Integrated Nuclear Security Network (INSN) Centralized Data Acquisition and Analysis System for Radiation Portal Monitors (RPM)

Course Outline I. Introduction A. Purpose of Integrated Nuclear Security Network B. Definitions C. Basic Architecture D. User Profiles and Responsibilities II. Getting Started A. Installation B. Configuration C. Data Acquisition III. Analysis A. Views B. Scenarios IV. Standard Operating Procedures A. Minimum Recommendations B. Data Backup V. Conclusions A. Exercises B. Questions and Answers

I. A. Purpose of INSN What it is System for networking sites to a central location(s) – System = network, hardware, software Designed for specific purposes – Obtaining Daily Files automatically – Analyzing data for status of health and trend monitoring – Tool for communication with site operators, maintenance and trouble- shooting – Secondary function to obtain User Files (alarm reports, RID files, others) for Headquarters and/or alarm support organizations What it is not Real-time remote surveillance/alarm relay tool Replacement for Front Line Officers, Central Alarm Station Does not provide all answers automatically – Human interaction is required – Tool facilitates information sharing among key stakeholders

What it is System for networking sites to a central location(s) – System = network, hardware, software Designed for specific purposes – Obtaining Daily Files automatically – Analyzing data for status of health and trend monitoring – Tool for communication with site operators, maintenance and trouble- shooting – Secondary function to obtain User Files (alarm reports, RID files, others) for Headquarters and/or alarm support organizations What it is not Real-time remote surveillance/alarm relay tool Replacement for FLOs/FLO training Does not provide all answers automatically – Human interaction is required – Tool facilitates information sharing among key stakeholders I. A. Purpose (Cont ’ d)

I. B. Definitions INSN – Integrated Nuclear Security Network System (hardware, software, communications infrastructure) for collecting data from RPMs for monitoring Status of Health and enabling expert assistance NDAC – National Data Analysis Center Location of the main workstation where data from CASs is acquired and analyzed ASC - Alarm Support Center Location where experts for alarm resolution assistance resides, often (though not necessarily) a separate workstation at a location separate from the NDAC CAS – Central Alarm Station Workstation and/or server at border crossing points obtaining all data (associated with radiation detection systems), and enabling Front Line Officer resolution of alarms Daily Files – Text file of raw RPM data recorded by the Central Alarm Station Files are generated on a daily basis Files contain information regarding occupancies, alarms, and other conditions Status of Health – Ability of the system to perform as designed Status may be healthy or unhealthy (includes equipment, network connection, operations) Healthy Site – System performs as designed with no failures in equipment, network, or operations Unhealthy Site – System does not perform as designed, experiencing failures in equipment, network, and/or operations

I. C. Basic Architecture

I. D. INSN User Profiles & Responsibilities

Alarm Support Centre (ASC) Working with ASC is similar to working with the NDAC client ➲ Can display and analyze data received from NDAC ➲ User Files view and analysis received by NDAC ➲ Generation and printing of general and events reports

II. Getting Started: A. Installation ➲ Before NDAC configuration it is necessary to have a list of all CAS with the following parameters: Daily Files prefix assigned to the given CAS IP-address of CAS-server where INSN service is installed Access port number for INSN-service Phone number (in case if modem is required for connection with CAS) ➲ Lists of all radiation monitors for each CAS with indication of: Daily Files prefix assigned to the given monitor Number of counting gamma and neutron channels with indication of their location on pillars Daily Files format

Select “NDAC connection...” NDAC connection setting Enter IP-address and NDAC port number. Usually NDAC client and service are installed on one computer. In this case IP-address of the service is II. Getting Started: B. Configuration

NDAC Configuration Select “Database connection...” Setting of NDAC database connection Enter IP-address and NDAC database port number. Usually NDAC client and database are installed on one computer. In this case IP-address of the service is

Select “NDAC configuration...” Filling the NDAC structure Specify folders of Daily and User Files if you want to change default paths Press the “Add group” button to create CAS group NDAC Configuration

Filling the NDAC structure Enter group name and prefix. Group prefix is a two letters country code. For example, MD. Press the “Add CAS” button to add new CAS in the group All CAS in the group have the same first prefixes (country prefix). Usually one group is enough. Press the “Remove” button to delete a CAS group Select “NDAC configuration...”

