Part 2- MMS in AFTN System Applications

The switching center Reports position monitors the status of all external FEPs and ports. Each FEP must report its own status, and all connected user station status conditions, to the switching center every 5 minutes. On the switching center dual LAN, a LAN control PC monitors the status of all servers and PCs comprising the switching center itself. Each LAN based PC must report its status to the LAN control PC every 3 minutes. Thus, if any PC fails, it is reported by name on either the LAN control unit or the Reports unit. In both cases, an incoming status report is considered overdue one minute after the end of the reporting period and is therefore reported to the Reports position.

If one of the 2 LAN hubs fails, it will be automatically reported on the LAN control PC and readily identifiable visually by the absence of blinking on the activity indicator light, or the absence of all port indicator lights if the power fails. In either case, the system continues running on the remaining good LAN hub.

If a router fails, it will be identifiable by error reports from the FEPs or the switching PCs directly connected to that router. If SNMP is employed, then the WAN network monitor display will also identify the failed router.

In all 3 above cases, the problem is much more likely to be intermittent, rather than a hard failure. Therefore, the initial corrective action is typically to reboot, or power down and then power up the failed unit. If this step does not clear the problem, or maintenance records indicate frequent errors on the unit, then the unit must be replaced by the on-site spare whenever maintenance staff is available.

Since the PCs have either 4 COM port connections, in the case of FEPs; or 2 LAN and 2 COM port connections, in the case of switching center server PCs; it requires only 15 minutes to replace a server or PC with its on-site spare. Even if the server PC is not replaced for days, it will have little or no impact on the traffic, since the remaining alternate paths automatically redistribute the message traffic.

If a router fails and cannot be rebooted, then the on-site spare must be used to replace the failed router. This task may take up to 25 minutes, since there may be more cables involved and the specific routing tables must be installed in the replacement router if protocols other than TCP/IP are used. The installation of the routing tables is simplified by a DRI supplied utility program, that reads the router tables from a floppy diskette and automatically loads them into the replacement router. No keyboard, display or manual intervention is required. It is only necessary to connect the FEP COM port to the router console port, and then power up the FEP from the specific diskette containing a copy of the router tables. Alternatively, the router tables can be downloaded from any of the server PCs or operational PCs directly to the router LAN port.

To summarize, assuming a reboot doesn't clear the problem, hardware maintenance is now reduced to the following actions, none of which requires even a screwdriver:

Considering the high degree of resiliency, the above 3 steps do not have to be performed on a demand basis. Instead, they can be scheduled for a convenient time when staff is available.

Because of the very low cost of LAN hubs and PCs, especially without video monitors, it is not necessarily economically prudent to spend any time attempting to repair the failed unit. If it is under warranty, it can be returned to DRI or the vendor. Alternatively, it can be sent to the local computer store for a service contract repair. In the case of the much more expensive router, after the initial warranty period, it may be worthwhile purchasing an annual service contract from the router vendor, rather than paying for repairs on a per-case basis. Typically, the annual service contract results in quicker turn-around, and Cisco provides good international 24 hour technical support at a very low cost.

The MMS supports V24/V28 (RS-232), RS-422, RS-423, current loop, and all of the various synchronous and asynchronous digital interfaces provided by the Cisco routers. The Cisco routers handle baud rates from 300 BPS to 2 MBPS. The switching PCs and FEPs handle baud rates from 50 baud to 115 KBPS. The number of data bits per character varies from 5 bits for Baudot code to 8 bits for ASCII code.

The MMS supports both ITA2 baudot and IA5 ASCII codes as defined in ICAO Annex 10. It also supports a hybrid combination where the ITA2 SOM (ZCZC) and EOM (NNNN) are used with the IA5 code set. In IA5 both upper and lower case is accommodated, in both the message text and the message envelope. The upper/lower case attribute is passed transparently, or converted to upper case based on a user settable parameter.

