FAA’s air traffic management mission is to promote the safe, orderly, and expeditious flow of air traffic in the national airspace. To accomplish this mission, FAA employs a vast network of ATC and traffic flow management computer hardware, software, and communications equipment to (1) prevent collisions between aircraft and obstructions and (2) facilitate the efficient movement of aircraft through the air traffic system. Automated information processing and display, communication, navigation, surveillance, and weather resources permit air traffic controllers to view key information, such as aircraft location, aircraft flight plans, and prevailing weather conditions, and to communicate with pilots. These resources reside at, or are associated with, several ATC facilities—flight service stations, air traffic control towers, terminal radar approach control (TRACON) facilities, and air route traffic control centers (en route centers). These facilities’ ATC functions are described below. About 90 flight service stations provide pre-flight and in-flight services, primarily for general aviation aircraft, such as flight plan filing and weather report updates. Airport towers control aircraft on the ground and before landing and after take-off when they are within about 4 nautical miles of the airport. Air traffic controllers rely on a combination of technology and visual surveillance to direct aircraft departures and approaches, maintain safe distances between aircraft, and communicate weather-related information, clearances, and other instructions to pilots and other personnel. Approximately 180 TRACONs sequence and separate aircraft as they approach and leave busy airports, beginning about 4 nautical miles and ending about 50 nautical miles from the airport, where en route centers’ control begins. Twenty en route centers control planes over the continental United States in transit and during approaches to some airports. Each en route center handles a different region of airspace, passing control from one to another as respective borders are reached until the aircraft reaches TRACON airspace. En route center controlled airspace usually extends above 18,000 feet for commercial aircraft. Two en route centers—Oakland and New York—also control aircraft over the ocean. Controlling aircraft over oceans is radically different from controlling aircraft over land because radar surveillance only extends 175 to 225 miles offshore. Beyond the radars’ sight, controllers must rely on periodic radio communications through a third party—Aeronautical Radio Incorporated (ARINC), a private organization funded by the airlines and FAA to operate radio stations—to determine aircraft locations. See figure 1 for a visual summary of the processes for controlling aircraft over the continental United States and oceans. Although en route centers’ specific hardware and software configurations may differ slightly, the centers rely on over 50 systems to perform mission critical information processing and display, navigation, surveillance, communications, and weather functions. Examples include the systems that display aircraft situation data for air traffic controllers, the system that collects data from various weather sources and distributes them to weather terminals, radars for aircraft surveillance, radars for wind and precipitation detection, ground-to-ground and ground-to-air communication systems, and systems to back-up primary systems. (See appendix II for a simplified block diagram of an en route center’s systems environment.) DCC is one of the 50-plus en route center systems. DCC runs on 1960s vintage IBM 9020E mainframe computers, and its software is written in two languages, assembly and JOVIAL. It is used at 5 of the 20 en route centers. (See figure 2 for the locations of the 20 en route centers and identification of the five that are DCC-equipped.) DCC’s purpose is to accept data from the Host Computer System (HCS) and process it to form the alphanumeric, symbolic, and map data that appear for air traffic controllers on their Plan View Displays (PVD). (See figure 3 for a simplified block diagram of DCC and the en route center systems with which it interfaces.) In response to expected increases in the frequency and severity of DCC problems and the possibility of delays in the system intended to permanently replace DCC as well as other en route display-related systems, FAA awarded a roughly $30 million contract in September 1994 for development of “a single, deployment-ready” interim replacement (i.e., DCCR) unit. FAA officials characterized this development effort as an “insurance policy” to protect FAA against delays in the permanent replacement, then called the Initial Sector Suite System (ISSS) and now called the Display System Replacement (DSR). (See appendix III for more information on DSR.) In July 1995, following a flurry of DCC problems and outages and known delays with ISSS, FAA decided that there was an urgent and compelling need to replace DCC at all five DCC-equipped en route centers in