<SECURITY RATING> <LIVELLO SICUREZZA> Doc N. DRAFT…………………. Iss. …. PROGRAM : Modernization Project of Romanian ATM System ACCEPTANCE TEST PROCEDURE SDP Contingency Management CDRL No. : Program No. : Contract Identification Code : ISSUED BY : SELEX Sistemi Integrati Via Tiburtina km 12,4 - Roma ITALY The copyright in this document is the property of SELEX Sistemi Integrati S.p.A. The document is supplied on the express understanding that it is to be treated as confidential and that it may not be copied, used or disclosed to others in whole or in part for any purpose except as authorised in writing by SELEX Sistemi Integrati S.p.A. document.doc <SECURITY RATING> <LIVELLO SICUREZZA> Page 1 Mod.
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.DRAFT………………….
Iss. ….
PROGRAM : Modernization Project of Romanian ATM System
ACCEPTANCE TEST PROCEDURESDP Contingency Management
CDRL No. :
Program No. :
Contract Identification Code :
ISSUED BY :
SELEX Sistemi IntegratiVia Tiburtina km 12,4 - Roma
ITALY
The copyright in this document is the property of SELEX Sistemi Integrati S.p.A. The document is supplied on the express understanding that it is to be treated as confidential and that it may not be copied, used or disclosed to others in whole or in part for any purpose except as authorised in writing by SELEX Sistemi Integrati S.p.A.
The total number of pages, included the eventual Appendixes and Annexes, is .. pages.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 1Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.DRAFT………………….
Iss. ….
SECURITY CLASSIFICATION
The following are the military classification levels for the documents from lowest to highest.
NON CLASSIFICATO CONTROLLATO UNCLASSIFIED NCRISERVATO RESTRICTED RRISERVATISSIMO CONFIDENTIAL RRSEGRETO SECRET SSEGRETISSIMO TOP SECRET SS
Editing, issue, custody, reproduction, diffusion and disposal of Classified documents must be done in conformity to the Internal Security Rules (“Regolamento Interno di Sicurezza”).
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 2Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
Validation
Prepared by :<Function> ..........................................................
1.1 SYSTEM OVERVIEW........................................................................................................81.2 IDENTIFICATION............................................................................................................111.3 GENERAL CONDITIONS................................................................................................111.4 QUALIFICATION PROVISIONS.....................................................................................111.5 STRUCTURE OF THE DOCUMENT...............................................................................11
1. SCOPEThe scope of this document is to provide the operators with an acceptance tests procedure to verify the correct implementation of the SDP Contingency. For this aim in the Orders and Tests sequence chapter are included orders and tests in a correct sequence to verify the functionality.The specifications contained in this document are current at the time of publication but may be subject to variation as a result of improvement.The part under test will be in accordance with Selex specifications at the time of manufacture.
1.1 SYSTEM OVERVIEW
The RDP Subsystem to be implemented in the Bucharest OPS for Phase 3 update consists on 2 Artas Gateway Servers (receiving data from ARTAS) and 2 Radar Fall Back Servers. During the System configuration phase, one pair is identified as the Main MRT (ARTAS), providing the users with surveillance data, while the other one plays the Fall Back MRT role. Each pair of servers is configured as the usual Master/Stand-by. If both the Main MRT servers becomes suddenly unavailable (e.g. maintenance purposes, manual technician selection, failure, etc.), the Fall Back MRT takes the Main MRT role, ensuring both the congruity among the MRT data flow and the continuity in the MRT mode. The switching from the Master to the Slave Server as well as from the Main to the Fall Back MRT takes place automatically as default, not producing any significant interruption in the MRT data provided to the ATC Controllers. If both the facilities are off at the same time, the System automatically switches to the DARD mode. The transition between Main MRT, Fall Back MRT and DARD can be even forced in manual mode.