The MMS also supports X.28, Telnet, PPP, SLIP, V.90, and Cisco PAD interfaces on any of its COM ports, in addition to TCP/IP, Frame Relay, DSL, cable modem, VPN, and X.25 on LAN ports. In the case of VSAT connections the MMS can provide either Frame Relay of TCP/IP PPP interfaces. Since the MMS switching center can also act as the VSAT hub, it is possible to reduce operating costs by avoiding the Frame Relay service charges on the VSAT links. In addition to VSAT other wireless LAN connections are available through IEEE 802.11a, 802.11b, and 802.11g. These WLAN allow mobile AFTN users to send and receive messages anywhere within 100 meters of a wireless access point connected to either a concentrator site or the switching center itself.

In the case of both X.25 and TCP/IP, error-checking and correction is inherent in the router-to-router WAN protocol. Beyond the WAN routers, the switch and FEPs and the connected user terminals also employ an error checking and correcting ACK / NAK protocol at a level above the highest router level. In the case of SVC calls, this ACK / NAK protocol provides for up to 45 attempts before encapsulating the message and delivering it to the system Reject position. To preclude tying up the router port, the 45 attempts are grouped in 3 sets of 15 attempts each, with 3 minutes delay between sets. On each new call attempt, a different port and selection number is used than the one that just previously failed. Thus, in the case of an SVC call inbound to the switch, the 45 call attempts for that message will automatically be distributed across at least 10 different router ports and linked PC ports.

In addition to the above hardware error correction, the ICAO-mandated format checking is performed at every step in the transmission of the message between the switch server PC and the end-user terminal. This includes the checking of message sequence numbers and validity testing the elements making up the AFTN 'envelope'. Any format error detected at any point causes the message to be diverted to the system Reject position with a 'plain language' description of the format error. Alternatively, a configuration parameter can be set to automatically return the message containing the format error back to the originating station. This method reduces the work load at the switching center by placing the obligation to correct the format error on the source of the message.

The ICAO Annex 10 defined Check message is also handled by the MMS. In addition to the standard 20 minute interval between Check messages, the MMS can be set, on a per circuit basis, for any interval as little as 1 minute between Check messages.

Any terminal or FEP in the network can send a 'loopback command' to any other PC in the network. The PC receiving this loopback command generates a detailed status report and sends it back to the requesting terminal. The status report includes current and cumulative message counts, error counts, cumulative out-of-service minutes, last sent and last received message sequence numbers, etc. Using this tool, it is possible to check on the status of any (or all) of the major elements in the network from any single terminal anywhere in the network. Both the initial command and the resulting response are encapsulated as actual AFTN messages, so they check the complete normal routing path through the switching center server PCs and the routers themselves.

In addition to the loopback check, any user can invoke, on a per-message basis, a function that demands a confirmation message back from the intended destination terminal confirming the receipt of the message. The sender can specify that the confirmation message is to be sent on receipt of the message or only when the message has been viewed or printed. A configuration parameter can be set to determine how long the sending terminal will wait for confirmation before resending the message. Another configuration parameter can be set to specify how many times the message will be repeated before the sender is notified of the non-delivery. As long as the MMS terminal is in service, it will automatically respond to any incoming message that requires a confirmation back to the sender.

The ICAO Annex 10 requirement for SVC QTA MIS and SVC QTA RPT service-messages is entirely automated in the MMS. An information message is automatically sent to the system operator control position to inform the operator of the action automatically carried out by the FEP. A user-settable parameter, on a per circuit basis, sets the maximum number of messages that are automatically retrieved and resent in response to a single request. Conversely, a user settable-parameter limits the maximum number of missed messages that the FEP will automatically request from the adjacent unit.

The user interface consists of pull-down menus and pop-up dialog boxes used to carry out operator commands. There is never a case where the operator has to type more than 10 characters to carry out the command. Some of the more complex and infrequently used operations, such as specialized message retrieval functions, automatically pop up a help message box containing detailed information about the command. In the case of status or any other information request, the requested information is displayed on the screen immediately. An Alt-H keystroke combination brings up a scrollable and searchable pop-up Help screen that lists all commands available to the operator, with a brief description of the command.

An online pull-down Help sub-menu can be customized by the user to describe system specific operational procedures, such as alternate routing instructions, contact numbers for adjacent AFTN sites, listing of collectives, listing of abbreviated addresses, current staff schedules, temporary changes to normal operational procedures, display of current routing tables, etc. Any of the displayed Help files can be searched for any key word(s) required.

