon targets are displayed on the RADS.
Disconnect cable 807964/180 from SK2 on the Driver Module for MSSR channel B.
At the radar site, verify that there is no MSSR channel swap when the MSSR B fault is inserted.
On the local OMTs, observe that the ACK button is red due to failures in both MSSR channels. Observe that the MSSR A block on the OMTs is red (from the previous fault). Verify that the MSSR B block on the OMTs is now red. Verify that the MSSR A and MSSR B Maintenance Action Required icons are indicated on the OMTs. Acknowledge all alarms.
On the Local and Remote RCPs, verify that the System Alarm indicator flashes red. Verify that SSR B turns red and flashes. Verify that the ACK indicator turned orange and flashes. Acknowledge all alarms. Note that after acknowledging alarms, alarm indicators go to a solid color on the RCP
On the RADS, observe that MSSR data is no longer being supplied to the controller after the channel B fault was inserted. Observe that PSR targets are still being displayed on the RADS.
Position the SCDI/CMS data switch to "CMS". At the MSSR CMS, verify that automatic fault isolation has identified the LDPA, Tx Assembly, 808125; Tx Interface Assembly, Tx Assembly, 807890; and Driver, Tx Assembly, 807888. Perform a manual fault isolation using the technical instruction book procedures to achieve the same result. Position the SCDI/CMS data switch to "SCDI".
At the MSSR Control and BITE PEC, observe the following indicator values:

D26	D23	D21	D20	D19	D18	D17	D16
0	0	0	1	0	1	1	1

D26	D23	D21	D20	D19	D18	D17	D16
0	0	0	0	0	1	1	1

D26	D23	D21	D20	D19	D18	D17	D16
0	0	0	0	0	1	1	0

Restore both MSSR channels. Place SW1 in the OFF position on both MSSR channels. Remove the inserted faults in both channels. Place SW1 to the ON position on both MSSR channels.

SCDI AND MSSR FAULTS

3. PSR CEC FMAC Fault

Purpose

Simulate FMAC A Communications Link failure.

Fault Type

Fault is automatically detected and isolated to single failed LRU.

Procedure

3.1 Verify that both SCDI and MSSR channels are running without any alarms and that SCDI A and MSSR A are online selected. Verify that all alarms have been acknowledged on the local OMTs and remote and local RCPs.

Position observers at the local OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.
Switch RCP Data Switch to SCDI B.Disconnect the serial communications cable from FMAC A A1 PLC Module A2 Connector J1 in the CEC.
On the local OMTs, observe that the ACK button turned red indicating the failure. Observe that the SCDIs reconfigure, then SCDI A turns red, then orange, then gray, then automatically reboots in an attempt to reestablish commun ications with the FMAC. After reboot, observe that SCDI A turns green, then red, then orange. Observe that the SCDI A Maintenance Action Required icon is present on the local OMTs.
On the Local RCP, after the reconfiguration and reboot, verify that:

System On-line indicator stays green and flashes;

System Alarm indicator turns red and flashes;

Antenna indicator stays green and flashes;

Polarizer indicator stays green and flashes;

SCDI A indicator turns orange and flashes;

UPS Status indicator stays green and flashes;

Power Status, AC indicator stays green and flashes;

and the ACK indicator turns orange and flashes.

On the RADS, observe that MSSR data is still being supplied to the controller after the FMAC A failure.
At the local OMT, after automatic fault isolation, on the SCDI A Status and Control screen verify that FMAC A is red. Press status for part information, e.g. U7A1, FMAC Channel A, G584169-1. Verify that the FMAC A 24 V turned gray.

SCDI AND MSSR FAULTS

4. Aurora Box B Fault

Purpose

Simulate Aurora Box B failure. This test will demonstrate the effect of interruption of data from both MSSR channels to the SCDIs.

Fault Type

Fault is automatically detected and isolated to single failed LRU.

Procedure

4.1 Verify that both SCDI B and MSSR A channels are online and that there are no alarms in those channels. Note that alarms are still present due to insertion of Fault #3.

Position observers at the local OMTs and RCPs and at the RADS. Ensure normal beacon operation at the RADS display.
Disconnect the power plug from the power socket on Aurora Box B. Aurora Box B is located on the left-hand side in the back of the CEC.
On the local OMTs, observe that the ACK button turned red indicating the failure. Observe that the SCDI A remains orange (from the previous fault). Observe that SCDI A Maintenance Action Required icon remains (from the previous fault). Observe that SCDI B turns red and that the SCDI B Maintenance Action Required icon appears.
On the local and remote RCPs, observe that the System On-Line indicator turns red and flashes. Observe that the System Alarm indicator turns red and flashes. Observe that the SCDI B indicator turns red and flashes. Observe that the ACK indicator turns orange and flashes.
On the RADS, observe that beacon targets are not being displayed.
At the local OMT, after automatic fault isolation, on the SCDI B Communications Interfaces screen observe that the MSSR A Data and MSSR B Data indicators are red.
Restore SCDI and MSSR online configuration. Reconnect FMAC serial communications cable. Restore power to Aurora Box B. Ensure that alarms clear.

SCDI FAULT AND REBOOT

5. SCDI A Reboot

Purpose

Simulate loss of the on-line SCDI and a SCDI reboot.

Fault Type

Fault is automatically detected and isolated to single failed LRU.

