Critical failure points of complex aeronautical systems for communication, navigation, and surveillance

A complex aviation system of communication, navigation, and surveillance can be represented by an equivalent circuit in which information is elaborated, processed, and flows. A failure in one point of the circuit can jeopardize the system operation. Every point of the circuit in which the information is compelled to go through is a single point of failure, where a failure is especially dangerous. The classic remedy is redundancy, in which the information is offered alternative paths. However, there are problems which redundancy cannot help. This paper especially analyzes the case of satellite systems, in which software plays a major role. Software failures may escape notice during development and appear only with actual use. Tentative figures of software MTBF are given. They are too small at the present time for an ATC system relying on satellite-based systems for sole means of navigation. (Author)