The Tower Is Older Than the Planes

On the afternoon of November 13, Chicago O’Hare and Midway airports began reporting equipment failures. The FAA issued a nationwide ground stop for “special conditions and safety reasons.” The order lasted more than four hours. Flight-tracking sites recorded nearly 15,000 delayed or canceled flights, and more than 1 million passengers waited. Less than three years earlier, in January 2023, a system outage had grounded flights for two hours. The same system had failed again.

The FAA said the cause was under investigation and might be a communications failure tied to aging equipment. That “might” carries weight. If the agency named the system, the next question would be why it had not been replaced.

Air traffic control runs tens of thousands of flights a day. It cannot lose power, and it cannot take a maintenance window like a data center. A home router can be unplugged and swapped. An air traffic control upgrade has to happen while every flight keeps moving. The old and new systems run side by side, and traffic shifts over slowly. Imagine repairing a highway and changing its traffic lights while cars race through at full speed. Every step needs checking, so progress is slow.

Slow is survivable. The danger comes when slow meets aging equipment, retiring staff, and budgets set one year at a time.

Spare parts come from secondhand markets, and repairs use 3D printing

Air traffic control systems serve for decades. Safety certification is strict, interfaces are complex, and one change can ripple through the whole system. An old system that has not caused a major accident keeps its default justification: it still works.

That justification has a price. Many devices are out of production, and original manufacturers no longer make parts. Maintenance crews hunt secondhand markets for old stock. When they cannot find a part, they print one. Repair work turns from standardized procurement into cannibalization, with one unit stripped to keep another alive.

The hardware is only part of the problem. An old system is a web of interfaces, standards, procedures, and trained people. A single replacement part can create a chain of incompatibilities. A new device can require fresh certification, retraining, and a redesigned backup plan. Aging equipment becomes an aging maintenance system. The parts supply breaks, the repair knowledge breaks, and the upgrade path breaks.

“It still works” becomes the reason to wait. Every debate about replacement ends with “a little longer.” Risk does not disappear when no one discusses it. It collects in corners.

The technical gap is harder to see than a missing part

The engineers who wrote the old code and understood the old hardware have mostly retired. Some have died. Younger technicians cannot read the system, and fewer people can fix a failure.

This is a technical gap, and it goes beyond lost craft. Legacy knowledge was never institutionalized. Documentation is missing. Interfaces are closed. Certification is expensive. Young workers avoid the system. Fault diagnosis depends on calling someone who remembers. The equipment still runs, but the people who understand it are leaving.

The gap stays invisible while the system works. When it fails, no one can explain the troubleshooting path. No one wants to sign off on a substitute part. No one has run the emergency plan for real. Repair slips from following a manual to calling a contact, and from engineering to luck.

Rehiring a few retired engineers will not close the gap. The work needs knowledge management, simulation testing, reverse engineering, dual teams, and documentation that turns individual memory into institutional capability. Equipment aging is the first layer. The aging workforce is the second. Together they create a long run while sick.

The hardest constraint is that the system cannot shut down

Infrastructure upgrades often fail at the same point. Building the new system is hard. Building it while the old one never stops is harder.

Air traffic control cannot pull a plug or update overnight. It must run old and new systems in parallel, cut over traffic, prepare rollbacks, train staff, and validate safety while flights keep moving. The margin for error is near zero.

Old and new software also speak different standards. Data formats clash. The new system reports one thing, the old system reports another, and operators use process and redundancy to keep the operation safe. Upgrades move by stage, region, and function. Every step gets validated, and every step keeps a fallback.

This makes modernization slow. Some of that slowness is engineering reality, not bureaucracy. The risk comes when slowness meets aging equipment and uncertain budgets. Then delay stops being caution and becomes accumulation.

NextGen shows what happens when a long project meets a short budget

The United States tried to upgrade. The NextGen program started in 2004 and was originally scheduled for completion in 2025. It has spent billions of dollars. Progress has slipped repeatedly, and public accounts now push completion beyond 2030.

