AlllQl 310513

NBSIR 82-2656

Simulation of the Guard Control

Station in a Computerized Site

Security Monitor and Response

System

U.S. DEPARTMENT OF COMMERCE

National Bureau of Standards

Center for Computer Systems Engineering

Institute for Computer Sciences and Technology

Washington, DC 20234

January 1 983

Task Code B99QMXPF

Work Unit 00065

Sponsored by.

•Defense Nuclear Agency

lA/ashington, DC 20305

NATIOHAL BUKtAu QF STANDAED8

- c \CC > OlC IQ'O

NBSIR 82-2656

SIMULATION OF THE GUARD CONTROL

STATION IN A COMPUTERIZED SITE C. I SECURITY MONITOR AND RESPONSE

SYSTEM

R. T. Moore

A. W. Holt

A. L. Koenig

A. Mink

G. Nacht

U.S. DEPARTMENT OF COMMERCE

National Bureau of Standards

Center for Computer Systems Engineering

Institute for Computer Sciences and Technology

Washington, DC 20234

January 1 983

Task Code B99QMXPF

Work Unit 00065

Sponsored by:

Defense Nuclear Agency

Washington, DC 20305

U.S. DEPARTMENT OF COMMERCE, Malcolm Baldrige, Secretary

NATIONAL BUREAU OF STANDARDS, Ernest Ambler, Director
r- Vi j

awth*

iOfnwo'?a«AtiO 3HT =)0 woiTAjun/ua

3TI3 a^sinaru'^Moo a mi moitate

3aMO«?33a OMA ?10TIMOM YTI«UD3E

VI 3TEVE

^1

n

'.IH

wmioM T tW

df illoH ^ A

JmM A

jrtafeW 0 .

(!9

iO«3MM03 "?0 TH3MrflAA3CI .a.U »^6)}mli3 »o v««^yS tfBntH»e(4 emfitiyd »oJtKj/noD iQ' '«in*3 “I vjjtiJAOf^MV bn»i »6awK>8 teJuqn>o3 *3 a:»t»n|

'?•

^E£OS D<? »ooi8

ni«!(*iiW^

«

?r eo€ !

, ^XWTJCCQ K«ftT ^doa) r*ftU rfiow-

•' 'I

^

'V yd boi<?!rioQ3

' yan&^A isolpul^ oeKtiltO

20^05 I»0 .(JOiQn^desW

.»/'J

&A.r

mlcKrfs^M ,30J^3I^M00^30 TM3MTflA^30 E-Ai

,Wl<lf*A Jiw^wa ,8QflACWAT« 10 UAH^lUa JA^OITAil

i . R* c:

' t
TABLE OF CONTENTS

Page

INTRODUCTION 1

Design Objectives 4

Features Contributing to Reliability 4

Features Contributing to Ease of Operation 5

Purpose of the Mock-up 6

INITIAL DESIGN 8

SYSTEM CONFIGURATION 9

Description of the GCS Console 11

Digital Display Unit (A) 12

Sonic Alarms (B) 17

CCTV Monitors (C, D) 17

CCTV Monitor Display (E, F) 17

Key Port (G) 18

Voice Unit Speaker (H) 19

Status Summary Display (I) 20

Monitor Pointing Switch (J) 22

Acknowledge (K) 25

10-Digit Keypad and Display (L, M) 25

Select Zone (N) 27

Zone Selected Display (0) 27

CCTV Controls (P, Q, R) 27

TV OK/Bad (S) 28

Lights On/Off (T) 30

Voice Of f /On/Repeat (U) 30

Test Controls (V) 30

Login and Logout (W and X) 32

Scroll Control (Y) 32

Key Life (Z) 33

Code Key (AA) 33

Code Master Key (BB) 33

Send Key Control (CC) 34

Send Master Key Control (DD) 34

Lock/Enable Control (EE) 35

Call BAF (GG) and Call ARF & BAF (FF ) 35

Arm FEDS Control (HH) 36

Safe FEDS (II) 36

Fire FEDS (JJ) 37

Confirm (KK) and Cancel (LL) 37

-iii-
Reset Alarm (MM) 37

Date Display (NN) 38

Time Display (00) 38

GCS HARDWARE DESCRIPTION 38

Console Processor Interface Boards 39

GCS Special Interface Boards 39

Switch Debounce 40

Lamp Drivers 40

LCD Decoder/Drivers 41

Keypad/lO-digit Display 41

Monitor Pointing Switch 42

CCTV Subsystem 43

Cameras 43

Video Switcher 43

Camera Controls 43

Camera Motor Drive 44

Voice Unit 44

Sonic Alarms 4 5

Console Shell 45

Cabling 46

Power Supplies 46

SIMULATION SOFTWARE 46

Software Design 47

The Console Process 48

The Scheduler 48

The Device Driver 48

The Clock 50

The Message Handler 50

The Message Handler and the DDU Manager 5 3

The DDU Updater 53

The Console Monitor 53

The Light Monitor 53

The Scroller 54

The Debugger 54

-iv-
The Event Process 54

Console Handler 56

Director Handler 58

Debugger 59

The Director Process 60

EXPERIMENTS USING THE SYSTEM 60

Validation of System Performance 61

Preparation of Training Materials 62

Tests of Training Materials 64

Test by an Electronics Technician 64

Test by a Secretary 64

Training of Military Personnel 65

SUMMARY AND CONCLUSIONS 66

Console Design Changes 67

10-Digit Keypad 67

Selected Zone Status Display 68

Organization of Status Display on DDU 69

Login/Logout 70

CCTV Facilities 70

Pan/Tilt/Zoom Control 71

Monitor Pointing Switch 71

Scroll Control 71

Emergency Controls 72

Key Port 72

Electronic Key 72

Writing Shelves 72

Summary of Changes 7 2

Conclusions 75

Director Software 75

GCS Video 76

Features Not Implemented 76

BIBLIOGRAPHY AND REFERENCES 77

GLOSSARY OF ACRONYMS AND ABBREVIATIONS 78

APPENDIX 1 79

-V-
Outline of GCS Console Instruction Course 79

A Sample Scenario 85

APPENDIX II 92

Summary of Responses to Request for Comments 92

-vi-
LIST OF FIGURES

Page

Figure lA. Block Diagram of CSSMRS 2

Figure IB. Expanded Block Diagram of CSSMRS 3

Figure 2 . Guard Control Station 10

Figure 3 . Overview of the GCS Console 12

Figure 4 . Digital Display Unit 13

Figure 5 . Alarm Message 14

Figure 6 . More Alarms Message 14

Figure 7 . Zone Specific Alarm Information 15

Figure 8 . A Guidance Message at the Bottom of the Display ... 16

Figure 9 . Right-hand Monitor Pair 18

Figure 10 . Left-hand Monitor Pair 19

Figure 11 . Site Status Summary Display 20

Figure 12 . Horizontal Console Panel 22

Figure 13 . Center Group of Controls 23

Figure 14 . Right-hand Control Group 26

Figure 15 . Left-hand Control Group 29

Figure 16 . Block Diagram of the Console Process 49

Figure 17 . Organizational Block Diagram of Event Process Software . 55

Figure 18 . Arrangement of CCTV Cameras and Still Pictures ... 63

Figure 19 . Console Back Panel 73

Figure 20 . Console Table Top 74

LIST OF TABLES

Table 1. Site Status Summary Display 21

Table 2. Functions of the Monitor Pointing Switch 24

Table 3. Test Control Functions 31

Table 4. List of Messages from Console Process to Event Process, . 51

Table 5. List of Messages from Event Process to Console Process . 52

Table 6. List of Messages from Director Process to Event Process . 57

Table 7. List of Messages from Event Process to Director Process . 58

Table 8. Color Code for Zones 0-9 68

-vii-
Si, *• ett . M

ai

m

u

n

. . #

i$

d5

it

tx

rA

, , . asiMeao >0 X’>0f3 .AI y>ug^1

•• «' "Sf»/^'rasssWi?® • ;’! r.11;

. ,* . fila«fw>0 ?3a »it;f .^0 n»rv^»vO • r * iffir VA WO ,< i

/

^ ^6M V 3

* ViucR

; >.*

^ , ,

. , . _ - ^ loJfnoM bnw1-idofS( . Q

^ , . . « . . . -lo^InnW b^5Ji-^TeL) , 01

. , . . . , . y;:ii«ir>u2 Situ

, / . . , . . , f»nft^ dfoanol fftinoxHOH

, . , , ^

. ft*. / . efcntnoD ^0 quo^S

* . . . * dW<riiO r<ntiK»0 bnw<-tH9f«

^ . . . . . quarts fcrttW)? bnwi-tl5J

, . . e»900T^' afoanop*?*!! 1o wtnbttO ^l^oTS

stswj^o^ t/tfivl %o fis'TOitO toft Unortfis^nte^,

b«« eti9f7i»3 VTD3*^b tBSMCfift-nA

, . ^ * r, • • Nn«t jI^aS sfoinoO

, , . . - . qot ifdfiT 0fo2noD

• -Z f

II

SI iiuenj

,£I snugH'

'TH St srtugf' ax s'lugMl

VI

81 aiagf^jf

91 oriugt^

OS

23J8AT

^ tttj

. , . * , . , y"twwu2 etol2 atU

. , * . rbtfw? enltfflo^^ toilnoM artj W awftaniil

, « . ,r

. . * ^nrjft:inu3 fo^tnoO ieaT

itwym^ 1W% ot afoafrtiJ iw*»^ ?9g«««H “to t?f J

srwfKji) tftaxrt*? tnav3 *m> "to taU

trtdvi oj ‘»o^f ?fiC62asH 'to tafJ

"fOtseitO ot zzit^<yi^ tn9v3 «wn^ ^sgaaaaW .to ta.U ^ - 0 aanol lot aboO lofoO

* i> ^

' #
simulation of the Guard Control Station

in a Computerized Site Security

Monitor and Response System

R. T. Moore

A. W. Holt

A. L. Koenig

A. Mink

G. Nacht

This report describes a mock-up of a Guard

Control Station that was used in simulating the

performance of this component of a Computerized

Site Security Monitor and Response System. The

mock-up was interconnected to three microcomputer

systems in an arrangement that permitted simulation of physical security scenarios in an interactive mode. Seven different individuals were allowed to act as operators of the Guard Control

Station Console following a brief period of training. Based both on observations of their actions

and on their comments, it was determined that the

CSSMRS concepts were effective and easy to learn.

The Console was judged to have met most design objectives, but certain controls and displays were

identified as candidates for minor modification or

relocation to further improve the overall effectiveness of the console.

Key words: alarm annunciation; physical security;

security systems; simulation.

INTRODUCTION

The Computerized Site Security Monitor and Response

System (CSSMRS) [1] was conceived as an integrated, computer

based system that could enhance the physical security of

storage sites for nuclear weapons and materials through the

use of state-of-the-art technology. It proposed a distributed network of microprocessors, each associated with the

security measures allocated to a protected zone. These

measures might include sensors to detect an intrusion, physical or psychological deterrents to forced entry, closed

circuit television to assess sensor alarms, and features to

aid in the control of access to that zone.

- 1 -
Each of these remote microprocessors communicates with

a central, triply redundant, computer system via a dual

loop, fiber optic, CROSSFIRE [*] data communications network.

The central computer complex maintains a continuously updated record of the status of each of the security zones. It

presents appropriate information and instructions to each of

the two Guard Control Stations, (GCS) as well as to higher

command levels. It receives, relays, or executes commands

from the GCS. A highly simplified block diagram of CSSMRS

is shown in figure lA.

O

A

/ \

/ \

perator

Figure lA. Block Diagram of CSSMRS.

In figure IB, the block diagram of the CSSMRS has been expanded somewhat to show additional functional details.

[*] The CROSSFIRE data link is an invention of Arthur

W. Holt.

- 2 -
Figure IB. Expanded Block Diagram of CSSMRS.

- 3 -
The CSSMRS was designed to provide timely, accurate and

unambiguous information about the site security status and

the progress of any attempted intrusion. To the extent that

is feasible, appropriate response initiatives are programmed

into the system. Changes in site security status and the

resulting response actions are automatically reported upchannel to higher command levels. Backup and reserve forces

are automatically called out in the event of certain identifiable threat situations, particularly those in which the

continued survival of local guard forces might be in doubt.

Design Objectives

While the overall design objective of CSSMRS was that

of providing improved physical security, it was recognized

that this objective could only be realized with a robust,

reliable system, that is easy to use, and is tolerant of human foibles. Users of an unreliable system will not develop

confidence in it. Even when an unreliable system is functioning correctly, there may be an element of residual doubt

about the correctness of its operation. A system that is

difficult to learn to use or to use, will cause the user to

perform more slowly, commit more errors, or both.

Features Contributing to Reliability

Some of the more significant CSSMRS design features

that contribute to system reliability and integrity include

the following:

The CROSSFIRE data link connecting the remote microprocessors with the central computer complex (CU) uses a dual

loop fiber optic channel that does not produce compromising

emanations and is immune to electromagnetic interference.

The arrangement is highly tamper resistant, and communication cannot be lost as a result of any single break, even of

both fibers as described in [1] . Signalling is at a rate

that permits the use of inexpensive, lightly stressed, components but still permits response times that are short compared to human reaction times. The use of dual loops together with a continuous polling mode of operation makes it

possible to immediately detect and localize any outage.

Communications between the site and higher headquarters

are conducted over two different, alternately routed, hard

wire, circuits. Continuous testing insures the prompt

detection of any fault in either of these redundant circuits.

- 4-
The central computer complex is triply redundant.

Correct system operation continues as long as any two of

these three computers are operational, A fourth computer is

on ready stand-by for plug-in replacement if any one of the

three working units should fail.

The use of mechanically rotating memory components has

been banned throughout the system. This single design

feature eliminates a major, if not the major, cause of computer system failures.

Two independent Guard Control Stations are provided.

Either one of these is capable of performing all necessary

man/machine interface functions. This provides an opportunity for load sharing as well as providing reliability

through redundancy.

Alternative back-up power sources have been specified

for all system components. There is a back-up for the

back-up at the central station, and the weapon storage magazines are equipped with an emergency, manual override for

the electronic lock[*] that does not require electrical

power to operate.

Features Contributing to Ease of Operation

The general arrangement of the GCS console is based on

the human engineering design criteria set forth in MILSTD-1472A [2]

Other features that contribute to the ease

of learning to operate the system include the following:

Minimal special skills are required of an operator.

The GCS operator does not have to know how to type in order

to operate the system. All controls are functional, and labeled in simple, easy to understand terms. The selection of

primary controls that are candidates for actuation under any

given circumstance is guided by illuminating those controls.

Flashing lights indicate "must choose” options. Steady

lights indicate reasonable but non-mandatory choices. Guidance messages are provided in the event an inappropriate

control is actuated. Certain critical and potentially consequential actions require that the action be confirmed before it is executed. This provides protection against accidentally invoking one of these actions.

[*] The electronic lock is an invention of Jacob Rabinow and Arthur W. Holt,

- 5-
Closed circuit television (CCTV) coverage of a zone is

automatically selected and presented to the GCS operator

whenever an alarm occurs in that zone. This permits immediate assessment prior to any action on the part of the operator. This is particularly useful in protecting against high

speed penetration of an outer perimeter zone where the penetrator is within the field of view of the camera for only

two or three seconds.

Information is presented to the operator both visually

and audibly. Alarms are accompanied by a series of sonic

alerts, and acknowledgement must be made in less than 40

seconds or reserve forces (BAF) are called out automatically. Alarm information is displayed on a Digital Display

Unit (DDU) , and is also articulated by a speech synthesis

system. The last audible message may be repeated by the

operator on command.

Special steps have been taken to protect the operator

from information overload. When there are multiple alarms,

the details about only one of them are presented to the

operator. The display does indicate the number of other

alarms so that the operator is aware of the backlog without

being overwhelm.ed by its detail. Alarms, other than the one

currently being displayed, are held in a rotary queue. They

can be brought up sequentially by actuating a single control. The operator does not have to know the identity of any

alarmed zones to call them up on the display.

Site status information is displayed whenever any zone

is selected that is not in an alarm condition. In addition,

overall site summary information is displayed by a cluster

of colored indicator lamps for quick look assessment by supervisory personnel.

Controls for the Pan, Tilt and Zoom functions of CCTV

cameras that are so equipped have been human engineered so

that the hand motions are the same as required if the operator were holding the camera in his hand.

