- NATS traced the September 8 outage to a software defect in its flight data system, not operator error.
- The failure grounded more than 2,000 flights and affected about 300,000 passengers across the United Kingdom.
- The Civil Aviation Authority will review the incident, while NATS tests a permanent fix before deployment.
NATS said a software defect caused the September 8 UK air traffic outage, grounding more than 2,000 flights and affecting 300,000 passengers. The operator traced the failure to its flight data system, which supports aircraft identification and control operations across UK airspace.
The disruption forced restrictions across the country for around six hours. It continued into the following day, stranding passengers and disrupting flights at airports across the United Kingdom.
NATS chief executive Martin Rolfe said the problem came from a narrow section of code rather than an operator mistake.
“This was a software issue in a specific part of our flight data system, that we have traced to a small subsection of coding.”
The failure happened during a timing-sensitive interruption. A manual request for an aircraft identification code was paused while a higher-priority task was handled. When processing resumed, the system generated corrupted data.
The preliminary report said the failure would have been avoided if the relevant request had arrived “one millisecond earlier or later.” NATS described the corruption as occurring “in the space of a millisecond.”
Transport Secretary Heidi Alexander called the disruption “completely unacceptable” and ordered the Civil Aviation Authority to conduct an independent review. The review is due within six months.
The government said the incident did not result from a cyberattack or operator error. NATS also said the preliminary report found “not caused by any incorrect actions” by military or civil operators.
The failure spread through London’s high-level control system
The incident began at 10:00am on 8 September, while the system processed the manual identification-code request. The higher-priority request interrupted that work, and the software resumed incorrectly.
The affected function belonged to the National Airspace System, which allocates codes used to identify aircraft on radar. It supported operations at the London Area Control Centre, which handles higher-level flights mainly above 24,500 feet.
Engineers received an alert at 10.02am that the link between the National Airspace System and the London Area Control system had dropped. The full seriousness of the failure did not become apparent for about two and a half hours.
NATS began restarting the system just after 3:15pm. Restrictions ended at 7:30pm.
Controllers switched to practiced fallback procedures
The fault left controllers without access to some live flight data. They invoked established fallback procedures, including manually coordinating handovers with neighboring national and international air traffic control units.
Those measures allowed operations to continue under restrictions while engineers worked to restore the system. More than 2,000 flights were cancelled, and the disruption affected hundreds of thousands of passengers across UK airports.
NATS said the restrictions lasted around six hours. The wider disruption carried into the following day, as airlines and airports dealt with cancelled, diverted and delayed services.
The operator said the failure was limited to a small subsection of code. It also ruled out hostile action, sabotage and a radar failure as causes of the outage.
The outage left passengers paying for an unexpected overnight delay
Addie Kitson, 26, was traveling home from China when her flight diverted to Stockholm. She spent 19 hours at the airport and faced nearly £100 in unexpected costs.
Her expenses included refreshments, adaptors and Wi-Fi. The diversion turned a technical failure in the control system into an extended airport stay for passengers far from their intended destinations.
The incident also prompted scrutiny of how a short interruption could affect later flight-data updates. The preliminary findings focused on the way the interrupted identification-code request resumed after the higher-priority task.
NATS is testing a permanent fix before deployment
Rolfe said NATS had contained the immediate problem while engineers prepared a lasting correction. The fix must pass safety testing before the operator deploys it across the affected system.
“The issue has been identified and mitigation is in place while a permanent fix is safety tested and deployed.”
Rolfe also apologized to passengers and said the operator’s responsibility was to move travelers without unnecessary delay.
“it's our job to get people where they want to go, quickly and without delay,”
The independent review ordered by Alexander will examine the outage while NATS completes the safety testing. The operator’s next technical milestone is deployment of the permanent fix after that testing is complete.
