SO96.4.18

ABSTRACT. The MSAS Data Monitor is a generic software product that represents the next-generation in real-time data monitoring and analysis tools. It goes beyond conventional text-based displays by representing data in a unique graphical form, conveying system status through the shape, color, motion, and position of graphical objects floating in a three-dimensional cyberspace environment. It is ideal for monitoring high volumes of data, for viewing results in easily configurable displays, and for providing both high-level and detailed views into a constellation of monitored satellites. The Data Monitor offers a great improvement over conventional graphic and text-based displays, not only because it dramatically increases the amount of data that a single person can absorb in limited time, but also because it can be completely installed and configured without any software development by the end-user. The system also provides innovation in alarm detection, reporting of both traditional limit-based alarms and alarms triggered by automated analysis of data.

The Data Monitor is the cornerstone of a suite of monitoring and analysis tools. It provides a new approach to data monitoring and visualization through a triad of interrelated functionalities:

• the three-dimensional CyberGrid enables the user to obtain a comprehensive, qualitative synopsis of all the satellites in a constellation;
• the Data Explorer organizes data and displays in a meaningful, easily comprehended hierarchy; and
• the Data Windows provide detailed, quantitative insight into specific monitored data.

Notification of alarm conditions is a primary function of any monitoring system. MSAS detects several types of alarms and provides a notification scheme that is tightly integrated with the visualization capabilities. Alarms are propagated through the data hierarchy created with the Data Explorer, are indicated in the CyberGrid and in the Data Windows, and are conveniently logged and summarized on a central alarm page. This paper describes some of the details and benefits of the MSAS monitoring and analysis suite, with primary focus on the Data Monitor.

The Data Explorer is used to organize data into an easily perusable arrangement of displays that accommodate thousands of monitored parameters. The displays are specified as data hierarchy that can be flator deep, depending on individual or team preferences. The Data Explorer is used to specify, modify, access, and navigate through a hierarchy and to select from the various available views of the data.

The Data Explorer relies on a "file-folder" paradigm for the specification of data collections. Menu options allow the user to create, name, modify, and delete folders. Once a folder is created, additional lower-level folders can be included within that folder to further sub-categorize the data. At the lowest level of thehierarchy, the data assigned to each folder must be allocated to data windows such as plots, tables,schematics, gadgets (dials, gauges etc.), or free-form reports. Data windows can also be inserted at higher levels in the hierarchy. The assignment of individual parameters to data windows is also done with the Data Explorer.

Let us look at the Data Explorer, shown in Figure 1. The left side of the window shows the existing hierarchy. When beginning for the first time, the root folder (at the highest level) is named ìRootî. The root folder corresponds to the system (or constellation of satellites) being monitored. Lower-level folders categorize data according to individual or team preferences. Typically the second-level folders correspond to individual satellites, with subsystems or other data groupings as optional lower levels. Folders can be opened or closed, hiding or showing other folders or data windows that have been specified within, at lower levels of the hierarchy.

The right side of the Data Explorer window shows the collection of data windows that have been specified for the folder that is mouse-selected on the left side of the window. Icons are used to identify the type of data window. The file and window options on the menu bar provide the interface for creating, modifying, and deleting folders and data windows.

The CyberGrid conveys massive quantities of information using the combination of color, shape, motion, and position as a novel alternative to the conventional text-based approach. Thousands of data parameters from multiple satellites can be easily accommodated on a single intuitive display, providing an effective and complete high-level synopsis. Alarm states are qualitatively represented using position and motion inaddition to the standard visual information conveyed with color. Lower-level detailed information is available via point-and-click with the mouse.

There are a variety of strategies for laying out custom configurations of the grid, all beginning with the specification of row and column groupings. For constellation monitoring, the rows would typically be labeled with mission names, and the columns with subsystem names and/or other subcategorizations of data. A configuration used for a satellite is shown in Figure 2. A second configuration shown in Figure 3 shows a health and status monitoring concept developed for airport radars and other instruments. In single mission display, the CyberGrid rows correspond to spacecraft subsystems or operations teams and the columns to sub-groupings within the subsystems.

The Data Explorer provides the means to configure the grid layout and to assign data parameters to the various groupings that are specified. The top level of folders specified in the Data Explorer correspond to the row labels of the grid. The next level of folders corresponds to the column headings. The data parameters contained at various levels below the column-heading folder are represented graphically within the CyberGrid square that is uniquely identified by its row and column names. Each of the data parameters will appear in the grid square as a geometric object (square, triangle or diamond, depending on the type of parameter). The objects will change color and position to indicate changes in the status of the monitored system.

The visual representation of a parameter is referred to as a data object. In the absence of alarm conditions, data objects will nominally be gray or white in color, indicating the respective absence or presence of recent data transmissions associated with a parameter.

The identity of an individual data object can be obtained with a right mouse-click on the object, which causes the object to briefly turn green and display its parameter ID and current value. Access to all the detailed tabular and graphical data corresponding to any of the grid squares is obtained with a left mouse-click in the grid square, which produces all of the data windows that have been configured for the parameters in that square.