Procedure

5.1 Verify that SCDI A is online selected and that there are no alarms indicated on the OMTs or RCPs.

5.2 Position observers at the local and remote OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.

On the online SCDI access the Local Workstations Actions screen, press the SCDI Shutdown button and press the Confirm button.
At SCDI A, before the SCDI reboots, observe that online SCDI A indicator turns gray and that control is transferred to the standby SCDI. After reboot, observe that the ACK button turns red and that SCDI A turns green.
At the Local RCP, before the reboot, observe that the SCDI A indicator turns gray and that the Selected, B indicator turns green. After reboot, observe that the SCDI A indicator turns green and flashes. Observe that the System Alarm indicator turns green and flashes. Observe that the ACK indicator turns orange and flashes.
On the RADS, observe that PSR and MSSR targets continued to be displayed throughout the reboot.

FACILITIES DEMOS / FAULTS

6. Backup Power Demonstration

Purpose

Demonstration that the UPS can carry the load of the ASR-11. Demonstrate that upon loss of commercial power, the system load is transferred to the Engine Generator.

Procedure

6.1 Verify that both PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs.

Position observers at the local OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.

Demonstrate UPS Operation

In the Engine Generator Shelter, set the RUN / OFF RESET /AUTO switch on the Engine Generator Control Panel to OFF.
On the local OMTs, observe that the ACK button turned red indicating the alarm. Acknowledge the alarms. Observe that the Eng/Gen block on the OMTs turned red. Observe that the Eng/Gen Maintenance Action Required icon appears. On the Engine Generator Status and Control screen, observe that the Engine/Generator Unit A, System Ready indicator turned red.
On the Local and Remote RCPs, verify that the System Alarm indicator turns red and flashes. Verify that EGEN turns red and flashes. Verify that the ACK indicator turned orange and flashes.
On the RADS, verify that targets continue to be displayed when the Engine Generator is disabled.
At the radar site, switch the Site Main Breaker to OFF.
On the local OMTs, observe that the ACK button turned red indicating the alarm. Acknowledge the alarms. Observe that the Site UPS indicator turns red. Observe that the UPS Maintenance Action Required and Facility Maintenance Action Required icons appear. On the Facility Status screen, observe that Site Status, Air Conditioners 1 and 2 turned red.
On the Local and Remote RCPs, verify that the System Alarm indicator is flashing red. Observe that the UPS Status indicator turns red and flashes. Observe that under Power Status, the UPS indicator turns red and flashes. Observe that ACK turns orange and flashes. Acknowledge all alarms.
On the RADS, verify that targets continue to be displayed when the UPS is carrying the system load. Allow the system to operate on UPS power for 10 minutes.

Restore Commercial Power and Enable Engine Generator

Switch the Site Main Breaker to ON
In the Engine Generator Shelter, set the RUN / OFF RESET / AUTO switch on the Engine Generator Control Panel to AUTO.
On the RADS, verify that targets continue to be displayed while the Commercial Power is restored and the Engine Generator is enabled.

Loss of Commercial Power / Engine Generator Demonstration

Verify that PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs.
Switch the Site Main Breaker to OFF.
For a brief period, the system will be running on UPS power. On the local and remote OMTs, observe that the Site Power Source, Commercial turns gray and UPS Battery turns green. Observe the APG Information, Facility Information, Facility Maintenance Action Required, Eng/Gen Information, Eng/Gen Maintenance Action Required, Site UPS Information and Site UPS Maintenance Action Required icons. On the Facility Status screen, Site Status, observe that Air Conditioners 1 and 2 indicators turn red. Observe that the Eng/Gen indicator turns red. Observe that the Site UPS indicator turns red.
After transfer to Engine Generator power, on the local OMTs, observe that the Site Power Source, Generator turns green. Observe that the Facility Information, Eng/Gen Information, Eng/Gen Maintenance Action Required, and Site UPS Information icons appear. Observe that the Eng/Gen indicator turns green. Observe that the Site UPS indicator turns green. Observe that on the Eng/Gen status and control screen, the offline indicator turns green (this is normally orange).
On the Local and Remote RCPs, verify that the System Alarm indicator turns red and flashes. Verify that the UPS Status indicator turns green and flashes. Verify that the EGEN indicator turns green and flashes. Verify that the Power Status, E/G turns orange and flashes. Verify that the ACK indicator turns orange and flashes. Acknowledge alarms.
Switch Site Main Breaker to ON to enable commercial power.

FACILITIES DEMOS / FAULTS

7. Online Air Conditioner Failure

Purpose

Demonstrate that the failure of an online Air Conditioner does not effect system operation.

Procedure

Verify that PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs.
Position observers at the local OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.
Turn off MDP-1 breaker to disable the online A/C.
On local and remote OMTs, observe that the lead Air Conditioner indicates failed. Observe that the ACK indicator turns red. Observe that the Lead Unit Failure lamp lights on the ECU Control Panel. Observe that the Facility Maintenance Action Required icon appears. On the Facility Status screen, Site Status, observe that the lead Air Conditioner indicator turns red.
On the Local and Remote RCPs, verify that the System Alarm indicator is flashing red. Observe that ACK turns orange and flashes. Acknowledge all alarms.
Turn on MDP-1 breaker to enable A/C and reset lead A/C . Ensure that the system is in a fault free state.

FACILITIES DEMOS / FAULTS

8. Intrusion Alarm

Purpose

Demonstrate that an intrusion alarm does not effect system operation.

Procedure

8.1 Verify that PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs. Verify that all site door intrusion sensors are active.

Position observers at the local and remote OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.
Open a door at the Radar Shelter to cause an Intrusion Alarm.
On local OMTs, observe on the Facility Status screen, that the Radar Room, Intrusion indicator turns red. Observe that the Facility Maintenance Action Required icon appears. Observe that the ACK indicator turns red.
On the Local and Remote RCPs, verify that the System Alarm indicator is flashing red. Observe that ACK turns orange and flashes. Acknowledge all alarms.

