NATS made a rare flight-plan message a common-mode air-traffic

Summary

At 08:32 UK time on 28 August 2023, NATS' Flight Plan Reception Suite Automated-Reprocessing system stopped processing flight plans automatically after receiving a valid Los Angeles-to-Paris Orly plan with a rare combination of attributes. A three-letter waypoint ambiguity contributed to a calculated UK exit point appearing before the entry point, which triggered a critical exception.
The secondary installation was physically separated and had separate power and data feeds, but it ran the same hardware and software. It received the same message and reached the same failure state within about 20 seconds. This was redundancy against some infrastructure failures, not software diversity against a shared logical defect.
Controllers continued to manage aircraft safely. The immediate safety control was a severe reduction in traffic. Normal automated throughput was roughly 700 to 800 flight plans an hour, sometimes about 900, while the manual fallback was designed for approximately 60 an hour. The contingency therefore protected the airspace by transferring disruption to departures, airlines, airports and passengers.
The CAA's final independent review estimated that more than 700,000 passengers were affected: approximately 308,000 by cancellations, 95,000 by delays longer than three hours, and around 300,000 by shorter delays. It estimated airline costs at about £65 million and aggregate downstream costs at £75 million to £100 million, against an estimated NERL service-quality penalty of about £1.8 million.
A later technical addendum materially changed the software-change account. The original 2018 build lacked one intended prevention check, but a separate logic test would have rejected the nonsensical route for manual handling while automatic processing continued. A substantial 2021 rewrite omitted that separate protection. More than 400,000 test plans did not reproduce the six-attribute combination, and the omission was not found until simulator work in June 2024.
NATS deployed a technical change during the night of 18 to 19 September 2023. The independent panel then issued 34 recommendations covering contingency capacity, software assurance, incident command, supplier escalation, communications, passenger evidence and regulation. An April 2025 progress report recorded 18 recommendations complete; a December 2025 update left two requiring more evidence; and the June 2026 final addendum said all 34 had been completed or embedded and formally closed the final two.
Closure is meaningful evidence of governance work, but it is not a substitute for operational proof. Durable accountability requires generic isolation of troublesome messages, independent or demonstrably dissimilar recovery paths where justified, measured useful capacity in degraded mode, rehearsed escalation, outcome metrics that include cancellations and knock-on effects, and publication of evidence that those controls keep working after future software changes.

The incident was caused by a valid message, not an invalid flight plan

The distinction between an invalid input and a valid but unfamiliar input is central. A system operator can reasonably reject malformed data at a boundary. It is much harder to defend a service that permits a standards-compliant message to place the whole processing path into maintenance, particularly when the service decides whether the national airspace system can accept normal traffic.

The flight originated in Los Angeles and was bound for Paris Orly. European flight-plan processing supplemented the filed route with waypoints relevant to the UK airspace segment. NATS' Flight Plan Reception Suite Automated-Reprocessing component, abbreviated FPRSA-R in the official reports, tried to identify the point where the flight would enter and leave UK airspace. One three-letter identifier, DVL, referred in the original plan to Devils Lake in North Dakota. The UK processing logic could also resolve DVL to Deauville in France.

After rejecting other candidate exit points under its route-selection rules, the system used the French interpretation and produced an impossible sequence in which the calculated exit from UK airspace came before the calculated entry.

That unusual result activated a critical exception. The primary processor entered maintenance mode. The pending message remained at the head of the queue, and processing it again reproduced the same exception. The secondary received the same data and behaved identically. NATS' major-incident report describes six attributes that had to coincide for this behavior; remove any one and the message would ordinarily have processed. Rarity explains why the defect had not appeared in live service. It does not turn the input into misconduct by an airline or pilot, and it does not remove the operator's responsibility for containing an unanticipated but valid state.

The component had entered operational service in September 2018 and had processed more than 15 million flight plans without previously causing delay. That record matters: the failure was not a chronically unstable service. But a long uneventful run is evidence about observed inputs, not proof that all permitted combinations are safe. The case exposes the difference between frequency and consequence. A rare combination can still be a foreseeable class of risk when a parser resolves ambiguous identifiers, derives route geometry, and is allowed to halt a national queue.

