Network Redundancy Requirements in Remote Digital Tower Infrastructure

Digital ATC infrastructure for non-towered airports needs links that airport sensors and remote controllers can rely on. For operators weighing the use of unmanned aircraft systems and drone integration, situational awareness starts with keeping video, communications audio, and other safety-critical data available. Network redundancy is therefore a foundational requirement and must cover communications links, backup data paths, power, and failover logic.

Why a digital tower's safety case begins with its network, not its cameras

A traditional tower gives controllers a direct, physical view of the airport, supported by hardwired radios and local power. A digital tower replaces that out-the-window view with information transmitted from cameras and sensors to a control facility. Video panoramas, radar feeds, communications audio, and weather data all depend on links between the airport and the controller.

Consequently, a link failure can mean more than a poorer picture or slower service. It can take away video, radio, and situational awareness at once, leaving the facility unable to offer its published services. Better cameras cannot compensate for that loss. General Aviation, which builds affordable digital ATC towers for non-towered airports, relies on those links just as other remote tower providers do. Redundancy must be built into the infrastructure from the ground up because the controller’s access to the airport depends on network continuity.

What the FAA's safety framework says about acceptable failure in a digital tower

The FAA’s remote tower safety assessment framework distinguishes partial loss of function from full loss. A system that still partly works may stay in use until the Controller in Charge decides that services cannot safely continue. Full loss of function leads to a switch to ATC-Zero. FAA Order JO 1900.47F defines that condition as the facility being unable to safely provide its published air traffic services, with contingency support from other facilities activated. It does not automatically mean that the airport becomes uncontrolled.

The FAA’s framework also identifies a very short critical exposure window for a loss-of-function hazard, depending on the circumstances. Recovery must fit within that operational constraint. Backup systems must restore the required function, or procedures must change to address its loss. Under the FAA’s System Design Approval process, vendors must submit safety artifacts that show system integrity and continuity, so the submission must include redundancy architecture. That standard applies both to systems that serve major airports and to providers such as General Aviation that serve airfields without existing tower infrastructure.

Section 621 of the FAA Reauthorization Act of 2024 requires a remote tower program and published milestones for system design and operational approval. IFATCA policy ADME 2.14 adds requirements for surveillance equipment capable of delivering the intended service and a robust contingency plan for system failure. The policy also sets a minimum video frame rate. That requirement places demands on bandwidth and latency even when traffic moves onto degraded or shared links.

The cascade risk that makes digital tower failures different from traditional tower failures

A traditional tower failure is local to one facility and the airport it serves. A remote tower center may serve several airports that share its power, telecommunications, and software infrastructure. An outage at the center can interrupt service at multiple airports simultaneously, even when each airport’s sensors remain functional.

The 2025 Philadelphia TRACON outages provide a concrete example of shared telecommunications risk. Controllers handling Newark traffic lost radar and radio contact with aircraft more than once. These outages illustrate the operational consequences of dependence on shared communications infrastructure. The national transportation agency’s ATC System Plan describes the FAA’s urgent transition from Time-Division Multiplexing to Internet Protocol as essential to safeguarding the National Airspace System. Some NAS radios are over 30 years old and rely on analog technology with high failure rates and scarce replacement parts.

Centralization can also improve resilience by allowing controllers to shift between facilities and backup resources to be shared. That benefit depends on redundant network and power infrastructure supporting the center itself. For a domestically built platform aimed at historically non-towered airports, as General Aviation’s is, shared infrastructure requires the same redundancy rigor as systems serving already-towered facilities. Smaller airports have the same claim to reliable service, and safeguards for each airport alone cannot deal with an outage across the center.

The four infrastructure layers where redundancy must be engineered in

Communications links form the first layer because they transport the airport’s continuous sensor output to the control facility. Fiber is the preferred primary medium for high-bandwidth panoramic and infrared video feeds. Route diversity is the essential engineering distinction. Two fibers in the same conduit remain exposed to the same cut, so responsible design requires different conduits and rights-of-way. The FAA’s Brand New Air Traffic Control System includes replacing old copper telecommunications lines and equipment with fiber-optic and wireless infrastructure as part of the wider shift to modern transport networks.

Backup data paths address what happens when the primary connection fails. LTE/5G cellular backup is widely deployed in small-airport infrastructure because it can be available without new civil works. Different carriers reduce dependence on one carrier’s network. Satellite connectivity, including low-earth-orbit networks, is emerging as a backup option for rural and remote sites where diverse fiber routes or reliable cellular coverage are unavailable. These options have different roles, and their availability alone does not establish that they can sustain the required ATC service.