Purpose of the Mock-up

The Guard Control Station mock-up (GCS) was assembled

to provide a test bed that could be used with computer simulation to test and evaluate the various novel design

features affecting the man-machine interface in the CSSMRS.

In particular, it was intended to provide information about

the ease or difficulty that non-technical personnel would

have in learning to use the system, and to show whether or

- 6 -
not that use would be direct, easy, and relatively error

free. It was expected to help provide answers to questions

of the following types;

Do users find that the Guard Control Station is friendly

or intimidating? Hopefully, the increasing availability and popularity of video games may have provided opportunities for many non- technical individuals

to use computer based devices and learn to feel comfortable with them.

Are the locations of the controls and indicators handy

and easy to use and do they have clear and easily understood labels and nomenclature? This was a major

objective in the layout of the GCS, but only actual

operating experience would reveal how well that objective has been attained.

Are the cues and guidance messages adequate to support

effective operation of the GCS by an operator with

limited technical background and minimal training?

Extensive audible and visual cues have been provided

including sonic alarms, voiced messages, and the use

of colors and lights in the controls and indicators.

Are the displays, including both graphics and video,

adequate in terms of size, resolution, location, and

information content?

These and related questions could best be answered by

the construction of a GCS that could be used in a simulation

environment to provide a highly realistic demonstration of

the behavior of such a station in a real CSSMRS. Such a model would provide nearly all of the audible, visual and

tactile stimuli to its operator that would be provided by a real GCS. It would react to his responses in the same way

as a real GCS. By teaching operators to use the GCS and by

observing their actions during the conduct of threat

scenarios on the simulator, it was expected that insight

could be gained regarding the adequacy of the GCS design and

its interaction with the balance of a CSSMRS.

- 7 -
INITIAL DESIGN

A detailed set of performance specifications was

developed from a general description of the GCS component of

CSSMRS [1] . These were in the form of state descriptions

and contained a list of all GCS controls, indicators, and

displays, and reflected their response to differing stimuli.

A complete state space description for the GCS was

found to be too large to be accomplished within available

resources. Instead, a number of major conditions were identified, which could co-exist at the same time. A state

space description of each of these major conditions was

specified which assumed the major conditions existed independent of each other. During a second iteration of

these independent state spaces, an attempt was made to

include variations resulting from the co-existence of

other major conditions. The resulting specifications provide a description for each state of each major condition. This description consists of the current condition of

the GCS (its initial state), the action causing a transition

and the resulting condition of the GCS (its next state)

.

The condition of the GCS, as described includes the controls

that are active, the illumination state of each indicator and control, the contents of each CCTV monitor, any

messages on the DDU that are of concern to the current

state, and the contents of a new message and its disposition

for the DDU, the Voice Unit and the Logging Printer.

Specifications for the physical layout of the Console

portion of a GCS were taken from the MIL-STD-1472A [2]

.

A

cardboard mock-up was made so that experimentation with

various positions and combinations of the controls, indicators and displays could be conducted.

At this point it was necessary to consider the fabrication of the GCS Console, the hardware to be used, and

the software required to drive the hardware. For the sake

of expediency and economy, the selection of hardware and

software were based on availability and familiarity rather

than optimization of function and speed.

The hardware would be centered around existing, available processors. The GCS Console, its lights, switches,

displays, and the interfaces between them, and the processors would be obtained commercially, if they were

available. Otherwise they would be custom designed and fabricated .

- 8 -
The software would be written in the C language [*

]

with some assembly language where necessary. Three

cooperating processes were involved in the software design.

One, the Console Process, was to service the console inputs

and outputs. The second, the Event Process, was to service

and maintain the history of events from the individual zones

via the C.U. and from the Console Process. A third process, the Director Process, was also required to coordinate

events and simulate the C.U. and the actions that could occur at the various zones.

Each process was placed on a separate processor. This

allowed the Console Process to run stand alone in a polling

mode, while the other processes were run under UNIX [3] [4]

an interupt driven operating system. Running under an

operating system was possible only for this mock-up, since

time was not as critical for the Event and Director

processes as it was for the Console Process. UNIX also

served as the development system environment.

These initial design decisions led to an efficient implementation of the GCS simulation model in a straightforward manner.

SYSTEM CONFIGURATION

The principal GCS components of CSSMRS in this simulation model are shown in figure 2. They consist primarily of

three parts, the Console itself, the Console Process and the

Event Process. GCS features detailed in NBSIR 79-1725 that

were not implemented in this model include the Logging

Printer, the Audio Recorder, the Geographies Display Unit,

the Radio, Telephone and Intercommunications facilities, and

the Duress alarm functions.

The Console is the principal interface between the

Operator and CSSMRS. It provides the Operator with closed

circuit television (CCTV) pictures of the site, interactive

controls, and both audio and video messages. The messages

can be of three types; routine status messages, alarm messages, or operator guidance messages. Status messages may

describe the state of equipment or conditions on the site.

[*] UNIX is a trademark of Bell Laboratories.

- 9 -
I 1 - _ iCU '

1 ”

I /N

/ \

Operator

Figure 2. Guard Control Station

such as malfunctioning sensors, presence of uncleared alarm

conditions, or zones in access condition. A new alarm condition replaces status messages and demands positive acknowledgement by the Operator. When that acknowledgement occurs, the message is expanded to provide details about the

nature of the alarm and suggested Operator actions. Operator guidance messages are presented to indicate results of

tests, candidate Operator actions, or actuation of an inappropriate control. As a message is presented to the Operator on the Digital Display Unit (DDU) , it is also vocalized

by a Voice Unit. Controls on the Console allow the Operator

to either have the last voice message repeated if desired,

or to turn the Voice Unit off if the audio is distracting.

The function of the Console Process is to service the

Console. It polls the state of the Console's controls and

detects any changes. It exchanges messages with the Event

Process and maintains a necessary subset of the System's database for its use. It checks the legality of the

Operator's actions and generates guidance messages for certain incorrect actions. It reflects the current state of

the site by various indicator lights on the Console, messages displayed on the DDU, and outputs by the Voice Unit.

The function of the Event Process is the maintenance of

the System's database, i. e., the history of events from the

Console Process and the CU . It maintains a detailed list of

the state of each zone (secure, accessed, alarmed, etc.,)

and the state of each Sensor and Forced Entry Deterrent device (FED) at each zone (disabled, active, alarmed, etc.,).

- 10 -
It maintains a list of all DDU messages currently resident

at the Console Process. The Event Process communicates with

the Console Process and with the CU. In many cases the

Event Process is able to determine the preferred choice of

Operator response to the current site status and, via messages to the Console Process, issue guidance prompts to the

Operator

A third process, the Director Process, was necessary to

simulate actions at the various zones which were forwarded

via the dual loop communications network, filtered through

the CU, and passed to the GCS . This was the means by which

sensor alarms, maintenance functions, equipment failures,

and other zone and CU events were simulated. Since this

Process is not actually part of the GCS model, it will not

be discussed in depth in this report.

Each of the processes was placed on a separate processor. The reasons for this were dictated by requirements and

system considerations and will be discussed in later sections of this report. Modified 16-bit parallel ports were

used for communications between processes. Since the standard circuit cards for these ports were designed for communication between a processor and a peripheral device, they

had to be modified for a processor-to-processor communication link.

Description of the GCS Console

The

sole is

pedestal

on the

ter face

pedestal

switches

GCS Simulation Model is shown in figure 3. The Conmounted on a dual pedestal base where each

is a standard 19 inch equipment rack. The pedestal

left side contains the Console Processor, inand driver circuit cards, and power supplies. The

on the right side contains the Voice Unit and video

for the CCTV's.

The vertical portion of the Console may be considered

as four functional sections: the Left and Right CCTV Monitors Sections, the Status Summary Display and the

DDU Section. These will each be described in detail below.

The letters in the illustrations are used to identify the

various components of the System in the descriptions that

follow.

- 11 -
Figure 3. Overview of the GCS Console

Digital Display Unit (A)

The Digital Display Unit, DDU, figure 4, is central to

the GCS. It is a 30.5 cm (12 inch) diagonal screen cathode

ray tube capable of displaying information using a format of

24 lines of 80 characters each. It is also capable of

displaying special information using any combination of double width or double height characters. For this simulation model the DDU displays four classes of information:

new alarm information, alarmed zone information, status

information and guidance messages. These messages were also

audibly annunciated when they were initiated.

- 12 -

L
Figure 4. Digital Display Unit

When an alarm occurs (a sensor has been activated) , the

information currently displayed on the DDU is removed and

replaced with a special "Acknowledge" request to the

Operator, figure 5. This also starts an audio alarm sequence which will be explained later. Other new alarms

cause a "More Alarms" message to be added to the screen,

figure 6.

All new alarm messages are double wide except for the word

"Acknowledge", which is double height and width. When

the Operator acknowledges the new alarm then, depending

on the state of the zone, the DDU will display either site

status information or alarmed zone information.

- 13 -
Figure 5. Alarm message.

- 14 -
If the Console controls are associated with or logically attached to an alarmed zone, then the information

displayed on the DDU is specific to that zone, figure 7.

It will tell the Operator, for example, which sensors at

that zone are alarmed, which equipment at that

zone is malfunctioning, the state of the Forced Entrance

Deterrent Systems (FEDS) at that zone and how many other

zones are alarmed. All information displayed in this format

is double wide.

Figure 7. Zone specific alarm information.

If the Console controls are attached to a nonalarmed zone then site status information is displayed, figure 8. This is not zone specific and will tell the Operator, for example, which Operators are currently logged

in, which zones are in access, which equipment is malfunctioning and at which zone, how many zones are in the

alarmed state and, if there are any communication

- 15 -
failures, where and what type of failures have occurred.

This information is displayed in the standard sized format

except for the number of zones in the alarmed state. This

message is double width so that it may be more readily seen.

The bottom line of the DDU is used for guidance messages to the GCS Operator, figure 8. These messages usually

indicate inappropriate use of a control or recommended

response actions to the current situation.

Figure 8. A guidance message at the bottom of the display.

- 16 -
Sonic Alarms (B)

The detection of a new alarm condition starts a sequence of audio alarms. This sequence is also initiated by the GCS Operator actuating the FIRE FEDS, the CALL BAF

or the CALL BAF & ARF Controls. (These Controls are

described later in this report.) This audio alarm sequence

is terminated as soon as the GCS Operator acknowledges the new alarm condition or verifies the action.

The first tone is 2900 Hz interrupted and lasts for 15

seconds. The second tone is 4500 Hz, steady, and lasts for

15 seconds. The third and final tone in the sequence is a

very loud buzzer and lasts until an Operator acknowledges.

CCTV Monitors (C, D)

A pair of CCTV Monitors, figures 9 and 10, are mounted

on either side of the DDU. At the GCS Operators discretion either pair may be connected to the assessment

camera (s) at any zone that is equipped with cameras.

Normally, the other Monitor pair is dark. When an alarm

condition occurs, the previously dark CCTV Monitor pair is

automatically selected and connected to the camera (s) at the

alarming zone. If there is a pair of cameras at a particular zone then both Monitors are used. If there is only

one camera available then only the lower Monitor is used and

the upper one is dark. In all cases any Monitor not connected to a camera is dark.

CCTV Monitor Display (E, F)

Associated with each Monitor pair, (see figure 9, for

example) there is an LCD numeric display (E) indicating

the zone whose camera is connected to the Monitor. Also

there is a set of indicators (F) showing which types of

camera controls (pan, tilt, etc)

,

if any, are available at

that zone.

- 17 -
Figure 9. Right-hand monitor pair

Key Port (G)

This is the connector, figure 9, into which

the Electronic Keys are inserted. It permits the loading

of a random number code and time period for which this code

is valid.

- 18 -
Figure 10. Left-hand monitor pair

Voice Unit Speaker (H)

The GCS Simulation Model is equipped with a speech synthesizer. This permits the annunciation of

each message as it is displayed on the DDU, thus providing

both audible and visible means of information transfer from

the System to the GCS Operator. Figure 9 shows the location

of the speaker for this Voice Unit.
Status Summary Display (I)

The Status Summary Display, figure 11, is a six indicator lights. These indicators

site status information to the Operator. Their

are summarized in Table 1.

group of

provide

functions

Figure 11 Site status summary display
TABLE 1 — Site Status Summary Display

Indicator Color Function

Repairs White

Required

ON when any critical system

component is in need of maintenance action , e.g., sensor has

failed test or a zone is operating on backup battery power. Can

be ON in company with any other

indicator

Contention Yellow ON for the duration of any conflicting or contentious commands

issued by the two guard control

stations. Can be ON in company

with any other indicator.

Communication Blue

Loss

ON when there is a loss of communication with any zone causing

that zone to be assumed to be

operating in autonomous mode.

Can be ON with any other indicator except "Secure".

Secure Green All zones in the site are secure.

This light can be ON only with

with "Contention" or "Repairs

Required". Lighting of any

other indicators causes this

one to be turned OFF.

Alarm Red

(Blinking)

Unacknowledged alarm condition

exists. This changes to Red

(steady) when acknowledgement

occurs. Can be ON with any other

indicator except "Secure".

Red

(Steady)

Acknowledged but uncleared alarm

conditions exist. Can be ON

with any other indicator except

"Secure"

Access Yellow Authorized Access is occurring

in one or more zones. Can be

ON with any other indicator

except "Secure".

- 21 -
The horizontal portion of the GCS console is shown on

figure 12. All of the controls that the Operator must handle are located on this horizontal area which is shown in

more detail in figures 13 through 15.

Figure 12. Horizontal console panel

Monitor Pointing Switch (J)

A Monitor Pointing Switch (MPS), figure 13, is provided

on the Console to facilitate the rapid and unambiguous

switching of CCTV Monitors and attachable Controls from one

alarmed zone to another.

The MPS is a two position, toggle switch with a hand

sized handle having a light at the outer end. The throw is

about 90 degrees. The tip of the handle always points toward the CCTV Monitor associated with the currently attached

zone. If the switchable controls are not attached to a zone, then the CCTV Monitor to which the MPS points is dark.

The functions of the MPS are summarized in Table 2.

- 22 -
The indicator light in the end of the MPS handle acts

as a prompt to the Operator in requesting an acknowledgement

when a new alarm condition is detected. It flashes when a new alarm condition is detected on a previously secure site.

It flashes alternately with the light in the ACKNOWLEDGE

switch (K) if a new alarm is detected at a zone not already alarmed while there are other uncleared, acknowledged

alarmed zones present. The light is turned off when the acknowledgment occurs.

Figure 13. Center group of controls

- 23 -
TABLE 2

Functions of the Monitor Pointing Switch

1) When the MPS is switched from one side

to the other, the CCTV Monitors from which it is

moved go dark. The dark Monitors are now ready to

receive the video from the cameras at any newly

alarmed zone.

2) All outstanding, unacknowledged

(new) alarms are acknowledged and the zones at

which these alarms have occured are added to the

alarm queue.

3) If the site is secure (no outstanding, uncleared alarms) and a zone has been

selected to which the CCTV Monitors and switchable

Controls are attached, then, as the MPS is moved

from one side to the other, the video will

also move from the Monitors on one side to the

other. That is, the video always appears on

the side to which the MPS points. The CCTV Monitors to which the MPS does NOT point will normally

be dark.

4)

If there is only one, acknowledged, uncleared alarmed zone, then, when the MPS is

moved from one side to the other, the switchable

Controls will be attached to this zone and the

video from the cameras at this zone will be

displayed on the Monitors to which the MPS now

points

.

5) If there is more than one acknowledged, uncleared alarmed zone, then operation of the MPS attaches the CCTV Monitors

and switchable Controls to each of the alarmed

zones in turn. That is, the zone at the top of

the alarm queue is attached and the previously attached zone is moved to the bottom of the

queue. This way each of the alarmed zones may be

rapidly examined in turn merely by moving the MPS

from one side to the other.

6) If there are alarmed zones in the

queue and a new alarm is detected at a zone not currently attached, then the video from

that newly alarmed zone will appear on the previously dark CCTV Monitors (the side to which the

- 24 -
MPS is NOT pointing) , Operation of the MPS will

then acknowledge the new alarm and add it to the

top of the alarm queue. The MPS now points to the

CCTV Monitors where the newly alarmed zone's

video is displayed, and the switchable controls

are attached to this zone. The CCTV Monitors on

the other side will go dark. If the previously

attached zone is on the alarm queue, it is moved

to the bottom.