The official record also rules out an attractive but unsupported explanation. The independent panel and later progress reporting found no evidence that a cyberattack caused the incident. The failure was an internal interaction among valid data, route interpretation, exception handling and shared software. Describing it accurately matters because cyber controls would not repair the demonstrated defect. The appropriate controls are input isolation, defensive route validation, change assurance, queue recovery, independent fallback and incident response.

A six-hour technical event became a multi-day transport event

The most useful accountability timeline separates the condition of the computer system from the capacity available to the transport network. NATS restored automated processing in roughly six hours, but traffic restrictions persisted beyond technical restoration and passenger effects continued for days.

At 08:32, automatic flight-plan processing ceased and NATS began using its manual contingency. The two automated installations had failed in quick succession. Voice communications, surveillance and controllers' ability to handle aircraft already in the system remained available, so this was not a loss of all air-traffic control. The binding constraint was the rate at which new flight plans could be validated and introduced safely.

The manual path was staffed through seven terminals at Swanwick. Prestwick personnel could contribute to limited tasks but were not trained to enter complete flight plans in the same way. Normal automated demand on a busy day was around 700 to 800 flight plans per hour and could peak around 900. The manual design rate was about 60 per hour. This was not an equivalent standby service waiting to take over; it was a safety contingency for maintaining a minimal flow while the fault was investigated.

NATS told EUROCONTROL's Network Manager about the problem at 10:43. At 10:45, a network regulation notice was issued to take effect at 11:00. The initial aggregate rate was 360 flights per hour, comprising 300 for Swanwick and 60 for Prestwick. That figure exceeded the manual-input rate because some plans had already been processed and because different constraints operated across the network, but it could not be sustained as stored plan data aged. Restrictions tightened. At 12:20, rates were reduced to 40 and 20 respectively; at 13:00, to 20 and 10.

The system retained about four hours of already processed data. As that window expired, changes and new plans increasingly required manual treatment. The store was effectively exhausted at 12:32. That explains why disruption could deepen several hours after the first exception rather than appearing as one instantaneous nationwide stop. Airlines and airports had to make decisions while the available capacity and expected recovery time were changing.

The incident reports show a staggered technical escalation. The external software supplier was contacted at 12:39. At 12:58, the supplier advised NATS to reprocess the pending queue. Test plans were sent at 13:26. Automated processing resumed at 14:27, and the system was reported technically operational at about 14:32. Restrictions then had to be unwound safely rather than removed in one jump. Capacity began to increase at 15:24 and all network restrictions associated with the incident were removed at 18:03.

NATS handled 5,592 flights that day against 7,536 anticipated, according to its report. Roughly 2,000 expected movements did not occur, a total that includes cancellations and flights that avoided the affected airspace. NATS said about three quarters of planned flights operated. Those figures are compatible with a system that was restored during the afternoon and still produced large downstream losses: aircraft, crews, airport slots and passengers cannot all be put back into position when a software status changes to green.

The disclosure record developed over time. The CAA's preliminary report set the initial chronology and described more than 1,500 cancellations on the Monday. Its interim report expanded the investigation through documents and stakeholder evidence. The final review then incorporated passenger research, cost estimates, technical retesting and a corrected account of the software history. Treating the earliest number or explanation as definitive would erase the value of the independent process that followed.

Primary and backup were separate machines inside one logical failure domain

The word "backup" can conceal several different protections. A duplicate power supply protects against a failed supply. A machine in another room protects against some physical hazards. Replicated data feeds protect against some communications failures. None of those measures necessarily protects against a deterministic software defect triggered by the same input.

NATS' primary and secondary FPRSA-R installations were in physically separate rooms and used separate power and data connections. They nevertheless used the same hardware and software. When both consumed the same flight-plan message, both calculated the same anomalous route and entered the same maintenance state. The secondary was available in an infrastructure sense but not independent in the failure dimension that occurred.