A middle-click on a row-name or grid square removes all nominal data in that row or square from view; displaying exceptions to nominal operations only. When the display of nominal data has been removed, the grid square is outlined with a blue border as a visual reminder. A subsequent middle-click causes the nominal data to reappear and simultaneously removes the blue border. Removing (or hiding) the nominal data from view reduces the density of objects shown on the display and better focuses operator attention on those data parameters that are exhibiting anomalous behavior. Hiding the nominal data in each grid square is recommended, in order to achieve the increased operational simplicity afforded by exception-based monitoring.

All the data values associated with all monitored parameters are normalized for display between the nominal grid and the upper grid. This eliminates the need to know the units and limit values associated with any monitored parameter in order to make qualitative status assessments about the severity of alarms. Normalization is required to accommodate parameters with widely varying predefined nominal values or with different units of measure. For example, the objects of Data Parameter A and Data Parameter B can(and should) lie within the same grid even though parameter Aís nominal range is between 2.000 to 75.500watts and parameter B has a nominal range between 500 to 600 milli-amps.

The CyberGrid allows the user to manipulate the viewpoint of the display. There are 6 degrees of freedom available in moving within the CyberGrid environment; the viewpoint may be translated in 3 dimensions along the X, Y, and Z axes, and oriented in 3 dimensions (rolled, pitched, and yawed). The CyberGrid offers 10 savable viewpoints. Three of these are pre-configured, the remainder are user-defined.

Mouse button combinations and mouse position determine the type of movement (pan, zoom, pitch, yaw, roll). Location on the screen determines the direction of the movement. For example, pressing the same button on the upper half of the screen pans the viewpoint up, but pressing the same button in the lower half pans the viewpoint down. The distance between the screen center and the cursor determines the speed of the motion. The farther the cursor is from the center, the faster the viewpoint moves.

The Data Monitor currently has six types of data windows, including two types of tables, schematic diagrams, free-form reports, gadget collections (gauges, thermometers, etc.), and X-Y plots showing data vs. data or data vs. time. Data Windows are created with menu options contained in the Data Explorer. Once created, data windows can be modified, reconfigured, and customized in numerous ways. Collections of data windows can be saved as retrievable configurations. Subsequently each of the windows in a configuration can be recalled on the screen, along with the various customizations to the windows. Figure 4 shows a small collection of data windows, including two types of tables, a plot, and a schematic.

All the data windows associated with a given CyberGrid grid square or data parameter can be simultaneously accessed with a mouse-click in the square. Alternatively, the data windows can be individually accessed from the Data Explorer. The user will routinely access data windows in both ways, as determined by the circumstances surrounding the need for access.

For new Data Monitor users, it is enough to be aware that the various types of data windows exist and that they can be extensively customized. The first steps in configuring a monitoring system should be focused on organizing the data into a complementary hierarchy and grid allocation. When the operator is satisfied with the high-level organization afforded by these tools, it will then be time to concentrate on the individual data windows and customize detailed views of the data.

After the operator has specified the displays, the Data Monitor is ready to be used for its ultimate purpose: to monitor the data and notify appropriate individuals of conditions that require the operatorís attention.

The first type of alarm that is detected by the Data Monitor is the limit alarm. A limit alarm will occur when one of the following conditions exits:

• An analog value falls outside of its predefined nominal range,
• The bit state of a status (discrete) data parameter does not correspond to a predefined state, or
• The counter value of an ASCII data parameter does not correspond to the expected value.

The Data Monitor detects and notifies analysts of three levels of limit violation alarms. From least to most severe, these are the advisory, warning, and critical alarm levels. When Data Monitor detects limit alarm violations associated with any of the monitored data parameters, the corresponding data objects in the CyberGrid will change from white to blue, yellow, or red to indicate advisory, warning, or critical alarms respectively.

In addition to the standard limit alarms, MSAS offers two different algorithms for detecting trend alarms. One is based on the rate at which a parameter value changes over time: if the rate of change of a parameter exceeds some predefined limit over a specified period of time, then the parameter triggers a trend alarm. The other algorithm is based on the continual increase or decrease of a parameter value over a given period of time: if the value of a parameter is constantly increasing or decreasing during a user-specified time interval, then a trend alarm will occur.

In both of these cases, the graphical object associated with the parameter will spin for a less severe or warning-level trend alarm. For more severe or critical trend alarms, the object will flash. If the object is already in a limit-based alarm state, then the color of the object remains the same as for the existing limit alarm. Otherwise, the object turns from white to brown. This use of color, spinning, and flashing allows the unambiguous display of all possible combinations of limit and trend alarms.