CSCI AEA is working in Main mode (RDP) while CSCI XMR is working in Fall Back mode (RFB). RDP and RFB operative status are:
- ”Not Ready” sent by CDB in order to enable the start-up phase or when, being attributed as data source, it is not able to send System tracks (there are not tracks in DB);
- “Ready to Work”. When the function is in this status, it is ready to become data source (RFB is not aligned); this status is attributed by the same function when it is able to send System tracks (there are tracks in its DB);
- “Aligned”. When the function is in this status, it is aligned with RDP and it is ready to become data source (valid only for RFB); this status is attributed by the same function when it is aligned (after Start-scan message of RDP and then two RFB scan). The reached status is notified to CDB;
- “Commutation” sent by CDB to notify to the function which is data source (multiradar data are sent);
Identification of the System working modes within RFB and RDP functions:- DARD_F; RDP and RFB functions cannot perform an automatic transition;- DARD_C; RDP and RFB functions can perform an automatic transition;- RFB_C; RFB function is multi-radar data source and consumer of RDP data to maintain
its STN dated with RDP STN, while RDP is multi-radar data source only towards RFB; in this System working mode RDP and RFB functions cannot perform an automatic transition;
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 7Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
- RFB_F; RFB function is multi-radar data source and consumer of RDP data to maintain its STN dated with RDP STN, while RDP is multi-radar data source only towards RFB;
- RDP; RDP function is multi-radar data source, while RFB is data consumer by RDP to maintain its STN dated with RDP STN.
Both the RDP and the RFB functions can be radar data source.
Only one function at time shall be enabled to send radar data. A function becomes radar data source when it is able to consume INI_INF message with operative status = ”Commutation”. To consume such message, a function must stay in the “Ready to Work” or “Aligned” status (valid only for RFB).
Manual transitions happen after an operator’s order is notified to CDB.On the base of the reached order (type demanded transition) and of the functions status (the function choice for the commutation must be in the “Ready to Work” or “Aligned” status), XCD starts the transition notifying to RDP and RFB the new status.The working modes that can be reached through manual transitions are DARD_F, RFB_F and RDP, and they are:
a. from RDP to RFB ( RFB_F mode) b. from RFB to DARD (DARDF_F mode)c. from RFB to RDP (RDP mode)d. from RDP to DARD (DARD_F mode)e. from DARD to RDP (RDP mode)
The Master/Slave commutation of RFB is obtained using the logic of the MRT that is qualified through an appropriate configuration parameter.
For the Master/Slave alignment of RDP and RFB, the following UDP ports (only dedicated ports) are used:
- 1 port for the alignment of RDP (reserved to the RDP function)- 1 port for the alignment of RFB (reserved to the RFB function)
Alignment of the DB with BYP flows on dedicated ports.
In every node transition, the parameter alignment between RFB Master and Slave is guaranteed by the logic inherited by the MRT, that foresees an alignment in real time of the changed data. RFB slave, to get the data flows necessary to the alignment, uses the UDP port reserved to him .
In every node transition, the alignment of the database of the tracks between RFB Master and Slave is guaranteed by the logic inherited by the MRT through BYP flows. RFB slave, to get the BYP flows, uses the UDP port reserved to him.
The logic that RFB uses to produce RFB System Tracks (on the basis of the information received by connected radar), is the same used by RDP (immediate consequence of the logic implemented by MRT).
The RFB and RDP functions use two different set of System Track Number.These, determined on the basis of the working modes (configuration parameter) are:
- from 0 to 4095 for System Track Number produced by RDP (STNRDP)
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 8Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
- from 4096 to 8191 for System Track Number produced by RFB (STNRFB)
RFB using the same algorithms of correlation used by RDP (logic MRT) and the ST flows of RDP, previously converted (elaborate as a data flow mono radar), it correlates the system tracks of RFB with those of RDP.
RFB has to use the STNRDP for all ST correlated with RDP tracks.
The period of alignment between RDP and RFB doesn't have to overcome the 12 sec. The alignment begins in the moment in which RDP sends the first message of Start-scan to RFB, and it will finish when RFB will have received the third message of Start-scan from RDP (calculation of two complete RDP scan). To this point RFB will send the SOFMG message to XCD with state "Aligned". From this logic it derives the necessity to maintain the time of a scan smaller of 6 seconds.
In the phase of start-up the timer of commutation is activated for verifying the presence of tracks in the DB. Then to the release of the timer the DB is checked and the timer is reactivated.
In every case therefore the timer is always active. To the release of the timer that checks the presence of radar data in input, if don't be received more radar data type RDP, all the RDP contributions are cancelled by the DB of the local tracks.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 9Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
1.2 IDENTIFICATION
The Site Acceptance Test Procedure is applicable to SELEX-SI SDP Contingency supplied for the Romanian ATC System Upgrading.
The present document is identified by the code EE110008314ATP02
1.3 GENERAL CONDITIONS
All tests will be performed in the normal environmental conditions of the sites as specified in the contract during the normal indoor operations.