The independent panel therefore treated software common mode as an accountability issue. It did not claim that every air-navigation system must immediately run two wholly different products. The review found that software diversity was used in many safety-critical radio and radar applications, but it was not aware of a peer air-navigation service provider using diverse software for flight-plan processing. Diversity can introduce integration complexity, inconsistent outputs, separate assurance burdens and additional cost. A second product can also contain its own defects.

That nuance does not rescue a nominally redundant design from scrutiny. It changes the question from "Why was there no different backup?" to "Which failure classes does the backup cover, which does it share, and what compensating controls limit shared failures?" NATS and the CAA needed an explicit position on diversity, not an assumption that physical separation made software independence unnecessary. The panel recommended a risk-based policy and stronger treatment of data that could disrupt processing.

One compensating control is message quarantine. If a plan produces an unhandled exception, the system can preserve it for investigation, send it to a manual queue and continue with later messages, provided doing so is safe and preserves ordering rules that matter. During this incident, the problematic message remained pending and could retrigger the exception whenever the system reconnected. The queue's recovery logic thus amplified one plan into a fleet-wide capacity event. A durable repair has to address that class of behavior, not merely teach the code to recognize the exact DVL combination seen in August 2023.

Another control is a tested degraded service with useful throughput. If software diversity is judged disproportionate, management cannot count a 60-per-hour manual process as equivalent to an automated path that usually accepts more than ten times that volume. It must quantify how long stored data lasts, how rapidly manual teams can be augmented, which functions each site can perform, and when traffic regulation must begin. Resilience is a portfolio of controls; every excluded control increases the burden of proof on the controls retained.

The safety response worked by exporting the loss of capacity

No safety occurrence was reported as directly resulting from the failure, and the independent review found that controllers maintained safe operations. That is an important result. It should not be converted into the broader claim that the system was resilient. Safety was protected because NATS and EUROCONTROL restricted the number of flights entering the constrained process. The control worked by saying no to demand.

For air-traffic management, that is often the correct immediate decision. Continuing near-normal departures without validated plans would have increased controller workload and uncertainty. The Transport Act does not require efficiency at the expense of safety. The accountability problem arises later, when a provider or regulator uses the absence of an accident as if it answered questions about continuity, preparedness and cost allocation.

The manual fallback had a distinct purpose. Expanding it to preserve 80 percent of normal capacity was considered and rejected by the review as disproportionate. NERL estimated it could require about 200 additional people continuously available, take around seven months to establish at busy sites, cost approximately £10.75 million a year and create extra human-error and safety exposure. That is a useful counterweight to simplistic demands for a fully manual mirror of automation.

But rejecting an 80-percent manual target does not imply that 60 plans an hour was the best attainable contingency. The panel recommended reviewing how maximum capacity could be preserved for longer, minimizing restrictions when they became necessary, cross-training staff where justified, improving stored-data and queue arrangements, and exercising the response. The policy choice is not binary between a second full workforce and the pre-incident state. Intermediate capacity, better quarantine, faster diagnosis and earlier flow management can materially reduce harm.

The safety-efficiency distinction also affects measurement. Traditional air-traffic-flow-management delay minutes capture regulated delay but can miss cancelled flights, aircraft displaced into later rotations and passengers whose journeys fail after the immediate regulation ends. A provider can therefore take the safest action and still need to account for the full consequences of the underlying preventable outage. Good incentives reward the safe restriction while charging management attention to the weakness that made it necessary.

Practical control was distributed, but it was not ownerless

The incident crossed corporate and regulatory boundaries. Distributed control means responsibility must be assigned by decision and capability, not dissolved among entities.

NERL controlled the operational service. It specified and accepted the flight-plan processing capability, operated both installations, chose the contingency design, staffed support, maintained incident procedures, decided when to escalate, and coordinated traffic restrictions with EUROCONTROL. Its economic licence gives it a privileged and highly consequential position in UK en-route air navigation. NATS Holdings' governance and resources sat above the licensed operator, but the direct statutory duties attached to NERL.