Acknowledge (K)

The ACKNOWLEDGE switch, figure 13, is a momentary action, lighted push switch. Its operation will acknowledge all outstanding, unacknowledged alarms, but will

not change the zone to which the CCTV Monitors and switchable Controls are attached.

The indicator light in this switch acts as a prompt

to the Operator to acknowledge newly detected alarm conditions. It flashes if a previously unalarmed sensor is

alarmed at a zone already in the alarm queue. It flashes

alternately with the light in the MPS handle if a new alarm

is detected at a zone not previously alarmed while there are

other uncleared, acknowledged alarmed zones present. The

light is turned off when the acknowledgment occurs.

Operation of this switch when there are no outstanding alarms to acknowledge causes an audible beep to

occur and a guidance message, "No alarm to acknowledge", to

appear on the DDU and to be vocalized.

10-Digit Keypad and Display (L, M)

The 10-Digit Keypad (L)

,

figure 14, is the means by

which the GCS Operator may enter numerical data into the

System. This data may represent either the zone number to

which the Operator wishes to attach the CCTV Monitors and

the switchable Controls or the identification number of the

GCS Operator who wishes to log on or to log off duty. A

CLEAR Key is provided to erase incorrect entries.

- 25-
Figure 14. Right-hand control group

Associated with the 10-Digit Keypad is an LCD 10-Digit Display (M) . As a number is entered via the Keypad it

appears on the Display. That is, it is appended onto the

right of the previously entered digits. The number

remains on the Display until it is either erased by use of

the CLEAR Key or entered into the system by use of the

SELECT ZONE Control (N) or the LOGIN (W) or LOGOUT (X) Controls

- 26 -
Select Zone (N)

The SELECT ZONE Control, figure 13, is a lighted,

momentary action, push switch. It is used in conjunction

with the Ten Digit Keypad. If a valid zone number is entered

into the Ten Digit Display via the Keypad then the CCTV

Monitors and switchable Controls may be attached to that

zone by the actuation of the SELECT ZONE Control.

If there is no zone number in the Ten Digit Display

prior to actuating the SELECT ZONE Control then a Guidance Message, "No Zone Number Entered", is displayed on the

DDU and is vocalized by the Voice Unit. Similarly, if an

invalid zone number is entered into the Ten Digit Display

then the Guidance Message "Invalid Zone Number Selected"

is used.

This Control has no effect while an unacknowledged

alarm condition exists. The ACKNOWLEDGE control will continue to flash for attention. Also, if attempts are made to

attach Controls to a zone that is experiencing a communication loss, a warning message is issued.

Zone Selected Display (O)

The Zone Selected Display, figure 13, is a three

digit LCD. It identifies to the GCS Operator the number of

the zone to which the switchable Controls are attached. This

number will be the same as the number in the LCD display

(E) associated with CCTV Monitors to which the MPS points.

CCTV Controls (P, Q, R)

Three controls are provided on the Console to

operate those assessment cameras which are fitted with

remote control facilities. There is a single Pan/Tilt/Zoom

Control (P) , figure 13, and two individual switches (Q

and R) , figure 15, for operating the focus and iris motors.

The Pan/Tilt/Zoom Control (P) is a "T" shaped control with three degrees of freedom. Pushing it straight forward causes the camera lens to zoom in making it appear as

though the camera were moving closer to the subject. Pulling the Control straight back causes the lens to zoom out

- 27 -
from the subject. Rotating the top of the Control to the

left or right causes the camera to pan to the left or right

respectively. Rocking the top of the Control forward causes

the camera to tilt down. Rocking the top of the Control

backwards causes the camera to tilt up. The hand motions on

the "T" simulate the motions which would be used if a camera were held in the Operators hand / i.e.

,

pushing and

pulling for moving close or away, rotating left and

right for

back for

panning left and right

tilting down and up.

, and rocking forward and

The Pan/Tilt/Zoom Control is spring loaded and

when released will return to the center, neutral position.

This causes all camera motion to cease. The camera, therefore, will remain in its current position when the Control

is released and will remain in that position until intentionally moved.

The IRIS (Q) and FOCUS (R) Controls, figure 15,

are lighted, three position, spring loaded, center off

switches. These switches are used to drive the motors for

these functions. Pushing the switch causes the motor to

run in one direction while pulling causes the motor to run

in the opposite direction. These Controls are lighted

when there is an operational camera equipped with these remote controls at the selected zone.

TV OK/Bad (S)

This Control, figure 15, is a lighted, three position,

spring loaded, center off switch. It is used by the Operator

to tell the System when a camera at the currently selected

zone is malfuncting. When the control is moved into the BAD

position, the System is informed of a malfuncting camera.

That camera is then considered to be not available. The CCTV

Monitor display (F) will then light the "NO CAMERA" legend.

If not already on, the white Site Status Summary Display

legend (I), "REPAIRS REQUIRED", will also be lighted. In

addition, an entry will be made in the DDU status display

showing the time and the zone at which the TV has been

determined to be malfunctioning.

When the camera has been returned to functional status,

that fact may be indicated to the system by the Operator

moving this control to the OK position. This will cause the

"TV Bad" entry to be removed from the DDU status display and

the CCTV Monitor display will show the Operator what

- 28 -
T S R Q U

Figure 15. Left-hand control group

controls, if any, are available. Also, if there are no other

devices at the site requiring maintenance then the white

Site Status Summary Display legend, REPAIRS REQUIRED, will

be turned off.

If the camera at the selected zone is already in the

state to which the TV OK/Bad Control is being pushed, then

nothing will occur. If there is no camera at the selected

zone, then operation of this control will have no effect.

- 29 -
Lights On/Off (T)

This Control, figure 15, is a lighted, three position, spring loaded, center off switch. It is used by the

GCS Operator to turn the lights on and off for the assessment camera (s) at the selected zone

Voice Of f /On/Repeat (U)

This Control, figure 15, is a lighted three position switch. It is spring loaded in the REPEAT position and automatically returns to the center or ON position. It allows the Operator to have the last voice message that was output repeated by pushing the Control to

the REPEAT position. It also allows the Operator to

turn off the Voice Unit by placing the Control in the OFF

position. The Voice Unit may then be returned to the on

state by placing the Control in the ON position. When

this Control is in the OFF position the light is also turned

off

Test Controls (V)

These Controls, figure 15, are all lighted push

switches. Each is lighted when the state of the System will

allow that test to occur. The functions of these Controls

are summarized in Table 3.

- 30 -
TABLE 3

Test Control Functions

Control Function

FEDS This Control may be actuated voluntarily by

the Operator or in response to a system

request. This control is lighted when a zone

is selected which is either Secure or in

Access. Operation causes the system to

sequentially test the squib bridgewire and

the voltage of the firing battery for each

FED device at that zone. If all FEDS test

good, then a guidance message results. If a failure results then the guard is advised to

notify maintenance and the failure message

remains on the Status Message Queue until

the condition is corrected and the FEDS are

retested

Sensors This Control may be actuated voluntarily by

the Operator or in response to a system

request.lt is lighted when no unacknowledged

alarm conditions exist and a valid zone has

been selected. Operation of this Control

causes the system to sequentially test each

Sensor at the zone. A Sensor passes the test

if, when a stimulus is applied , it goes

from the quiet to the alarmed state, and,

when the stimulus is removed, the sensor

returns to the quiet state. If all Sensors

pass the test, a guidance message results.

If any Sensor fails, then the Operator is

notified and advised to post a guard at that

zone and to notify maintenance. Each failed

sensor is noted as a status message and

remains on the status message queue until

the condition is corrected and the Sensor

passes the test.

HQ Link This Control transmits a test message over

each of the redundant data links to higher

headquarters. If the messages compare then

the Link is considered to have passed the

test and a Guidance Message results. If the

messages do not compare, then a message goes

on the status message queue, and remains

until the condition is corrected and a

successful test is completed.

- 31 -
Indicators This Control energizes all lamps in the

Console while it is depressed.

Sonic Alarms This Control causes the system to energize

each of the Sonic Alarms in turn for a period of two seconds.

Login and Logout (W and X)

These Controls, figure 14, are lighted push switches.

They allow the Operator to either Login (W) or Logout

(X) of the System. The Operator must first enter the correct

identification number into the 10-Digit Display via the

Keypad. When the tenth digit has been entered, the lights in

these two Controls begin to alternately flash. The lights

are turned off when either of these Controls is actuated.

The identification number is automatically checked for

its validity. If the identification number is correct then

the Login is allowed. Similarly for the Logout, except

that there can never be less than two GCS Operators on duty,

and the Logout will not be allowed if this situation

results

Use of these Controls is inhibited if there are

any outstanding unacknowledged alarms. Operation of either Control while in this state will cause the System

to reiterate the request for the Operator to "Please Acknowledge" .

Scroll Control (Y)

This Control, figure 14, is a lighted, momentary actuated, spring return switch.

The site status messages which are displayed on the

DDU may not fit onto a single DDU page. Therefore, they are

kept in a buffer having a capacity of more than one page.

This Control allows the information in the buffer to be

circularly advanced around the screen of the DDU, from the

bottom towards the top.

This Control is lighted when the DDU buffer contents exceeds a single page of information, otherwise

it is dark. It is always dark when site status information

is not being displayed.

- 32 -
Key Life (Z)

This Control, figure 14, is a three-digit

thumbwheel switch. It is used to set the time interval, in

minutes, during which an Electronic Key is valid. The least

significant position is fixed at zero, so that the minimum

increment is ten minutes. This value will be loaded into an

Electronic Key along with a random number. When this

time interval expires, the random number is erased from the

system.

Code Key (AA)

The CODE KEY Control, figure 14, is a lighted push

switch. Actuation of this Control causes a computer generated random number to be loaded into an Electronic Key,

along with the time interval from the Key Life Control and

the number of the zone that is currently selected.

In order to code an Electronic Key for a particular

zone, the Key must be inserted into the Key Port (G) , a

non-zero Key Life must be selected, the Lock/Enable (EE)

must be enabled, the switchable Controls must be attached

to the desired zone, and then the CODE KEY Control actuated.

Guidance messages are presented to the Operator if these

conditions are not met.

The CODE KEY Control is lighted when no unacknowledged alarm conditions exist and a valid zone is

selected for which an Electronic Key does not already exist.

The light goes out when a Key is successfully loaded.

An Electronic Key loaded in this manner may be used

only once. If it is not used within the time specified by

the Key Life Control, the random number is automatically

erased from the key memory.

Code Master Key (BB)

The CODE MASTER KEY Control, figure 14, is a lighted

push switch. Actuation of this Control causes a computer

generated random number to be loaded into an Electronic

Key, along with the time interval from the Key Life Control. An Electronic Key loaded in this manner is valid for

- 33 -
any zone and may be used any number of times within its

lifetime

.

In order to code a Master Electronic Key, the Key must

be inserted into the Key Port (G) , a non-zero Key Life

must be selected, the Lock/Enable (EE) must be enabled, and

then the CODE MASTER KEY Control actuated. Guidance messages are presented to the Operator if these conditions are

not met.

The CODE MASTER KEY Control is lighted when no

unacknowlegded alarm conditions exist and a Master Electronic Key does not already exist. The light goes out when

a Key is successfully coded.

Send Key Control (CC)

The SEND KEY Control, figure 14, is a lighted push

switch. Actuation of this Control causes a previously

generated random number to be sent to the currently selected

zone. This is the same number that was previously loaded

into an Electronic Key for use at the designated zone by

operation of the Code Key Control. If no valid Key exists

for this zone, that is, no Key has been coded or a Key has

been coded but its lifetime has expired, then nothing

happens and guidance messages are provided to the

Operator. If, at the zone, the random number in the Key

matches the number that was transmitted to that zone, then

a bolt is withdrawn from a strike and the door to the zone

is unlocked. When the key is inserted, the random numbers

in both the Electronic Key and computer memory are erased in

order to limit the use of the key to a single time.

The SEND KEY Control is lighted whenever a zone is

selected for which a valid Electronic Key is coded

and no unacknowledged alarm conditions exist.

Send Master Key Control (DD)

The SEND MASTER KEY Control, figure 14, is a lighted

push switch. Actuation of this Control causes a previously generated random number to be sent to the currently

selected zone. This is the same number which was previously loaded into a Master Electronic Key by use of the

CODE MASTER KEY Control. If no valid Key exists that is, no

- 34 -
Key has been coded or a Key has been coded but its lifetime

has expired, then nothing happens and guidance messages

are provided to the Operator. If, at the zone, the random

number in the Master Key matches the number that was

transmitted to that zone, then a bolt is withdrawn from a strike and the door to the zone is unlocked. Whether or not

a match occurs, the random numbers are not erased. This way

the Master Key may be used again either at the same zone or

at another zone.

The SEND MASTER KEY Control is lighted whenever a valid Master Electronic Key is coded and no unacknowledged alarm conditions exist.

Lock/Enable Control (EE)

This Control, figure 14, is a keyed two position

switch. In order for the CODE KEY and CODE MASTER KEY

Controls to be functional this Control must be in the Enable

position. Guidance messages are provided to the Operator

when either the CODE KEY or CODE MASTER KEY is actuated

while this Control is in the Lock position.

Call BAF (GG) and Call ARF & BAF (FF

)

These controls, figure 13, are lighted push

switches. They are the means by which the Operator

may call out reinforcements to cope with an emergency situation. BAF is the back up force of off duty guards on or

adjacent to the exclusion area. ARF is an augmentation

force located at higher headquarters. When ARF is called,

BAF is automatically called. However BAF may be called

without ARF. When either of these Controls is actuated a three step sequence of sonic alarms is initiated. This is

the same sequence which is initiated by a new alarm condition. Also, the CONFIRM (KK) and CANCEL (LL) Controls

flash alternately.

Acutation of the CONFIRM Control terminates the

sonic alarm sequence and causes the immediate execution of

the CALL BAF or the CALL ARF & BAF request. The CONFIRM

Control also opens a voice communication link between the

Operator and the BAF area so that the Operator may provide

the BAF forces with instructions or directions relative to

the emergency situation.

- 35-
Actuation of the CANCEL Control terminates the sonic

alarm sequence and cancels the CALL BAF or the CALL ARE & BAF request. In this manner an accidental actuation of these

Controls may be cancelled

If neither CANCEL or CONFIRM Controls have been actuated when the alarm sequence times out in 40 seconds,

then, automatic callout occurs. This action is based on the

assumption that the Operator would actuate one of

these Controls unless incapacitated.

In the event that a new alarm condition should occur during the sonic alarm sequence, then, in addition to

the CANCEL and CONFIRM Controls, the ACKNOWLEDGE Control

will begin to flash. Actuation of the ACKNOWLEDGE

Control or the Monitor Pointing Switch will acknowledge

the new alarm. Termination of the sonic alarm sequence

is only accomplished by use of the CANCEL or the CONFIRM

Controls. During the new alarm condition use of either

the CANCEL or the CONFIRM Controls will not only do their

normal functions but also do the acknowlegdment of the new

alarm.

The rational for this is that the purpose of the acknowlegdment is to provide evidence to the system that the

Operator has not been incapacitated. Use of the CANCEL

or CONFIRM Controls provides this evidence.

Arm FEDS Control (HH)

This Control, figure 13, provides the first of three

step in the sequence to remotely fire the FEDS. Actuation

of this control will cause the FIRE FEDS (JJ) and the SAFE

FEDS (II) to begin to alternately flash. The ARM FEDS

Control is lighted when a zone is selected that is in the

alarm acknowledged state and the FEDS have not previously

been either armed or fired.

Safe FEDS (II)

This control, figure 13, causes the FEDS to be returned

to the unarmed state. It flashes alternately with the

FIRE FEDS Control when the ARM FEDS Control has been properly used. Operating it at any other time will have no effect and guidance messages will be provided to the Operator.

- 36 -
Fire FEDS (JJ)

This Control, figure 13, is the second of three steps

in the sequence to remotely fire the FEDS. It flashes alternately with the SAFE FEDS Control when the ARM FEDS Control has been properly used. Actuation of this Control

causes the CANCEL and CONFIRM Controls to flash alternately.

Use of this Control any time other than when it flashes

will have no effect and guidance messages will be provided

to the Operator.

