Air traffic control depends heavily on technology: surveillance systems to monitor aircraft, communication systems to speak with pilots, flight-data systems to manage information, and numerous other technical systems most passengers never see.
Normally, all of this works quietly in the background. But what happens when it doesn’t?
A radar sensor can fail. A radio frequency can become unusable. Flight data can become unavailable. A network connection can be lost. A power supply can fail. None of this should surprise an air navigation service provider, modern air traffic management is designed around a fundamental assumption:
Technical systems will eventually fail.
The safety question is therefore not simply how reliable the primary system is. It is what happens after that system is no longer available.
ATC Cannot Depend on One System
Imagine a control unit that depends on one surveillance sensor, one communication system or one power source. It may work perfectly for years, but if that single component fails with no alternative, one technical problem immediately becomes an operational one.
This is why safety-critical infrastructure is built with redundancy: the failure of one component should not remove the entire capability. The backup doesn’t have to be identical to the primary system, what matters is that controllers retain enough capability to keep operating safely, or can transition to a predefined degraded or contingency mode.
Redundancy is not about making failure impossible. It is about preventing one failure from becoming critical.
Failures Across the System
The same logic applies wherever a critical function depends on technology.
Surveillance: Controllers may draw on several sources, conventional radar, Mode S, multilateration and ADS-B. Here’s how those technologies work. If one source fails, another may still provide coverage, although losing a single sensor is very different from losing the system that combines data from several of them, or losing surveillance across an entire unit.
Communication: A failure can affect a single frequency, a transmitter, a working position or a larger network. Alternative frequencies, separate equipment and predefined procedures provide layers of protection, and both pilots and controllers train specifically for communication failures.
Working positions: A controller working position brings together surveillance, flight data and communications, so losing a position is a different kind of problem from losing a single sensor or radio. Depending on the architecture, another position may be available, responsibilities may be reorganized or operations may shift to another configuration.
In each case, if the remaining capability isn’t enough for normal operations, controllers may need degraded procedures, reduced capacity, additional spacing or restrictions on certain operations.
Safe does not necessarily mean normal.
A Backup Is Only Useful If It’s Truly Independent
Redundancy is more complicated than simply buying two of everything. Two apparently independent systems might share the same electrical supply, the same network connection or the same technical room, leaving both exposed to the same fire, flooding or cooling failure.
On paper there are two systems; in reality, a single event can disable both. This is known as a common-mode or common-cause failure.
True resilience therefore means looking beyond individual devices and examining the whole chain on which a function depends, including power distribution, switching equipment, batteries, emergency power, cooling, networks and the technical systems themselves.
A backup is only useful if it can survive the failure that disabled the primary system.
Sometimes the Answer Is Less Traffic
A common misconception is that a backup must allow ATC to continue exactly as before. It doesn’t have to.
A degraded system may only support a lower level of traffic safely. Procedures may have to change, additional spacing may be required, fewer sectors or frequencies may be available, and air traffic flow management can be used to limit the number of aircraft entering affected airspace.
That can result in delays, regulations, rerouting or restrictions on certain operations.
From a passenger’s perspective, this may simply look like an ATC delay. From a safety perspective, it can be the system working exactly as intended.
When technical capability decreases, traffic capacity may have to decrease with it.
What If the Main Control Tower Becomes Unavailable?
Some failures go beyond a single system. A fire, major technical fault, power disruption or another serious event could make an entire control tower temporarily unusable.
This is where a contingency tower or alternative facility becomes important: a facility that allows controllers to continue providing a safe level of service when the primary tower cannot be used.
But there is an important difference between having a backup facility and having an equivalent one.
Unless the contingency facility offers the same systems, information and equivalent visual conditions as the main tower — including an adequate view of the runway and relevant parts of the manoeuvring area — controllers may have to work with reduced capability, and traffic may need to be reduced accordingly.
In practice, a contingency facility will not necessarily reproduce every capability available in the primary tower. That is not a failure of the contingency concept; it is exactly what contingency planning is intended to address.
The primary purpose of a contingency facility is to maintain a safe service, not necessarily normal traffic capacity.
Degraded Mode Should Already Have a Plan
“Degraded mode” can sound alarming, but it simply means that one or more systems or functions are not available at their usual level. The response should already have been worked out before the failure happens.
European rules require air navigation service providers to maintain contingency plans for significant degradation or interruption of their services. EUROCONTROL also provides guidance covering backup systems, alternative facilities, different operational configurations, coordination with neighbouring ATC units and, where appropriate, delegation of services.
The important word is planning. The middle of a major technical failure is not the moment to start designing the backup plan.
Backup systems also need regular testing, and controllers, engineers and other operational personnel need to remain familiar with degraded and contingency procedures. A technically available backup that cannot be used effectively under pressure is not a strong safety barrier.
Redundancy therefore depends on people and procedures as well as technology.
Why Not Build a Backup for Everything?
Because aviation safety is based on risk assessment, not unlimited duplication.
Some failures are extremely unlikely. Some functions can safely revert to another capability, while others can tolerate a short interruption. Other functions are critical enough to justify several independent layers.
Redundant infrastructure is expensive to build, maintain, test and periodically replace. Additional complexity can also create new dependencies and failure modes.
The goal is therefore not maximum redundancy at any cost. It is appropriate redundancy for the safety significance of the function and the consequences of its failure.
Old Technology Can Sometimes Be Part of the Backup
Replacing older infrastructure with newer technology can sometimes remove an independent fallback.
Satellite navigation is one example. As aviation becomes increasingly dependent on GNSS, Europe has had to consider what navigation infrastructure should remain available if satellite-based services are disrupted.
The broader principle applies throughout air traffic management: before removing an older system, it is worth asking whether it provides an independent capability that becomes particularly valuable when the primary system fails.
Newer does not automatically mean more resilient if the change also removes an independent layer of protection.
The System Is Designed for the Bad Day
Most of the time, ATC technology simply works. Surveillance is available, radios function, networks exchange information and flight data appear where controllers expect them.
But the real test of a safety-critical system isn’t only how well it performs when everything is available, it’s how predictably and safely it behaves when something isn’t.
In air traffic control, the best response to a technical failure should rarely be improvisation. It should be a plan developed, assessed, trained and tested long before the failure occurs.