The software supplier controlled specialist product knowledge and code-level support. NATS' reports identify Frequentis as the supplier involved in diagnosis. Supplier control did not remove NERL's duty to assure the service it bought. It did mean that Level 3 knowledge and some remediation capability were external dependencies. A resilience design has to treat time-to-supplier-engagement, contractual access, diagnostic information and out-of-hours support as operational controls rather than procurement footnotes.

The CAA controlled licensing, economic incentives and regulatory oversight. Under the current NERL licence and monitoring framework, the CAA monitors service, resilience and compliance. Before the incident, it had not audited the 2018 deployment or the 2021 modification because those changes were not judged likely to create a significant safety risk. The later finding shows the limit of a lens focused narrowly on safety severity: a change can preserve aircraft separation while creating national continuity and consumer harm.

EUROCONTROL controlled network flow coordination, not NATS' defective code. Its Network Manager converted the UK capacity constraint into regulated traffic across the European network. It depended on timely, credible information from NATS. Earlier notification could have improved planning, but it could not repair the processor.

Airlines and airports controlled many passenger-facing decisions. They chose cancellations, rerouting, customer messages and provision of meals or hotels under severe uncertainty about capacity and recovery. Their actions could reduce or compound individual harm. They did not cause the common-mode software exception, and they could not know the repair time before NATS could estimate it.

Passengers controlled almost none of the system. They bore the cost of replacement travel, accommodation, missed work, lost holiday time, care obligations and uncertainty. Many had to retain receipts and claim reimbursement after the event. Their contractual relationship was usually with an airline, not NERL, even though the originating technical failure sat in the air-navigation service.

Parliamentary evidence helps distinguish admission from verification. In October 2023 oral evidence, NATS' leadership acknowledged responsibility for its system while explaining that voice and radar services remained available and that price-control penalties would reduce future revenue. In April 2024 evidence, it described larger response calls, a single accountable post-holder, more testing and revised escalation. Those statements are primary evidence of what management said and implemented. Independent CAA review and subsequent validation are stronger evidence of whether the response addressed the recommendations.

Incident command and supplier escalation consumed avoidable time

The technical defect was rare; the escalation architecture was a management choice. NATS used support levels with different availability. Level 1 engineering personnel were on site. Level 2 support was on call and off site, and Level 3 expertise depended on further escalation, including the supplier. The staffing model for Level 2 was influenced by planned engineering workload rather than the day's traffic demand, even though the consequence of slow recovery was operational.

The independent review found that bringing Level 2 expertise into the response took about an hour and a half after remote avenues were exhausted, Level 3 assistance was sought after more than three hours, and the supplier was contacted after more than four hours. NATS' own chronology records the supplier call at 12:39. Once engaged, the supplier helped identify the pending-message recovery action within roughly 20 minutes.

It is not possible to state exactly how much earlier the service would have returned if the supplier had been called at the first alarm. Diagnosis can require evidence collection, and a specialist contacted earlier might still have needed time. The supported conclusion is narrower: the escalation path did not match the potential consequence, and earlier engagement created a credible opportunity for faster recovery. The independent panel said it likely would have expedited resolution but did not quantify the saving.

Command was also distributed across operational and technical forums. NATS concluded that it lacked one person with unambiguous end-to-end accountability during the event. Multiple calls can broaden expertise, but they can also leave no single owner for supplier escalation, network notification, customer information and the transition from technical recovery to operational recovery. Later evidence described a single accountable post-holder and larger coordinated calls. The durable test is whether exercises demonstrate decision rights under stress, not whether an organisation chart contains a new box.

NATS' October 2023 written evidence to Parliament argued that primary and backup had operated as designed and initially resisted characterising the event as a resilience failure. The independent panel took a broader view: identical software made common-mode failure possible, the manual fallback offered less than 10 percent of normal automated capacity, and incident escalation and communication needed improvement. These positions can be reconciled only by distinguishing component availability from service resilience. The machines may have followed their configured fail-safe behavior; the national service still failed to sustain acceptable capacity.