If the FIRE FEDS Control had been used then the CONFIRM Control is the third and final step in the sequence

to remotely fire the FEDS. All steps, in the sequence must

be taken in the proper order to fire the FEDS; select

a valid zone. Arm FEDS, Fire FEDS , and Confirm. If, at any

point in the sequence, the Operator selects another zone and

then returns to the original zone, then the sequence continues from where it was when the original zone was selected.

That is, attaching to another zone does not return the FEDS

at the original zone to the safe state.

Confirm (KK) and Cancel (LL)

These controls, figure 13, flash alternately when the

FIRE FEDS or the CALL BAF or the CALL ARF & BAF Controls are

properly operated. Their use to confirm or cancel these

commands has already been described.

Reset Alarm (MM)

The RESET ALARM control is shown in figure 13. This

control is used to restore a zone to the Secure condition

when an access condition is terminated, or after conditions

causing a sensor to alarm have been quieted. In addition,

if an Alarm State is present and the use of the TEST SENSORS

control shows that the sensor causing the alarm has failed,

then, use of the RESET ALARM control will restore the zone

to a Secure State. Prior to restoring the zone to the

Secure State under such circumstances, the Operator must insure that a guard has been posted at that zone.

If there is no Unacknowledged Alarm condition present,

then the RESET ALARM control is lighted when the selected

zone is in either the Access or Alarm States.

- 37 -
When this control is successfully used, the zone is removed from the alarm queue and the alarm messages are replaced by status messages on the DDU.

Date Display (NN)

A four digit display of the current date as is shown in

figure 11. The first two digits represent the month. These

are separated by a colon from the second two digits which

show the day of the month.

Time Display (00)

Directly below the date display, a six digit display

shows the current time in hours, minutes, and seconds on a

24-hour basis. This is shown in figure 11.

GCS HARDWARE DESCRIPTION

In the following sections, some of the specially

designed or modified hardware components of the GCS simulator are described.

- 38 -
Console Processor Interface Boards

The Console Processor in the GCS contains six parallel

line interface boards and one serial line interface board

with four ports. The parallel line outputs drive the lamps,

alarms, digital readouts, and the video switches; the parallel inputs are connected to the console switches. The serial line ports interface the Console Terminal, DDU, Voice

Unit, and the Event Processor (download link) to the Console

Processor. An additional parallel line interface was modified specifically to communicate with the Event Processor at

a higher data rate than is possible with the serial download

link

A 60 Hz line clock is available in the Console Processor for timing and synchronization. It is not configured as

an I/O device (not addressable, therefore not programmable)

but is connected directly to an interrupt line reserved for

that purpose.

GCS Special Interface Boards

To connect the GCS hardware to the Console Processor,

parallel line interface boards requires a variety of circuits for decoding, driving, debouncing, etc. This circuitry is located on 10 special-purpose logic boards mounted in

a card file in the left pedestal of the GCS adjacent to the

Processor. Cables from the parallel line interfaces connect

to these boards as do cables from the six console panels,

thus this card file serves as a junction box for-’signal cables with signal routing done on the boards and on the card

file backplane. The 10 logic cards are of the following

types

Switch Debounce (2 each)

Lamp Drivers (3 each)

LCD Decoder/Drivers (3 each)

Keypad/lO-digit Display Interface (2 each)

- 39 -
Switch Debounce

The pushbutton and lever switches on the Console require debouncing circuits so that one actuation is not

misinterpreted as several due to contact bounce. This is

accomplished by connecting each switch to a latch (RS flipflop) ; the latch is set upon closure of the normally-open

switch contacts and is unaffected when these contacts bounce

open. The latch is reset by the normally-closed contact

pair when the switch is released and, again, the latch is

not affected by bounce. Note that double-throw switches are

required for this technique. The latch outputs are tied

directly to the inputs of the parallel line interface

boards, one line (bit) per switch.

Lamp Drivers

There are two incandescent lamps in each indicator and

each illuminated switch. Each lamp requires 180 milliamperes of current at 5 volts. Since this is far more than

the current drive capability of the parallel line interface

outputs, lamp driver circuits are required. The lamp driver

chips that are used have a 2-input OR-gate in front of each

driver circuit which facilitates the implementation of a

hardwired lamp test feature. One input of each gate is tied

to an output of a parallel line interface board; the remaining inputs are tied together and driven by the TEST INDICATORS function switch so that the lamps are all turned on

when this switch is depressed.

Power for the lamps comes from a 5 volt, 25 ampere supply. In order to minimize the power surge through the system cabling when all lamps are simultaneously turned on (as

in TEST INDICATORS) the lamps are biased to nearly glowing

when in the OFF state. This is done by connecting a 31 ohm

resistor to each lamp pair in parallel with the lamp driver.

This has two effects which reduce the step increase in

current: (a) the power supply is pre-loaded to more than

50% of its peak load, and (b) the lamp filaments are preheated which increases their resistance. This reduces inrush current when the lamp is turned on. The lamps are rated for 6.3 volt operation and running them at only 5 volts

greatly increases their life expectancy.

- 40 -
LCD Decoder/Drivers

The liquid crystal displays (LCD's) are one-half inch

high, seven-segment digits with four or six digits per

display package. To drive each segment individually from

the Processor ports would require a very large number of

lines (bits), that is, seven times the number of digits.

Therefore, decoder/dr iver integrated circuits are used which

require only four input lines per digit. Still, to drive

the 19 digits the GCS uses would take 76 bits of parallel

port output, a formidable number. A further reduction is

accomplished by using a multiplexing scheme. This scheme

requires only 16 bits for data plus 6 bits to select the

display to be set or updated. The decoder/dr iver chips contain latches for the data and all the driver circuits necessary for supplying the required waveforms to the LCD backplanes and segments.

Keypad/lO-digit Display

The 12 keys of the keypad are not interfaced to the

Console Processor through the parallel ports. Since the

keypad output is always directed to the 10-digit display, it

has been hardwired for that function. Eleven of the

single-pole, single-throw switches on the keypad are debounced and then encoded to four lines. These four lines

feed a 10 X 4-bit shift register. As each key is depressed,

its number is entered into the rightmost digit position of

the register, causing previous entries, if any, to shift to

the left. When the register is full (10 digits entered) a

FULL status signal is asserted at one of the parallel ports.

The Processor reads one digit at a time; the leftmost

digit. This causes the string to shift left one position,

with blank spaces coming in on the right end. The process

of read/shift is repeated until the register is empty (all

blanks)

The eleventh key on the pad, labeled inserts a symbol in the display, but this capability is not normally

used. The remaining (12th) key on the keypad is used to

manually clear the register. This is used when the operator

realizes he has made an erroneous entry. The clear key is

not decoded; it simply forces the code for "blank" into all

digit positions.

- 41-
The contents of the shift register is at all times

displayed by the 10-digit LCD display. Non-latching

decoder/dr iver circuits translate the four-line codes in the

shift register to the seven-segment LCD digits.

For error conditions, the display can be placed in a special mode which causes it to flash a pattern of dashes

( ). Upon receipt of an ERROR command from the

Processor, codes for "blank” and are alternately forced

into all stages of the shift register at a rate of about 2

Hz. The flashing continues until the Processor clears the

ERROR bit or the CLEAR key is depressed.

Monitor Pointing Switch

The Monitor Pointing Switch (MPS) is a large 2-position

switch designed to give unambiguous and rapid switching of

CCTV displays and associated controls. Reliable electrical

switching, positive mechanical action, and large actuator

size are the prime requisites of this custom designed

switch

.

Electrical switching is done with optical switches instead of mechanical contacts. Each optical switch consists

of an LED source and photo-transistor detector molded into a U-shaped package. A flange on the underside of the MPS

passes through the "U" to obstruct or pass the light beam

according to the position of the switch. Two optical

switches are used for each position for redundancy; the outputs of the detectors are OR-gated so that one failure will

not cause the MPS to be inoperative.

Outputs from the MPS to the Console Processor consist

of three bits: MPS LEFT, MPS RIGHT, and MPS MOVED. The MPS

MOVED bit is asserted by motion in either direction and is

cleared when the Processor reads that information. Connections to the parallel interface lines of the Processor are

made via one of the switch debounce boards.

- 42-
CCTV Subsystem

The CCTV Subsystem employes commercial 525 line resolution, black and white camera and monitor equipment. In virtually all other respects, however, the system described

below is quite different from what would be installed at an

actual site. A site with a large number of cameras would

require a more sophisticated Video Switcher and would employ

video transmission and camera control arrangements of the

sort described in Reference 1.

Cameras

In this simulation, four CCTV cameras are used in the

alarm assessment system. Three are stationary, fixed lens

cameras; the fourth is mounted on a pan/tilt head and has a

zoom lens with controllable iris and focus adjustments.

Video Switcher

The video signals from the cameras are connected to the

monitors by the Video Switcher. Switching is accomplished

through reed relays that are in turn controlled by the Console Processor through one of the parallel line ports. Two

bits of the parallel port are assigned to each video signal

to select left or right display. The Processor, using

internal information and the Monitor Pointing Switch position, actuates the appropriate relay(s). The top/bottom assignment is hard-wired since this depends on the number of

cameras per zone. For two-camera zones the video from the

camera with the longer focal length is switched only to top

monitors; all other video is switched to bottom monitors.

Camera Controls

Pan, tilt, and zoom control for the camera equipped

with those features is done via a special handgrip style

control. Electrically, the Pan/Tilt/Zoom Control consists

of optical switches, two switches for each control axis.

Each optical switch has a light source and a detector molded

into one package. The light paths of the switches are all

obstructed when the control is in the rest position; actuation allows light to pass in the selected switch. With this

design, failure of a light source will not result in unintended motion of the camera.

- 43 -
Control of lens iris and focus is provided for by two

3-position lever switches mounted on the lower left panel.

These are conventional hard contact switches.

Camera Motor Drive

The controllable CCTV hardware used in this simulation

is part of a commercial area surveillance system that has

been adapted for this application. The original control

module is mounted in the right pedestal of the GCS . The GCS

camera controls are connected through relays to this control

module; the control module is in turn cabled to the camera.

The control module contains the required power supplies of

165 volts and + and -70 volts DC. It is designed to drive

camera positioning equipment at distances up to 3000 feet.

Voice Unit

The Voice Unit in the GCS is a stored vocabulary speech

response device that synthesizes utterances from encoded,

compressed speech data that has been stored in read-only

memory (ROM) . The vocabulary has been selected for the application and is sufficient to annunciate all the messages

that are printed on the DDU.

The Voice Unit is computer controlled through the use

of word pointer and commands. Word pointers specify which

utterance should be spoken; commands are used to instruct

the unit to change pitch, select frame rate, set interutterance delay, etc. Commands and word pointers are arranged in the desired sequence by the computer program and

downloaded to a buffer in the Voice Unit via a serial I/O

port. Once they have been downloaded, a microcontroller in

the unit retrieves the encoded speech data from ROM and

presents it to the speech synthesizing circuits that generate the digital representation of the original speech

waveform. A digital-to-analog converter then transforms

this representation into its analog counterpart which is amplified and fed to a conventional 8 ohm speaker.

The vocabulary may be changed or added to by changing

or adding ROM chips. Seven 28-pin ROM sockets are available

to the user. These sockets accept 16, 32, or 64 kilobit

ROMs, thus the vocabulary memory may range from 16 kilobits

to 448 kilobits. (One second of speech requires about 2.2

kilobits of memory.) The present implementation uses all

seven ROM sockets for a total of 248 separate utterances.

These utterances include 226 discrete words, 11 prefixes and

- 44 -
suffixes, 2 phrases of 5 words each, and 4 tones. Not all

ROMs are utilized to capacity because the vocabulary was ordered in increments as the system was developed instead of

as a single unit. For example, one ROM contains just two

phrases (in German) ; this was done to demonstrate the

multi-lingual capabilities of the unit.

Sonic Alarms

Three audible alarms are provided. They were selected

so that each is easily distinguishable from the other. Two

are solid state audio devices; one gives a 2900 Hz pulsating

sound and the other a 4500 Hz continuous tone. The third

device is a conventional buzzer. The alarms are driven from

one of the parallel ports of the Console Processor in the

same manner as the lamps, i.e., one bit of the port drives

each device through a current driver circuit. All of the

devices are mounted on the upper left panel of the GCS.

Console Shell

The cabinetry for the GCS has been designed for flexibility of device placement in order to facilitate experiments in the layout of controls and displays. The Console

consists of an upper plywood shell, with cutouts for panels

and shelves for TV monitors. It rests on two short equipment racks which serve as pedestals.

The plywood shell is 34 inches long by 68 inches deep.

The lower portion, sloped 15 degrees from the horizontal

plane, has a long cutout designed to accept three 11.5 x 20

inch metal panels. The upper portion, sloped 15 degrees

from the vertical plane, has five recessed shelves for

placement of the four CCTV monitors and the DDU. Shelves

are used here instead of rigid mounting devices to facilitate experiments with angular and depth positioning of these

units. In addition to the shelves, there are cutouts for

three metal panels: 8 x 24 inch panels on either side of

the shelf area and a 5 x 18 inch panel at top center. All

exterior surfaces of the plywood shell, including the recessed shelves, are covered with Formica.

The pedestals are stock equipment racks, 26 inches

high, 22 inches wide, and 28 inches deep. The internal

mounting space accepts standard 19 inch wide panels. The

left pedestal houses the Console Processor, the card file

for the special GCS interface boards, and two power

- 45 -
supplies. The Processor is mounted on chassis slides; the

card file is mounted to the front rails above the Processor,

The power supplies are attached to the rear rails. The

right pedestal contains the Voice Unit, Video Switcher, and

Camera Motor Drive,

Cabling

GCS internal cabling is designed around a modular concept for ease of assembly and maintenance. Each panel may

be lifted out, quickly disconnected, and completely removed

from the console. All signal connections are made via flat

cables; cable ends have crimp-on insulation displacement

connectors. DC power (+5 volts) is brought to each panel

via a locking circular connector which accepts up to

14-guage wire.

Power Supplies

Five volt DC power is required for the special interface boards and for the lamps. Since the lamp power supply

is subject to large step changes in load it is inadvisable

to run the lamps and interface boards from the same supply.

Hence, two supplies are used, a 25 ampere switching supply

for the lamps and a 3 ampere linear supply for the interface

boards. The Processor and other packaged units such as the

Voice Unit, CCTV cameras, etc., have their own internal DC

supplies

SIMULATION SOFTWARE

For the sake of expediency and economy, the selection

of hardware and software was based on availability and familiarity rather than optimization of function and speed. The

hardware used existing available DEC LSI 11/23 [*]

[*] Certain commercial equipment, instruments, or materials are identified in this paper in order to adequately specify the experimental procedure. Such identification does not imply recommendation or endorsement

by the National Bureau of Standards, nor does it imply

that the materials or equipment identified are neces-

- 46 -
processors. The software was written in the C language [3]

(and some assembly language where necessary) . The UNIX

operating system served as the development system environment, and was also used for part of the run time environment.

Software Design

Three cooperating processes were the basis of the

software design. One, the Console Process, was to service

the console inputs and outputs, and the second, the Event

Process, was to service and maintain the history of events

from the individual zones via the C.U. and from the Console

Process. A third process, the Director Process, was also

required to coordinate events and simulate the actions that

could occur at the various zones.

Each process was to be placed on a separate processor,

primarily because the processors available had a limited per

process address space (56K by tes/process) . Also, project

requirements specified that the Console be polled rather

than interrupt driven, to increase speed and avoid operating

system overhead. Placing each process on a separate processor allowed the Console Process to run stand-alone in a polling mode, while the other processes could be run under an

interrupt driven operating system. This was possible, for

this feasibility model only, since time was not as critical

for these other processes. The Director Process was placed

on a third processor, mainly so as not to interfere with or

delay the other processes.

The additional communication overhead between the processors was more than offset by the gain in speed with

parallel processing. The communication between the three

processes was designed to be message based, with an extensible message set. It was inplemented on a 16 bit parallel

port for speed, approximately 40K bytes/sec.

sarily the best available for the purpose.