PSR FAULTS

9. REX/SDP A RF Assembly Failure

Purpose

Simulate a PSR A RF Assembly A1 Target High Beam RF Module A2 LNA AR1 failure.

Fault Type

Fault is automatically detected and isolated to single failed LRU.

Procedure

9.1 Verify that PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs.

Position observers at the local OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.

Remove LNA Power Cable W2 from the RF Assembly A1 Interface CCA A4 Connector J11.

On the local OMTs, observe that the REX/SDPs have reconfigured. Observe that REX/SDP A turned red then orange. Observe the REX/SDP A Maintenance Action Required icon. Observe that the ACK button turned red indicating the failure. Acknowledge the alarms.

On the Local and Remote RCPs, verify that the System Alarm indicator turns red and flashes. Verify that PSR A turns red and flashes, then orange and flashes. Verify that the Selected, A indicator not illuminated and B turns green and flashes. Verify that the ACK indicator turned orange and flashes. Acknowledge all alarms.

On the RADS, observe that PSR targets are still being supplied to the controller after the REX/SDP reconfiguration.

On the local SCDI/OMTs verify that on the REX/SDP Channel A Fault Isolation Result screen, the RF Assembly turns red and that the U1A1, RF Assembly, G584050-1 is identified as the faulted LRU.

PSR FAULTS

10. PSR Transmitter Driver B Power Supply Failure

Purpose

Simulate a PSR Transmitter Driver B Power Supply U4A7A3 failure. This fault will be inserted into PSR Channel B while Channel A is already in a faulted state.

Fault Type

Fault is automatically detected and isolated to single failed LRU.

Procedure

10.1 Verify that PSR Channel B is online selected and that there are no alarms indicated on the OMTs or RCPs for channel B. Note that alarms still exist in channel A due to Fault #9 remaining in that channel.

Position observers at the local and remote OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.
At the Transmitter Power Supply Cabinet U4, power off the Transmitter Driver B Power Supply A7A3.
On the local OMTs, observe that the REX/SDP A is orange (from the previous fault). Observe the REX/SDP A Maintenance Action Required (from previous fault), Tx Maintenance Action Required, and Tx Information icons. Observe that REX/SDP B indicator stays green. Observe that the Tx Driver B indicator turned red. Observe on the Transmitter Control screen, Drivers, B turns gray and indicates Driver status is unknown and Power Supplies, B turns red indicating PSU has failed. Verify that the ACK button turned red indicating the failure. Acknowledge all alarms.
On the Local and Remote RCPs, verify that the System Alarm indicator is red (from the previous fault). Verify that PSR A is orange (from the previous fault). Verify that the Selected, B indicator is green (from the previous fault). Observe that the System Alarm flashes red. Observe that the XMTR Status indicator flashes green. Verify that the ACK indicator turned orange and flashes. Acknowledge all alarms.
On the RADS, observe the loss of PSR targets. Observe that MSSR target data is still being supplied to the controller after the loss of PSR service.
On the local SCDI/OMTs, verify that on the Transmitter Status Screen, Driver Supplies, B turned red. Verify that RF Output Power, Xmtr Short Pulse, Xmtr Long Pulse and Driver B turned red and that Driver A turned gray. Verify that Automatic Fault Isolation identified U4A7A3,Power Supply, G533024-1.
Restore the system to a fault free state. Note that when restoring the transmitter, the REX/SDP will overflow and reboot. This will happen because the Adaptive Clutter Map has not had time to integrate the thresholds up. The large number of false targets will cause a reboot of the REX/SDP.

PSR FAULTS

11. Transmitter Amplifier Module Faults

Purpose

Demonstrate the graceful degradation in PSR coverage with loss of up to 2 transmitter amplifier modules.

Procedure

11.1 Verify that PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs.

11.2 Position observers at the local OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.

On the Transmitter Control screen, turn off any one of the eight Amplifier Modules. This Amplifier Module will turn orange (not red).
On the local OMTs, observe that when 7/8 Transmitter Amplifier Modules are enabled, the Tx indicator shows 7/8, the Tx Maintenance Action Required icon appears.
On the Local and Remote RCPs, verify that when 7/8 Transmitter Amplifier Modules are enabled, the System Alarm indicator turns red and flashes.
On the RADS, observe that PSR and MSSR targets are still being supplied to the controller after the loss of one transmitter amplifier module.
Turn off a second Amplifier Module. Confirm. The Amplifier Module will turn orange (not red).
On the local OMTs, observe that with 6/8 Transmitter Amplifier Modules enabled, the Tx indicator shows 6/8, the Tx Block turns red, the Tx Maintenance Action Required icon appears, and the ACK button turns red. Acknowledge all alarms.
On the Local and Remote RCPs, verify that when 6/8 Transmitter Amplifier Modules are enabled, the System Alarm indicator stays red (does not flash). Verify that the XMTR Status turns red and flashes. Verify that the ACK indicator turned orange and flashes. Acknowledge the alarms.
On the RADS, observe that PSR and MSSR targets are still being supplied to the controller after the loss of two transmitter amplifier modules.
On the local SCDI/OMT, observe that on the Transmitter Detailed Status screen, BIT reports the status of both disabled amplifiers as orange. On the Transmitter Status screen, observe that the RF Output Power, Xmtr Short Pulse and Xmtr Long Pulse turns red.
Enable power to both amplifier modules. Return the system to an alarm free state.

PSR FAULTS

12. Ethernet Fault

Purpose

Simulate loss of Ethernet A Repeater A25.

