Approaches to Array and Network Processing for Enhanced Nuclear Explosion Monitoring

Steven J. Gibbons, Johannes Schweitzer and Tormod KværnaNORSAR, P.O. Box 53, 2027 Norway

steven@norsar.no, johannes@norsar.no, tormod@norsar.no

Site-specific ALERT warning system

Array-Based Waveform Correlation

Seismic Array Stations of the IMS

Empirical Matched Field Processing

Incoherent Array Processing

Threshold Monitoring

−180˚

−180˚

−120˚

−120˚

−60˚

−60˚

0˚

0˚

60˚

60˚

120˚

120˚

180˚

180˚

−60˚ −60˚

−30˚ −30˚

0˚ 0˚

30˚ 30˚

60˚ 60˚

SCHQULM

PPT

ROSC

LPAZ BDFB

CPUP

PLCA

MAW

STKA

NRIK

KBZ

KEST

KMBO

BOSA

VNDA

EKA

KVAR

MMAI

KURK

SPITS

HFS BVAR PETK

TORD

GEYT

NOA

ESDCMJARBRTR

SONM

MKAR

ILAR ARCES

NVARKSRS

GERES

WRA

PDAR

ZALV

ASAR

YKA

CMAR

USRK

TXAR

AKASG

FINES

DBIC

Primary Seismic Array

Auxiliary Seismic Array

Primary Seismic 3-C station

ARCES (PS28)

AKASG(PS45)

ASAR(PS3)

BRTR(PS43)

BVAR(AS57)

CMAR(PS41)

EKA(AS104)

ESDC(PS40)

FINES(PS17)

GERES(PS19)

GEYT(PS44)

HFS(AS101)

ILAR(PS49)

KSRS(PS31)

KURK(AS58)

KVAR(AS83)

MJAR(PS22)

MKAR(PS23)

MMAI(AS49)

NVAR(PS47)

PDAR(PS48)

PETK(PS36)

SONM(PS25)

SPITS(AS72)

TORD(PS26)

TXAR(PS46)

WRA(PS2)

YKA(PS9)

USRK(PS37)

ZALV(PS33)

40 km

20 km

10 km

10 kmNOA - NC2(PS27)

NOA - NBO(PS27)

NOA - NAO(PS27)

NOA - NC6(PS27)

NOA - NB2(PS27)

NOA - NC4(PS27)

NOA - NC3(PS27)

10 km

The array stations of the IMS seismic network are the most powerful stations for the detection and classification of seismicsignals. The time-delays between arrivals on the different sensorsallows for beamforming for the optimized detection of signalsfrom a given direction since noise from other directions is suppressed by the stacking operation. f-k analysis and relatedtechniques can estimate the direction of arrival and assist in phaseidentification. We here examine the exploitation of seismic arraysfor enhanced nuclear explosion monitoring.

Azi: 302.0o Vel: 10.59 km/s

−0.4

−0.2

0.0

0.2

0.4

Sy

−0.4 −0.2 0.0 0.2 0.4Sx

2009-145:00.56.47 (May 25) 2006-282:01.37.34 (October 9)

−0.4

−0.2

0.0

0.2

0.4

Sy

−0.4 −0.2 0.0 0.2 0.4Sx

Azi: 311.2o Vel: 9.41 km/s

306.5 o306.5 o

5 km/s

10 km/s

5 km/s

10 km/s

2013-043:02.59.56 (Feb 12)

−0.4

−0.2

0.0

0.2

0.4

Sy

−0.4 −0.2 0.0 0.2 0.4Sx

Azi: 307.9o Vel: 8.77 km/s

306.5 o

5 km/s

10 km/s

124˚

124˚

128˚

128˚

132˚

132˚

136˚

136˚

140˚

140˚

144˚

144˚

32˚ 32˚

34˚ 34˚

36˚ 36˚

38˚ 38˚

40˚ 40˚

42˚ 42˚

44˚ 44˚

46˚ 46˚

USRKJKA

MJAR

JNU

KSRS

(402 km)

(956 km)(439 km)

(1152 km)

(923 km)

The array stations of the IMS seismic network are the most powerful stations for the detection and classification of seismicsignals. The time-delays between arrivals on the different sensorsallows for beamforming for the optimized detection of signalsfrom a given direction since noise from other directions is suppressed by the stacking operation. f-k analysis and relatedtechniques can estimate the direction of arrival and assist in phaseidentification. We here examine the exploitation of seismic arraysfor enhanced nuclear explosion monitoring.

