How an emergency alert interrupts a song

Almost everything else described on this site can fail quietly. A processor set badly makes a station sound thin; a log that does not reconcile makes an accountant unhappy. Alerting is the one part of a broadcast plant where a failure has a different order of consequence, and its design shows it. The system is redundant, tolerant of loss, and built so that no single connection, network or authority is required for a message to travel.

Three systems, seventy-five years

The American arrangement has been rebuilt twice. CONELRAD, established in 1951, worked by shutting down most transmitters and moving the remaining programming onto two designated frequencies, 640 and 1240 kHz, marked on radio dials of the period so that listeners could find them. The purpose was as much to deny navigational beacons to bombers as to inform anyone.

The Emergency Broadcast System replaced it in 1963 and lasted until 1997. It kept stations on their own frequencies and relied on a chain of relays, plus a tone that a great many people can still hum. The Emergency Alert System took over in 1997 and added the thing the previous two lacked: machine-readable data, so that a receiver could decide whether a message concerned it without a human listening to every word.¹

The anatomy of an alert

An alert has four parts, in a fixed order, and every one of them is required.

The header. A burst of audio frequency shift keying, sent three times in succession so that a decoder that misses one copy can still assemble the message. The tones sit just above the voice band and the data rate is a little over 520 bits per second, which is slow enough to survive a poor path. The three repetitions are why the burst sounds like a stutter rather than a single noise.²

The attention signal. Two tones, 853 Hz and 960 Hz, sounded together for between eight and twenty-five seconds. Its job is human: it wakes up a listener, and it holds the air while receivers that decode the header switch their audio. Using those two tones outside a genuine alert or an authorised test is prohibited, and the prohibition is enforced. It has cost broadcasters and programme producers real money for putting the sound in an advertisement or a trailer.³

The message. Spoken audio, or in the newer path synthesised from text, of limited duration. This is the only part a listener is meant to act on.

The end of message. Another short data burst, again sent three times, telling every downstream decoder that the event is over and normal programming may resume.

The same header syntax is used by NOAA Weather Radio, which is why an inexpensive consumer weather receiver can be programmed to stay silent unless the alert names its own county. The protocol is shared; only the transport differs.

Two paths, on purpose

A message reaches a station by two independent routes, and the redundancy is the entire design philosophy.

The relay chain

The older path is a tree of monitoring assignments. Each participating station is required to monitor at least two other sources, named in a state plan. Certain stations are designated local primaries, and are themselves monitored by everyone around them; above those sit state relay arrangements and, at the top, a small number of national entry points hardened against loss of power and communications.

The virtue of the arrangement is that it needs nothing but a receiver and a transmitter. If the internet is down, if the telephone network is congested, if the power grid has failed everywhere except at the sites with generators, the chain still carries a message from one transmitter to the next by the oldest available means: over the air.

The internet path

Since 2012, participants must also be able to receive alerts formatted in the Common Alerting Protocol, distributed through the federal alert aggregator. CAP is a structured document rather than an audio burst. It can carry a longer text, several languages, and either recorded audio or text for a decoder to speak. It removes the generational degradation that a long relay chain produces, since each station receives the original rather than a copy of a copy.⁴

Neither path replaces the other. The internet path is better in every respect except the one that matters most, which is behaving well when the infrastructure it depends on is the thing that has broken.

Tests, logs and the ways it goes wrong

An alerting system that is never exercised is an alerting system that does not work, so the rules build testing into ordinary operation. A required weekly test is originated by each participant at an unscheduled time. A required monthly test is originated higher up and relayed down the chain, which exercises the relay itself rather than just the equipment. Periodic national tests use a distinct event code and are coordinated across the country; the first nationwide test took place in 2011.

Every test and every real activation is logged, and the results of national tests are filed electronically with the regulator. Those filings are where the system's real weak points show up: monitoring assignments pointing at a station that has changed frequency, decoders with an exhausted battery-backed clock, audio wired so that the alert plays into a monitor speaker instead of the transmitter.

The failure that gets remembered is the opposite one. In January 2018 a false alert warning of an inbound ballistic missile was issued in Hawaii and took thirty-eight minutes to retract. It was a procedural failure rather than a technical one, and the subsequent inquiries changed how origination interfaces are designed: confirmation steps, clear separation of test and live controls, and a pre-scripted cancellation message ready to send.

That is the recurring lesson of the whole subject. The equipment is simple and has been reliable for decades. Almost every serious incident has come from a human interface, a wiring assumption, or a monitoring assignment that nobody checked after something else changed. The wiring assumptions in question are the subject of the wiring of a room that talks back.