The 2021 change is the most consequential assurance finding

The public technical account changed after the final report's main text was drafted. That correction is not a minor editorial detail; it relocates the critical assurance failure.

The original account suggested that an intended line or block of defensive code had been absent when FPRSA-R entered service in 2018. Simulator testing in June 2024 found a more complex history. The 2018 version did not contain the intended search-prevention logic, but it did contain a separate reasonableness test. When the route calculation placed exit before entry, that test would have sent the individual plan for manual processing and allowed automatic work on other plans to continue.

In 2021, a major software change supported Prestwick Upper Airspace Free Route Airspace. The relevant code was substantially rewritten. The separate reasonableness test was not carried into the changed version, while the originally intended prevention logic was still absent. The combination removed both layers that could have stopped one anomalous calculation from halting the queue. On the evidence available, the production vulnerability therefore arose from the 2021 change, not simply from a latent 2018 omission.

The change had been tested with more than 400,000 flight plans. None contained the same six attributes in the required combination. Volume testing was substantial, but representational coverage was incomplete. This is a familiar automation trap: a large corpus can demonstrate reliability over common history while saying little about combinations created by ambiguity, enrichment and boundary logic. Robust assurance requires tests derived from invariants and failure classes as well as sampled traffic.

An invariant here was straightforward to state even if complex to implement: a calculated exit should not precede entry, and any failure of that condition should isolate the plan rather than stop the service. A change-impact review should also have identified every defensive check in the rewritten path and shown where each protection moved. The fact that one check was omitted and another was never present indicates a gap between specification, implementation and acceptance evidence.

The CAA had not audited either software event. Risk-based regulation cannot inspect every code change, and the operator remains first-line owner. Still, the case shows why the regulator's materiality test must include continuity and consumer consequence, not only the likelihood of direct loss of separation. The panel said NERL needed to ensure that supplier testing demonstrated that delivered functionality matched specifications. That is governance over an external codebase: the buyer need not write the code, but it must be able to prove that critical behavior survived modification.

The harm was larger and less measurable than the operator's penalty

The final review estimated more than 700,000 affected passengers. Approximately 308,000 experienced cancellations, 95,000 delays over three hours and around 300,000 shorter delays. These are estimates rather than a passenger-level census. Airlines did not provide complete passenger lists to the review, and the CAA said its powers did not compel the data needed for exact totals.

That uncertainty should widen, not narrow, the accountability inquiry. Cancellation counts are easier to obtain than lost work, missed connections, additional care needs or a family buying a replacement journey before a refund. The commissioned Transport Focus study examined passenger experience and support, while the separate qualitative research report followed 42 entities across 30 disrupted journeys. It found experiences ranging from delays of hours to being stranded for three days, inconsistent communication and support, and limited awareness of legal rights. The sample was designed for depth, not statistical prevalence, so its stories illuminate mechanisms of harm without establishing how often each occurred.

Airlines bore the largest directly estimated commercial cost, about £65 million. The panel placed total downstream costs between £75 million and £100 million. Airports incurred costs in the single-digit millions, and passengers collectively incurred many millions more in immediate spending and other losses. Disruption continued after 28 August because aircraft and crews were out of position; the final report identified effects at Bristol as late as 4 September, while refunds and claims could take weeks or months.

NERL's estimated service-quality penalty was about £1.8 million. The figure is not the whole of NATS' cost: management time, repair work, reputational harm and future regulatory requirements also matter. But it reveals a structural mismatch. Most measurable loss sat with actors that did not control the flight-plan processor. When an operator's automatic financial consequence is a small fraction of system-wide cost, regulation needs other mechanisms to create attention to low-frequency, high-impact continuity risks.

NATS' 2024 annual report offers the company's broader performance context: it handled about 2.41 million flights and attributed only a small share of European air-traffic-control delay outside the August event, while the incident pushed its average delay measure above target. That context prevents one incident from being presented as typical daily performance. It also demonstrates why averages are limited public evidence. A service can perform strongly most days and still impose a concentrated, very large tail loss.