The MJAR array in Japan is the only seismic array ata regional distance to have recorded all three DPRKnuclear tests as a certified primary IMS station. However, it failed to contribute to the automaticSEL3 bulletin for all 3 events - despite strong signals.

0.0 5.0 10.0 15.0

May 25, 2009, black.October 9, 2006, red.

Waveforms filtered 2.0 - 8.0 Hz

MJA0_HHZ

MJB1_HHZ

MJB2_HHZ

MJB3_HHZ

MJB8_HHZ

Time (seconds) - absolute times not shown.

The reason for the failure of classical array processing at MJAR for thePn phase from the DPRK tests is that the waveforms are incoherentacross the array for the frequency band with optimal signal-to-noiseratio (SNR) - see the 2006 and 2009 signals above.It can be demonstrated however that robust detections and parameterestimates can be obtained for all 3 arrivals (lowermost panel) by spectrogram beamforming and smoothing of the resulting slownessgrids with the array response function for a 4-5 second signal.

References:Gibbons et al, Geophys. J. Int., 2008 http://dx.doi.org/10.1111/j.1365-246x.2007.03650.xGibbons, Pure. appl. geophys., 2012, http://dx.doi.org/10.1007/s00024-012-0613-2

1

2

3

4

5

6

1

2

3

4

5

6

Det

ectio

n

Mag

1

2

3

4

5

6

1

2

3

4

5

6

Mon

itorin

g

Mag

1:30 1:35 1:40 1:45 1:50 1:55 2:00

9 Oct 2006 Day 282HH:MM (GMT)

IMS Network + KSRS

KSRS data

The red “Detection” trace shows continuous estimates of the smallest seismic event that can be detected by 3 or more stations in the network (at the 90% confidence level). Only P-phases are considered.The blue “Monitoring” trace shows continuous estimates of the largest seismic event that could possibly have occurred (at the 90% confidence level). Both P- and S-phases are considered for stations at regional distances.

In the context nuclear explosion monitoring it may be useful toobtain estimates of the largest events that might have occurredwithin a given location and time interval. Threshold monitor-ing is a method that applies the amplitude and travel-time pattern derived from previous events in the source region ofinterest to obtain continuous estimates of the largest events thatcould possibly have occurred (Monitoring), or the smallestseismic event that can be detected by e.g. 3 or more stations ofthe network (Detection). These estimates are based on theassumption that conventional methods like beamforming and band-pass filtering are used for data analysis.

Reference:Kværna et al., Seismological Research Letters, 2007: http://dx.doi.org/10.1785/gssrl.78.5.487

Starting time 2011-296:15.00 (October 23)

KKAR beam (2-4 Hz)

AGRB_bz (2-4 Hz)

Transformed empirical matched field statistic trace (KKAR)

15:00 15:10 15:20 15:30 15:40 15:50

CC trace (full array) with mainshock template (KKAR)

CC trace (single channel KK01) with mainshock template

15:45 15:47 15:49

Zoom in

In extensive aftershocksequences after verylarge earthquakes, corre-lation detectors using themainshock signal as thetemplate are usually veryineffective at detectingaftershocks (due tosource location, spectralcontent of signals etc.).The narrowband EMFPmethod is effective atgenerating triggers. Heredemonstrated for theOctober 23, 2011, Vanearthquake, EMFPdetects aftershock signalsdown to the noise level.

2 Hz

4 Hz

8 Hz

Plane wave Real data (event 1) Real data (event 2)A waveform correlation detector compares the ups anddowns of a template seismic signal with successive segmentsof incoming data and triggers a detection when a sufficientlyclose match is observed.A correlator is the optimal detector for two identical signals,but suffers when waveforms differ due to, for example, different source-time functions. Empirical Matched FieldProcessing (EMFP) is a narrowband technique whichmatches the phase and amplitude relations between the sensors of an array or network for a given incoming wavefront. The narrowband nature makes it far less sensitiveto the source-time function and/or significant spectral differences between the master and detected signals.

Reference:Harris and Kværna, Geophys. J. Int., 2010: http://dx.doi.org/10.1111/j.1365-246x.2010.04684.x

A greatly enhanced detection capability results from the stacking of correlationcoefficient traces across an array or network. False alarms - positive detectionsfrom noise or signals from sources unrelated to the master event - do occur.Two wavefronts approaching an array from the same direction will result incorrelation coefficient traces which are well aligned at the time of a detection.If f-k analysis on the correlation coefficient traces does not result in an almost-zero slowness vector then the two wavefronts cannot come from the samedirection and the detection has to be a false alarm. This allows us to run thedetectors at aggressively lowthresholds with exceptionally low false alarmrates.The figures display the detection of the 2013 DPRK nuclear test on the NOAarray using the 2009 test signal as a template (above) and the f-k verificationthat the wavefronts approached the array from the same direction (left).