All required personnel will be provided by SELEX-SI.
The test will be done by an SELEX-SI test team and demonstrated to the Customer's representative.
1.4 QUALIFICATION PROVISIONS
The qualification methods used to ensure the requirements compliance shall be performed according to “Demonstration” criteria. They consist of observable functional operations (performed by the System or part of the System) not requiring any use of instrumentation, special test equipment, or subsequent analysis.For each commutation between RDP and RFB mode will be checked:No double targets should appear.No loss of data (more than 10 seconds) on CWP screens, on REC and on plotter.No loss of correlation between CALLSIGN and track.The correctness and continuity of serial MRT output shall be tested during commutation.
1.5 STRUCTURE OF THE DOCUMENT
This document is structured in 4 chapters:
Cap. 1: ScopeIt introduces the document and its goal.
Cap. 2: Referenced documentsIt lists all the referenced publications and the documents used for writing this acceptance procedure and useful for consultations.
Cap. 3: Tests descriptionIt explains one by one all the tests and orders to be performed.
Cap. 4: Tests Results
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 10Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
It details all the results obtained during the acceptance tests.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 11Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
2. REFERENCED DOCUMENTS
[1] AMS - E184-01-2375SSS_A-SSS for MRT_Contingency Management – 25/02/03.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 12Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
3. TESTS DESCRIPTION
3.1 TESTS LIST
The SDP contingency acceptance tests list is the following:
The order REL SFM is provided in order to on-line disable/enable the automatic transition, after REL SFM command (from auto to manual) according to RFB/RDP operative state and the initial mode of operation a change of status will be executed as described in the following table:
Initial Mode Forced flag RFB status RDP status
Final Mode after transitions
DARD-C NO->YES NR NR DARD-F
RFB-C NO->YES RTW-NAo RTW-A
NR RFB-F
DARD-C NO->YES NR NR DARD-F
The following tests demonstrates that the following modes of operation manual transitions shall be provided:
a. RDP → RFB;
b. RFB → DARD;
c. DARD → RFB;
d. RFB → RDP;
e. RDP → DARD;
f. DARD → RDP.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 16Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
3.4.1 TEST SEQUENCE AND DESCRIPTIONS
To perform the test is necessary to follow a predefined sequence to avoid the execution of additional orders to change initial conditions necessary to perform the test. Before start the tests RDP must be Operative and RFB ready to work aligned.
Action Expected Result Evaluation CriteriaType the command MRT STS and press “return” until the RDP Node becomes Operative.
A table will be shown on the I/O console.
Verify that the function status is OPERATIVE.
Type the command REL RFB and press “return”.
The System will pass in RFB mode.
Observation of the diagnostic messages.
Type the command REL DRS and press “return”.
The System will pass in DARD mode.
Observation of the diagnostic messages.
Type the command REL RFB and press “return”.
The System will pass in RFB mode.
Observation of the diagnostic messages.
Type the command REL RDP and press “return”.
The System will pass in RDP mode.
Observation of the diagnostic messages.
Type the command REL DRS and press “return”.
The System will pass in DARD mode.
Observation of the diagnostic messages.
Type the command REL RDP and press “return”.
The System will pass in RDP mode.
Observation of the diagnostic messages.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 17Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
3.4.1.1 RDP -> RFB Manual Transition
Purpose: Verify that the manual transition from RDP to RFB shall occur when the RFB is Ready To Work and REL RFB order is executed.
Initial conditions: RDP Operative and RFB Ready to Work Aligned
The order REL SFM is provided in order to on-line disable/enable the automatic transition, after REL SFM command (from manual to auto) according to RFB/RDP operative state and the initial mode of operation an automatic recovery or change of status will be executed as described in the following table:
Initial Mode Forced flag RFB status RDP status
Final Mode after transitions
DARD-F YES -> NO RTW-A RTW RFB-C
DARD-F YES -> NO RTW-NA RTW RDP
DARD-F YES -> NO RTW-NA NR RFB-C
DARD-F YES -> NO NR RTW RDP
DARD-F YES->NO NR NR DARD-C
RFB-F YES->NO RTW-NAo RTW-A
NR RFB-C
DARD-F YES->NO NR NR DARD-C
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 24Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
In automatic transitions the recovery could be executed after a change of operative state of RFB/RDP or after REL SFM command (from manual to auto) if the RFB/RDP operative state and the mode of operation foresees an automatic recovery,
Initial Mode RFB status RDP status Final Mode after transitions
DARD-C RTW-A RTW RDP
DARD-C RTW-NA RTW RDP
DARD-C RTW-NAO RTW-A NR RFB-C
DARD-C NR RTW RDP
RFB-C NR! RTW RDP
In the automatic transitions the falls could occur in case of the dispatch of the chgsof "not ready" from RFB/ RDP due to loss of the tracks, or in the case of fall of the RFB/RDP node that was operative (it in this case the timeout on the reception of life message expires). In the table the "NR!" denotes the fall of the node or the loss of the tracks.