The independent panel recommended metrics that capture cancellations and knock-on effects rather than relying only on regulated delay minutes. That recommendation is essential for incentive design. What is not counted can be exported. A useful continuity metric must follow the passenger and rotation consequences far enough to reveal whether recovery of the central system actually restored the network.

The legal record divided safety, service and passenger remedies

NERL's core duties are grounded in section 8 of the Transport Act 2000. A licence holder must secure that a safe system is provided, take reasonable steps to provide an efficient and coordinated system, take reasonable steps to meet demand, and consider likely future demand. These duties do not promise uninterrupted capacity. They do make safety only one part of the statutory account.

The CAA administers NERL's economic licence and service-quality framework. The final review did not report a criminal prosecution or judicial finding that NATS had breached a legal duty. Its accountability instrument was an independent review, recommendations, licence oversight and the approximately £1.8 million price-control consequence. That distinction must remain explicit: documented technical and governance shortcomings are not the same as a court judgment of negligence or statutory breach.

Passenger rights operated through airlines. Under the retained air-passenger compensation regulation, cancellation and long delay can create duties to offer reimbursement or rerouting and to provide care. The CAA's incident-specific consumer advice said the NATS failure was likely an extraordinary circumstance, making fixed-sum compensation unlikely where the airline could not have avoided the disruption through reasonable measures. That exception did not erase duties to provide or reimburse reasonable meals, accommodation and alternative travel in qualifying cases.

This structure produces an accountability gap visible to passengers. The airline may owe immediate care despite lacking control over the originating infrastructure. The passenger generally has no equivalent direct claim against NERL under the airline contract. NERL's financial exposure is mediated through its licence rather than calculated from each traveller's loss. The panel therefore recommended stronger passenger-data access, collaboration and consumer communication as well as technical repair.

As of 15 July 2026, proposed reform should not be mistaken for enacted law. The Civil Aviation (Consumer Protection and Regulatory Reform) Bill's parliamentary stages page showed that it had completed second reading in the House of Lords and entered committee stage, with report stage still to be announced. A Department for Transport announcement described proposed powers for the CAA to fine airlines and airports for failures including passenger support and information. Those powers were still legislative proposals at the access date and were directed principally at consumer-rights enforcement, not a retroactive reassignment of the 2023 NERL costs.

Repair evidence progressed from a patch to formal closure

NATS deployed its immediate technical modification during the night of 18 to 19 September 2023, within 21 days of the incident. The change was intended to prevent the observed route condition from causing another system-wide halt. NATS also changed queue handling, escalation, incident command, supplier engagement, training and communications. Immediate deployment is evidence of response speed; it is not by itself independent evidence that the root class was resolved.

The CAA's final independent review, published in March 2024 and later updated with the technical correction, issued 34 recommendations. They extended well beyond the offending calculation. NATS was asked to review contingency arrangements, software assurance and diversity, engineering support, escalation, command and testing. The CAA was asked to examine regulation, incentives, metrics, auditing and data powers. Airlines, airports, government and the wider sector received recommendations on collaboration, communications, passenger evidence and exercises.

The follow-up sequence provides a traceable repair record. CAP3109, reporting progress to April 2025, recorded 18 recommendations complete. NATS said it had met all recommendations directed to it, while the CAA continued validating evidence and sector-wide work. The report described a cross-industry disruption exercise on 24 February 2025 and evidence relating to software assurance and diversity.

CAP3193 in December 2025 recorded 32 of the 34 recommendations as complete or embedded. It kept Recommendation 1, on preserving maximum capacity and minimizing restrictions, and Recommendation 8, on a senior resilience and customer-experience forum, open for further evidence. That choice matters: the regulator did not equate submission of an action plan with closure.

CAP3193A, published in June 2026, closed the final two. It said NATS had provided additional assurance for contingency arrangements and that the CAA was satisfied the intent of Recommendation 1 had been met. It also cited evidence that the senior leadership forum contemplated by Recommendation 8 had been established. The CAA concluded that all recommendations had been actioned and ended its event-specific reporting to the Department for Transport.

