Design Philosophy

During the mid 1990’s three emerging trends had a significant impact on DRI’s product development plans during the design of the Multi-protocol Message System (MMS). As a result of these increasingly negative and significant trends, DRI designed the MMS to minimize or completely nullify the impact of these factors described below.

The first trend was highlighted by the highly publicized FAA problems coping with critical equipment failures on an aging system base that was increasingly difficult and expensive to maintain. This difficulty was a direct consequence of employing systems based on highly proprietary vendor-specific system components. Even though many of these same system components were touted as ‘commercial-off-the-shelf’(COTS), it was a moot point, since they could only be provided by a single source. Once that component was cancelled, or the vendor was acquired or dissolved, the entire system became vulnerable. Not only could the system no longer be upgraded to meet ever-increasing demand, in many cases the system could not even be maintained.

Another well publicized case was the takeover of both Digital Equipment Corporation and Tandem Corporation by the PC manufacturer Compaq Corporation. Both of these 2 large companies supplied many of the fault-tolerant systems employed in the AFTN applications throughout the world. As in the case of any acquiring company, unprofitable or niche market product lines are typically terminated shortly after the takeover. Once the product line is terminated, it is only a short time before all ongoing maintaince and spare parts support is declared to be at an 'end-of-life-cycle' phase, whereby all support is dropped within 6 months. This takeover by Compaq highlighted the critical importance of vendor independence wherever possible.

The second emerging trend was that even the very largest and most expensive AFTN systems are unreliable and prone to message loss and excessive message delivery delays. In comparison to the now commonplace wide-area-networks (WAN), the point-to-point AFTN systems fare poorly. Without exception this is the case, even though AFTN systems typically handle only a fraction of the message traffic on most WANs. This fact is not yet widely recognized, since many AFTN messages are not critical, and there is no controlled method to measure message delay or message loss. Recent controlled operational tests however, have documented just how unreliable many AFTN systems are.

The primary cause of this poor AFTN performance is the inadequate error detection of the message text, combined with lack of error-correcting protocols. Unlike typical AFTN systems, the far more reliable wide-area-networks employ cyclic-redundancy-check (CRC) bytes to detect errors. This much more rigorous error checking method is also employed on an end-to-end basis within the MMS AFTN system. In a typical AFTN system, even when an error detected is within the text of a message, it requires manual intervention by at least 2 people to recover the problem message. Often, this recovery effort is unsuccessful, or results in a delay which makes the recovered message irrelevant.

Additionally, at the system level, the concentration of the switching and routing function into a single or dual (standby) system adds to the unreliability. Since the standby system is only used in the event of failure, any latent hardware fault goes undetected until the very moment the standby system is forced into use by a failure of the on-line system. The inevitable result is a total system failure.

In almost all cases, these dual systems depended upon a highly proprietary circuit interface unit that allows only one of the 2 available systems to control the communication lines. Not only does this design introduce a ‘single-point-of-failure’, but the resulting vulnerability often requires round-the-clock maintenance and operational staff support that drives up the cost of system operation. Even in the case of fault-tolerant systems, the single common interface point to the communication lines makes the fault tolerant systems almost as vulnerable to total failure as the dual standby system approach.

Some system vendors attempted to improve the reliability of AFTN systems by implementing expensive workstations as the message switching functional element. These workstations typically implemented Error Checking and Correction (ECC) main memory and RAID level 5 hard disk subsystems. Although this definitely improved the reliability of the computer itself, it did nothing to eliminate the communication line interface as a single point of failure. Today, many PCs are available with both ECC and RAID level 5 hard disk subsystems, at a fraction of the cost of the workstations. However, in a properly designed distributed architecture, these more complex PCs are not required, since the distributed architecture itself achieves the maximum possible reliability.

Another common cause of AFTN system failures is the fact that many AFTN systems are operating at (or beyond) their maximum capacity. Thus, almost any unique event, however trivial, causes a total system failure. Since there are typically no meaningful real-time statistics available at the time of failure, the cause is often mistakenly attributed to the ‘unique event’. The actual cause however, is that any system operating at its maximum capacity is vulnerable to almost any trivial event, such as a high queue load due to a line out of service. This is often why, when one AFTN system fails, it also takes down the connected AFTN system of the adjoining state when the failed system is restarted.

In those cases where this ultimate cause is properly recognized, there is frequently no recourse for the organization operating the AFTN system. Even in the rare case where the original vendor is still in the AFTN business, the system architecture precludes any significant expansion beyond the initial installation. There are also cases where the design permits some degree of expansion, but a vendor specific proprietary component required for the expansion is no longer available.

Some vendors attempted to deal with this AFTN reliability issue by introducing ICAO CIDIN-based interfaces to their AFTN systems. This partial step only improved the reliability between countries/states, but did nothing for the far more numerous communications lines within states. Other vendors provided a "gateway" to an external WAN, but this still left all internal AFTN users as vulnerable as before, since the internal AFTN communication lines were still point-to-point, with minimal error checking, no error correction, and with no automatic alternate path to the end-user.

Even in the very rare cases where an AFTN system was more than simply an obsolete point-to-point network, the system was incapable of adapting to the newer low cost network technologies. As new telecommunication service providers entered the market, the existing typical AFTN system was locked into whatever single line protocol was implemented at system installation. Typically, this network technology was X.25. Thus, as other non-AFTN networks were able to take advantage of newer lower cost technologies, such as TCP/IP, Frame Relay, ISDN, DSL, dial-up access, etc. the AFTN system was forever locked into only X.25 or, even worse, point-to-point lines. Any modern store-and-forward system should be able to combine any mix of these networking technologies into a single AFTN network. Since market conditions frequently change, the system must be capable of easy reconfiguration to the optimum hybrid network, based on changing cost/ benefit trade-offs.

In response to these 3 serious vulnerabilities, of vendor dependence, poor reliability, and an inflexible architecture, DRI developed the Multi-protocol Message System (MMS). The MMS system resolves all of the above described reliability problems at a cost significantly below the price of the traditional point-to-point AFTN systems. The MMS system today offers all of the advantages of the future ATN, at a lower operating cost than will be available when ATN is finally implemented.

As a result, the end-to-end error checking, based on the same CRC method used in wide-area-networks, combined with the distributed architecture, makes the MMS system the most reliable AFTN system in operation today. A detailed description of this store-and-forward message switching system is available in the MMS Product Specification document.

Home                                                 Top