Procedure

12.1 Verify that PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs.

Position observers at the local OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.
Switch RCP to SCDI A. Remove power to Ethernet A Repeater A25.
On the local OMTs, observe that the ethernet reconfigures. Observe the SCDI A and SCDI B Maintenance Action Required icons. Observe that the ACK button turned red indicating the failure. Acknowledge all alarms.
On the Local and Remote RCPs, verify that the System Alarm indicator turns red and flashes. Verify that the ACK indicator turned orange and flashes. Acknowledge all alarms.
On the RADS, observe that PSR and MSSR targets are still being displayed to the controller after the ethernet fault.
Verify on the local SCDI Communication Interface screen that Ethernet A turned red.

PSR FAULTS

13. REX/SDP A SBC 1 Failure

Purpose

Demonstrate system operation after a Single Board Computer (SBC) failure in REX/SDP A.

Procedure

13.1 Verify that PSR A, MSSR A, and SCDI A are online selected and that there are no alarms indicated on the OMTs or RCPs.

Position observers at the local and remote OMTs and RCPs and at the RADS. Ensure normal operation at the RADS display.
Hit ABORT button on SBC 1.
On the local OMTs, observe that the REX/SDPs reconfigure. Observe that REX/SDP A block turns gray, and no Maintenance Action Required icon is shown. Observe that the Tx Driver A turns gray. Observe that the REX/SDP B Information icon appears and that the ACK button turns red. Acknowledge all alarms.
On the Local and Remote RCPs, observe that the System Alarm indicator turns green and flashes. Observe that the PSR A indicator turns gray. Observe that the Selected, B indicator turns green and flashes. Verify that the ACK indicator turned orange and flashes. Acknowledge the alarms.
On the RADS, observe that PSR and MSSR targets are displayed after the SBC failure.
On the local SCDI, observe that Fault Isolation reports the following status:

Channel A Failure/Threat Status screen (Detailed Status), all gray
Transmitter Status screen, Drivers, A turns gray
Transmitter Status screen, Interface Modules, A turns gray
Transmitter Status screen, Power Supplies, A turns gray
Transmitter Status screen, RF Output Power, Driver A turns gray
Transmitter Status screen, Emergency Inhibit Status, Duty Cyc A and Pls Wdth A turns gray
Transmitter Status screen, Stability, Driver A turns gray
SBC 1 to 3, no VME light activity
SBC 1, no RUN light

13.8 After SBC reset is complete, return the system to a fault free state.

Attachment D

ASR-11 Operational Inventory:

Functional and Human Factors Inventory Checklists

Airport Surveillance Radar, Model 11 (ASR-11)

Operational Inventory

June 27 – 29, 2000

Operator Maintenance Terminal Inventory List

FUNCTIONS

Set up

Take control

Exercise control

Release control

Exercise local workstation actions

Conduct facilities status monitoring

Review other control screens

SET UP

Actions	Expected Results	Yes/No	Comments/Notes
Review main screen Alarms window-severity 3 Information window-severity 1 & 2 Main screen help	Per training lab pages: 4-5, 5-7 & 8 4-5, 5-7 & 8 4-6
Review information event history logs	Per training lab pages 5-9 – 5-13
Review detailed status screens Antenna Transmitter REX/SDP MSSR Facility Engine Generator Site UPS	Per training lab pages: 5-13 – 5-14 5-15 – 5-18 5-19 – 5-26 5-26 – 5-27 5-37 5-38 4-19, 5-39

TAKE CONTROL

Actions	Expected Results	Yes/No	Comments/Notes
Select "Take Control" from Site Pop-up Menu	Per training lab pages 4-7 & 8

EXERCISE CONTROL

Actions	Expected Results	Yes/No	Comments/Notes
Change channel mode: on-line vs. maintenance PSR MSSR SCDI	Per training lab pages 4-9 & 10
Stop antenna rotation	Per training lab pages 4-11 & 12
Start antenna rotation	Per training lab pages 4-11 & 12
Start engine generator	Per training lab page 4-20
Stop engine generator	Per training lab page 4-20

RELEASE CONTROL

Actions	Expected Results	Yes/No	Comments/Notes
Select "Relinquish Control" from Site Pop-up Menu	Per training lab pages 4-7 & 8

EXERCISE LOCAL WORKSTATION ACTIONS

Actions	Expected Results	Yes/No	Comments/Notes
Enable/disable external printer	Per training lab page 4-18
Enable/disable audio alarms	Per training lab page 4-18
Update users	Per training lab page 4-18
Dump log file	Per training lab page 4-18

CONDUCT FACILITIES STAUS MONITORING

Actions	Expected Results	Yes/No	Comments/Notes
Open/close equipment shelter back door	Intrusion alarm
Open/close EGEN shelter door	Intrusion alarm
Fail temperature sensor at equipment shelter and return to normal	Temperature alarm
Fail smoke alarm at EGEN shelter and return to normal	Smoke alarm
Fail fire alarm system at site and return to normal	Fire alarm
Open/close site gate	Intrusion alarm

REVIEW OTHER CONTROL SCREENS

Actions	Expected Results	Yes/No	Comments/Notes
Review PSR equipment control screens Receiver Transmitter	Per training lab pages: 4-13 4-14 & 15
Review MSSR equipment control screen	Per training lab page 4-16
Review SCDI status and control screen	Per training lab page 4-17

ASR-11 Operational Inventory

Human Factors Inventory

Operator Maintenance Terminal

Name:

Date: June 27 – 29, 2000

Instructions: The purpose of this questionnaire is to help structure an inventory of the human factors design of the Operator Maintenance Terminal (OMT). Please use the OMT and then complete this questionnaire.