Formal closure is the strongest available public evidence that the prescribed governance work was completed. It remains bounded evidence. Some items were described as embedded in ongoing operational, regulatory or legislative policies rather than one-time technical deliverables. The addendum does not publish a new destructive test of every rare flight-plan combination, a measured rate for the revised degraded mode under a future busy-day failure, or proof that a dissimilar backup could never share a new defect. No responsible assurance could make the last promise.

The correct reading is therefore neither cynical nor absolute. NATS repaired the known condition, changed its response architecture and supplied evidence that the CAA accepted. The CAA maintained a public sequence of interim, final and progress reports and withheld closure on two items until more evidence arrived. Those are real accountability outputs. Their durability must now be judged by recurring tests, change records, operational exercises and outcome data after the special review has ended.

Counterfactuals show which controls could have reduced harm

Counterfactual analysis is useful only when tied to demonstrated mechanisms. Five comparisons survive that test.

The 2018 build is an internal counterfactual. June 2024 simulator work showed that the original version's separate reasonableness check would have rejected the impossible exit-before-entry result, routed the individual plan for manual attention and continued automatic processing. That is direct evidence that one defensive control could have contained the same input. It also shows that the 2021 rewrite, not unavoidable novelty alone, changed the consequence.

Quarantine is a queue-level counterfactual. If an exceptional message had been isolated after its first failure, later plans could potentially have continued while specialists examined it. This cannot be asserted without safety and ordering qualifications, but the independent panel specifically identified generic data handling and quarantine as a required design direction. The goal is graceful degradation: lose one transaction, not the service.

Earlier specialist engagement is a response counterfactual. The supplier helped identify a recovery action soon after contact. Calling earlier would not guarantee a four-hour saving, because the necessary diagnosis might not have been immediate. It would have removed waiting time from the critical path and created an earlier chance of resolution. That is enough to justify severity-based escalation thresholds and rehearsed out-of-hours contacts.

A truly diverse backup is an architectural counterfactual, not an automatic prescription. Different processing software might not have reproduced the exact defect, but it could have disagreed in other unsafe ways and would have carried material cost and assurance complexity. The incident supports an explicit diversity assessment and compensating controls where diversity is rejected. It does not prove that buying a second product is the only rational answer.

A full manual mirror is a disproportional counterfactual. The estimated staffing, cost, training time and human-error exposure make permanent 80-percent manual capacity difficult to justify. More modest changes could still improve endurance: additional trained terminals, better cross-site capability, preserved stores, precomputed safe plans, earlier regulation and exercises that measure sustained throughput rather than merely confirming that a manual procedure starts.

These comparisons prevent two opposite errors. The incident was not an unforeseeable act for which no control could exist; the 2018 retest and queue design show feasible containment. Nor does hindsight justify every expensive redundancy proposal. Accountability asks whether the chosen control set was proportionate to consequence and whether exclusions were explicit, tested and accepted by the right authority.

Confirmed facts, supported inference, and unknowns

Confirmed facts

A valid flight plan triggered a critical exception in the primary and secondary automated flight-plan processing installations on 28 August 2023. Both used the same hardware and software, although they were physically separated with separate power and data connections.
Automatic processing stopped at 08:32. Technical processing resumed at approximately 14:27, the system was reported operational around 14:32, and associated traffic restrictions were fully removed at 18:03.
The manual fallback was designed for approximately 60 plans per hour against normal automated rates around 700 to 800 and peaks around 900. Traffic restriction was the principal safety control.
The final independent estimate exceeded 700,000 affected passengers and placed aggregate downstream cost at £75 million to £100 million. The report explicitly qualified the precision of passenger figures.
June 2024 simulator work established that a defensive logic check present in the 2018 build was omitted during the substantial 2021 rewrite. The revised test corpus of more than 400,000 plans had not contained the six-attribute trigger.
NATS deployed a technical change in September 2023. The CAA issued 34 recommendations and, in June 2026, stated that all had been completed or embedded and that the final two were closed.