Large projects suffer most when funding is never certain. The FAA cannot easily get long-term appropriations. It asks Congress for money every year. The two parties fight, budgets appear and disappear, and one side cuts while the other delays. A project that must last more than a decade cannot count on steady money. Government shutdowns over funding have happened more than once.

Contractors respond rationally. They avoid stocking parts, hiring long-term teams, and making long-cycle investments. The project starts and stops. A team assembles, then the budget stalls. Testing finishes, then the next year brings a new justification cycle. Large projects suffer more from discontinuous funding than from high costs.

The political math is simple. Fixing the system is this term’s bill. Leaving it is the next term’s bill. A four-hour grounding costs less than a twenty-year upgrade. Winning a contract feels safer than delivering a system. Avoiding an incident feels safer than surgery. Each short-term choice makes sense on its own. Together they produce long-term failure.

Government, controllers, airlines, and manufacturers all wait

An air traffic control upgrade requires airlines to modify onboard equipment. Every modification costs money. Airlines ask what they get in return. If the benefit is unclear, they wait.

The incentives do not line up. The new system delivers broad, long-term, diffuse benefits. The costs land on specific actors in the short term. The government waits for airlines. Airlines wait for subsidies. Manufacturers wait for standards. Controllers wait for budgets. The FAA waits for safety validation. Each group can prove that waiting is rational. The system as a whole cannot afford the wait.

Calls for cooperation will not fix this. It needs cost-sharing rules, mandatory timelines, unified standards, subsidies, and accountability. Without those, every actor protects its own budget while the shared system absorbs the risk.

A safety culture that avoids incidents can create bigger ones

Safety is the first rule of air traffic control. The FAA has long followed a “no incidents first” approach. New technology gets repeated review, and approval chains stretch out. The old system is old, but it has not had a major accident in decades. Management can justify making do.

The bureaucratic logic is real. Doing more creates more chances to be blamed. Doing less creates fewer. An upgrade that fails becomes the decision-maker’s fault. A failure without an upgrade can be blamed on aging equipment or an investigation. As long as no one presses, “possibly caused by aging equipment” can last until the next grounding.

Safety requires active risk management. A system with no major accident may still be unsafe. The risk may simply not have reached the threshold. Redundancy, backups, aging management, drills, and single-point checks are invisible in calm periods. They decide whether a failure becomes local delay or a nationwide stop.

Patchwork buys time and adds risk. Sporadic failures become system-wide failures. A small communications fault can ground flights across the country. One repair did not fail. A fragile system met a single point of failure.

Four pressures stack into a long run while sick

The U.S. system faces four pressures. The old system runs but cannot be maintained well. The new system can be built but is hard to run in parallel. Upgrades take a decade or more while budgets are annual. Government fears blame, airlines fear cost, contractors fear lost funding, and no one wants to pay first. Safety culture rewards avoiding incidents, which makes “do not change” look safe while risk accumulates.

These pressures create the long run while sick. Equipment ages. Repair skills leave. The new system cannot connect. The old system cannot stop. Funding comes and goes. Responsibility stays diffuse. Each year brings a patch. Surgery keeps getting postponed.

This is a governance failure as much as a technical one. The problem goes beyond one old switch. A high-safety, long-cycle, multi-actor system that cannot shut down is trapped by short budgets and split incentives.

Other countries face versions of the same problem. Legacy systems, parallel operation, knowledge transfer, and coordination are common to critical infrastructure everywhere. Institutions differ. The pattern does not. Decline often arrives through “it still works,” one deferred decision at a time.

Conclusion

A country’s infrastructure shows its condition in the tower, the budget line, the retiring engineer, and the system no one dares stop.

Old systems can run. They cannot run forever. Modernization requires long commitment, stable funding, knowledge transfer, common standards, and coordination. Remove one piece and the upgrade becomes another three years of patching.

The grounding showed a system running a long race while sick. It traded “it still works” for a larger risk next time.