03:08:30 03:08:40 03:08:50

Starting time: 2013-043:03.08.30

Detection statistic stack (maximum 0.639)

Detection statistic NC200_BHZ (maximum 0.746)

Detection statistic NC602_BHZ (maximum 0.530)

Detection statistic NAO01_BHZ (maximum 0.540)

NC200_BHZ

NC602_BHZ

NAO01_BHZ max. amp. 838

max. amp. 578

max. amp. 865

max. amp. 495

max. amp. 1009

max. amp. 844

TEMPLATE

TEMPLATE

TEMPLATETEMPLATE

TEMPLATE

TEMPLATE

35

7

7

7 7

7

7

9

9

9

9

9

9

9

0.00

Slow

ness

Sy

(N-S

)

0.00 0.25-0.25

-0.25

0.25

Slowness Sx (E-W)

NOA array:f-k analysis of single channel detection statistic tracesTemplate time: 2009-145:01.05.30Maximum of detection statistic: 2013-043:03.08.38.153

A matched filter or correlation detector is themost effective method for detecting a known signal in noisy data. Its applicability to verification seismology appears to be far broaderthan initial assumed due to the repeatability ofsignals generated by seismic events within closeproximity of each other.

If two events are co-located then the correspond-ing patterns in the waveforms from the twoevents are separated by the same time differenceat all stations. This means that a zero delay stack-ing procedure can be applied across arrays andnetworks of, in principle, arbitrary size. The lossof coherence which precludes classical beam-forming over extended apertures no longerapplies: the necessary conditions for waveformsimilarity are a proximity of the source locationsand similarity of source mechanisms.

Reference:Gibbons and Ringdal, Geophys. J. Int., 2006: http://dx.doi.org/10.1111/j.1365-246x.2006.02865.x!

SPI

ARC

FIN

HFS

NOA

EKA

03:07:00 03:08:00 03:09:00 03:10:00

Time (UTC) on 2013-043 (February 12)

Triggering phase detection

1

3

3

5

5

7

7

9

9

9

-0.4

-0.2

0.0

0.2

0.4

Slow

ness

Sy

(N-S

)

-0.4 -0.2 0.0 0.2 0.4

Slowness Sx (E-W)

FINESIsolines: dB below maximum

126˚

126˚

128˚

128˚

130˚

130˚

132˚

132˚

40˚ 40˚

42˚ 42˚

44˚ 44˚

Since a seismic array is able to provide anestimate of the direction from which awavefront arrives, it is relatively simple todefine criteria to decide if the arrival is acandidate for a phase generated by a seismic event at a site of special interest,such as a nuclear test site.

In the case here, a detection with a highsignal to noise ratio at the FINES array isfound to be a P-phase from about 67degrees azimuth, consistent with an arrivalfrom the DPRK test site. If this is indeedan arrival from this site, then we knowquite accurately the times at which P-phases from this hypothetical explosionwould arrive at other seismic array stations(indicated by the blue boxes in the plot tothe right).

The blue boxes provide a kind of template for the site of interest. In each of the time-windows indicated by the boxes, detection lists are searched for phases whichare consistent with an event at the target site. If there is evidence of characteristicphases in the time-windows defined by the template, the event hypothesis is strengthened and the associated phases are fed into an event location algorithm (usingarrival times, backazimuth and slowness measurements). The figure to the left indicates the fully automatic ALERT location estimate (using the HYPOSAT program) for the event displayed above - the location is 12 km from the presumedlocation of the DPRK nuclear test site.The NORSAR Event Warning System (NEWS) provides automatic event alerts onhttp://www.norsardata.no/NDC/bulletins/alert/

Reference:Schweitzer, J., HYPOSAT – An Enhanced Routine to Locate Seismic Events,Pure appl. geophys., 2001: http://dx.doi.org/10.1007/pl00001160

The figure shows threshold monitoring results for a 30 minutetime interval around the 2006 underground nuclear test inNorth Korea, using data from the operational IMS network.Notice that the array KSRS in South Korea was not certified atthat time (and so not available to IDC operations) but that a 10minute segment of KSRS data were subsequently added toillustrate the change in performance.