Supported inferences

Physical redundancy was limited public evidence for the demonstrated failure class because both installations shared deterministic processing logic and the triggering data. This follows from the architecture and synchronized behavior; it is not a claim that every NATS backup lacks independence.
The 2021 change-assurance process overemphasized historical-volume testing relative to defensive invariants and traceability of safeguards. The evidence shows extensive test volume and a missed protection; the exact internal rationale for test selection is not public.
Earlier supplier escalation had a credible prospect of reducing outage duration because useful recovery advice followed contact quickly. The amount of time that would have been saved cannot be established.
The licence penalty alone was weakly aligned with system-wide harm because it was much smaller than estimated downstream cost. Reputational, remediation and regulatory costs mean it was not NATS' only consequence.
Formal completion of recommendations improves confidence in governance and preparedness, but recurring exercises and outcome evidence are required to show that improvements survive later software and staffing changes.

Unknowns

The exact number of affected passengers and their total personal loss remain unknown because complete passenger-level records were not available to the review.
Public reports do not disclose every proprietary code path, supplier contract term, acceptance artifact or internal deliberation behind the 2021 release.
No public evidence can establish the exact recovery time under a hypothetical earlier call, a different message-quarantine implementation or a diverse secondary product.
The future degraded-mode throughput of the revised arrangements under an incident with the same demand profile has not been demonstrated in a comparable public live event.
Recommendation closure does not establish how the system will respond to every new valid input, future code rewrite or coupled infrastructure failure.

The durable accountability test

NATS should be judged against evidence that can outlive the incident team and the 34-item programme.

First, define the failure domains. Every primary-secondary pair should have a current statement of shared software, hardware, data, configuration, identity, supplier and operational dependencies. For each shared domain, the operator should identify a compensating control and the test that demonstrates it. Calling a component a backup should never substitute for this map.

Second, test invariants and adversarial combinations. Flight-plan assurance should cover route geometry, identifier ambiguity, enriched data, impossible ordering, queue poisoning and repeated exceptions. Large historical corpora remain useful, but coverage should be reported by risk class and state transition, not only by the number of plans replayed. Major rewrites should trace every existing defensive check to its new implementation or document an approved removal.

Third, prove graceful degradation. A troublesome message should be safely isolated where possible, with subsequent valid traffic continuing. NATS should measure the proportion of normal demand sustained at 15 minutes, one hour, four hours and eight hours after loss of automation, including the effect of aging stored data. Exercises should reveal operator workload, error rates and the point at which network regulation becomes necessary.

Fourth, bind escalation to consequence. The responsible post-holder, Level 2 and Level 3 specialists, supplier and EUROCONTROL notification points should be triggered by measurable severity and elapsed-time thresholds. Exercises should record time to decision, time to specialist participation, time to a credible restoration estimate and time to customer communication. Supplier dependence belongs in the continuity model.

Fifth, measure passenger and network outcomes. The service-quality framework should count cancellations, long and short delays, missed rotations and the duration of knock-on effects, not only central flow-delay minutes. Airlines and airports should supply appropriately governed passenger and operational data so the CAA can estimate harm without pretending uncertain figures are exact.

Sixth, keep legal categories precise. Safe restriction, efficient continuity, airline care obligations and fixed compensation are different questions. Public reporting should say which duty was met, which remedy applies and which body controlled the relevant decision. Proposed legislation should be labelled as proposed until Royal Assent and commencement.

Seventh, publish repair evidence after closure. The CAA's June 2026 addendum ended special reporting, but ordinary licence monitoring should continue to show that contingency plans are exercised, software assurance is sampled and lessons survive material changes. A recommendation marked complete should have an owner, a recurring control and an observable failure signal.

The NATS event was unusual because six attributes aligned. It became nationally consequential because one message could stop a queue, two installations shared the same logic, the manual path had limited capacity and specialist escalation took hours. The lasting accountability standard is not zero failure. It is whether the operator and regulator can demonstrate that the next rare, valid message remains one difficult case instead of becoming another common-mode transport crisis.