- 47 -
The Console Process

The Console Process is a combination of a minimum

operating system and an application program running on a bare processor. It functions mainly as an intelligent device driver. It samples the state of the console switches,

processes any change in their state, exchanges messages with

the Event Process, and updates the console display lights to

reflect current operational conditions. Messages are exchanged to inform the Event Process of any state changes, as

well as accepting information on current operational conditions from the Event Process. The Console Process also

maintains an abbreviated status record about the overall

site and the currently attached zone, if any. Formatted DDU

messages, generated by the Event Process, are stored and

displayed as necessary by the Console Process. The software

organization of the Console Process is shown in figure 16,

where each box represents a module. The device drivers,

scheduler, and clock modules handle the necessary operating

system features in this polling environment. The remaining

modules handle the various application features. The only

requirement placed on a module is that once it starts executing it completes its designated function.

The Scheduler

In this organization the execution flow is controlled

by a table driven scheduler which continually polls each application module in sequence. The individual modules determine if there is any work for them to do, and at completion

return a result indicator to the scheduler. Based on the

result indicator the scheduler determines if one or more of

the next sequential application modules should be skipped

during this round of polling. After the polling of any application module the device driver module is always polled

next. Thus, in effect interleaving the device driver module

between each application module.

The Device Driver

This module handles the details of getting data between

the buffers and the individual devices (DDU, Logging

Printer, Voice Unit, and Communication Channel - inbound and

outbound) . Each device is allocated a dedicated circular

buffer. The inbound communication channel acts as a

- 48 -
Initialization

Scheduler

zi:zz3e:z:zz:

Device Driver

> DDU Manager J-

^ DDU Updater }

Light Monitor

^ S c r o i i e r ^ DDU Updater *

^ Debugger

Ciock

t—^ Message Handier | >

> Console Monitor J >

*Executed more than once for a polling sequence,

but only a single copy of code is used.

Each rectangle represents a module.

Figure 16. Block diagram of the Console Process

producer function, filling its buffer, while for all the

other devices the drivers act as a consumer function, emptying their buffers.

- 49 -
The Clock

This module, which is a combination of operating system

and application function, is the only exception to the noninterrupt requirement. This is strictly due to the architecture of the processor which had no programmable interface

tc the hardware clock. Therefore, in this case an interrupt

was the only means of determining when a clock tick had occured. The operating system function of this module is to

keep track of the current time. The application function of

this module is to update the console date and time LCD

display each second and maintain various other application

required time durations.

The Massage Handler

This application module processes all incoming messages

from the Event Process and then removes them from the incomming message buffer. The list of messages between the Console and Event Processes are shown in figures 17 and 18,

along with their parameters. The incoming messages of figure 13 fall into two general categories: (1) update the

current abreviated site or attached zone status, and (2)

process a device request (i.e., add or delete a formatted

DDU message, execute a formatted voice message, etc.). If

the current message is not concerned with the DDU, then the

DDU Manager and DDU Updater module are skipped during this

polling cycle.

- 50 -
TABLE 4

List of Messages from Console Process to Event Process

Message format:

size in command command

bytes type number parameters

2 bytes 1 byte 1 byte n bytes

COMMAND TYPE COMMAND NO. PARAMETERS

request 0 - date and time - info 1 - valid zone list -

2 - zone status zone #

6 - alarmed status -

9 — site status —

send 0 — date and time date, time

info 2 - zone status zone status

3 - CCTV for zone # zone # , ok/bad

4 - lights, zone # zone # , on/off

7 - set FEDS state zone #, safe/arm/f ire

8 — acknowledge —

guard 0 - login ID #

action 1 - logout ID #

3 - code key zone#, key#, key life

4 — code master key#, key life

test 0 — test FEDS zone #

request 1 - test sensors zone #

2 — test HQ links —

request 0 — BAF zone #, guard/automatic

help 1 - ARF zone #, guard/automatic

2 — restore —

access 0 — access zone#

1 - master access zone#

2 - clear access zone#

3 - clear master

access zone#

4 - secure zone#

6 - check key life -

- 51-
TABLE 5

List of Messages from Event Process to Console Process

Message format:

size in command command

bytes type number parameters

2 bytes 1 byte 1 byte n bytes

COMMAND TYPE COMMAND NO. PARAMETERS

request

info

send

info

guard

test

access

results

logg ing

message

DDU

message

voice

message

0 -

2 -

0 -

1 -

2 -

6 -

9 - 10 -

11 -

0 -

2 -

0 -

1 -

2 -

3 -

4 -

5 -

0 -

1 -

0 -

1 ~

2 -

3 -

4 -

5 -

6 -

7 -

0 -

1 -

date and time

zone status

date and time

valid zone list

zone status

alarm zone status

site status

communication

failure

alarm

identity valid

HQ link

regular key

master key

clear access

clear master

go secure

continue alarm

status

alarm

remove status

remove alarm

display status

display alarm

display new alarm

augment new alarm

guidance

canned guidance

status

alarm

zone #

date, time

zone # '

s

zone status

zone status

site status

zone status

yes/no

zone#, yes/no

zone#, yes/no

zone#

zone#

zone#

zone#

message

message

message #

message #, zone#

message #, message

message #, zone#, message

message #, zone#, message

message #, zone#, message

message #, guidance message

message (guidance)#

message

message

- 52 -
The Message Handler and the DDU Manager

A major function of the Console Process is to maintain

a data base of current DDU messages, and manage their

presentation. This requires a reasonable amount of work and

has resulted in this function being split into a number of

modules. The Message Handler module does the initial processing of a DDU message request, by updating the actual DDU

data base and marking the resulting status. The DDU Manager

module acting on the new data base status then computes the

contents of a new display window for the DDU, and the

changes required to the current display window to produce

the new display window.

The DDU Updater

This application module is the final step of the DDU

function. The DDU data base consists of two separate, but

similar, data bases: (1) a Status message data base, and (2)

an Alarm message data base. The DDU Updater module keeps

track of which data base is currently being displayed. If a change is indicated in the data base to the current DDU

display, the DDU Updater module fills the DDU buffer with

the previously computed changes required to produce the new

display window.

The Console Monitor

This module samples the console switches and processes

any newly activated ones. The processing starts by checking

the validity of the activated switch against the current

system state. If it is not valid, then some combination of

an audio beep, a printed DDU guidance message, and an audio

guidance message will provide the operator error feedback.

If the activated switch is valid then the indicated action

is initiated by updating the local abreviated status information and sending the appropriate messages to the Event

Process

The Light Monitor

Based on changes in the local status and data base this

module turns on, off, or flashes the lamps in the console

switches and indicators.

- 53-
The Scroller

This is another module related to the presentation of

the DDU message data base. It is applicable to the condition of too many messages to fit onto the display window at

one time. When activated this module will compute the contents of a new display window that is the current display

window circularly scrolled up by a single, but entire, message. Only entire messages are displayed, never any partial

messages. When successfully activated this module indicates

to the scheduler that the DDU Update module should be the

next application module to be polled.

The Debugger

This module was used during debugging and is intended

for normal preventative maintenance and trouble shooting.

It interacts with a separate terminal, that may be built in

or a portable one that can be plugged in when required. It

allows maintenance personnel to interactively peruse the local data base and status information, monitor the contents

of messages exchanged with the Event Process, as well as run

predefined diagnostics while the system continues to work.

The Event Process

The Event Process maintains a detailed data base for

all zones within the site. This data base contains information on the state of each zone ( i . e . ,Secure , Alarmed, Accessed, etc.), the state of each sensor and FEDS, as well as

a reference to all currently active DDU messages residing

within the DDU message data base maintained by the Console

Process

For this simulation model the Event Process was implemented within an interrupt driven operating system environment, rather than a stand alone polling environment as was

the Console Process. Under this type of environment, when a process issues a read device request, the process is usually

blocked until the read request is completed. When the device is a terminal or a communication link to another process, the duration of this blocking can be very long,

depending on whether the other end has something to write.

The Event Process must wait for asyncronous input from the

- 54 -
Console Process, the Director Process, and from a local debugging terminal. Therefore, the existing blocked I/O of

the operating system was not acceptable. A modification was

made to the applicable device drivers which provided a programable user option to invoke non-blocked device reading.

Under this option, a read request would complete immediately

with an indication whether or not there was something to be

read. This modification provided the Event Process the capability to poll each of these devices and to determine when

there was something to process.

A block diagram of the software organization for the

Event Process is shown in figure 19, where each box

represents a module. The Controller polls the communication

channel to the Console Process, the Director Process, and to

the Debugging terminal. When a message is received, the

Control module passes it to the appropriate handler module

for processing.

Console

Handler

Controller!

j

Debugger,

Maintenance

Director i Handler

'Information !

i

f

• Console

... « Device Pending 1

( Request Action Failure i Action

[ 1

'

Sensor

Activation

j

Figure 17. Organizational block diagram of Event Process

software. Each rectangle represents a module.

- 55 -
Console Handler

The Console Handler module processes messages from the

Console Process, These messages fall into two general categories (1) request for specific information from the Event

Process data base and (2) notification of a legal console

action.

The first category of Console Process messages, request

information, is relatively straight forward. This category

includes messages such as "request list of valid zones",

"request abreviated status of zone 15", etc. The requested

information, located within the Event Process' data base, is

extracted and sent to the Console Process.

The second category of Console Process messages, action

notification, is the more complicated category (e.g., fire

FEDS at zone 4). This requires the Event Process to check

the validity of the action for the current system state. If

it is not valid, then either a reject message or a specific

message is returned to the Console Process. A reject message is a short message, that causes the Console Process to

update its local abreviated status information and inform

the Operator that the requested action failed. Alternatively a specific message requires the Event Process to assemble

both a completely formatted DDU and audio guidance message

that will provide the Operator with specific rejection details. These messages are sent to the Console Process which

maintains and presents them.

If the action is valid then the indicated action is initiated by first updating the data base. Depending on the

type of action requested, the Event Process may be able to

affect or provide the desired result by itself. If not it

must then send an appropriate messages to the Director Process and then, while noting that this action is pending,

wait for the response. When the results of the action are

known, either success or failure, the Event process updates

its date base and sends a result message and specific messages to the Console Process. A result message is a short

message, which causes the Console Process to update its local abreviated status information. Specific messages, as

noted above, provide the Operator details on the results of

the requested action.

It should be noted that "determining system state",

"updating the data base", and "assembling formatted messages" are complex operations that involve significant workload. While the Event process is servicing these various

requests, other actions and requests may be processed in

parallel by both the Console and the Director Process.

- 56 -
TABLE 6

List of Messages from Director Process to Event Process

Message format:

size in command command

bytes type number

1 byte 1 byte 1 byte

parameters

^~by tes

COMMAND TYPE COMMAND NUMBER PARAMETERS

device 0 - FEDS at zone#

change

zone#

# of FEDS

good/failed list

1 - sensors at zone#

2 - HQ link

3 - communication change

zone#

# of SENSORS

good/failed list

good/failed

zone# (1 byte)

good/failed/degraded

direction if degraded

4

- reload FEDS zone #

test 0

request 1

2

access 0

results

- FEDS

- sensors

- HQ link

- access zone#

successful/failed

1 - master access zone#

successful/failed

attack 0 - alarm sensor

1 - quiet sensor

zone#

# of sensors

list of sensors

zone#

# of sensors

list of sensors

- 57 -
1

TABLE 7

List of Messages from Event Process to Director Process

Message format:

size in command command

bytes type number parameters

1 byte 1 byte 1 byte n bytes

COMMAND TYPE COMMAND NUMBER PARAMETERS

send 0 - FEDS State zone#

information state

saf e/arm/f ire

guard 0 - LOGIN identity

action

1 - LOGOUT identity

help

called

0 - BAF -

1 - ARF

access request 0 - ACCESS zone#

1 - MASTER ACCESS zone#

Figure 21. List of messages from Event Process to Director

Process

,

Director Handler

The Director Handler module processes messages from the

Director Process, figure 20, These messages fall into three

general categories (1) devices failure, (2) result of pending action, and (3) sensor alarm.

- 58 -
The first category of Director Process messages, device

failure, is concerned with providing the current operability

status of the various devices throughtout the entire site

(e.g., motion sensor failed at zone 17). This status can be

operational, partially operational, and failed. The Event

Process updates its data base with this information, and

sends both a result message and specific messages to the

Console Process.

The second category of Director Process messages, action result, provides the result of a previously requested

action that takes place somewhere on the site ( e.g., access

successful at zone 10). The Event Process updates its data

base, clears the pending status, and sends both a result

message and specific messages to the Console Process.

The third category of Director Process messages, sensor

alarm, is a spontaneous action that indicates a sensor has

changed state, from quiesent to active or active to

quiesent. An activated sensor indicates that a disturbance

has been detected. This may have been caused by an intruder, or by failure of the sensor. When a sensor is activated the Event Process first tests if that sensor is

operational. If the sensor is known to already be in

failure mode, the activation is disregarded. The Event Process updates its data base indicating the sensor and zone

affected, as well as adding the zone onto the Alarm queue.

Also the Console Process is sent a result message causing it

to update its local abreviated status and specific messages

are sent to inform and evoke a response from the Operator.

Debugger

The Debugger module was used during debugging and is

intended for normal preventative maintenance and trouble

shooting, similar to that for the Console Process. It interacts with a separate terminal, that may be built in or a

portable one that can be plugged in when required. It allows maintenance personnel to interactively peruse the data

base, status information, and the contents of messages exchanged with both the Console Process and the Director Process, as well as run predefined diagnostics, while the system continues to function.

- 59 -
The Director Process

The Director Process is the driver for the Event and

Console Processes. It was designed to accept commands from

a human operator via a terminal, translate those commands

into one of the messages in figure 20, and send that message

to the Event Process. The messages represent the results of

actions that may occur at the various zones throughout the

site. Since the Event and Console Process require only the

resultant action, there was no need to simulate the complex

computations required to determine that the actions actually

occured

.

The Director Process was not designed to keep track of

the system state or to automatically execute preprogrammed

senarios. Although these features are not difficult to add

and they would be useful in a training environment, they

were not deemed of high enough priority for our simulation

model. The only data base maintained consisted of the

current list of active zones and the current list of zones

requesting access. Although other information regarding

changes in the system status were sent to the Director Process, they were displayed to the Operator and not retained.

The Director Process also required the non-blocking read option so that it could constantly poll the terminal for commands from the operator, and the communication link for information on changes in system status from the Event Process .

EXPERIMENTS USING THE SYSTEM

A series of experiments using the GCS mock-up were conducted. The first of these involved validating the system

performance to insure that its behavior was in accordance

with specifications in all respects. Next, certain training

materials were prepared describing the CSSMRS and the GCS.

These were intended to support a tutorial presentation.

Scenarios were written that could be used to provide handson experience in a simulated physical security environment.

These materials were employed in experiments in which coworkers who did not have a background or experience in physical security were trained to use the system. Finally, a group of military personnel were trained to operate the GCS.

Observations of these experiments provided insight as to the

ease or difficulty of learning the CSSMRS concepts and

learning to use the GCS. These observations, together with

- 60 -
student's comments, also provided the basis for a number of

minor changes in the physical arrangement of the console.

! Validation of System Performance

j Key aspects of the performance of the GCS in a simulatI ed CSSMRS environment were described by a "partial" state

ij diagram that was amplified by a descriptive event/result

sheet that was prepared for each of the active console controls. This process was repeated for each of the system

I states. The format of the event/result sheets was standardI ized. On each sheet an event is postulated and the results

I are described. In most instances, the postulated event is

I the actuation of one of the console controls. The descripj tion of the results includes changes, to status as well as

changes to any of the displays, messages, audible or visual

I signals, or other operator cues. This is further expanded

! by comments where appropriate.

More than 150 of these event/result sheets were

prepared using a computer based word processing system.

This, together with the standardized format, greatly facilitated making necessary revisions or up-dates. These sheets

I served as the guiding basis for the simulation software that

was developed for the mock-up. While they do not cover

every conceivable event that could occur in any possible

system state, they are sufficiently broad in scope that the

outcome of any event that is not described can be inferred

with a high order of confidence.

Validation of the system performance was accomplished

by going through each of these event/result sheets and testing to verify that performance was in compliance. This process revealed a number of software "bugs". In most instances they were readily corrected. In a few cases it was

determined that it would be better to change the requirements on the sheets. Only a few instances were disclosed

j where the event/result sheets did not provide complete cov-

! erage of the circumstances. Additional sheets were prepared

I to cover those situations.

The testing and validation process provided an initial

indication that the console layout was generally good, it

appeared to be easy to use, and was effective in conveying

information to the Operator.

- 61-
Preparation of Training Materials

Two types of materials were prepared for use in training personnel to be Operators of the GCS.