In addition to satisfying the requirements of ICAO Annex 10, the MMS makes possible the definition of large distribution lists from a single ICAO address. For example, multiple distribution lists can be created by the user, each invoked by a single unique ICAO address, each one capable of regenerating the message to address as many as 400 ICAO addresses. This collective/broadcast list function can be useful in distributing weather information and NOTAMS, and any other type of message that must be sent to a large group.

This predetermined address list functions at the switching center acting on any received incoming message. This function is separate from the abbreviated address function, which operates locally at the user terminal and is described later. An abbreviated address at the user terminal can expand locally into one or more addresses. These addresses may also include 'collectives', which are then even further expanded upon reception at the switching center.

All of the operating parameters, including individual circuit parameters, are established by user created text files. Thus, any simple text editor, such as Notepad or Edit, is all that is needed to change any configuration, including the routing tables. All configuration data is checked for validity and any errors are reported when the server or PC is started.

In the case of routing table configuration, a special safeguard is applied to detect and remedy the routing problem whereby a message circulates indefinitely within the AFTN network ('circular routing'). In this case, after 40 routing actions have occurred on the same message, this message is then encapsulated and sent to the system Reject position with an appropriate error notice.

Of the 7 or more PCs on the LAN that connect the switching center units together, 3 of the PCs are assigned functional roles, such as system archive, system reports, system alarms, LAN control, and message reject and correct. These assigned roles do not preclude the operator from originating a new message on any of the LAN connected PCs, even including the server PCs. These roles are assigned at start-up based on configuration files and are instantly displayable on all of the PCs. These functional roles can be distributed across all of the PCs, or assigned to a single PC. However, these roles can be reassigned at any time, by the operator, to any other PC on the LAN. Thus, if it is necessary to remove a PC for servicing or replacement, the operator can choose which of the other PCs will be assigned that role served by the unit being removed. In the absence of an operator choice the defined default backup is assigned.

The configuration files also determine whether or not certain functional roles will be automatically switched, in the event of failure of the PC currently serving that particular function. For example, if the configuration is set to preclude the system archive role from being switched, and that particular PC failed, then the system would temporarily be without a system archive unit. In this case, however, all of the other servers and PCs would now hold their own archive data until some PC was assigned the system archive role. Once that assignment occurred, these servers and PCs would now unload all of the locally stored archive data into the newly assigned system archive PC.

Each server and PC at the switch and all Front-End-Processor (FEP) PCs have their own routing tables. In effect, each FEP is a small scale AFTN switch in itself. Message traffic leaving the switch, for a particular destination, is sent via router and WAN line to a specific FEP. Since there are always at least 2 paths for any route, the next message to the same destination will be sent through a different router and FEP serving that same route. If there are 3 or more FEPs serving that route, then the switch will treat the list of FEPs on a 'rotary' basis, to ensure that all active paths are continually used.

If the message sent to a particular FEP can not be delivered, due to a hold condition or high queue load on the next intermediate link, then the FEP automatically returns the message to the switching center. The switching center then automatically sends this same message to a different FEP on the same route. If that FEP is also blocked due to a hold condition on the next link, then this second FEP also returns the message to the switch. This recirculation of the message continues until either the intermediate link is restored to service, or the entire destination is put on hold, or an alternate destination is assigned by the operator.

In addition to the automatic alternate routing described above, the operator can override any automatic alternate route, by assigning a new route for a particular destination. In doing so, the operator will be redirecting this traffic to a different pair of FEPs than would normally receive it. This routing control operates at a level above the automatic routing provided by the WAN routers. This AFTN level alternate routing step can be performed quite easily by simply entering the 2 destination numbers involved, and then confirming the action with another keystroke. To protect against incorrect alternate routing assignments misdirecting traffic to an invalid route, this newly assigned pair of FEPs must have entries in their own routing tables that accept this particular alternate routed traffic. If there are no entries, then these FEPs immediately reject the message during the delivery attempt. This rejection forces the switch PC to encapsulate the message and divert it to the system rejects position, with an appropriate error message. This rejected message alerts the operator to reassign this traffic to a valid alternate destination.

A pop-up information screen(s) displays all of the destinations, along with the default direction, and the current alternate destination if activated. Each destination that is currently redirected is flagged with 2 asterisks to make them easily noticeable. If any destination is on hold, then the current message count accumulated in that particular hold queue is displayed along with the asterisks.

