A never-before-occurred error, in this case the scheduled shutdown of automatic systems and problems with error diagnosis, caused major disturbances in British airspace on August 28. An interim report from the National Air Traffic Service (NATS), responsible for airspace surveillance, explains how the problem could have arisen and how something like this should be avoided in the future. At the same time it becomes clear The report with the rumor that a cyberattack may have played a role. Around 1,500 flights had to be canceled in British airspace on Monday. The effects on air travelers were still being felt the next day.

Advertisement

The cause of the outage was a flight plan submitted by an airline that contained a constellation of waypoints that caused a security shutdown in the NATS processing systems. This flight plan contained two waypoints with identical names, but geographically distant from each other. The British FPRSA-R system obtains the relevant flight plans for Great Britain from the European air surveillance organization Eurocontrol and makes them available to air traffic controllers. During post-processing, the flight route with the entry point and, if applicable, exit point to British airspace is extracted. However, in this particular case, the system found no points that are in British airspace, so it selects the points closest to the front and rear and finally landed on the waypoints with the same name that are outside Great Britain.

It is not an error

For security reasons, the system will enter safe mode in case of inconsistency. The British aviation regulator stresses that, in the interests of safety, this is not a mistake, but that’s the way it is.
Only manual intervention triggers automatic processing again. Since an identical backup system could not safely process the flight plan either, both the primary and secondary systems went out of service within a few seconds. A four-hour window in automatic processing is intended to ensure that an error of this type does not have a direct impact on the airspace, but that technicians have sufficient opportunity to get systems back up and running.

In this case, four hours were not enough, as the interim report shows. Instead, technicians from the Swanwick Air Traffic Control Centre, who were always on site, were initially unable to explain the fault and called another team via a remote connection. Finally, the manufacturer was also called until the crucial clue about the triggering flight plan was found in a software log file. Following security protocols, it took some time before the automatic processing of flight plans could be restarted.

How should something like this be avoided in the future?

In the event of systems failure, instrument flight plans can still be entered manually. However, for safety reasons, this is only possible to a lesser extent than with automatic systems. This phase, which lasted several hours, allowed British airspace to remain open, but there were numerous delays and cancellations.

According to NATS, this was the first time such an issue had occurred since FPRSA-R went live in October 2018. Meanwhile, around 15 million flight plans have been processed without this error. To rule out a recurrence, a manufacturer software update was installed in early September that prevents the system from crashing completely. It should also be easier to discover the cause of a processing stop. A more detailed study will also shed light on whether the four-hour time frame will continue to be sufficient in the future.

(mki)