NATS Software Fault Grounded 2,000 UK Flights, Report Finds

On September 18, Britain's air traffic control provider NATS published its first technical account of the September 8 airspace failure that grounded more than two thousand flights and disrupted the journeys of over three hundred thousand people. The 18-page preliminary report, requested by Transport Secretary Heidi Alexander, blames a legacy software defect that hid inside the country's National Airspace System for years.

According to the report, the defect lived in the module that allocates or reassigns aircraft squawk codes, the identification numbers controllers use to match radar blips to flight plans. A manual request for a code was being processed when a higher-priority message arrived, pausing the original task. When processing resumed, the defect made the software restart the request incorrectly, producing corrupted output that infected later flight data updates.

A one-millisecond window for disaster

What makes the finding remarkable is how narrow the trigger was. NATS says the vulnerable section of code had an exposure window of roughly one millisecond: the interrupting message had to land precisely while the original request was partway through updating a value. Arriving a millisecond earlier or later would have let the update complete normally. The sequence had apparently not happened in live operations before September 8, which explains how the NATS Software Fault stayed hidden for years without being caught by testing or monitoring. Detailed aviation coverage of the preliminary findings describes the trigger as an exceptionally precise combination of events.

The corruption did not crash the system outright. At 10:02 that morning, London Area Control detected that its connection to the National Airspace System had dropped, then recovered automatically after about 45 seconds, with no immediate operational impact. But at 12:32 the connection began dropping repeatedly as controllers struggled to process the bad data, and automated functions became unavailable as staff shifted to manual procedures. By 12:45 NATS was restricting the number of aircraft entering some sectors and temporarily stopping departures at UK airports. At 13:32 the link failed completely and controllers switched to established fallback procedures, which kept aircraft safely separated but throttled capacity to a trickle. Some sectors were capped at as few as 30 aircraft per hour, and restrictions on arrivals meant planes due to land in Britain could not always depart from their origin airports.

The controlled recovery took hours. Engineers and the Major Incident Manager concluded around 13:45 that the likeliest culprit was the National Airspace System, and after extensive coordination with airports and neighboring air traffic units, the restart began at 15:17 and finished at 16:09. Because the two systems had been disconnected, flight data had become unsynchronized, and engineers spent the rest of the evening reconciling duplicate flight plans and mismatched code and callsign associations. All systems were stable by 18:50 and the last restrictions were lifted at 19:30. In total, departures were stopped for about four and a half hours across a six-hour window, and NATS handled 6,094 flights that day instead of the 8,000 it had expected.

Compensation ruled out, accountability questioned

The financial answer for passengers is already clear and unwelcome: the Civil Aviation Authority classified the failure as an extraordinary circumstance, which effectively blocks statutory cash compensation for the cancelled flights. Hundreds of thousands of travelers were stranded or spent nights in airports while airlines spent millions of pounds repositioning crews and aircraft and refunding tickets.

NATS chief executive Martin Rolfe apologized to those affected and said safety had not been compromised, but he rejected calls for his resignation. Rolfe said the problem had been traced to a small subsection of code, that mitigation measures are in place while the permanent software correction undergoes safety testing, and that the incident was unrelated to the August 2023 flight-planning outage or the radar issue of July 2025. Alexander called the disruption completely unacceptable and demanded answers on why the flaw went undetected. Ryanair, Europe's largest airline, criticized the provider's resilience and demanded financial compensation for the costs it incurred.

The CAA is now conducting its own independent review, ordered by the government, which will examine whether NATS is set up to run a resilient service and is expected to report within six months. NATS itself has committed to a full Major Incident Investigation within 60 days of September 8, covering root causes, recovery arrangements, command and control, and why the defect was never identified. Travelers flying in or out of Britain can follow the fallout and the permanent fix through GenZ NewZ travel coverage, including how the CAA's review reshapes the rules around passenger payouts.