NDAC Configuration Select “NDAC configuration...” Filling the NDAC structure Mark the Box and enter CAS phone number if CAS uses modem connection Press the “Add RPM” button to create new monitor for a given CAS Enter name and CAS prefix and parameters of INSN connection Press the “Remove” button to delete CAS

NDAC Configuration Filling the NDAC structure Select Daily Files format for the given RPM Enter number of gamma and neutron counting channels with indication of their location on pillars Enter the RPM name and prefix Press the “Remove” button to delete RPM Press the “Apply” button to assign RPM parameters Select “NDAC configuration...”

NDAC Configuration Select “User accounts...” User’s account manager There are two access levels in the program – Administrator and Operator Press the “Add” button to add new user

NDAC Configuration User’s account manager Enter login and access level Enter user password Press the “OK” button System settings can be changed only by administrator, not by operator Select “User accounts...”

NDAC Configuration User’s account manager Use the “Edit” button if you want to change password or user’s access level Use the “Lock” button if you want to temporally lock user’s access Press the “OK” button to apply changes Administrator only can edit user’s account list Press the “Remove” button to delete user Select “User accounts...”

➲ The NDAC software will connect to the CAS on startup ● Connection will be maintained as long as the network allows ● The NDAC software will look for new Daily Files on connection ● Only new Daily Files will be updated from the CAS ● Received data as stored in the database ➲ Each CAS is displayed as an icon with general information ● Name of the location ● Connection status ● Date of last successful download of Daily File ● Time of next Daily File update II. Getting Started: C. Data Acquisition

CAS Connection States Ready The last CAS connection was successful Error The last CAS connection was unsuccessful Busy CAS data transfer in progress Undefined Current data on CAS connection state are out-of- date II. Getting Started: C. Data Acquisition

Data Acquisition Data acquisition from CAS Right-click the mouse on the CAS icon in order to call a pop-up command menu Check connection test of connection between NDAC and CAS Synchronize Daily Files request Daily Files update Query User Files request User Files Note: Daily Files are synchronized automatically, but can be synchronized manually

Data Acquisition User Files acquisition Execute “Query User Files” command. If connection is established successfully and there are new User Files in the CAS, a list of files will appear Mark files which you want to transfer Press the “Transfer” button to start files transfer from CAS to NDAC User Files are manually created by the CAS user (RID files, alarm protocols, images, etc. User Files must be manually requested by the NDAC Files must be put in the INSN “User Files” folder by the CAS operator

Data analysis User Files acquisition When files are transferred from CAS they can be exported to the local computer using CAS details, User Files List view. File download status

➲ The NDAC software will connect to the CAS on startup ● Connection will be maintained as long as the network allows ● The NDAC software will look for new Daily Files on connection ● Only new Daily Files will be updated from the CAS ● Received data as stored in the database ➲ Each CAS is displayed as an icon with general information ● Name of the location ● Connection status ● Date of last successful download of Daily File ● Time of next Daily File update III. Analysis: A. Views

Select item with the same name in the Analysis menu of the main window Data Analysis CAS details view Right-click the mouse on the CAS icon to call a pop-up command menu Select CAS details... item … or

Data analysis CAS details view To see general overview and access for information, open the CAS details view The CAS current state view shows general information for each monitor connected to the CAS. The the Occupancy count, Alarms count, and name of the last transferred Daily File are displayed. Pressing this icon generates a report which can be printed or saved in a PDF file A pop-up list for selecting of the information type This button brings up a window with detailed information about a given monitor

Data analysis CAS details view Select “ Daily Files ” list to view the list of Daily files received from the given CAS A protocol is generated by pressing this icon Marked files are saved in a user-specified folder by pressing the “Export to disk” button

Use this button for a window with detailed info of the RPM Data analysis RPM Statistics What can this view tell you? Trends of different events Number of occupancies Tampers Power faults Excesses of expected background limits Gamma alarms Neutron alarms Gamma/Neutron alarms

At a Glance What could this mean? Gamma/Neutron Alarm, Tamper Alarm. Which do you want to follow up on?

Site Profiling What could this mean? Relatively high number of alarms as percent of occupancies. Does this site see a lot of NORM cargo? Is this the typical volume of traffic for this site? Does this site get a lot of tamper alarms? Any pattern to when they occur?

