UK Regulator to Review NATS Outage as Minister Says Resilience Falls Short

LONDON — The UK Civil Aviation Authority (CAA) is carrying out an independent review of the September 8 failure of the NATS flight-processing system, and the company's chief executive has been given until September 16 to tell ministers what went wrong.

Transport minister Keir Mather set out both deadlines when he answered an urgent question in the House of Commons on September 10. He told MPs that at around lunchtime on September 8, NATS "experienced an issue with its flight processing system at its Swanwick centre affecting the data that was available to controllers," and that Secretary of State for Transport Heidi Alexander had asked the CAA "to conduct an independent review to establish cause," with an update due to him within six months. Alexander and Mather met NATS chief executive Martin Rolfe on September 9 and agreed he would send a report on the cause by September 16.

The CAA has described the same review in slightly broader terms, saying the government asked it to establish what happened and consider "how well NATS is set up to deliver a resilient service".

NATS has not published a technical explanation. Its public account of the day remains a sequence of short status updates: an acknowledgement at 13:46 that it was investigating a technical issue affecting departures, confirmation at 15:25 that "the issue was in our flight processing system," a note at 16:40 that "we have implemented a fix and our flight system is starting to recover," and a statement at 19:30 that the issue was resolved and operations had returned to normal. By 22:10 the company called it "a very complex recovery" that had "created difficulties for the whole aviation network." It has promised a full investigation.

Mather told the Commons that NATS had confirmed the fault was technical and did not believe it to be cyber-related.

What has been reported, and by whom

The Financial Times has reported that flight data filed for a UK military aircraft set off the failure. At the time of writing, Airways is still corroborating the claims in that report.

The Guardian, which did report the account, attributed it squarely to the FT rather than confirming it independently, writing that "according to the Financial Times, four people briefed on the incident claimed that the shutdown was caused by a flight plan submitted by a UK military aircraft." That is a single-outlet report carried by a second outlet, not two outlets arriving at the same finding.

The Ministry of Defence said it did not believe there was any indication of an error on the part of the military, and that it would be inappropriate to comment further until the NATS investigation had concluded. No investigator has attributed the outage to the military flight, to the operator of that aircraft, or to any individual, and Airways makes no such attribution.

Mather also told MPs that the air traffic control systems used by civil aviation and those used by the military and the MoD are separate.

Why a flight-processing fault empties a schedule

The clearest published account of what this class of failure does to UK airspace is not from 2026 but from the CAA's independent review of the August 2023 outage, which examined the same function at the same center.

Controllers do not stop working when automated flight data processing is unavailable. They enter and pass flight data by hand, which stays safe and is far slower. The review put numbers on the gap: in normal operation the system could process about 800 flight plans an hour, and manual input reduced that to about 60.

That ratio is what turns an outage measured in hours into disruption measured in days. Because the binding constraint becomes controller workload rather than radar or radio, the only way to keep that workload inside safe limits is to put fewer aircraft into the system. Aircraft and crews then finish the day out of position, and recovery runs until the rotations close.

Whether the September 8 failure produced the same capacity profile is not established. NATS has not said.

The 2023 failure, in detail

The comparison is worth making precisely, because the 2023 mechanism is documented and the 2026 one is not.

On August 28, 2023, the system that failed was the Flight Plan Reception Suite Automated, or FPRSA-R, at Swanwick Area Control Centre. According to the review panel, it could not process the flight plan for a single service from Los Angeles to Paris Orly. The plan had been filed in accordance with standard procedures; the review did not find it defective.

The problem was a duplicated identifier. Most waypoints use five-letter abbreviations, but a minority use three. Searching for the flight's exit point from UK airspace, FPRSA-R settled on Deauville in France, whose abbreviation is DVL, and accepted it because DVL appeared in the filed plan. That DVL was Devil's Lake in North Dakota. The result was a route whose exit point came earlier than its entry point. Recognizing that as not credible, the system generated a critical exception error and, as designed, disconnected itself to prevent apparently corrupt data reaching controllers.

The secondary system took over, received the same flight plan, and failed the same way. Both were out within roughly 20 seconds. The CAA estimated that more than 700,000 passengers were affected.

The panel, chaired by Jeffrey Halliwell, published its final report on November 14, 2024 with 34 recommendations directed at NATS, the CAA, airlines and airports, and government.

Mather told the Commons that all 34 have been implemented.

NATS has not said whether the September 8 failure involved FPRSA-R or a different component, and nothing published so far establishes that the two events share a technical cause. What the 2023 report does establish is that a valid, unremarkable filing was able to stop both the primary and the standby path within seconds, because each responded to an input it could not reconcile by removing itself from service. Whether the September 8 fault belongs to that class is one of the questions the CAA review is positioned to answer.

The resilience question in the Commons

The absence of a fallback was put to the minister directly. Simon Hoare, the Conservative MP for North Dorset, asked whether it was "slightly ludicrous that NATS has put all its eggs in one basket," saying there was "no shadow, back-up or secondary scheme" available.

Mather accepted the point. He replied that "the hon. Member is right to point to the fact that resilience is clearly not where it needs to be," that the systems need to be "more adaptive and more reactive," and that technological change had to be "at the forefront of the CAA and NATS' priorities." Asked separately by Liberal Democrat MP Liz Jarvis what would guarantee "a genuinely effective back-up system," he said resilience "is not currently where we need it to be."

Airways has not independently established the redundancy state of the component that failed on September 8.

Passengers

The CAA has said the disruption is likely to count as an "extraordinary circumstance" under passenger rights rules, which means passengers are unlikely to be entitled to cash compensation for delays and cancellations directly caused by it. The regulator was explicit that this reading is illustrative guidance and that passengers who disagree may still pursue claims.

The airlines' other duties are unaffected. Carriers must still offer a refund or re-routing, and must provide meals, refreshments and accommodation proportionate to the length of the delay, reimbursing reasonable costs where they cannot offer a suitable flight themselves.

Mather said the government granted night-flight alleviations at Heathrow (LHR/EGLL), Gatwick and Stansted to help clear the backlog.

What has not been established

• The specific field, value, or combination the system could not process.
• Whether the filed flight data was compliant with ICAO filing rules.
• Why the record was not rejected or isolated at ingest.
• The redundancy state of the failed component.
• Whether the September 8 fault involved FPRSA-R or a different part of the architecture.
• Any causal finding attributing the outage to the military flight or its operator.

What happens next

Two documents will replace the current reported account: the report NATS owes ministers by September 16, and the CAA's independent review, which is due to update the department within six months. Until one of them describes the failure mechanism, a reported trigger exists and a cause does not.