The left column consists of human factors considerations drawn from the "Human Factors Checklist for the Design and Evaluation of Air Traffic Control Systems" developed by the John A. Volpe National Transportation System Center. The list has been tailored for the ASR-11 system.

The middle column requests your note on whether the OMT design incorporates the human factors consideration. Is it incorporated (Y), not incorporated (N), or is the consideration not applicable (N/A)? The right column provides space for your comments or notes. If a human factors consideration has NOT been incorporated, please provide specific detail on the omission.

Human Factors Consideration	Design Inventory	Comments/Notes
Visual Displays
Information does not disappear from the display without being deleted or suppressed by the operator.	Y___ N___ N/A___
Essential information is never blocked or obstructed by other information.	Y___ N___ N/A___
All information that the operator needs to accomplish a task that is essential and time-critical is located on a single page or in a small set of windows.	Y___ N___ N/A___
Visual displays provide necessary information in a usable form when it is needed.	Y___ N___ N/A___
Display clutter is not a problem.	Y___ N___ N/A___
Symbols chosen for the display are intuitive so that the operator can interpret them quickly and accurately.	Y___ N___ N/A___
When the meaning of the color is critical, color is used redundantly with another type of visual cue.	Y___ N___ N/A___
The operator is able to recognize and differentiate between color codes under anticipated lighting conditions.	Y___ N___ N/A___
The operator will not need to identify more than five colors (to interpret the meaning of the color when it stands alone).	Y___ N___ N/A___
Color displays are readable and adequately bright under all anticipated lighting conditions.	Y___ N___ N/A___
When the operator must distinguish between the color of characters and symbols, small blue characters and symbols are not used.	Y___ N___ N/A___
Characters and symbols can be read easily under all anticipated lighting conditions (e.g., from dim light to direct sunlight, if applicable).	Y___ N___ N/A___
Saturated (i.e., vivid) red and blue are never presented next to each other.	Y___ N___ N/A___
Computer displays and controls are clearly visible and easy to use under all anticipated lighting conditions.	Y___ N___ N/A___
The active window is highlighted to distinguish it from inactive windows.	Y___ N___ N/A___
The relationship between different windows is clear to the operator.	Y___ N___ N/A___
Data changes are emphasized effectively so that it attracts the operator’s attention.	Y___ N___ N/A___
If size coding is used, it is limited to two widely different sizes.	Y___ N___ N/A___
Formats used within data fields are consistent from one display to another.	Y___ N___ N/A___
Visual displays and their labels are sufficiently visible under all anticipated lighting conditions.	Y___ N___ N/A___
Labels, terms, and abbreviations are used consistently across the display.	Y___ N___ N/A___
Only one abbreviation is used for each word or item and abbreviations are used consistently on all visual displays.	Y___ N___ N/A___
Punctuation is used conservatively and consistently.	Y___ N___ N/A___
Continuous text is presented in mixed upper-and-lower case.	Y___ N___ N/A___
Visual displays maintain good image quality even at the dimmest possible setting.	Y___ N___ N/A___
Information that the operator must read and understand quickly, such as alarms or critical error messages, never blinks or flashes rapidly (i.e., faster than 5Hz.)	Y___ N___ N/A___
Highlighting and blinking are used sparingly.	Y___ N___ N/A___
Alerts have a low incidence of false alarms.	Y___ N___ N/A___
The same color coding strategy is applied to every display used by the same operator.	Y___ N___ N/A___
The color red is used only for warning/danger.	Y___ N___ N/A___
Yellow is used to indicate caution.	Y___ N___ N/A___
Green is used to indicate for normal/ready status.	Y___ N___ N/A___
No more than two levels of blinking are used.	Y___ N___ N/A___
If blinking is used, it is cancelable by the operator.	Y___ N___ N/A___
This design effectively directs the operator’s attention by means of alerting, coding, and emphasis techniques.	Y___ N___ N/A___
Information that is blinking has an "on" period that is at least as long as the "off" period.	Y___ N___ N/A___
Auditory Alerts
Auditory alerts are used as a redundant warning mechanism.	Y___ N___ N/A___
The meanings of auditory alerts are readily apparent.	Y___ N___ N/A___
Auditory signals are not masked by other auditory alerts or background noise.	Y___ N___ N/A___
The number of auditory signals (e.g., warnings, alerts) that the operator may need to identify is fewer than five.	Y___ N___ N/A___
Auditory alerts are easily discernible from other signals or noise.	Y___ N___ N/A___
The same auditory signal always indicates the same information.	Y___ N___ N/A___
Auditory alerts are consistently implemented throughout the system.	Y___ N___ N/A___
The information contained in an auditory alert is also displayed visually.	Y___ N___ N/A___
Auditory alerts are only used when immediate action is required.	Y___ N___ N/A___
Auditory alerts are cancelable by the operator.	Y___ N___ N/A___
Auditory alerts sound until canceled by the operator.	Y___ N___ N/A___
The pause between a repeating auditory signal is less than or equal to three seconds.	Y___ N___ N/A___
Data Entry Procedures
The number of keystrokes (or other control actions) necessary to input data and the amount and complexity of data entry is kept to a minimum.	Y___ N___ N/A___
This system makes it easy to recover from data-entry errors.	Y___ N___ N/A___
Keystrokes or other data-entry actions are echoed immediately on the screen, that is, there is no delay in providing a legible representation of what has been entered.	Y___ N___ N/A___
The data entry method helps to minimize errors and provides for quick, simple data editing and correction.	Y___ N___ N/A___
This user interface system queries the operator at critical choice points, e.g., "Are you sure you want to turn the antenna off?"	Y___ N___ N/A___
The operator receives appropriate feedback on data acceptance or rejection.	Y___ N___ N/A___
The computer does not erase all or part of any erroneous data entry.	Y___ N___ N/A___
The operator controls the pace of data entry; that is, the computer does not impose time limits or time outs.	Y___ N___ N/A___
The computer does not restrict the order in which data items are entered.	Y___ N___ N/A___
Data processing is initiated only after an explicit command from the operator.	Y___ N___ N/A___
Boundaries indicate where to enter the data and show maximum field length.	Y___ N___ N/A___
A cursor appears to indicate data-entry mode and location.	Y___ N___ N/A___
Field labels use accepted terminology and are used consistently.	Y___ N___ N/A___
Command execution requires minimal operator action.	Y___ N___ N/A___
The consequences of destructive commands are explained.	Y___ N___ N/A___
Destructive commands require operator confirmation of intention before they are executed.	Y___ N___ N/A___
Command execution always occurs by explicit operator action, never as a by-product of another action.	Y___ N___ N/A___
The operator can suspend/interrupt or cancel/undo a transaction in progress.	Y___ N___ N/A___
Command ordering is consistent from screen to screen/window to window.	Y___ N___ N/A___
Command labels use accepted terminology and are used consistently.	Y___ N___ N/A___
Commands are consistent in their placement across multiple windows; in their wording; and in their method of activation.	Y___ N___ N/A___
The computer indicates the current operational mode.	Y___ N___ N/A___
Entry of long sequences of command parameters is not required.	Y___ N___ N/A___
Upper- and lower-case letters are accepted as equivalent when the operator is entering a command or command parameter.	Y___ N___ N/A___
Feedback is always given to indicate that the computer has initiated a command.	Y___ N___ N/A___
Commands should be stated in the affirmative; that is, they should tell the operator what to do, rather than what not to do.	Y___ N___ N/A___
Error messages are provided whenever needed.	Y___ N___ N/A___
Error messages are direct and precise.	Y___ N___ N/A___
Error messages are presented immediately after an error’s occurrence.	Y___ N___ N/A___
Error messages are not redundant.	Y___ N___ N/A___
Guidance messages are presented in mixed upper and lower case.	Y___ N___ N/A___
Messages about limits not met or exceeded specify the appropriate range for data entry.	Y___ N___ N/A___
Questionable data entries elicit cautionary messages.	Y___ N___ N/A___
Feedback regarding processing delays specifies the process, the length of the delay, and completion of the process.	Y___ N___ N/A___
Data Entry and Control Devices-Keyboards/Mice
If a numeric keypad is provided, it is visually separated from the main keyboard and arranged in a 3 X 3 + 1 matrix.	Y___ N___ N/A___
Keys on keyboards and keypads have no more than two functions.	Y___ N___ N/A___
Nonactive keys are left blank (i.e., not labeled).	Y___ N___ N/A___
The key used to initiate a command is clearly labeled "Enter."	Y___ N___ N/A___
Keyed data are displayed quickly (echoed) on the screen.	Y___ N___ N/A___
Tactile and auditory feedback are provided in response to keystrokes.	Y___ N___ N/A___
The main keyboard is located directly in front of and below the associated visual display, at a comfortable distance from the seated operator’s position.	Y___ N___ N/A___
If a mouse is part of the design, it can be used compatibly with all of the tasks the operator is supposed to perform.	Y___ N___ N/A___
Operators can easily and smoothly position the cursor with the mouse.	Y___ N___ N/A___
Movement of the mouse produces cursor movement in the same direction on the display. For example, if the mouse is moved to the left, the cursor moves to the left on the display.	Y___ N___ N/A___
The mouse is equally usable with the left or right hand.	Y___ N___ N/A___
The mouse has no sharp edges and meets standards for width (1.6 to 2.8 in.), length (2.8 to 4.7 in.), and thickness (1.0 to 1.6 in.)	Y___ N___ N/A___