Initial Mode RFB status RDP status Final Mode after transactions
RFB-C NR! NR DARD-C o F (according to the flag FORCED)
RFB-F NR! NR DARD-F
RDP RTW-A NR! RFB-C o F (according to the flag FORCED)
RDP RTW-NAo NR NR! DARD-C o F (according to the flag
FORCED)
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 25Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
3.5.1 TEST SEQUENCE AND DESCRIPTIONS
To perform the test is necessary to follow a predefined sequence to avoid the execution of additional orders to change initial conditions necessary to perform the test. Before start the tests RDP must be Operative and RFB ready to work aligned and Forced flag set to NO.
Type the command REL RDP and press “return” until the System working mode becomes RDP.
A table will be shown on the I/O console.
Verify that the System mode is RDP.
Type the command RFB RTB and press “return” until the RFB Node becomes Ready to work and Aligned.
A table will be shown on the I/O console.
Verify that the function status is READY_TO_WORK and the function status1 is ALIGNED.
Switch OFF RDP nodes. The Node will stop processing.
Verify the unavailability on CMS
Type the command RFB RTB and press “return” until the System working mode becomes RFB.
A table will be shown on the I/O console.
Verify that the System mode is RFB.
Switch off radar data distribution units Radar data will be not received.
Observation of the diagnostic messages..
Type the command RFB RTB and press “return” until the System working mode becomes DARD.
A table will be shown on the I/O console.
Verify that the System mode is DARD.
Switch ON radar data distribution units
Radar data will be received.
Observation of the diagnostic messages.
Type the command RFB RTB and press “return” until the System working mode becomes RFB.
A table will be shown on the I/O console.
Verify that the System mode is RFB.
Switch ON RDP nodes. The RDP Node will start.
Observation of the NSV and other CSCIs diagnostic messages.
Type the command MRT STS and press “return” until the RDP Node becomes Ready to work.
A table will be shown on the I/O console.
Verify that the function status is SOF OPERATIVE
Switch OFF RFB nodes. The Node will stop processing.
Verify the unavailability on CMS
Type the command MRT STS and press “return” until the System working mode becomes RDP
A table will be shown on the I/O console.
Verify that the System mode is RDP.
Switch OFF radar data distribution units
Radar data will be not received.
Observation of the diagnostic messages.
Type the command MRT STS and press “return” until the System working mode becomes DARD.
A table will be shown on the I/O console.
Verify that the System mode is DARD.
Switch ON radar data distribution units
Radar data will be received.
Observation of the diagnostic messages.
Type the command MRT STS and press “return” until the System working mode becomes RDP.
A table will be shown on the I/O console.
Verify that the System mode is RDP.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 26Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
3.5.1.1 RDP -> RFB Automatic Transition
Purpose: Verify that the automatic transition from RDP to RFB shall occur when the RDP Source is no more available.
Execution: The automatic transition from RDP to RFB (RDP→RFB_C) is performed when the RDP function, through lack of tracks in the DB, sends no more the life message to CDB and RFB has notified to CDB that it has reached the “Ready to Work Aligned” status. The necessary conditions to the transition are determined by the following actions:
Type the command REL RDP and press “return” until the System working mode becomes RDP.
Verify that the System mode is RDP by the command REL STA ...
Type the command RFB RTB and press “return” until the RFB Node becomes Ready to work and Aligned. Verify that the function status is READY_TO_WORK and the function status1 is ALIGNED. ... System Mode : RDP
RFB Role : MST Function Status : READY_TO_WORK Function Status1 : ALIGNED ...
Switch OFF RDP nodes and verify the unavailability on CMS
Type the command RFB RTB and press “return” until the System working mode becomes RFB . ... System Mode : RFB-C RFB Role : MSTFunction Status : OPERATIVE Function Status1 : NOT_ALIGNED ...