Within any MMS switch PC, or any FEP, there are usually 2 or more different serial ports, in addition to the LAN ports, to choose from in onward routing of a particular message. In order to avoid any message delay resulting from high queue loads, it is desirable to perform load balancing by selecting between 2 or more possible ports. If one of the ports is on a hold condition for any reason, then the remaining port(s) is unconditionally selected. However, if all ports are serviceable, then the routing algorithm selects the port with the fewest messages on queue. If there are no messages as in the normal case, or all choices have an equal number of messages on queue, then the algorithm selects the one with the least cumulative total output traffic for the day.

The most common method of message retrieval is by channel ID and output sequence number (CSNO). This type of retrieval is carried out automatically by the FEPs, in response to an incoming SVC QTA MIS or SVC QTA RPT service message. Each FEP circuit has a settable parameter that establishes the maximum number of messages that will be retrieved in a single request (typically 30). For each retrieval to the requesting terminal, the FEP also sends a detailed 'results report' back to the switch operator position.

Additionally, the operator at the switching center can cause any FEP to send retrieved messages to either the original recipient, or back to the user terminal on which the operator entered the request. This operator command requires typing only the 10 characters for the starting and ending CSNOs (for example: SLA345-444). In the case of retrieval commands from the switching center, the FEP will allow up to 100 messages per single command. Depending on the speed of the FEP CPU chip, 100 messages can typically be extracted and queued for delivery in approximately 15 seconds. The length of time required to retransmit the retrieved messages is a function of the baud rate for that circuit, or the WAN speed in the case where they are returned to the switching center. Depending on the level of traffic, the FEP typically holds all messages for at least 12 hours. Any retrieval of messages older than 12 hours may require the system archive in the switching center.

At the switching center a variation of the retrieval function provides for a full message trace based on message control field criteria. For example, by retrieving based on the embedded MMS message sequence number of the incoming message, all resulting output messages will be collected. Regardless of the selection criteria used to retrieve the messages, the entire collection is saved to a file which is popped up on the screen for viewing at the completion of the retrieval command. From this displayed collection of messages the user can easily select any message to be retransmitted to the original destination. It is also possible to automatically retransmit the entire collection by a single operator action.

All of the messages can be retrieved at the system archive of the switching center by other criteria rather than simply the CSNO range. This includes input circuit, origin indicator, destination, direction, or even the text content of any part of the message. This more sophisticated retrieval allows the operator to specify starting and ending times, and even starting and ending days where the search must span multiple days.

Another variation of this more sophisticated retrieval command is provided by commands to selectively narrow the number of messages retrieved. For example, by using this more selective command, it is possible to select only messages containing flight plans for KLM, arriving on the EuroControl input circuit, and addressed to a specific Flight Data Processing system, with a message origination time between 1535 and 2213 hours.

The PC serving as the system archive is normally equipped with a removable drive or cartridges of 250 MB or greater. This drive can be used to copy the hard drive daily archive file for an off-site backup. However, since all of the switch PCs contain disk drives of at least 10 gigabytes, this cartridge drive does not necessarily have to be used at all. Depending on the daily traffic load, the daily archive file will typically range from 40 MB to 200 MB. Thus, it is quite possible to satisfy the ICAO 30 day retention requirement by simply copying the daily archive file to any one of the other 7 PCs on the LAN. This provides 2 copies for all 30 days in 2 different PCs.

For systems handling extremely heavy traffic loads, it is possible to compress the daily archive before storing it on the removable cartridge. Since text-only data compresses at a ratio of approximately 10-to-1, the removable cartridge can accommodate 2.5 gigabytes of data. At least to date, the most heavily loaded AFTN system in operation anywhere generates less than 180 MB of data. Since the MMS uses addressable drives under the MS Windows operating system, any new techniques or devices such as network attached storage (SAN) can be automatically incorporated into the archive function.

All MMS terminal units include a built-in text editor. The editor includes all the normal editing functions, such 'file save' and 'file load', 'cut and paste', 'word-wrap', 'file insertion at cursor position', 'search', 'search and replace', 'undo', etc. User-settable parameters determine the appearance and behavior of the editor, such as block cursor, blink rate, color and font selection. This editor can be used to create any size AFTN message, by either typing or the insertion of prepared text files. Files can be easily concatenated on screen to create customized 'canned messages'.

