What went wrong during crippling UK air traffic control failure?

Nine days after the UK’s air-traffic control system failed, the company responsible has explained the cause of the problem – a sequence of events that had simply not been foreseen.

Nats – the national air-traffic provider for the UK – has released a report about the failure, which led to the cancellation of more than 2,000 flights.

What happened?

At 8.32am on bank holiday Monday, 28 August, the Nats air-traffic control (ATC) system received a flight plan for a transatlantic jet that was due to overfly the UK.

The flight plan had been handed on routinely. Eurocontrol’s Integrated Initial Flight Plan Processing System. Eurocontrol, based in Brussels, is the pan-European organisation that coordinates air navigation.

Normally the Nats system extracts the relevant UK portion of the flight and presents it to air-traffic controllers (ATCOs). But data in the flight plan triggered the shutdown of the entire system and its back-up (technically, they were both put into “maintenance mode”).

The report says the system “was unable to establish a reasonable course of action that would preserve safety and so raised a critical exception”.

A “critical exception” is the planned last resort – the point at which the affected system cannot continue.

Without the automated system to assist them, controllers could handle far fewer flights – just 15 per cent of the normal flow.

While aircraft that were in flight were able to continue without diverting, most planes were kept on the ground to avoid adding to the controllers’ workload.

What was wrong with the ‘rogue’ flight plan?

The root of the problem was that it contained duplicate “waypoints”. These are specific locations on the surface of the Earth with five-letter names. For example, flying over the Isle of Wight towards the London area, pilots typically traverse KATHY, ABSAV and AVANT. There is a finite number of combinations, and some are duplicated.

Flight plans for aircraft overflying the UK, as this one was, must contain a waypoint where the pilots intended to enter British airspace. They need not contain a waypoint at the exit point from UK skies. The Nats system is programmed to search on a database for the nearest waypoint beyond British control. It appears that this was a duplicate of another waypoint in the flight plan.

“Since flight data is safety critical information…