Millisecond software glitch caused UK air traffic chaos, but questions remain on detection

On the morning of September 8, a defect buried in the UK's air traffic control software activated without warning. The problem unfolded in the space of a millisecond—so fast that no human operator could have caught it in real time. A request to assign an identification code to an aircraft was interrupted by a higher-priority task. When the system resumed processing the original request, the software did not resume correctly. The output corrupted. Flight data downstream became unreliable.

Engineers at National Air Traffic Services noticed the problem at 10:02am, just two minutes after it occurred. By 10:06am, they reported that the system had recovered and appeared to be working normally. No operational impact, they said. They continued investigating, but there was no sense of urgency. No major incident was declared. The morning proceeded.

Then, at 12:32pm—two and a half hours later—the link between the national airspace management system and London's control center dropped again. This time, the failure did not self-correct. Controllers had to shift to manual procedures for some tasks. By 12:45pm, Nats began restricting incoming flights as the system continued to malfunction. At 1:32pm, the system failed completely. Airlines were notified of restrictions at 1:40pm. Between 2:50pm and 4:09pm, engineers rebooted the entire system. Full operations did not resume until 7:30pm—nine and a half hours after the initial error.

The damage was immense. Over 2,000 flights were cancelled. Hundreds of thousands of passengers found their travel plans erased or delayed. Aircraft were displaced across the network. The backlog of disruption took more than two days to clear. This was the third major failure of the UK's air traffic control system since the summer of 2023, and it raised a question that government ministers and airline executives could not ignore: why was a known software defect never found and fixed before it brought the system down?

Martin Rolfe, the chief executive of Nats, issued an apology and insisted that safety had never been compromised. The defect was a legacy issue, he said—something inherited from earlier versions of the software, previously unknown, that only manifested when a very specific sequence of events occurred simultaneously. A permanent fix was being safety-tested. Mitigation was in place. But his words offered little comfort to an industry already fractured by repeated failures.

Heidi Alexander, the transport secretary, said the Nats report left critical questions unanswered. She tasked the Civil Aviation Authority with conducting an independent review to examine not only Nats' findings but also the company's investment plans and regulatory accountability. The review would be published within six months. The message was clear: Nats' leadership and systems were now under formal scrutiny.

Airlines demanded more than apologies. Tim Alderslade, chief executive of Airlines UK, called for mandatory investment in system resilience so that a single fault could never again cascade into nationwide disruption. EasyJet's Kenton Jarvis said passengers deserved action, not promises. Ryanair's Neil McMahon went further, calling for Rolfe's resignation and rejecting what he characterized as an excuse masquerading as an explanation. The industry was signaling that the tolerance for failure had expired.

What emerges from the timeline is a system that detected its own failure but did not recognize the danger. Engineers saw the problem, confirmed recovery, and moved on. The system appeared stable. No alarm bells rang at 10:06am because the system, at that moment, genuinely was stable. The real failure came later, when the same defect triggered again under slightly different conditions. By then, the window for prevention had closed. The question now is whether the review will reveal how such a window can be kept open—how a system can be designed not just to recover from errors, but to prevent them from ever reaching the point where recovery is the only option left.