NATS traces 2,000 cancelled UK flights to a millisecond software defect

A software defect that fired in a millisecond on the morning of 8 September is what shut down parts of Britain’s air traffic system, cancelled more than 2,000 flights and left hundreds of thousands of passengers stranded, National Air Traffic Services said on Friday.

The preliminary report points to a “legacy and previously unknown defect” in a module of the National Airspace System, the software that underpins UK airspace and hands aircraft their squawk codes, the four-digit identities used on radar.

A valid manual request for a squawk code was paused so the system could handle a higher-priority task. When the first request resumed, the defect sent it down the wrong path. The output was corrupted. That corruption then touched later flight-data updates. NATS said the bad step happened “in the space of a millisecond.”

How a code request became a six-hour outage

Engineers were first told at 10.02am that the link between the national system and London Area Control had dropped. The link dropped again at 12.32pm. A major incident was declared. Controllers moved some work onto manual procedures. By 12.45pm NATS was restricting traffic. The system failed completely at 1.32pm.

The glitch sat in the London Area Control centre. Restrictions still had to be applied across the country so NAS could be restarted. Heathrow, Gatwick, Stansted, Luton, Manchester and Glasgow were all hit. Manchester recorded more than 100 delays and more than a dozen cancellations. Some passengers sat on the tarmac for more than four hours.

The technical failure was contained the same evening. The human backlog was not. Crews and aircraft were in the wrong cities. It took more than two days to clear the disruption. About 2,163 flights were affected. One briefing put the passenger count near 300,000.

What NATS ruled out

Chief executive Martin Rolfe said the incident was not related to the August 2023 NATS failure, which also produced nationwide chaos, and not related to a radar problem in July 2025. He said it was not caused by “incorrect actions by either military or civil operators.” The Ministry of Defence had already denied a report that a military aircraft was to blame. The government had earlier ruled out a cyber attack.

“This was a software issue in a specific part of our flight data system, that we have traced to a small subsection of coding,” Rolfe said. “The issue has been identified and mitigation is in place while a permanent fix is safety tested and deployed.” He apologised again to passengers and to airlines.

Ryanair has called for Rolfe to resign since the 2023 failure. That demand will return. Transport Secretary Heidi Alexander called the disruption unacceptable and asked the Civil Aviation Authority to run an independent review.

Why a small defect travels so far

Squawk allocation is ordinary work. Controllers and software request codes all day. Switching between a code request and a higher-priority task is also ordinary. The defect lived in the resume path, the least glamorous part of the code. When that path failed, the national picture of who was where in the sky could not be trusted. The safe response was to stop adding traffic.

That is the design logic of a safety system. It is also why a millisecond error in one module can cancel a long weekend. Airlines then pay for hotels, rebooking and crew overtime. NATS has not published a damage figure. Carriers have spoken of millions of pounds.

The temporary mitigation is already in place. The permanent patch must pass safety testing before it is loaded onto the live system. Until then the resume path that failed on 8 September is being worked around, not rewritten in production.

The question the report leaves open

NATS says safety was not compromised. No mid-air conflict was reported. The cost sat with people on the ground and with airline schedules. The independent CAA review will decide whether a legacy defect of this kind should have been found after 2023, and whether the six-hour restriction and two-day recovery were the best that the current architecture can do.

For now the public record is short and specific. A paused squawk request, a bad resume, a corrupted output, a national hold. The coding line that did it has been named inside NATS. The travelling public only needed to know that it took a millisecond to write and more than two days to unwind.