Data analysis Site Profiling (Continued) Detailed information on a given monitor Select the event type to view Specify filter of events on date Then press the “Apply” button

Data analysis CAS Data View Detailed information on the monitor: Alarms Channel count Select the event Press the “Show Alarm” button left pillarright pillar upper gamma lower gamma neutron

Data analysis CAS Data View Detailed information on the monitor: Alarms Press the icon to generate a protocol – alarms list Press the icon to generate a protocol on the specified alarm

Data analysis CAS Data View Detailed information on the monitor: Occupancies Channel count Select the event Press the “Show Occup.” button left pillarright pillar upper gamma lower gamma neutron

Data analysis CAS Data View Detailed information on the monitor: Occupancies Press the icon to generate a protocol for the given measurement

Data analysis CAS Data View Detailed information on the monitor: Faults Select type of the event Press the “Show” button

Data analysis CAS Data View Detailed information on the monitor: Background Note: When specifying date interval, consider that background data sampling for the long interval requires some time

Data analysis General Report Select appropriate item in the “Analysis” menu Enter date interval and press the “Generate” button

Request spectra and alarm protocols to assess individual events and build site profiles Data analysis User Files Can Help Marked files will be saved in a user-specified folder on pressing the “Export to disk” button

Too many alarms. What could be the cause? Data analysis III. Analysis. B. Scenarios Comparing detector profiles for clues Could be voltage spikes on one detector. Could be NORM in routine commerce Could be threshold reset too low Could be operational problems (background suppression, cross- talk)

Too many alarms. What could be the cause? Data analysis III. Analysis. B. Scenarios Comparing detector profiles for clues Could be NORM in routine commerce Could be threshold reset too low Could be operational problems (background suppression, cross- talk)

Non-uniform alarm profile. What could be the cause? Data analysis III. Analysis. B. Scenarios Comparing detector profiles for clues Could be distribution of the source in cargo Could be voltage spike Need to follow up on alarm resolution, compare with other alarms on that RPM to determine.

Non-uniform alarm profile. What could be the cause? Data analysis III. Analysis. B. Scenarios Comparing detector profiles for clues Could be distribution of the source in cargo Could be voltage spike Need to follow up on alarm resolution, compare with other alarms on that RPM to determine.

Gaps in data. What could be the cause? Data analysis III. Analysis. B. Scenarios Could be scheduled power outages. Could be routine loss of power due to infrastructure inadequacy. Could be one person turning off RPMs during her/his shift.

Gaps in data. What could be the cause? Data analysis III. Analysis. B. Scenarios Could be: scheduled power outages. Routine loss of power due to infrastructure inadequacy. One person turning off RPMs during her/his shift. Routine maintenance You may have advance warning of this pattern from the overview screen

Tamper alarms. Data analysis III. Analysis. B. Scenarios Possible causes: Maintenance activities Intentional tampering. Loose connection with the magnetic sensor. Look at timing of the activities to help determine. Obtain a copy of maintenance schedules and orders to verify.

IV. Standard Operating Procedures. A. Minimum Recommendations ➲ Check the Main View twice a day (beginning and end of shift) ➲ Look for patterns in connectivity, confirm Daily File download ➲ Run analysis of each CAS and its RPM for 1 week, 2 week, and monthly intervals on a routine basis and develop operational profiles for each site and RPM. ➲ Follow up with CAS operators to investigate anomalies. ➲ Determine who should receive reports on status of health of RPMs, issues with operations, and observed anomalies in alarms, etc. ➲ Determine communication hierarchy between NDAC and sites, NDAC and ASC to ensure no duplication of efforts ➲ Maintain a list of CAS operators, their schedules, and phone numbers. ➲ Ensure CAS operators know how to save User Files, and develop request procedures (e.g., by phone, ). ➲ Obtain copies of planned maintenance schedules.

Data backup and Archiving is recommended Daily and User Files from the CAS are stored in the directories specified during system configuration. Default paths are: %ALLUSERSAPPDATA%\YaNDACServer\daily_files and %ALLUSERSAPPDATA%\YaNDACServer\user_files, correspondingly. It is recommended that these directories be copied to external storage (external HDD, USB flash, or other storage media) at least once per week. IV. Standard Operating Procedures. B. Data backup

V. Conclusion: A. Exercises Exercises are intended for practice. There are no wrong answers, just opportunities for discovery.

A hypothetical Member State ABC has the following: – 1 NDAC – 1 ASC – 7 CAS – 2-4 RPM per CAS CASs are located at: – Airports – Dry ports – Seaports – Land borders

– CAS 7 is new and needs to be added. What do you do? – Which CAS data are you interested in monitoring and why? – How will you know that the connection between you and a CAS has failed? What shall you do then? – Why it is important to know about missing data files? – How will you request the user files from CAS L2 for a specific alarm at L002? – You want to share analysis of a Daily File or a User File of a certain RPM with the ASC. What do you do? – Data received from a certain CAS deviates significantly from its average value. What could be the reason? What do you do? Exercise Tasks

V. Conclusion. B. Questions & Answers Any questions?