There is a category of network where the usual language of availability stops being useful. Not because the numbers are wrong, but because they describe the wrong thing. Air navigation is the clearest example: the communications and data links behind a control position are safety systems, and a safety system is not evaluated on how often it works.
Why the percentage misleads
An availability figure of 99.5% sounds robust and permits roughly 44 hours of unavailability a year. For a back-office system that is unremarkable. For a link carrying ground-to-air communications it is not a service level, it is a description of a hazard — and the figure says nothing about the distribution, which is what actually matters. Forty-four hours spread as brief blips is a different system from forty-four hours as two long outages.
The more useful specification for this sector is not a percentage but a failure narrative: what fails, what takes over, how quickly, automatically or manually, and who is standing next to the equipment while it happens.
What typically goes wrong
Three patterns recur, and none of them are exotic.
A single path sold as sufficient. A remote installation connected on one circuit, because one circuit was what was quoted against a budget. There is no failover; there is a repair time.
Redundancy that is not independent. Two circuits that share a duct, a landing station or an upstream provider. The diagram has two lines; the physical world has one. This is the failure that surprises people, because they believed they had bought protection.
Escalation that leaves the country. The provider is local, the capacity is bought from abroad, and the person who can actually diagnose the fault is in a different time zone with no contractual relationship to the aviation authority. The local provider is not being evasive when they say they have raised it — that is genuinely where their power ends.
What a defensible design looks like
Two paths that are independent in kind. Primary on protected terrestrial fibre where it exists, with the route documented rather than assumed. Secondary over satellite — genuinely independent, because it shares no duct, no route and no landing station with the first. For sites with no fibre at all, satellite as primary with a second terminal or a second carrier as protection.
Monitoring into an operations centre that is staffed continuously and locally. Not a portal the authority can log into — a team that sees the alarm and acts on it, in the same country and time zone as the installation.
One party accountable for the whole path. The single most useful property in an incident is that the company you have a contract with also operates the equipment. Everything else is escalation.
Latency treated as a design parameter. Consistency matters more than raw speed for most aviation traffic. A path chosen for stable, predictable behaviour beats one chosen for a headline figure.
Where the boundary sits
We are an infrastructure operator, not an air traffic systems vendor. What we provide is the connectivity layer underneath: site connectivity to airfields and remote stations, backhaul for radio installations, in-country hosting for systems that should not sit on another continent, and monitoring from an operations centre in Mogadishu.
The operational systems themselves — the surveillance, the flight data processing, the controller working positions — come from specialist suppliers, and we work alongside them. Saying so at the first meeting rather than the third is not modesty; in safety-related procurement, a supplier who claims the whole scope is a risk in itself.
What to bring
The sites, what each one carries, the availability you have to demonstrate and to whom, and what the consequence of a four-hour outage actually is at each location. That is enough to design against — and it usually reveals that one or two sites justify considerably more investment than the rest, which is a better outcome than spreading the same specification evenly across all of them.