The decisive comparison is performance during an outage. Cellular or satellite connectivity alone cannot be assumed to sustain continuous camera feeds at the required frame rate, and a backup must meet the applicable latency and display requirements. A connected link is not necessarily a usable backup. If it delivers degraded video or introduces delay beyond the critical recovery window, it does not fulfill the intended safety function. Procurement decisions therefore depend on the traffic the path can support under failure conditions.

Power is the third layer, covering both the sensor site and the control facility. At a small airport, a commercial grid outage can remove cameras, microphones, weather sensors, and networking equipment together. A UPS provides bridge time. Long outages call for generator backup that is kept in working order and tested, and the remote tower center needs the same protection because a loss of power there can affect every airport it serves. When a storm disrupts both grid power and terrestrial fiber, backup power and backup communications must activate simultaneously and independently.

Failover logic lets the service keep running on those backup systems. In the shortest loss-of-function exposure windows, a person would likely switch paths too slowly, so the system must detect the loss and select a path on its own. Detection must still distinguish degradation from failure. An unneeded switchover can itself disrupt operations, so link-health monitoring and switching policies must account for when the system can still be used. Software-defined networking supports automated, policy-driven switching, but the monitoring layer must also resist spoofed failure signals that could trigger an unwanted transition.

Why cybersecurity is a redundancy requirement, not a separate workstream

Digital towers add IP links, management interfaces, and software-defined switching layers, which give attackers more ways in than a hardwired, on-site facility does. A cyber-induced failure can have the same operational consequence as damaged hardware while being harder to detect and attribute. More paths do not automatically mean greater resilience. A cellular or satellite backup that lacks the primary link’s encryption and authentication standard can become the weaker route through the architecture.

If injected signals can imitate a failed link, the mechanism intended to preserve service can instead be used to disrupt it. The monitoring layer needs protection of its own. The February 2026 AI Infrastructure Sovereignty paper describes operational control through monitoring, coordination, and validation across compute, network, and energy domains. Applied to ATC infrastructure, that principle makes visibility into system behavior a prerequisite for establishing whether redundancy is functioning, so airport procurement teams must evaluate security and redundancy architectures together.

How funding constraints at small airports create pressure to cut the redundancy that safety requires

Small and general aviation airports look at digital towers because the cost of building and staffing traditional towers has often put control coverage beyond their reach. But diverse fiber routes, cellular backup, satellite connectivity, and generator power all add to the cost of a digital tower. The financial pressure is real and understandable. A system with a single path and a single power source avoids those upfront costs, giving providers a reason to put redundancy in a later phase. That apparent saving separates the affordable proposal from the infrastructure needed for approval and operation.

The FAA’s Contract Tower Competitive Grant Program provided $20 million annually for tower modernization projects. IIJA supplemental airport funding expires at the end of FY2026, leaving airports that sized capital programs around those funds facing reduced federal support beginning FY2027. The funding timeline complicates capital planning for these airports. The One Big Beautiful Bill, signed in July 2025, allocates dedicated funding to establish a remote tower approval process and deploy systems at nontowered airports. That support is spread across a national program, so each site still needs redundancy it can afford.

Shared remote tower centers can lower the cost of serving multiple airports, but their economic case depends on protecting the shared facility. Cutting its power or communications redundancy exposes all participating airports to the same infrastructure weakness. Approval cannot be deferred from the engineering decision. Under the SDA process, a system without adequate redundancy cannot be approved to operate, so postponing redundancy also postpones approval. Building it into the initial architecture costs less than retrofitting the system to meet the requirement later.

What responsible redundancy design looks like in practice, and where General Aviation fits

Responsible design begins by identifying single points of failure in communications, power, and failover logic before submission for SDA review. The task is to eliminate those dependencies in the initial architecture. Where diverse fiber ducts or extensive civil works are difficult to build, multi-carrier cellular backup and satellite tertiary paths become substantive design components. Their suitability still depends on demonstrating the required service performance.

General Aviation’s approach is to incorporate redundancy from the ground up rather than add it after the basic system has been designed. Real-time diagnostics and unified management help operators assess the multi-link architecture, while sensor-site UPS and maintained generator backup must be specified and tested during commissioning. For an airport introducing its first ATC capability, this may also be its first requirement for guaranteed power continuity at a particular site.

Failover automation must then be validated under realistic failure conditions before operational approval. A tabletop account of how switching should work is not sufficient for the critical exposure window. The design has to withstand the intended test. That validation connects the procurement promise to the continuity needed by controllers, rather than leaving recovery as an assumption attached to a diagram. It also ties affordability to a safety architecture that works, with the needed safeguards in place from the start.

Section 621 sets the policy focus for that work. It requires the FAA to prioritize airports without a permanent air traffic control tower, airports providing small or rural community air service, and airports newly accepted into the Contract Tower Program. At these sites, lower-cost digital infrastructure needs redundancy-first design to reach its intended safety mission without deferring the engineering that makes approval possible.