The first was an outline of a brief, tutorial instruction course that covered CSSMRS concepts that are essential

in order to operate the GCS. These include such things as

the subdivision of the site into zones; the association of

certain console controls with a zone that has been selected;

communication with a zone; access to a zone; alarm acknowledgement and the automatic selection of closed circuit

television for assessment; and the use of FEDS and the ARF

and BAF response forces. The course also includes a description of the operation of the GCS itself. There are

frequent hands-on exercises and demonstrations. The course

material can be thoroughly covered in about four hours of

time, with additional time required for the hands-on experience if there is more than a single person in the class.

The course outline is shown in Appendix I.

Additional training materials were prepared in the form

of scenarios. These are conducted using an instructor who

plays the role of various on-site support personnel such as

mobile patrols or maintenance personnel. A second "director" plays the role of adversary by invoking alarms or other

events from a nearby computer terminal. The trainee plays

the part of GCS Operator and responds to the alarms or other

events in what the trainee believes to be an appropriate

manner. The instructor and the director have copies of the

scenarios to guide their actions, but the student does not.

The students actions are guided solely by the various console displays and signals.

When an alarm occurs, CCTV from the alarming zone is

automatically selected and displayed on one or both of the

previously dark console monitors. In order to provide some

basis for reasonable operator responses to simulated alarms,

it is necessary to simulate video data from the alarming

zone. This was done by placing still, black and white photographs of perimeter fencing in the fields of view of each

of three television cameras that were located near the

director, figure 18 . The director could set appropriate pictures in place before

the camera (s), and then type into his terminal the command

that would cause an alarm to be reported and simultaneously

cause the picture (s) to be displayed on the console monitor.

A variety of pictures were available. Some of these showed

adversary attacks on the perimeter fence. Others showed an

intruder, which in one instance was a deer. In others,

there was no visible evidence of what might have caused the

- 62 -
Figure 18. Arrangement of CCTV cameras and still pictures.

alarm condition. One group of these photographs was especially made for the scenarios using a camera and lens combination that would exactly duplicate the fields of view of

the two cameras that were specified for use on a 100 meter

perimeter segment in [1] . These confirmed that the resolution was adequate to recognize a man-sized intruder anywhere

along the full length of the segment.

In addition to the three fixed CCTV cameras, there was

a fourth camera mounted in the simulation room that was

equipped with controls on pan, tilt, zoom, focus and iris

that could be remotely manipulated from the console when the

zone with which it was associated had been selected. This

was used in conjunction with a group of small targets that

had been scattered about the room to give the students an

opportunity to develop their skills in camera manipulation.

- 63-
The scenarios covered a considerable range in complexity. They ranged from simple exercises intended to develop

speed and confidence in finding and operating the various

controls to more complex and stressful exercises simulating

a multi-person attack on the storage site. They include examples of virtually all of the actions that an operator

would be required to participate in, such as key issuance,

access, maintenance actions, and testing activities as well

as alarm acknowledgement, patrol dispatching and FEDS actuation. An example of one of the more complex scenarios appears in Appendix I.

Tests of Training Materials

Initial tests of the training materials were conducted

in two separate sessions using two co-workers who were not

familiar with the project or with physical security procedures. In each instance, less than one day was devoted to

the training effort. The time was approximately evenly divided between the course material and the scenarios.

Test by an Electronics Technician

The first person to test the training materials was a male electronic technician who had not previously participated in the construction of the console or had any intimate

connection with the project. He was presented with the tutorial course material for approximately an hour, and then

was initiated to the scenarios. He quickly learned to use

the GCS, but some of his scenario response actions were

sub-optimal and it was apparant that the time devoted to

covering the tutorial material should be lengthened. This

trainee's handling of the console controls was generally

good, but on a couple of occasions he made errors in the

zone selection process. This served as an alert to a possible repetition of these errors on the part of future

trainees

.

Test by a Secretary

The second trainee was a female secretary that was reported by her supervisor to be a satisfactory, average performer in her regular job. In this instance, presentation

of the tutorial portion of the course material was extended

to about two hours before work was started on any of the

scenarios. She seemed to grasp the material quite quickly.

She had no problems with any of the controls and all of her

- 64 -
response actions to simulated alarm conditions were judged

satisfactory. The only problem that she seemed to experience was that of simulating radio communications with the

guard patrols. This was an area that had not been covered

in the instructional material, and since she had had no prior experience as a communicator, her difficulty here was

quite understandable. In all other respects her performance

as an operator of the GCS was highly commendable.

Training of Military Personnel

During the first week of October, 1982, five male military personnel were trained to use the GCS. One of these

was an Air Force Master Sargent with extensive experience in

physical security equipment, having served as chief instructor for the Small Portable Control and Display System

(SPCDS) of the Base and Installation Security System (BISS).

The other four were Army Military Police from Ft. Meade with

no significant experience with security systems or special

weapons storage sites.

Most of the first day was spent going over the tutorial

portion of the course material. This was interspersed with

frequent hands-on sessions where the students operated the

controls and began to get the feel of the system. None of

them seemed to have any difficulty understanding the system

concepts and learning the meanings of the various signals

and displays.

When the tutorial portion of the course material had

been covered, all of the students but one were isolated from

the simulation laboratory. The one student remaining in

that laboratory then operated the GCS while the scenarios

were played out. Then another student was brought in to

participate in running the scenarios. The reason for the

isolation of the others was to keep them all at the same

level of training on their initial exposure to the

scenarios. Once they had completed the scenarios they were

permitted to remain in the simulation laboratory to watch

the next student's actions. All of them performed quite

well, and very few mistakes were made. Those few generally

involved zone selection, but the trainees themselves did not

seem to notice this, Occasionaly a student would make a

response that, while not exactly in accordance with the

response anticipated in the scenarios, was still acceptable.

In these cases the instructor and director were nearly always able to make impromptu moves that would lead the simulated action back to the prepared script.

- 65 -
When all of the trainees had completed all of the

prepared scenarios, they were given brief instructions in

the operation of the computer terminal used by the director

to simulate adversary actions. They very quickly mastered

this, and then preceded to generate and act out impromptu

scenarios, with each student taking turns at playing the

different roles of director, instructor, and operator. They

became quite proficient at this, and generated a number of

very realistic event sequences. They became adept at keeping track of the locations of the simulated patrols that

they dispatched to assess alarm conditions or conduct

maintenance activities. They conducted impressive demonstrations for several visitors to the simulation laboratory,

and seemed to be thoroughly comfortable and at home with the

system.

At the conclusion of the training sessions, they were

each given a questionaire to complete. This was intended to

draw out their comments about what they found to be good or

bad about the arrangement of the console and its controls

and displays. A copy of the questionaire and their combined

responses and comments appears in Appendix II.

SUMMARY AND CONCLUSIONS

Observations of the performance of the seven individuals that have been trained to operate the GCS provides convincing evidence that most of the original design objectives

have been met. The trainees invariably found that the GCS

was easy to learn and easy to use. They did not find it intimidating or overpowering and seemed to feel quite comfortable with it after a relatively short period of time. The

displays, cues and guidance messages were judged adequate in

terms cf size, resolution and information content, but

further improvements can be made by relocating certain

displays and controls, and by adding another group of

displays. The queueing of multiple alarms, and the operator

controlled display of detailed information about only one

alarm at a time provided obvious relief from information

overload. This was in marked contrast to the more congested

display of status information that appears in chronological

sequence on the DDU when the zone that has been selected is

secure

.

- 66 -
Console Design Changes

Based on a review and analysis of both our observations

and the comments of the trainees, a number of changes to the

design of the GCS console are being reflected in the specifications for a prototype CSSMRS. These are discussed in detail in the following sections.

10-Digit Keypad

On the mock-up, a 10-digit keypad is located on the

right hand side of the console table. This is used to enter

digital information into the system. The digital information is either a 10-digit operator identification number or

a one-to-three-digit zone number. The number that is entered on the keypad appears on a 10-digit liquid crystal

display directly above the keypad. When a zone number, consisting of only one-to-three-digits , is entered, nothing

else happens until the SELECT ZONE control is operated. At

that time, the number that has been entered in the 10-digit

display is transferred to the 3-digit ZONE SELECTED

displays, and the 10-digit display is cleared. Console controls and CCTV (if available) are attached to the zone that

has been selected.

On certain occasions, student GCS operators were observed to be watching the ZONE SELECTED display rather than

the 10-digit display as they made entries on the keypad.

There was hesitancy and a brief period of confusion before

they realized what the problem was. Additionaly, observations of hand movements indicates that a faster, more positive zone selection would occur if the 10-digit keypad is

relocated to a position directly below that presently occupied by the ZONE SELECTED display on the console table. The

SELECT ZONE control will be moved from its present location

and will appear as a pair of keys, one located on either

side of the keypad. This will permit zone selection to be

made by operation of either key, using either the thumb or

little finger. The entire process can be completed without

the arm movement that is presently required on the mock-up.

The relocated keypad will be used only for entering

zone identity and not for entering operator identity. The

keypad will require much better tactile characteristics than

the keypad used on the mock-up. The feel should be similar

to that of the keys on the typical computer terminal or

electric typewriter. In addition, the keys should be color

coded with the electronic industry code as well being labeled with the digit value. This will permit the zones in

small sites to be identified by "color" rather than "number"

- 67 -
if desired. A software switch should be provided so that

zones zero through nine can be optionally identified by a color instead of a number. The equivalence of number,

color, and a three character abbreviation of that color are

shown in Table 8 below.

TABLE 8

Color Code For Zones 0-9

Zone Color Abbreviation

0 Black BLK

1 Brown BRN

2 Red RED

3 Orange ORN

4 Yellow YEL

5 Green GRN

6 Blue BLU

7 Violet VIO

8 Gray GRA

9 White WHI

digit ZONE SELECTED display will be replaced

with a three-character display labeled ENTRY. Keypad entries will appear here until the SELECT ZONE (or CLEAR) key

is depressed, and then this display will go blank again.

When the software switch is set to COLOR, the display will

show the three character abbreviation of the color of the

key that is operated. When the switch is set to NUMBER the

display will show the numerical value of the keys (up to

three digits) that are actuated. When the SELECT ZONE key

is actuated, the information shown in the display is

transferred to the other ZONE SELECTED displays.

Selected Zone Status Display

The six colored lamps at the top of the console panel

provide a "quick look" indication of overall site status

that is more useful to a supervisor than to the Operator.

As long as the Operator has selected a zone that is in an

alarmed state his display provides him with complete and uncluttered information about that zone. However, when the

Operator selects a zone that is not in the alarmed state,

the display shows status information that may involve a number of zones. The Operator must read through this to

learn the status, such as ACCESS, REPAIRS REQUIRED, or other

conditions affecting a particular zone.

- 68 -
Two changes will improve this situation. The information on the status display can be better organized (this

will be described in a following section), and a zone status

display can be added. The added zone status display will

contain a three-character LCD display and six colored lamps

which replicate all of the functions of the site status summary group. This zone status display will be mounted on a panel located directly behind the MPS and beneath the DDU.

When an operator selects a zone, either by use of the keypad

or by operation of the MPS to select an alarmed zone, the

identity of the selected zone will appear in the threecharacter display. Zone identity may be either a number or

color depending on the setting of the software switch. The

status of this zone will be indicated by illuminating one or

more of the six associated status lamps.

Organization of Status Display on DDU

In the mock-up, status information is displayed on the

DDU whenever the selected zone is in a non-alarmed state.

The information is ordered chronologically rather than being

grouped by class or condition. Thus, if the white, REPAIRS

REQUIRED, summary status lamp is lit, it may be necessary to

scan the full list of status messages in order to ascertain

which zone(s) require maintenance. This will be changed,

and the entries will be grouped by class, and listed chronologically within each class. Alternate classes will be in

reverse video to define the class without loss of screen

area that would be required to provide separation by inserting a blank line between groups, however, if any class is

empty, a blank line will be inserted in its place.

The top line of the status display will be used for reporting the number of outstanding uncleared alarms. This

report will be in double width letters, and will blink continuously so long as there are any outstanding alarms.

Video will not be reversed.

The first group will be reverse video and display any

zones in Access.

The second group will be normal video. It will display

any time dependent actions such as KEY SENT. The remaining

time on any items in this group will be continuously decremented at intervals of not less than one minute, and the entry will be removed when the time limit has expired.

- 69 -
The third group will be reverse video. The entries

will be updated with each automatic cycle of sensor and FEDS

tests conducted by the central processor unit and any

failures are listed. The entries will also list all other

maintenance actions that are outstanding.

The fourth group will list the names, but not identity

numbers, of operators logged in and on duty, in normal

video.

A variable size window at the bottom of the screen will

be used to display operator guidance messages as on the

mock-up. It and the top line, displaying uncleared alarms,

will not be affected by the scroll control, while the other

four groups of status messages will be scrollable.

Login/Logout

The provisions for operators to login and logout of the

system will be revised to protect the identification number

of operators from being disclosed to possible unauthorized

or unqualified personnel. This will be accomplished by removing the present 10-digit keypad, 10-digit display and the

LOGIN and LOGOUT controls from the console table and locating them in a recessed, covered enclosure which may be at

any convenient location in, or adjacent to the control room

containing the GCS. Again, the keypad will have greatly improved tactile characteristics as compared with the one used

in the mock-up, but color coding is not required here.

When a valid login occurs, the operators name but not

identity number will be displayed on the status display.

The voice annunciation will be truncated to, "Valid (Invalid) Operator Login (Logout)”, since it would be impractical to continuously update roster names for the voice unit.

CCTV Facilities

On the mock-up, there is a three-digit display indicating the selected zone and a cluster of lamps indicating TV

facilites at that zone associated with each of the monitor

pairs. They are located to the left of the left hand monitor pair and to the right of the right hand monitor pair.

These were judged to be too far toward the periphery of vision, and will be moved to a position between each of the

monitor pairs and as close to the DDU as feasible. The

three-digit displays will be changed to three character

displays to accomodate zones identified by colors, and an

- 70 -
up-arrow and down-arrow will be added to each. These arrows

will be selectively illuminated to point to the monitors

that should be active for the selected zone. They will provide cues to CCTV malfunction, since if both arrows are illuminated and only one monitor is operating, there is evidence of a problem with the dark video channel.

Increased visibility of the CCTV facilities indicators

will be provided by removing the smoke colored indicator

covers and using covers with greater translucence or less

attenuation. The intensity of the lamps in all of the indicators has been lowered somewhat by operating them at a reduced voltage (5.0 volts rather than 6.3 volts) in order to

provide a projected life of 290,000 hours (33 years). This

is in keeping with overall CSSMRS reliability objectives.

Pan/Tilt/Zoom Control

The Pan/Tilt/Zoom CCTV control will be moved back about

10 cm. (three inches) farther from the edge of the console

table. This location is judged to be more appropriate to

the expected frequency of use since few zones are expected

to be equipped with cameras that are controllable. The new

location will improve the access and visibility of the controls associated with the electronic key.

Monitor Pointing Switch

The handle on the MPS will be shortened by about three

cm., and the throw of the switch will be increased to a full

90 degrees, side to side. This control is the single, most

used control on the console, and it's continued operation is

vital to the operation of the system. Further reductions in

size would be at an unacceptable cost of reduced mechanical

strength and durability.

Scroll Control

The SCROLL control will be moved to a position to the

right of the MPS and symmetrically located with the SAFE

FEDS control.

- 71 -
Emergency Controls

The CALL BAF and the CALL BAF & ARF controls will be

separated from each other and placed in locations that are

symmetrically aligned with ARM FEDS and SAFE FEDS. A

locked, key operated switch labeled FIRE WADS (Weapons Access Denial System) will be located in line with these two

controls and aligned with FIRE FEDS.

Key Port

The system specifications will make provision for a second key port that duplicates the functions of the console

key port but is remotely located from the console. The location of this duplicate key port may be outside of the control room so that it is possible to load an electronic key

without having to gain access to the control room.

Electronic Key

The final design of the electronic key will incorporate

an LCD display that shows the remaining key life. This

display will be in minutes and seconds, and will be updated

each second.

Writing Shelves

A pair of pull-out shelves will be provided on the console, one on either side of the operator. These can be used

as surfaces for writing.

Summary of Changes

Figures 19 and 20 show the general arrangement of the

GCS console after these changes have been reflected. Figure

19 shows the console back panel and figure 20 shows the console table top.