All messages entering the MMS system are subjected to an Annex 10 format validation check at the entry point to the system. If any errors are detected, the original message is encapsulated and a 'plain language' error message is appended and then sent to the system Reject position for correction. Optionally, this faulty message and appended error notice can instead be returned to the sending station for correction.

For any message typed on any MMS terminal unit, a full AFTN envelope is generated automatically. Usually, only the address must be entered by the operator. However, If the message is intended for a frequently addressed station(s), then it is possible to set a parameter so that a default list of addresses is automatically inserted. In fact, a single or multiple character 'abbreviated address' can be used, which is immediately expanded with up to the maximum of 21 addresses allowed.

Once a message has been prepared, and the AFTN envelope automatically generated, it is still possible to accidentally corrupt the message format by over-typing or typing a line that exceeds the ICAO allowed maximum line length. Therefore, when the message transmit function key is pressed, a final validation check is performed. If any errors are now detected, the cursor is placed on the incorrect element and an exact description of the error is popped up.

After any message has been prepared and the AFTN envelope has been generated, the operator can pop-up an ICAO address book to select the normal ICAO address or an abbreviated address, which expands to a list. The address book is created and updated with a simple text editor. Each entry contains the ICAO 8 character address and a description/name field of up to 50 characters. This description field can contain anything, such as an organization name, functional name, or the name of a person. For example, an address book entry might contain 'names' such as 'UK Weather Query 3', or NOTAM Distribution List 1' or 'Flight Plan submit' or 'AIS/OpMet Office', etc.

In an adjoining column to the name/description column, the actual 8 character ICAO address would be included. The cursor selection bar is placed on the desired entry, and the Enter key then inserts that ICAO address or address list at the proper point in the message envelope. If, instead of an 8 character address, an abbreviated address of 1 to 8 characters was listed, then that abbreviated address is then expanded up to a maximum of 21 ICAO addresses.

Any size message can be created using the functions of the built-in text editor, including loading any text file from any accessible directory anywhere on the disk. Regardless of how large the message, the operator can automatically send it in segments that satisfy Attachment D of Annex 10 Volume II. By using a special key to transmit the message, the normal 'overlength' check is bypassed, and multiple messages are generated and queued for transmission by segmenting the single large message on the screen into however many smaller messages are required.

Every 5 minutes, each FEP sends in a detailed status report to the switching center.This status report covers all communication lines on that FEP. The data sent includes the message counts in and out, and both current and cumulative daily count. It also includes current line errors and cumulative daily line errors, in addition to the current and cumulative number of minutes out of service, number of service messages sent and received, the number of messages on queue, and the reason code for any hold condition.

A key combination is used to view the overall current status of all of the FEPs and switching PCs in the system. Another key combination is used to instantly view all of the circuit conditions described above, grouped by FEP, in a single scrollable, searchable on-screen report. A third key combination prompts for a circuit number and then displays a summary of all the 5 minute status reports from midnight up to the current time. At midnight there will be 288 single summary line entries making up the report. This report also breaks out hourly subtotals and makes it very easy to determine peak traffic periods either on an hourly basis or 5 minute interval.

All of these daily reports are retained in a history line status directory. After a certain number of days, the oldest reports are automatically erased to avoid eventually filling up the disk. Since these reports are delimited text lines, they can easily be imported into a spreadsheet for more detailed analysis.

The switching center Reports position monitors the status of all external FEPs and ports. Each FEP must report its status to the switching center every 5 minutes. On the switching center dual LAN, a LAN control PC monitors the status of the 8 servers and PCs comprising the switching center itself. Each LAN based PC must report its status to the LAN control PC every 3 minutes. Thus, if any PC fails, it is reported by name on either the LAN control unit or the Reports unit.

Whenever there are more than 100 messages on any specific circuit queue, then that queue is reported by the FEP to the system operator every 15 minutes, until the total number drops back below 100. Any time there is a change in the input and output circuit state (such as a required modem control signal) that change is reported immediately to the system operator. If the loss of a required modem control signal implies an interruption in the message path, then the output traffic for that circuit is automatically put on hold. If any circuit is on any kind of an output hold condition, this 'hold-state' is reported every 20 minutes until it is cleared.