Airport Surveillance Radar, Model 11 (ASR-11)

Operational Inventory

June 27 – 29, 2000

Radar Control Panel Inventory List

FUNCTIONS

Set up

Take control

Exercise control

Release control

Respond to alarms

Confirm status

SET UP

Actions	Expected Results	Yes/No	Comments/Notes
Test lamp indicator	Per training aid
Adjust brightness	Per training aid
Adjust volume	Per training aid

TAKE CONTROL

Actions	Expected Results	Yes/No	Comments/Notes
Press take control button	Per training aid

EXERCISE CONTROL

Actions	Expected Results	Yes/No	Comments/Notes
Facilities
Start antenna rotation	Per training aid
Stop antenna rotation	Per training aid
Start engine generator	Per training aid
Stop engine generator	Per training aid
Radar
Change selected channel PSR MSSR SCDI	Per training aid
Change channel mode: on-line vs. maintenance PSR MSSR SCDI	Per training aid
Change antenna polarization (automatic/manual status and control issue)	Per training aid

RELEASE CONTROL

Actions	Expected Results	Yes/No	Comments/Notes
Press release control button	Per training aid

RESPOND TO ALARMS

Actions	Expected Results	Yes/No	Comments/Notes
Facilities
Antenna rotation start	Per training aid
Antenna rotation stop	Per training aid
Engine generator start	Per training aid
Engine generator stop	Per training aid
Radar
Change in selected channel PSR MSSR SCDI	Per training aid
Change in channel mode: on-line vs. maintenance PSR MSSR SCDI	Per training aid
Change in antenna polarization Automatic switch Manual switch	Per training aid

CONFIRM STATUS

Actions	Expected Results	Yes/No	Comments/Notes
Transmitter-requires module failure	Per training aid
Panel-requires panel failure	Per training aid
System Online-requires loss of PSR, MSR, or both	Per training aid
UPS Status-requires UPS fault	Per training aid
Power status-requires going to EGEN, then failure of EGEN	Per training aid
System Alarm-requires failure	Per training aid

ASR-11 Operational Inventory

Human Factors Inventory

Radar Control Panel

Name:

Date: June 27 – 29, 2000

Instructions: The purpose of this questionnaire is to help structure an inventory of the human factors design of the Radar Control Panel (RCP). Please use the RCP and then complete this questionnaire.