-72 -
73

Figure

19.

Console

Back

Panel
f

I

i

I

74

Figure

20.

Console

Table

Top
Conclusions

The mock-up of the GCS and its operation in a simulated

physical security environment has provided an excellent opportunity to evaluate both the ergonomics of its design and

the potential utility of such a simulator as a training device.

Observations of the actions and performance of trainees, and

careful evaluation of their comments in relations to these

observations has suggested a number of minor changes in the

arrangement of console controls and indicators. Their inclusion in the design of a future prototype model of the

CSSMRS will make small, but useful improvements in the

speed, accuracy, and ease of GCS operation. It is believed

that none of these changes will have noticeable effects on

the process of learning to use the GCS, as it is felt that

the principal objectives with respect to this process were

attained with the original mock-up design. None of the

seven students that were trained appeared to experience any

difficulty in learning to operate the GCS.

As a training tool, the present implementation of the system

has several significant, but potentially correctable deficiencies, These involve characteristics of the programming

that was prepared for the director processor and its terminal, the CCTV video presentation to the Operator, and the

fact that several important adjuncts to the CSSMRS GCS were

not implemented in this mock-up.

Director Software

The software for the director processor was not arranged to support several capabilities that would be highly

desireable on a training simulator. For example, there was

no provision by which multiple alarms could be simultaneously introduced at several zones, or by which alarms at

several zones could be quieted simultaneously. Alarms at

each zone had to be introduced and quieted individually by

keyboard entries at the director's terminal. The delays associated with this process would prevent a realistic simulation of certain classes of events, and errors in keyboard

entries can cause unintended results.

For training purposes, it would be highly desireable to

program entire scenarios so that they could be completely

executed by the director processor without a requirement for

interaction by anyone other than the student trainee at the

GCS. The processor could even be programmed to score the

trainee's performance. This would reduce the manpower

- 75 -
required to conduct a training session.

GCS Video

The use of black and white, still photographs as a demonstration of the resolving power that results from the

use of the recommended arrangement of perimeter CCTV cameras

proved to be quite effective. Those same photographs, however, are not very realistic alarm assessment imagery. The

lack of motion, and the small number of cameras that made it

necessary to reuse a given camera on more than one zone, all

detracted from the illusion of reality. We would recommend

that a training facility be equipped with from eight to

twelve video tape units. There should be one for each zone

of the simulated facility that is equipped with CCTV. Their

tapes should be pre-recorded with scenes and actions that

are appropriate to the director processor's scenario, and

they should be started simultaneously at the beginning of

the scenario, and should run continuously for its duration.

This could provide extremely realistic video. For example,

if a student should happen to be attached to a zone where

the scenario had scheduled an alarm to occur, the student

might actually see the intruder approach the perimeter a second or so before the alarm was triggered!

Features Not Implemented

We recommend that a simulation training facility should

be provided with several of the GCS adjunct facilities that

were not implemented on this mock-up. These include a Geographical Display Unit (GDU) replicating the layout of the

simulated site and equipped with status indicator lamps for

each zone. This is particularly important as the console

DDU does not present any geographic information to the

operator; it was intended that this would be provided by the

GDU. It is needed in order to provide the operator with an

overall perspective on the locations of possibly related

alarms

.

Another facility that is not adequately implemented on

the mock-up is that for communications, including radio,

telephone and intercomm. In fact, until these have been implemented and tested, it is not clear whether or not a single operator can handle the work load, or whether some portions of the communications functions may have to be handled

by another person.

- 76 -
The logging functions should also be implemented in a facility intended for training in order to insure that students are properly instructed in the procedures for recording the dispositions of alarms. This administrative function was not addressed at all in the exercises involving the

mock-up.

With the implemetation of thesei additional adjunct facilities and capabilities, we believe that a highly effective training facility could be set up based on the general

software approach to simulation that has been demonstrated

in this project.

BIBLIOGRAPHY AND REFERENCES

1, R. T. Moore, R. J, Carpenter, A. W. Holt, A. L.

Koenig and R. B, J. Warnar, "Phase II Final Report

Computerized Site Security Monitor and Response System", National Bureau of Standards, NBSIR 79-1725,

PB 294 343, NTIS, Springfield, VA 22161.

2. Military Standard, Human Engineering Design Criteria

for Military Systems, Equipment and Facilities,

MIL-STD-1472A, Department of Defense, Washington, DC

20301.

3. Kernigham, B. W. and Ritchie, D, M. , "The C Programming Language"

,

Cliffs, NJ, 1978.

Prentice-Hall

,

Inc. , Englewood

4. Ritchie, D. M. , and Thompson, K., "The UNIX

Timesharing System"

1974.

, CACM, Vol. 17, No, 7, July

- 77 -
GLOSSARY OF ACRONYMS AND ABBREVIATIONS

ACK Acknowledge

ARE Augmentation force. This force may be located at

higher headquarters.

BAF Back-up force. This force is located on or near

the secure site.

CCT7 Closed circuit television.

CSSMRS Computerized Site Security Monitor and Response

System.

FEDS Forced Entry Deterrent Systems.

GCS Guard Control Station.

HQ Headquarters

.

MPS Monitor Pointing Switch.

- 78 -
APPENDIX 1

Outline of GCS Console Instruction Course

1. Background of CSSMRS

A. Experiment to see if modern technology can be

used to improve the physical security of

Special Weapons storage sites,

B. Use the computer to help make the guard's job

easier. Provide guidance toward the right choice

of action.

C. Does not require that the guard know anything about

computers or know how to type. The system uses

functional controls with guidance by means of

lights and voice announcements as well as printed

messages on the screen.

D. A novice cannot do anything to hurt the system.

If the wrong control is pushed, it will tell you,

or ask you to Cancel or Confirm that order. In

other words, "Do you really want to do that?"

E. Our objective is to find out whether or not it

really is easy to learn to use, and if it is not,

find out what to change before a prototype is built.

2. CSSMRS Concepts

A, The site is divided into zones - each zone is

100 m. perimeter - one football field long - or

one magazine or bunker

B. Each zone has the following;

Intrusion sensors which might include;

Maid/Miles Radac

Motion (ultrasonic, RF or TV) Spir

E-Fild Blid

Vibration (three types) Optical

Magnetic Switch Infra-red

- 79 -
Tamper Alarms

Explain each

Duress

Audio

Closed Circuit Television to assess alarms - TV may include controls and lights

Forced Entrance Deterrence Systems

Gas

Smoke

Pyro

Explain each - all are conceptual

A Computer

With communications

Two way - with dual loops

That takes over if communications fails

and won't let anybody in!

That reports alarms

That can test sensors

That can test FEDS

That helps control access

C. There is a Central Station with computers

It acts as a link between the zones and two GCS

It talks to the zone computers

It runs the controls and displays on the GCS

It talks to higher headquarters

It calls BAF or BAF and ARF if the GCS

operator is disabled

D. There are two Guard Control Stations in a real CSSMRS

(only one has been implemented in this model) which

Permit interactions between the guards and the

system by:

Displays

Hand out list

Identify each on GCS

Signals and voice announcements

Controls

System - hand out list

Identify each on GCS

Attachable - hand out list

Identify each on GCS

Demonstrate simple interactions - provide

hands-on practice:

- 80 -
Log in

Logout

Test indicators

Test sonic

Select zone 2

Observe CCTV controls there

Select zone 4

Observe CCTV controls there

Operate controls

Test FEDS

Test Sensors

Voice repeat

Scroll

E. Each zone has security status that depends on

prevailing conditions

Hand out list of status displays

SECURE

Define

Status information on display

Most likely controls to use are lighted

CCTV (if any) on monitor that MPS is

pointing toward

Demonstrate above

ALARM UNACKNOWLEDGED

Define

Voice and display announcement

Audible alarm sequence begins

Flashing lights in controls

Most other controls disabled

CCTV from new alarm on the dark monitors

MPS not pointing to these

BAF call out if no acknowledgement

Demonstrate above

ALARM ACKNOWLEDGED

Define

Display shows full alarm report

Audible alarm sequence is stopped

Status light is on steady

Most likely candidate controls are lighted

Controls associated with zone MPS pointing

toward

Demonstrate above

ACCESS

Define

Most likely candidate controls are lighted

- 81 -
Status information on display

Demonstrate above

REPAIRS REQUIRED

Define

Demonstrate

COMMUNICATIONS FAILURE

Define

No controls operable at this zone

Zone autonomous

Demonstrate

CONTENTION

Define

Not implemented in this model

3. Instruction in the use of Guard Control Station

Review use of keypad and significance of lights

A. When an alarm occurs

TV from the alarming zone appears on the previoulsy

blank screens

Appears immediately

Provide opportunity to catch moving targets

Alarm must be acknowledged to prove to the system

that the guard is not disabled.

30 seconds - one tone

30 more seconds - another tone

10 more seconds - a buzzer

Then BAF is automatically called

How would you like to face your buddies

if you dragged them out of the sack for

not acknowledging an alarm on time?

Two ways to acknowledge an alarm

MPS - attaches controls to alarmed zone

ACKNOWKEDGE - does not attach controls to zone

Demonstrate each way

After acknowledgement, must find out what caused

alarm

Examine scene in CCTV

Send patrol to investigate

If intruder is observed, there are options

Send patrol to apprehend

Demonstrate simulated radio call

Actuate FEDS

Demonstrate

- 82 -
Arm FEDS

Fire FEDS

Confirm

Call BAF

Demonstrate

Confirm

Call BAF and ARF

Demonstrate

Note one time functions

If more than one alarm occurs they are added to

queue by acknowledgement.

Step through queue using MPS

Only one at a time appears on

display

The number of the zone you are looking at

is always displayed

Practice alarm acknowledgement for each trainee

B. Clearing alarms

Conditions for clearing:

You must be satisfied that there is no

threat

The condition causing the alarm must have

gone away

Sensors at the zone must be working

Test Sensors

Clear by operating RESET ALARMS

Alarm message replaced by status message

Control lighting changes

Practice clearing alarms for each individual

C. Access Procedures

Purposes of access

Move SNM

Repair or maintenance

Author izations

Two man rule

Mechanical and electronic keys

Coding Key

Lock/Enable

Key life - Two digit thumbswitch

One-time key

Only one outstanding

- 83 -
Master key

Multiple use - multiple keys

Demonstrate coding each type

Sending key

One minute window for successful access

Demonstrate simulated procedure for access

Telephone communication

Send key

Access

Demonstrate key life expired

Sending master key

Similar to one-time key except multiple use

Demonstrate

Terminating Access

Must close door

Telephone GCS

Operate TEST SENSORS

Operate RESET ALARM

Describe conditions for successful

termination

Door closed and strike engaged

No alarmed sensors

Demonstrate successful and unsuccessful

termination

D. Scenario exercises

Conduct all scenarios with each student.

Isolate students while others are running

scenarios until they have done theirs.

- 84 -
A Sample Scenario

The simulated site consists of ten perimeter zones that

are numbered one through ten, and nine magazines that are

numbered 11 through 19. In addition, the entrance portal is

designated zone 116, and the Site Security Control Center is

designated zone 114.

SITE LAYOUT FOR SCENARIO SHOWING ZONE NUMBERS

10

9

1

XXXXXXXXXXXXXXXXXXXXXXXXX

I

X 116

2

xxxxxxxxxxxxxxxxxxxxxxxx

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

114

sscc

12

14

X

X

X

X

X 3

X

X

X

X

X

X

X

X

X

X

X 4

X

X

X

X

X

X

X

X

X

X

X

8 X

X

X

X

X

X

X

X

X

X

X 5

X

X

X

X

XXXXXXXXXXXXXXXXXXXXXXXXX

7

X

xxxxxxxxxxxxxxxxxxxxxxxxxxx

6

- 85 -
INITIAL CONDITIONS:

The site is secure, but zone 15 is operating on backup battery power. An instructor, (I), is logged in on the system

and can simulate the activities of a second GCS operator

( 0 )

.

(I) will also simulate the actions of maintenance personnel

and of patrol ABLE and BAKER.

The director of the simulation (D) operates the "Terrorist"

terminal and mounts the photographs for the fixed CCTV cameras. The instructor, (I), observes the performance of the

operator, (0), and records any errors and any instances

where 0 did not know what to do next.

1 .

2 .

3.

4.

5.

6 .

7.

8 .

9.

I: Requests 0 to login.

0: Enters 1234567890, LOGIN

I: Announces that maintenance personnel are going to fix

zone 15, and that they should be given a 10 minute key.

"Let me have a key for zone 15".

0: Enters 15, ZONE SELECT

Puts key in port and enters 10 (min) , CODE KEY

Gives key to I.

D; Issues test HQ command

0: Operates TEST HQ LINK

I: Requests 0 to test lamps

O: Operates TEST LAMPS

D: test sensors zone 2

10. O: Enters 2, ZONE SELECT

Operates TEST SENSORS

11. I: Positions himself at door of room to act as intruder

12. D; alarm motion zone 116

13. O: Operates MPS and CCTV CONTROLS to assess alarm,

and dispatches Patrol ABLE to investigate at zone

116.

14. I: Using local phone, announces; "We, the maintenance

personnel, are at zone 15 and want access."

-86- I

I

k
I moves out of the doorway and is no longer visible

in the CCTV monitor

.

15.

16.

17.

18.

19.

20

21 .

22 .

23.

24.

25.

26.

27.

D: quiet motion zone 116

0; Enters 15, ZONE SELECT

Operates SEND KEY

"Go on in"

D: open door zone 15

alarm e-field zone 3

after instaling perimeter zone photographs

A5 and B5 in cameras A and B.

O: Operates MPS

and dispatches patrol BAKER to investigate zone 3

I: Simulating patrol ABLE at zone 116,

advises 0 that an intruder has been apprehended

at zone 116 and that the area is clear.

I: Unless 0 does so without prompting, he should

be asked to try to secure the alarm at zone 116.

Note if prompt is required.

0: Operates MPS to bring up zone 116

(Enter 116, ZONE SELECT is an acceptable but

less efficient series of actions.)

Operates RESET.

D: As soon as operator releases zone 3, install

pictures A6 and B6 and generate a alarm maid zone 3 as soon as zone 116 is secure.

0: Operates MPS to acknowledge alarm at zone 3.

(He should now recognize intruder is in the

middle of the clear zone between fences and

should advise the enroute patrol BAKER of this)

.

O: Simulates radio call to patrol BAKER

"There is one man inside the fence."

D: Disables CCTV covering zone 3

quiet maid zone 3

quiet e-field zone 3

close door zone 15

good power zone 15

0: Operates TV BAD control.

I: Simulates telephone call from maintenance

- 87 -
personnel at zone 15 indicating that they have

vacated and locked the zone and that it may now

be secured.

28. 0: Enters 15, and RESET.

(O should also advise the maintenance personnel

of the TV failure at zone 3, and instruct them

to return for an electronic key to that zone.

28. D: alarm motion zone 18

29 .

30.

0: Operates MPS to acknowledge.

Finds there is no CCTV to assess, so instructs

patrol ABLE to investigate.

D; quiet motion zone 18

bad motion zone 18

31 I: Simulates radio transmission, "This is patrol BAKER.

There is no one in zone 3.”

32. O: Reply, "OK, resume regular patrol."

Operates MPS to bring up zone 3

Operates RESET.

33. I: Simulates radio transmission, "This is patrol ABLE.

The door at zone 18 is locked and all appears secure"

34.

35.

36.

0: Reply, "OK let me try to secure the zone"

Operates MPS to bring up zone 18.

Operates RESET. (It fails)

Operates TEST SENSORS. (They fail, white light on)

0: Radio transmission to patrol ABLE, "The sensors

have failed test at zone 18. Post a guard there

until we can get them fixed."

I; "OK, I'm leaving Smith on guard at zone 18".

37

.

0: Operates RESET. (Green light comes on)

38. I: Simulates maintenance, "We are here, what is the

problem". (Preferably 0 should send them to

fix zone 18 and relieve the guard ahead of

making the CCTV repair at zone 3)

39. O: Enters 18, ZONE SELECT

Puts key in port, enters 10 MINS., CODE KEY

Gives key to I.

40. D: Issues command to test sensors zone 11

- 88 -
41. 0; Enters 11, ZONE SELECT

Operates TEST SENSORS

• CM I: " We are ready to access zone 18"

43. 0: Enters 18, ZONE SELECT

Operates SEND KEY

"Go on in"

44. D: open door zone 18

45. D: Inserts picture with deer in camera C

and "alarm e-field zone 6".