In addition to circuit conditions imposing an immediate and automatic output hold condition on any circuit, the system operator can also send specific commands to the FEP to turn off a circuit entirely, ignore circuit input, or put circuit output traffic on hold.

The switching center LAN control unit acts as a master clock for the entire network. Every 10 minutes this unit sends date and time commands to all the other units on the LAN. Then, every 20 minutes, the system Reports position sends date and time commands to all FEPs. Normally the FEPs are 8-12 seconds behind the LAN control unit due to the transmission time of the command.

The MMS system also provides for the use of an external reference clock, such as that derived from a GPS receiver. In this case, the time and date information must be supplied in a common defined ASCII text format.

Message Templates: A function key pops up a list of ATS and OpMet message templates. The default set of 40 templates can be customized and expanded by the user. Even the colors of the fill-in fields and captions, and the contents of the help notes, are customizable by the user. Multiple variations of the same type of template can be included in the list. For example, a user may require 3, 4, or 100 variations of the flight plan template to cover the most common cases of typical flights. In addition to the supplied set of 40 message templates a facility is provided so that the users can define their own templates for future use.

Within each template the fields are automatically filled in wherever possible, and editable default text can be included in any field. The ECT performs error checking on a field basis, as data is keyed in by the user. Error checking can also be performed at any time on the entire template by pressing the 'F2' key. A running count of the current error number and the total error count are presented in the error message box.

Template Playback: Even after a filled-in template has been converted to message form, it can be restored back to template form for further editing. This is done using the 'playback template' entry. This feature also allows the most recently transmitted message to be 'played back' in template form to serve as the basis for the next message, thereby eliminating the need to retype the fill-in repetitive information.

Once a completed message is on the screen, the user has the option to automatically send it at any future time. This future time can be minutes, hours, days, etc into the future. The user is prompted to enter a specific time-of-day and a specific date. The default values in the dialog box are for the following day at 6 minutes past midnight.

This default time can be set as a configuration parameter.

A keyboard macro definition file defines sequences of text characters that are inserted whenever the corresponding key or key combination is typed. For example, an address list of up to 8 addresses, or a complete 1,800 character standardized message, can be inserted by a single keystroke. Also, a formatted table of multiple rows and columns can be defined as a keyboard macro. The keyboard macros can also be used to automatically fill in fields within a message template.

For those concentrator sites that do not handle heavy traffic loads, it is possible to reduce costs by using only a single WAN link and router and provide backup via an automatically dialed-up voice telephone line to the switching center. The dial-up service is provided by ordinary low cost industry standard V.90 modems. The dial-up function can also be used to offload high message queues on the FEP router port. Since the voice telephone network itself provides a great deal of resiliency, it is even possible to connect a concentrator site to the switching center by only a dial-up line. Whether this dial-up only connection between the concentrator and switching center is cost-effective depends upon the combination of traffic load and toll call charges in effect. Since calls only last for the duration of the accumulated message traffic transmission time, this method is typically viable for any node that handles fewer than 500 daily messages.

Messages are batched on both the switching center and FEP sides, and up to 300 messages will be delivered, in either direction, during a single call. Calls are automatically generated at a rate based on a combination of lapsed time and accumulated messages. This provides a reasonable compromise between telephone toll call charges and user-settable tolerable average message delay of 1 minute. Based on the local tariffs there is always some point of traffic load increase at which the toll charges amount to a higher cost than a dedicated line. If that point is reached, then a router must be installed and the FEP routing tables changed accordingly in order to minimize operating costs.

By using ordinary V.90 modems on the voice telephone network, authorized end-users, such as regional airports, weather observation stations, etc., can send and receive message traffic over calls between the end-user and either the switching center or the concentrator site. Connecting to the concentrator site minimizes any possible long-distance call charges. Various security techniques are employed to preclude unauthorized users gaining access to the AFTN network. This option provides a very low-cost means of connecting all of the regional airports, or any other authorized users, to the AFTN network. The ACK/NAK error correcting protocol insures at least 45 attempts, per message, to transfer the message error-free. To minimize call-blocking and continuous busy signals, at least 2 switching center telephone numbers should be available to the end-user. As the number of dial-up users increase, the number of dial-up lines at the concentrator sites must be expanded to insure quality of service.