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 27Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
Verify that the System mode is RFB by the command REL STA ...
Expected Result: System working mode becomes RFB .
3.5.1.2 RFB -> DARD Automatic Transition
Purpose: Verify that the automatic transition from RFB to DARD mode shall occur when both the RDP and the RFB sources are not available.
Execution: The automatic transition from RFB to DARD (RFB_C→DARD_C) is performed when the RFB function, through lack of tracks in the DB, sends no more the life message to CDB and RDP has not yet notified to CDB that it has reached the status “Ready to Work”. The necessary conditions to the transition are determined by the following actions:
Switch off radar data distribution units Type the command RFB RTB and press “return” until the System working
mode becomes DARD-C. ...
System Mode : DARD-C RFB Role : MST Function Status : NOT_READY Function Status1 : NOT_ALIGNED ...
Expected Result: System working mode becomes DARD-C
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 28Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
3.5.1.3 DARD -> RFB Automatic Transition
Purpose: Verify that the automatic transition from DARD to RFB shall occur when the system is in DARD mode and the RFB becomes available while the RDP is still unavailable.
Execution: The automatic transition from DARD to RFB (DARD_C→RFB_C) is performed when the RFB function has notified to CDB that it has reached the status “Ready to Work”. The necessary conditions to the transition are determined by the following actions: Switch ON radar data distribution units Type the command RFB RTB and press “return” until the System working
mode becomes RFB.
... System Mode : RFB-C RFB Role : MSTFunction Status : OPERATIVE Function Status1 : ALIGNED ...
Expected Result System working mode becomes RFB .
3.5.1.4 RFB -> RDP Automatic Transition
Purpose: Verify that the automatic transition from RFB to RDP shall occur when the RFB Source is no more available.
Execution: The automatic transition from RFB to RDP (RFB_C→RDP) is performed when the RFB function sends no more the life message to CDB and RDP has notified to CDB that it has reached the “Ready to Work” status. The necessary conditions to the transition are determined by the following actions:
Switch ON RDP nodes.
Type the command MRT RTB and press “return” until the RDP Node becomes Ready to work.
... System Mode : RFB-C RDP Role : MST Function Status : READY_TO_WORK Function Status1 : DUMMY
...
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 29Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
Switch OFF RFB nodes.
Type the command MRT RTB and press “return” until the System working mode becomes RDP
... System Mode : RDP RDP Role : MST Function Status : OPERATIVE Function Status1 : DUMMY
...
Expected Result: The System working mode becomes RDP
3.5.1.5 RDP -> DARD Automatic Transition
Purpose: Verify that the automatic transition from RDP to DARD mode shall occur when the RDP becomes unavailable and the RFB is still unavailable or the RFB is not delivered in the SDPS configuration.
Execution: The automatic transition from RDP to DARD (RDP→DARD_C) is performed when the RDP function, through lack of tracks in the DB, sends no more the life message to CDB and RFB has not yet notified to CDB that it has reached the status “Ready to Work”. The necessary conditions to the transition are determined by the following actions:
Switch OFF radar data distribution units
Type the command MRT RTB and press “return” until the System working mode becomes DARD.
... System Mode : DARD-CRFB Role : MSTFunction Status : NOT_READY Function Status1 : NOT_ALIGNED Input Source : LIVE
...
Expected Result: The System working mode becomes DARD.
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 30Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
3.5.1.6 DARD -> RDP Automatic Transition
Purpose: Verify that the automatic transition from DARD to RDP shall occur when the system is in DARD-C mode and the RDP becomes available.
Execution: The automatic transition from DARD to RDP (DARD_C→ RDP) in configuration is performed when RDP notifies to CDB that it has reached the status “Ready to Work”.
Switch ON radar data distribution units
Type the command MRT RTB and press “return” until the System working mode becomes RDP.
... System Mode : RDP RDP Role : MST Function Status : OPERATIVE Function Status1 : DUMMY
...
Expected Result: The System working mode becomes RDP
document.doc <SECURITY RATING><LIVELLO SICUREZZA>
Page 31Mod.
<SECURITY RATING><LIVELLO SICUREZZA>
Doc N.
Iss.
4. TESTS RESULTSAll the results obtained during the acceptance tests are reported into the Tests Data Record