the interim before DSR is ready. In making such capital investment decisions, FAA uses four criteria: sponsor (i.e., user) support; mission importance; information technology architectural conformance and maturity; and cost-effectiveness. Each criterion carries a standard weighting factor that is to be consistently applied to all proposed projects. (See figure 4 for these weighting factors.) According to DCCR documentation and FAA officials, sponsor support and mission need (i.e., aviation safety) drove the July 1995 decision to produce and deploy DCCR. In particular, FAA’s Air Traffic Services organization, the Air Traffic Controllers Association, and the Air Transport Association strongly endorsed DCCR. Also, FAA officials told us that extensive media attention to the DCC outages, considerable congressional interest, and public safety concern were major considerations. For example, one official stated that FAA was “taking too much heat in the papers for DCC outages and wanted DCCR to solve the problem.” In FAA’s view, the need to quickly replace DCC was urgent and compelling, and DCCR was the only practical alternative to sustaining safe, orderly, and efficient air traffic services in the near-term. FAA considered two cost estimates in analyzing DCCR’s costs versus benefits. However, the results of this analysis were inconclusive, and according to FAA officials, were not relevant to the decision to produce and deploy DCCR because of the urgent need to replace DCC. One of the cost estimates was done by the DCCR project office and the other by the program analysis and operations research office. Using the two cost estimates, the FAA analyzed three DCCR life expectancy scenarios. Under the “most likely” scenario, the project office’s cost estimate produced a DCCR net present value of negative $37 million and a benefit-to-cost ratio of 0.7 to 1. In contrast, the program analysis and operations research office’s lower cost estimate under the same scenario placed these values at $29 million and 1.4 to 1, respectively. Neither estimate considered maintenance costs. Given the expense of DCC maintenance, including it would likely have made DCCR more cost-effective under both estimates. While FAA officials agreed with our assessment of the impact of including maintenance costs, they did not quantify this impact. The month following its July 1995 decision, FAA awarded a roughly $34 million contract to produce five DCCR systems and has publicly committed to having the first site operational in October 1997 and the fifth and last site in February 1998. (See figure 5 for the respective sites’ publicly announced delivery and operational readiness demonstration dates.) DCCR’s installation and operation will not change the air traffic controllers’ current system interface and thus will be transparent to them. It consists of two components—the Display Channel Rehost Processor (DCRP) and the Display Controller and Switch (DC&S). DCRP will use a commercial, off-the-shelf IBM processor to execute about 120,000 lines of rehosted DCC code and 60,000 lines of new code. The primary contractor is developing the new code, and a subcontractor is rehosting the DCC code. DC&S uses custom-developed hardware and about 65,000 lines of new code implemented in firmware to perform keyboard, trackball, and display control functions. (See figure 6 for a simplified block diagram of DCCR and the systems with which it interfaces.) According to FAA, a major system outage is one which significantly delays air travel or produces significant media interest. Most of the recent major system outages at the five DCC-equipped centers have been DCC-related. Our analysis of FAA major outage data from September 1994 through May 1996 at the Chicago, Dallas-Ft. Worth, New York, Washington, and Cleveland en route centers showed that DCC accounted for 10 of the 21 outages, or about 48 percent. Moreover, these DCC outages were responsible for 195 of 225 hours, or about 87 percent, of unscheduled system downtime at these centers during this time. (See figures 7 and 8.) System availability is defined as the time that a system is operating satisfactorily, expressed as a percentage of the time the system is required to be operational. FAA has specified a DCC system availability requirement of 99.9 percent. DCC exceeded that requirement from fiscal year 1990 through 1993, but failed to meet it in fiscal years 1994 and 1995, with availability of 99.83 and 99.81 percent, or 0.07 and 0.09 percent below the requirement, respectively. (See figure 9.) According to FAA officials, DCC’s acceptable history of availability has been attained through the extraordinarily hard work, commitment, and ingenuity of its highly skilled, but small, workforce of technicians. For example, to obtain replacement circuit boards for the 9020E, which is out of production, FAA officials told us that technicians scavenged parts from a computer used by the FAA Air Traffic Training Academy and cannibalized parts from two scrapped computers at the FAA Supply Depot.