The AFTN operational staff can determine which dial-up numbers are provided to which users. The assigned numbers can be changed easily by using a text editor on a dial-up routing file. In order to insure network security, these numbers will be invisible to the user and automatically dialed by the MMS terminal program. An automatic password is exchanged at least daily and the password is randomly changed at least once per day. In addition other proprietary security techniques are used to protect against Denial-of-Service (DoS) attacks and message spoofing. If either DoS or message spoofing attempts are detected, a descriptive alarm message is automatically sent to the operator alarm position.

The 'unattended operation' option checks a circuit parameter to return any message containing a format error to the source of the message. A copy is sent to the system Reject position, where it is eventually deleted after a user-settable lapsed time period. The message returned to the source is encapsulated and a detailed plain language error message is appended.

Also, a user selected remote terminal sends a message to itself every 5 minutes. If 7 minutes passes without a returned self-addressed message, the terminal notifies a monitoring station every 3 minutes until service is restored. This monitoring station can be either a direct connected terminal or a dial-up connection.

Also, any abnormal condition, such as a high message queue, or a route failure not covered by the automatic alternate routing described in section 9, invokes a customized script which executes alternate routing or hold commands. The event-triggered script carries out exactly the same commands that would otherwise be prescribed for an on-site operator to carry out. When the abnormal condition is cleared, another specific event-triggered script is executed to return the system to the state that existed prior to the abnormal event.

The contingency system provides a fully-equipped second switching center at a location physically remote from the main switching center. Although the 2 switching centers may very well be hundreds of miles apart, they are both connected to the same WAN. Also, all of the remote concentrator sites that are also connected to the common WAN can send their messages to either or both switching centers. Both of the switching centers each provide over 99.999 % availability. This contingency system option is typically required where the AFTN generated revenue must be protected by commercial insurance. To minimize the otherwise very large insurance premiums, a contingency system insures that no catastrophic event, such as flood, fire, explosion, etc., can cut-off the AFTN service for even a very brief period. Note that the contingency system is not used at all for normal operational backup, since the main switch is totally protected against a total system failure, based on its own distributed architecture.

The FEPs at the remote concentrators can dynamically adjust to a change in 'on-line' system and 'hot-standby' system assignments, in reaction to commands sent out by either site. Under operator control, the FEPs send the message traffic either to both sites, or only the current on-line site. Traffic received by the 'hot-standby' site is routed in the same manner as the on-line site. However, except for certain special cases, the hot-standby site skips the very final step of actually sending out the resulting messages through its attached WAN routers. The role of 'on-line' and 'hot-standby' site can be switched under operator control at any time from either site. An alternate routing command executed at one site, is automatically passed to the other site for execution. Normally, the 'hot-standby' site is totally unmanned, and will operate indefinitely in parallel with the on-line site.

A complete automated NOTAM facility based on a mirrored SQL data base can be provided within or outside of the AFTN switching center. However, this option relates to a more limited non-SQL data-base function, which can be utilized as a supplement to an existing NOTAM facility, or a limited automated implementation of a NOTAM handling facility. As in the case of the AFTN Contingency System in section 39 above, the NOTAM function can be replicated in one or more duplicated remote locations. In this case all duplicated NOTAM systems receiving incoming messages but only the on-line NOTAM system generates output messages.

All of the normal functions listed in Annex 15 can be carried out by this option, within the AFTN system. The function provides for the automatic replacement or cancellation based on the NOTAMR and NOTAMC messages. A NOTAM message template is provided to facilitate NOTAM origination. A format and 'reasonableness' validation check is performed on any message entered for storage or presented on the screen for transmission. Multi-part NOTAMS can be assembled or disassembled by a simple operator command.

In addition to the NOTAMC means, the user can optionally establish a time limit in which the NOTAM is automatically removed. In addition to retrieval by NOTAM serial number, NOTAMs can be retrieved by any contained text. Up to 400 addressees can be invoked for any single NOTAM transmission.

Part One