The middle column requests your note on whether the RCP design incorporates the human factors consideration. Is it incorporated (Y), not incorporated (N), or is the consideration not applicable (N/A)? The right column provides space for your comments or notes. If a human factors consideration has NOT been incorporated, please provide specific detail on the omission.

Human Factors Consideration	Design Inventory	Comments/Notes
Visual Displays
Information that the operator needs, for example, alerts, does not disappear from the display without being deleted or suppressed by the operator.	Y___ N___ N/A___
The display responds quickly.	Y___ N___ N/A___
When the meaning of the color is critical, color is used redundantly with another type of visual cue, such as shape, backlighting, or location.	Y___ N___ N/A___
The operator is able to recognize and differentiate between color codes under anticipated lighting conditions, i.e., range of 5 to 6000 foot-candles.	Y___ N___ N/A___
The operator will not need to identify more than five colors (to interpret the meaning of the color when it stands alone).	Y___ N___ N/A___
Color displays are readable and adequately bright under all anticipated lighting conditions.	Y___ N___ N/A___
Characters and symbols can be read easily under all anticipated lighting conditions (e.g., from dim light to direct sunlight, if applicable).	Y___ N___ N/A___
Data changes are emphasized effectively so that it attracts the operator’s attention.	Y___ N___ N/A___
Acronyms used in the new display are intuitive and easy to understand.	Y___ N___ N/A___
Terms used in the new display are intuitive and easy to understand.	Y___ N___ N/A___
Visual displays and their labels are sufficiently visible under all anticipated lighting conditions.	Y___ N___ N/A___
Labels, terms, and abbreviations are used consistently across the display.	Y___ N___ N/A___
Only one abbreviation is used for each word or item and abbreviations are used consistently on all visual displays.	Y___ N___ N/A___
Visual displays maintain good image quality even at the dimmest possible setting.	Y___ N___ N/A___
Information that the operator must read and understand quickly, such as alarms or critical error messages, never blinks or flashes rapidly.	Y___ N___ N/A___
Highlighting and blinking are used sparingly.	Y___ N___ N/A___
Alerts have a low incidence of false alarms.	Y___ N___ N/A___
The color red is used only for warning/danger.	Y___ N___ N/A___
Yellow is used to indicate caution. For the ASR-11, yellow indicates the component is in maintenance status and is not available for use.	Y___ N___ N/A___
Green is used to indicate for normal/ready status.	Y___ N___ N/A___
No more than two levels of blinking are used.	Y___ N___ N/A___
If blinking is used, it is cancelable by the operator.	Y___ N___ N/A___
This design effectively directs the operator’s attention by means of alerting, coding, and emphasis techniques.	Y___ N___ N/A___
Information that is blinking has an "on" period that is at least as long as the "off" period. (The recommended rate is 2-3 Hz. Hertz =one cycle per second).	Y___ N___ N/A___
Auditory Alerts
Auditory alerts are used only when necessary and as a redundant warning mechanism.	Y___ N___ N/A___
The meanings of auditory alerts are readily apparent.	Y___ N___ N/A___
Auditory signals are not masked by other auditory alerts or background noise.	Y___ N___ N/A___
The number of auditory signals (e.g., warnings, alerts) that the operator may need to identify is fewer than five.	Y___ N___ N/A___
Auditory alerts are easily discernible from other signals or noise.	Y___ N___ N/A___
Auditory alerts do not provide more information than is necessary.	Y___ N___ N/A___
Auditory alerts are consistently implemented throughout the system.	Y___ N___ N/A___
The information contained in an auditory alert is also displayed visually.	Y___ N___ N/A___
Auditory alerts are only used when immediate action is required.	Y___ N___ N/A___
Auditory alerts are cancelable by the operator.	Y___ N___ N/A___
Auditory alerts sound until canceled by the operator.	Y___ N___ N/A___
The pause between a repeating auditory signal is less than or equal to three seconds. .	Y___ N___ N/A___

Airport Surveillance Radar, Model 11 (ASR-11)

Operational Inventory

June 27 – 29, 2000

Video Display Control Unit (VDCU)

FUNCTIONS

Set up

Change target display

Change weather display

Confirm status

SET UP

Actions	Expected Results	Yes/No	Comments/Notes
Adjust brightness level	Brightness levels increase and decrease across screen 8 step range
Adjust audio level	Audible touch feedback volume increases and decreases Lowest level can be heard 8 step range
Turn audio on/off	When off, no audible touch feedback When turned on, audible touch feedback is heard When turned off then back on, the audible feedback volume is at a midpoint level
Select predetermined brightness levels High Medium Low	3 discernable brightness levels are visible

CHANGE WEATHER DISPLAY

Actions	Expected Results	Yes/No	Comments/Notes
Select weather display mode Discrete	VDCU-Top half of button, labeled DISC, highlights. RADS-Selected high and low level weather, only, displayed.
Select weather display mode Summation	VDCU-Lower half of button, labeled SUM, is highlighted. RADS-All weather levels, summed up from low and high thresholds, displayed.
Select weather intensity level display thresholds while in discrete mode High level threshold Low level threshold	Numbered, level button highlights. High level: Upper half of corresponding HI/LO button, labeled HI, highlights. Low level: Lower half of corresponding HI/LO button, labeled LO, highlights. All other HI/LO buttons are not highlighted.