46. 0: Operates MPS to bring up zone 6.

Sees deer and radios patrol Baker,

"There is a deer in zone 6. See if

chase him over the fence."

you

47. D: good motion zone 18

00 . I: I think we have cleared the problem here

zone 18. Will you please test sensors"

at

49. 0: Enters 18, ZONE SELECT

Operates TEST SENSORS

Responds, "Sensors test OK now. You can close

up and bring Smith back with you. Remember, I'

got another problem at zone 3."

PAUSE

50.

51.

52.

53.

54.

55.

56

57.

58.

D: close door zone 18

I: "We have locked up zone 18 now"

0: Operates RESET

D: Puts deer picture in camera A

alarm maid zone 7

0: Operates MPS and again sees deer

Radio to patrol BAKER, "Now he is in zone 7."

D: test sensors zone 12

0; enters 12, SELECT ZONE, TEST SENSORS

D: Replaces deer picture with clear zone camera A

I; "This is BAKER. We see him. He just jumped the

ve

- 89 -
outer fence.

59. D; quiet e-field zone 6

quiet maid zone 7

60. 0: ”Good, I'll secure both zones"

Operates MPS

Operates RESET

Operates MPS

Operates RESET

• 1

—

1

I: Advises 0 that maintenance personnel are back and

want key for zone 3 to fix the CCTV problem there.

62. 0; Enters 3, ZONE SELECT

Puts key in port, enters 10 (min.), CODE

Gives key to I KEY

63. D: test sensors zone 4

64. 0: Enters 4, ZONE SELECT

Operates TEST SENSORS

(Sensors test OK, but note that there is still

no CCTV working at zone 3).

65. I: Simulating maintenance, "We are ready to access

zone 3 now and fix your CCTV".

66. 0: Operates SEND KEY

"Go on in"

67. D: Permits successful access

Requests TEST SENSORS ZONE 4

(As soon as 0 releases zone 3, restores the

cameras A & B, pictures A9 & B9).

CCTV

63. 0: Operates 4, ZONE SELECT

Operates TEST SENSORS

69. I: Simulating maintenance, "I think we have

fixed your problem at zone 3. Check your TV"

70. 0: Operates 3, ZONE SELECT

(Finds both monitors working)

Operates TV OK

Advises maintenance personnel that it is OK.

PAUSE

- 90 -
71. D: close door zone 3

• CM I: "We have closed and locked zone

73. 0: Operates RESET

74. I: Would you like to log out now?

75. 0: Enters 1234567890, LOGOUT

(Another guard will have to login before this

logout is accepted by the system)

.

- 91 -
APPENDIX II

Summary of Responses to Request for Comments

the military

gram. Their

ceived) and

tects their

The following questionaire was given to each of

personnel who participated in the training proresponses have been assembled (exactly as reassociated with a letter identifier that proprivacy .

COMMENTS

October 7, 1982

In addition to any other comments that you may have about

the Computerized Site Security Monitor and Response System

concept and the simulated implementation of it that you have

been working with for the past three days, please address

the following questions about the console itself. Your

thoughtful responses, together with the rationale for them,

will be greatly appreciated and will be most helpful.

1. Are there any controls or indicators located in positions that you found to be awkward or hard to reach? If so,

where would you suggest that they be relocated?

A. (a) Move the Site Status Summary Display down to the

panel. Nothing causes the Operator to direct his attention

to its location. (b) Move the CCTV Facilities at Selcted

Zones more to the center of the console. Nothing causes the

Operator to direct his attention to them. (1) A character

generator could be used to display the affected zone on the

monitor and eliminate the other indicators.

B. Site status lights should be lower on the console. CCTV

equipment lights should be closer to the center of the console.

C. Move the systems display down so that it was more visible to the Operator, and move the CCTV indicators to a position inside the zone screens so that they could be more

easily detected. This would cut down on response time when

- 92-
the Operator is assessing a situation in a particular zone.

I also believe that I would move the camera control handle.

In its present location it inhibits the movement of one's

hand from the key pad to the select zone button.

D. The Site Status Summary Display where it is located now

does not attract the operator's attention. Those summary

lights should be lowered to get more attention. Same should

be done for date and time displays. In reference to the

CCTV display lights and zone indicator (located next to TVs

on outside) should be moved in between the 2 TVs on both

sides. While working controls you hve no occasion to look

at lights. If moved between TVs much more useful for operators. The camera control knob should be moved up away from

edge of panel. It makes it awkward to move hands and is

easily leaned on there for moving camera unintentionally.

E. The zone CCTV lights on the side of the panel should be

moved in towards the center. Reason being that usually

there is no reason to look that far off to the side. Also

the camera pan handle should be moved up about six inches so

it wont inhibit the movement of your hands from side to the

other. The functions lights at the top should be moved to

the control panel itself because it is very hard to be aware

of it when it's way up top.

2. Did you find the labeling of any of the controls or

displays confusing or hard to understand? If so, how do you

thing it should be changed?

A. Labeling of the controls and indicators seemed to be

useful in the understanding and operation of the console.

HQ data link is confusing unless it is fully explained,

i.e., what HQ, where it's located, and what type link you

are talking about. There are no indicators to let the

operator know his equipment is working or when it fails.

B. NO.

C. Labeling quite satisfactory. Console is uncluttered by

unnecessary labels, making controls easy to locate. CCTV

indicator lights could be brighter.

D. Lights on indicators should be brighter, especially the

green lights. Lights should not have smoke colored cover

over them. It should be clear, especially the "no camera"

light

.

E. Some lights should be brighter.

3. Did you find it easy or difficult to learn to use the

- 93 -
console? If so, describe what the problem was.

A.

B.

C.

D.

Easy to understand and work with.

Easy to learn.

Easy to use.

Very easy to use.

E. A challenge, but not very hard to learn.

4. What is your opinion about the usefulness of the Monitor

Pointing Switch for stepping through a group of uncleared

alarms?

A. It's big and noisey.

B. Switch makes it possible to see all alarms very quickly

and take action for all alarms.

C. Pointing switch extremely useful. Seems to be one of

the fundamental and essential features of the system. Use

of the switch allows the operator to pull all information on

a particular zone instantaneously without choosing zones

that have previously been selected. The operator would undoubtedly need this capability in the event that multiple

incidents would take place.

D. Moving point was very useful in stepping through alarms.

Switch made it possible for operator to go through alarms

more quickly and get an idea of how things are going on the

site

.

E. It is all right.

5. When using the Monitor Pointing Switch, did you have any

difficulty in keeping track of the zone to which your controls were attached? If so, what would make it easier for

you to keep track of which zone the controls are curently

associated with?

A. Didn't find it difficult to keep track of.

B. No problems with it.

C. No problem keeping track of zones. Any problems could

be remedied by moving the CCTV indicators in so that he had

3 quick reference points close to the center of the screen

indicating what zone he's in at a given moment.

- 94 -
D, No problem keeping track of zones. If you move the CCTV

equipment in between the 2 TVs you would have 3 items telling him which zone he was in.

E. When you switch the lever over in a 2 or more alarm situation, the computer should say, for example, vibration

alarm zone 2 and when you switch over to the second alarm,

it should specify zone and circumstances.

6. Did you find the Pan/Tilt Zoom control easy to use? If

not, what arrangement of controls for these functions do you

think would have been better?

A. Easy to use but compared to other controls and indicators is large and bulky.

B. Easy to use

C. Easy; no rearrangement necessary.

D. Easy to use. Should be moved up on console.

E. Easy to use, but should be moved up about 6 inches.

7. Are there any other controls or displays you think

should be on the console? If you answer yes, please

describe the form and function of these additional controls

and/or displays.

A. Some type of indicator that would indicate the time

remaining on the electric key. Some type of indicator that

will show that a TV camera has gone bad.

B. Would like to test all sensors and feds at once.

C. TV bad indicator. A 60 second count down after sent key

and a time remaining indicator for keys.

D. Camera down zone. Key code countdown. A 60 second

count down display.

E. Detailed map board above the system with led lights so

when someone goes out and calls in we know exactly where

they are and can assist them by giving them the most direct

route possible.

8. Are there any controls or displays on the console that

you feel could be removed? If so, which ones, and why do

you think that they should be removed?

A. Difficult to say.

- 95-
B. No.

C. No.

D. No.

E. No.

9. Did you find the console to be intimidating, or friendly

to learn to use?

A. Easy to use.

B. Easy to understand.

C. Friendly. Overloading an operator can be a problem with

any security system

D. Very easy to use.

E. Friendly

10. Do you think that this sort of simulator would be a useful tool for training personnel to work with a future

field model Computerized Site Security Monitor and Response

System?

A. As a training simulator, it should be set up where the

computers could control more than one console. This would

cut down on the cost and increase the number of students

that could be in training at one time. Preprogram scenarios

so the trainer doesn't lose track of what has taken place.

B. Yes, if the simulation was improved.

C. Yes, but the simulation would need a great deal of improvement to include the geographical display unit, video

type (instead of still pictures) and scenarios

D. Yes, but computer should be programmed to do everything

the terrorist terminal does. Have precomputerized

scenarios. Should have video tapes camera pictures.

E. Yes. They should have a school or even a different MOS

for operating this unit. Someone should have a basic

knowledge of computers and how they work before they operate

on a real ADA site.

11. Please continue with any other comments that you wish

to make.

- 96 -
A. (1) Sensor test all at once rather than individually.

(2) Software to indicate the number of times a sensor has

been activated. (3) Eliminate the voice announcement of the

operator change and their code. (4) Ability to shut down

sensors for maintenance or due to high nuisance or false

alarm rate. (5) Have a portion of the computer that could

be programmed locally to indicate local instructions for the

operator to follow. (6) Green lights need to be brighter.

(7) Time for notification of HQ that an operator has failed

to respond to an alarm is too long. (8) FEDS are a use of

force and should be dealt with the same as the use of a weapon, K-9, nightstick, or MACE. (9) Remove the term

"Guard." (10) Stop considering the military police and security police as dumb. The operator of this type of equipment

will be highly motivated and educated to the point that he

will be able to understand technical information.

B. None.

C. My only comments address the human element and not the

system itself. First, I would want to include an exterior

check and balance system so that the operators can be monitored, making sure they are doing their jobs and responding

to situations in an acceptable time span. Also for the sake

of security and integrity of the entire system, I would implement a couse of training for use of system to include a

"deadly force" type rule for the use of FEDS, and realistic

simulations so that the operator is completely aware of his

responsibilities. Upon completion of the couse, the individual would be certified to operate the system and only those

that are certified may do so. This could help in eliminating misuse of the system. I don't see the system as one

that should be operated by just anyone.

D. The console is a pleasure to work with and would really

be useful in actual environment. Having just left a hawk

missile tactical site in Germany I can see where it would

fit in and work exceptionally well.

E. I never had any real experience with computers but I had

no problem understanding principles behind the system.

12. Education:

A. A/A in Police Science. Total of 95 semester hours in

occupational education and computer programming.

B. High school diploma. Private pilot. Worked as technician with T.C.I. for three years.

C. High school and two years college in fine arts and

- 97 -
business administration. Former art director and department

head for graphic arts company.

D. High school graduate. Civilian police desk

and controls. Milirary police school graduate.

E. High school graduate.

operations

- 98 -
NBS-n4A IREV. 2 -ec) U.S. DEPT. OF COMM. 1. PUBLICATION OR 2. Performing Organ. Report No. 3. Publication Date BIBLIOGRAPHIC DATA

REPORT NO.

SHEET (See instructions) NBSIR 82-2656 February 1983

4. I ITLE AND SUBTITLE

Simulation of the Guard Control Station in a Computerized Site Security

Monitor and Response System

5. AUTHOR(S)

R„T. Moore, A.W. Holt, A.L. Koenig, A. Mink, G. Nacht

6. PERFORMING ORGANIZATION (If joint or other than NBS, see instructions)

NATIONAL BUREAU OF STANDARDS

DEPARTMENT OF COMMERCE

WASHINGTON, D.C. 20234

7. Contract/Grant No.

8. Type of Report & Period Covered

9. SPONSORING ORGANIZATION NAME AND COMPLETE ADDRESS (Street, City. State, ZIP)

Defense Nuclear Agency Task Code B99QAXRF

Wash., D.C. 20305 Work Unit 00014

10. SUPPLEMENTARY NOTES

Q2I Document describes a computer program; SF-185, FIPS Software Summary, is attached.

11. ABSTRACT (A 200-word or less factual summary of most significant information. If document includes a significant

bibliography or literature survey, mention it here)

This report describes a mock-up of a Guard Control Station that was used

in simulating the performance of this component of a Computerized Site Security

Monitor and Response System. The mock-up was interconnected to three microcomputer systems in an arrangement that permitted simulation of physical

security scenarios in an interactive mode. Seven different individual s were allowed to act as operators of the Guard Control Station Console following a brief period of training. Based both on observations of their actions and on their comments, it was determined that the CSSMRS concepts were effective and

easy to learn. The Console was judged to have met most design objectives, but

certain controls and displays were identified as candidates for minor modification or relocation to further improve the console's overall effectiveness.

12. KEY WORDS (Six to twelve entries; alphabetical order; capitalize only proper names; and separate key words by semicolons)

13. AVAILABILITY

Unlimited

1 1 For Official Distribution, Do Not Release to NTIS

1 1 Order From Superintendent of Documents, U.S. Government Printing Office, Washington, D.C.

20402.

[X^ Order From National Technical Information Service (NTIS), Springfield, VA. 22161

14. NO. OF

PRINTED PAGES

105

15. Price

$13.00

US^ -M-DC 6043-P80
f 1 .1 ko ,Mto09 «o .r^vd ^«y

ATACOIMWaOSJa* . ynwir><*wtf Y3BWtf

3JTIT8M Ov«A iJT*T >

ji»i- • <*tfc» au*-' '"'-’' * "'-

M &rar.T.'. i>"VW‘

• t .W^ A »ytOOT

**”*

1 |QHAOMAt| 10 UAJHUa JAMOttAtl

131 HUI03 10 T«3»ITI*«lfa '* >W« .noTSiiJMxAfr

tit; ...... .^i> jA4)aMPm S''Tj «Mdj idk iM

IRXApfM iiOoJ ilseT ^sn9eAj»fjijlJ,.«rt*’t90 >1 edA(OCK) IfMJ JltoK ^ ,.30COS 0.0..<1*6W

ra

' t3 'd. aiTOil YIAT^ :

:'^z yar j <‘ * -

k,^.o«n. »l -

.^,9.i.» . "••-«»«> >1 '?<

' 8<

'T'^ "I ' ^

^ j|

i>MU i*W f«n>t>c3 'tuOPt »o q«-X3<» ^ ^

tftDUYHa Vo wo^^alwift jjMli Jn4*r»cn6Yi 6 na n^

o*i9M af/B-ubNlbnt ^n9ioVVH» rt9v«2 .^boTsv^Jono^nf «a nt

5 Bfliwflrrol sroinoS notJSJZ foiJn^

fto fertA ar*otls6 Vo infl^Jav'i 98<io no rtiod bsaa^ .pnrnra'iJ vo bonwj isriQ

fans svtJDsVVs 91SM ?V<jaonb^> 2J»M2?D adtlrc/t^bw^flnislsb

fu6 , 2SvUosUo npfasb Horn ism svnd oi boetwjt

'-IVffam" loV 25inbtfafiio ae fasn^Jnofal^ si#rf fans afo^ino?

j .i^swvMosVVs rrsnsvo a'sfgznoo sHJ ovtrKjmr vs<^ f**uV oi nofisboTs^ to fiotis^ J

-yjV' - - .f""'' >','

*.* } m ¥ ^ .««« .^A«Lt A ^ J A- m ?PJ

;»> " • ' 'r-tiTS

I *t^’ , „.^ ^ ,:n ,i;<.«. b.. ..I-**-’

\

90 .Ok* >1

jtiaAn OSTVHI^

SOI

•*

09l\^, JB|

00. eu

. .r , .. '-’w ? ,,.* .•*'.'*' t ..„«-

n

mJtBAJlAVt

MHfttInU iXX

2fTw « *0 ,fwii«d«tt»*0 >A‘jMno boi QV

,i4'i) •-)! 'i

»V-

>J- '*

j>*

.i. '•Vi

Si