Simultaneous with the color and motion changes, objects in alarm rise above the white grid to a height proportional to the severity of the alarm. The upper grid indicates the most severe condition is relevant for a given parameter, typically associated with the point beyond which irreversible damage has occurred. The height of the objects between the two grids is based on normalization of each data parameter between the center of its nominal range and the final alarm ceiling. When the data parameter object value exceeds the flight approved error limit, the object remains red and rises on its pole to the level of the green ceiling. The corresponding square in the upper grid will then turn from green to red.

The Alarms column is the first column in the grid and is the only column that is not specified by the user in the Data Explorer. This column provides a visual representation of the overall alarm status. An alternate view is provided by a tabular alarm page, that can be accessed from the main window of the Data Monitor or by clicking on a data object in the Alarms column.

These views are related. When the user acknowledges the alarms in the Data Monitor Main Window, the objects in the Alarms column of the CyberGrid are deleted. When a channel goes out of alarm before it isacknowledged, the data object in the Alarms column will turn white. It will remain in the alarmís column until the next acknowledgment. This scheme enables operators and analysts to be away from the monitoring system, and to be immediately informed of all new alarms upon return. A simple acknowledgment of alarm status prior to departure clears the CyberGrid Alarms column; subsequently occurring alarms will be collected in the Alarms column until the next acknowledgment.

Alarm information is also propagated through the hierarchy in the data explorer. A data window containing a parameter in alarm will turn blue, yellow, or red depending on the severity of the alarm. Each folder above that data window in the hierarchy will also turn the color of the alarm. When multiple parameters in a single path in the hierarchy are in alarm, the color corresponding to the most severe alarm dominates. Thus, no matter what the current view in the Data Explorer and regardless of which folders are open and which folders are closed, alarm information is communicated unambiguously and in a way that cannot be overlooked.

MSAS consists of a suite of applications that support configuration of a total monitoring system. The Data Access module provides the interface to the actual data. Data Access is controlled via the Data Monitor. The Data Editor application displays, filters, and (when necessary) enables data files to be edited. Data can be accessed and saved in files using the Data Access module and then loaded into the Data Monitor for a non real-time session as an after-the-fact quick analysis alternative to constant monitoring in real-time.

The Alarm Limit Editor is used to specify, view, and/or edit alarm limits. The Data Dictionary Editor is used for specifying and viewing channel definitions that are relevant in a given monitoring scenario. Use of the Alarm Limit Editor and the Data Dictionary Editor as actual editors can be restricted to authorized individuals only.

The Task Scheduler provides a means for scheduling automated data access and for piping retrieved data to the Data Monitor for automated detection and notification of alarms, or for scheduling automated analysis or report generation.

Hardware savings. The number of required computer workstations can be significantly reduced. Savings of at least 40% (or $80K for a 5-satellite constellation) are projected by one Data Monitor customer.

Reduced training costs. The Data Monitor reduces the level of education required for satellite operators and the level of familiarity required with individual satellites. It minimizes the complexity associated with operational differences between similar, non-identical satellites. This is achieved by normalizing all monitored data on one scale and providing visual indication of alarm severity that is not provided by any other commercial systems. One customer predicts reduction in training time on the order of 75%, resulting in a net savings of three weeks for each operator that needs to be trained.

Reduced installation costs. Because the Data Monitor is off-the-shelf software, it can be quickly installed and configured by operators or analysts who have no software development background. All competing products are software development toolkits, which require anywhere from 6 work months to 2 work years of adaptation and customization subsequent to purchase. The Data Monitor can usually be installed and fully configured in a few days.

Reduced maintenance costs. The Data Monitor can be configured by analysts, it can also be reconfigured by analysts. Other products require software development expertise for reconfiguration, which translates to an in-house software development staff of one or more individuals who are responsible for making software changes in response to operational needs. In the case of other products, these changes must be recompiled, adding risk by possibly introducing new bugs into existing software.

Reduced personnel costs. The Data Monitor effectively displays data from multiple satellites on a single workstation, making it possible for one analyst to be responsible for multiple satellites simultaneously. This translates to cost savings on the order of $100K for each operator or analyst that can be eliminated. The Data Monitor makes it possible to further reduce costs by eliminating the need for around-the-clock operator presence in satellite monitoring, contacting appropriate staff members via their pagers when necessary, and making it uniquely simple for these individuals to rapidly update themselves on status when they are called to the scene.

The MSAS data representation has been designed to eliminate the need for analysts to read text for the purpose of obtaining complete status information. The system enables an intuitive understanding of spacecraft health that goes well beyond the knowledge that ìnothing is currently in alarm.î Such a representation has a number of advantages:

• significant cost savings in hardware, maintenance, training, and personnel are achievable
• software development is no longer required as an essential step in configuring or maintaining a highly effective monitoring system
• analysts become aware of problem situations before actual alarms occur without needing to manually assess collected trend data
• greater information is provided in considerably less screen real-estate
• operations differences between non-identical spacecraft are ultimately minimized through data abstraction
• since the human brain has developed a high degree of skill at recognizing spatial patterns, complex data relationships are more readily apparent in a visual-spatial display as opposed to a text display