CHANGE WEATHER DISPLAY (continued)

Actions	Expected Results	Yes/No	Comments/Notes
Select weather intensity level display thresholds while in summation mode High level threshold Low level threshold	Numbered, level button highlights. High level: The HI/LO buttons corresponding to the levels at and above the selected high level highlight HI. Low level: The HI/LO buttons corresponding to the selected low level, and up to the selected high level, highlight LO. Any HI/LO buttons below the selected low level are not highlighted.

CHANGE TARGET DISPLAY

Actions	Expected Results	Yes/No	Comments/Notes
Select target display Mapped	VDCU- button labeled MAP highlights. RADS-all correlated, and uncorrelated targets within a mapped area, are displayed .
Select target display Correlated	VDCU - button labeled COR highlights. RADS – Correlated targets, only, displayed.
Select target display Uncorrelated/Correlated	VDCU – button labeled COR/UNCOR highlights. RADS – correlated and all uncorrelated targets displayed.

CONFIRM STATUS

Actions	Expected Results	Yes/No	Comments/Notes
Observe weather level availability	VDCU – buttons labeled AVL highlight when the associated level of weather is available.

ASR-11 Operational Inventory

Human Factors Inventory

Video Display Control Unit

Name:

Date: June 27 – 29, 2000

Instructions: The purpose of this questionnaire is to help structure an inventory of the human factors design of the Video Display Control Unit (VDCU). Please use the VDCU and then complete this questionnaire.

The middle column requests your note on whether the VDCU design incorporates the human factors consideration. Is it incorporated (Y), not incorporated (N), or is the consideration not applicable (N/A)? The right column provides space for your comments or notes. If a human factors consideration has NOT been incorporated, please provide specific detail on the omission.

Design	Design Inventory	Comments/Notes
Visual Displays
Information that the controller needs does not disappear from the display without being deleted or suppressed by the controller.	Y___ N___ N/A___
The display responds quickly.	Y___ N___ N/A___
All information that a controller needs to accomplish a task that is essential and time-critical is located on a single page or in a single window.	Y___ N___ N/A___
The display provides necessary information in a usable form.	Y___ N___ N/A___
Characters and symbols can be read easily under all anticipated lighting conditions, e.g., from dim light (5 fc) to direct sunlight (6000 fc).	Y___ N___ N/A___
The position and form of displayed objects appear the same to the controller while seated directly in front of the display as they do from other anticipated viewing angles.	Y___ N___ N/A___
Data changes are emphasized effectively so that it attracts the controller’s attention.	Y___ N___ N/A___
Acronyms in the new display are intuitive and easy to understand.	Y___ N___ N/A___
Terms used in the new display are meaningful.	Y___ N___ N/A___
Visual displays and their labels are sufficiently visible under all anticipated lighting conditions.	Y___ N___ N/A___
Labels, terms, and abbreviations are used consistently across the display.	Y___ N___ N/A___
Only one abbreviation is used for each word or item and abbreviations are used consistently on all visual displays.	Y___ N___ N/A___
Visual displays maintain good image quality even at the dimmest possible setting.	Y___ N___ N/A___
Information that the controller must read and understand quickly, such as alarms or critical error messages, never blinks or flashes rapidly.	Y___ N___ N/A___
High priority alerts and other critical information are located within the central display area (the central 15 degrees of the area where the controller normally looks, given the normal viewing position).	Y___ N___ N/A___
Highlighting and blinking are used sparingly.	Y___ N___ N/A___
Alerts have a low incidence of false alarms.	Y___ N___ N/A___
No more than two levels of blinking are used.	Y___ N___ N/A___
If blinking is used, it is cancelable by the controller.	Y___ N___ N/A___
This design effectively directs the controller’s attention by means of alerting, coding, and emphasis techniques.	Y___ N___ N/A___
Information that is blinking has an "on" period that is at least as long as the "off" period. (The recommended range is 2-3 Hz. Hertz = one cycle per second.)	Y___ N___ N/A___
Auditory Alerts
Auditory alerts are used only when necessary and as a redundant warning mechanism.	Y___ N___ N/A___
The meanings of auditory alerts are readily apparent.	Y___ N___ N/A___
Auditory signals are not masked by other auditory alerts or background noise.	Y___ N___ N/A___
The number of auditory signals (e.g., warnings, alerts) that the controller may need to identify is fewer than five.	Y___ N___ N/A___
Auditory alerts are easily discernible from other signals or noise.	Y___ N___ N/A___
Auditory alerts do not provide more information than is necessary.	Y___ N___ N/A___
Auditory alerts are consistently implemented throughout the system.	Y___ N___ N/A___
The information contained in an auditory alert is also displayed visually.	Y___ N___ N/A___
Auditory alerts are only used when immediate action is required.	Y___ N___ N/A___
Auditory alerts terminate when canceled by the controller.	Y___ N___ N/A___
Auditory alerts are cancelable by the controller.	Y___ N___ N/A___
Auditory alerts sound until canceled by the controller.	Y___ N___ N/A___
The pause between a repeating auditory signal is less than or equal to three seconds.	Y___ N___ N/A___
Data Entry and Control Devices-Touchscreens
Controllers can achieve sufficient touch accuracy with the touchscreen, i.e., active area can be accessed without promoting input error.	Y___ N___ N/A___
Touchscreen displays can be read easily under all anticipated lighting conditions.	Y___ N___ N/A___