NATS Traces 2,000 Flight Cancellations to Millisecond Software Defect

National Air Traffic Services has traced the September 8 flight-plan processing failure linked to more than 2,000 cancellations to a previously unknown software defect. The finding appears in the preliminary report requested by the UK transport secretary, which NATS delivered after chief executive Martin Rolfe was given one week to explain the failure, the performance of safeguards and measures intended to prevent a recurrence.

The defect occurred within a millisecond, but restrictions remained in place for about six hours and the resulting disruption took more than two days to clear. That gap between the duration of the computing error, the controlled restoration of airspace capacity and the much longer airline recovery is now central to a separate Civil Aviation Authority review.

What the preliminary report establishes

NATS said the defect was in a small part of the National Airspace System, which supports management of UK airspace. The affected software allocates identifying codes to aircraft when those codes are requested manually rather than assigned automatically.

While one manual request was being processed, a higher-priority activity paused it. NATS reported that the software did not resume the request correctly, producing corrupted output that affected later flight-data updates. With less information available to controllers, traffic restrictions were imposed to maintain safety.

The immediate technical effect was limited to flights handled by the London Area Control centre, principally higher-level traffic. The operational response was broader: restrictions were applied across the United Kingdom so the national system could be restarted and flight data reloaded. NATS said safety was maintained, the event was not a cyberattack and mitigation is in place while a permanent fix is safety-tested and deployed.

Those findings identify the triggering defect, but they do not by themselves settle the larger resilience question. A safety-critical system is judged not only by whether its core software can fail, but also by how quickly monitoring identifies the condition, how effectively redundant or fallback processes preserve service and how narrowly operational restrictions can be contained.

Why recovery lasted longer than the outage

Air traffic management and airline scheduling operate as an interconnected network. Restricting UK airspace does not merely delay individual flights at their departure gates. It leaves aircraft at the wrong airports, displaces flight and cabin crews, consumes legal working hours and removes equipment from later scheduled services.

Restoring the processing system therefore removed the original capacity constraint without instantly restoring the airline network. Operators still had to reposition aircraft and crews while fitting delayed services into airport slots and available airspace. Heathrow, Gatwick, Stansted and regional airports were among those affected, and hundreds of thousands of passengers experienced disruption. More than 1,700 flight movements were cancelled or otherwise failed to operate as scheduled on the first day, according to cited Cirium data; cumulative cancellations subsequently exceeded 2,000.

This distinction matters when assessing safeguards. Technical recovery time measures how quickly NATS restored its system. Passenger recovery time measures how effectively the wider aviation network absorbed and cleared the disruption. A review focused only on the software restart would miss much of the public consequence.

The regulator has a broader assignment

The CAA review is independent of NATS’ preliminary investigation and is expected to examine resilience, contingency planning, communications, regulatory oversight and plans to modernize critical systems. It will also consider how earlier recommendations were implemented and what international practices could improve recovery. An initial regulatory report is expected by the end of January 2027, followed by a final report by March 8.

NATS says the September defect was unrelated to its major August 2023 outage, which involved problematic flight-plan data. That technical distinction is important, but it does not remove the policy question raised by repeated national disruptions: whether continuity arrangements can prevent a localized or unusual computing fault from producing nationwide capacity restrictions.

Financial responsibility is another unresolved tension. Airlines generally must provide qualifying delayed passengers with meals, accommodation, refunds or rerouting, even when an air traffic-control failure is treated as an extraordinary circumstance that does not require cash compensation. Ryanair estimated its own losses from the disruption at at least £3 million. That structure places much of the immediate recovery cost on airlines and passengers, while the infrastructure failure originates elsewhere in the aviation system.

NATS says it has invested more than £1 billion in systems and technology over the past decade and plans to submit proposals for a further £1 billion of investment through 2033. Those proposals are not yet adopted policy, and investment totals alone cannot demonstrate resilience. The CAA’s longer review must determine whether modernization priorities, fallback arrangements and regulatory oversight adequately address how a millisecond software defect became more than two days of passenger disruption.

By Thomas Caldwell — AMI’s senior editor for mechanical and mobility engineering, covering vehicle electronics, systems integration, electrification, chassis systems, propulsion, and safety policy.