On 8 September, the flight data system underpinning UK air traffic control corrupted a piece of data and started dropping its link to London Area Control. Controllers saw nothing for two and a half hours. Departures were eventually stopped, more than 2,000 flights were delayed, cancelled or diverted, and restrictions stayed up until 19:30.

NATS published its preliminary investigation report on 18 September. The defect is the interesting part.

The mechanics:

  • At 10:00, a valid manual request for a squawk code — the identification code an aircraft transmits so radar tracks can be matched to a flight plan — was being processed when a higher-priority message arrived.
  • The allocation was paused, as designed. When it resumed, a legacy and previously unknown defect meant it did not resume correctly, and the output was corrupted.
  • The exposure window was about one millisecond. Arrive a millisecond earlier or later and the update completes normally. NATS says this is why it had never happened before.
  • At 10:02 the LAC system tried to process the corrupted data, timed out, and dropped its link to the NAS. The notification cleared after 45 seconds. An engineering ticket was raised and closed as “recovered and is stable with no ongoing operational impact.”
  • From 12:32 the drops returned, more frequently each time, as more processing attempts hit corrupted data. At 13:32 the link dropped and did not come back — automatically, and by design, to protect the integrity of both systems.

Three things stand out beyond the bug:

  • Self-healing hid the fault. Timeout-and-reconnect existed to localise problems, and it worked — which is exactly what gave corrupted flight data a two-and-a-half-hour head start over anyone noticing.
  • Blast radius came from sharing, not from the broken component. The defect was in the LAC path, but the NAS also serves other ATC units and airports. Restarting it needed pre-planning and coordination, and the traffic gap had to be created UK-wide — including stopping departures from foreign airports.
  • Recovery was mostly reconciliation. Restart plus data reload took about 52 minutes. Reconciling unsynchronised state — duplicate flight plans, code and callsign correlation anomalies, plans amended during the restrictions — took 2 hours 40.

What held: all aircraft stayed safely separated throughout, and the fallback procedures for losing the NAS link had been in the 2025/26 controller refresher syllabus, simulated. The Major Incident Manager role existed because a 2023 investigation recommended it and the CAA independently verified the implementation.

The generalisable bug class is the preemption path — a routine operation suspended mid-update and resumed into a partially written state. Those paths are rare in production, so they never get hardened, and a latency budget becomes the only thing standing between you and corrupt output.

The report’s own framing is worth borrowing too: the full investigation, due within 60 days, has a term of reference that asks whether lessons from previous major incidents were applied here. Detection gaps get fixed by better alarms. Two-and-a-half-hour detection gaps get fixed by asking who was supposed to notice.