Select Committee on Environment, Transport and Regional Affairs Third Report


The Environment, Transport and Regional Affairs has agreed to the following Report:—



1. During this Parliament, the Transport Sub-committee has conducted inquiries into National Air Traffic Services Limited (NATS) on three previous occasions.[10] In part our interest has been prompted by the Government's proposal that NATS should be subject to a public-private partnership, a measure contained in the Transport Act which recently was given Royal Assent.[11] We have also investigated the company because of continuing delays to the New En Route Centre at Swanwick, originally intended to be operational by 1996, and now scheduled for opening in January 2002,[12] because of concerns about capacity constraints and controllers' workloads at the London Area and Terminal Control Centre (LATCC), and because of other matters such as the project to build a New Scottish Centre.[13]

2. We decided to conduct this latest inquiry because of several recent developments at NATS. The most prominent was the major failure of computer systems at LATCC on 17 June 2000, which caused "substantial air traffic delays".[14] In addition, following a review of the project at the end of May 2000, it was decided that the Private Finance Initiative (PFI) contract between NATS and EDS Limited to provide software at the Oceanic Air Traffic Control Centre at Prestwick should be terminated.[15] Having begun to undertake a brief inquiry into NATS, we decided that the time was right also to examine what progress had been made at the New En Route Centre at Swanwick, and at the New Scottish Centre at Prestwick.

3. Therefore, on 27 July 2000, we invited interested parties to submit evidence to us about National Air Traffic Services, "including developments at both Swanwick and at Prestwick and the failure of systems at West Drayton".[16] We received written evidence from seven organisations: the Department of the Environment, Transport and the Regions, the Civil Aviation Authority, NATS, British Airways, the British Air Transport Association, the Guild of Air Traffic Control Officers and the Institution of Professionals, Managers and Specialists (IPMS), the union which represents air traffic controllers. We took oral evidence from the IPMS and from NATS on 8 November 2000, and visited LATCC on the following day. We also benefited from the expert assistance of Mr Laurence Price, our specialist adviser. We are most grateful to all those who assisted us in our inquiry.

Main Issues


4. Prior to their departure, aircraft are required to file a flight plan. Such plans are stored in the National Airspace System, which then produces flight progress strips, which are used by controllers to manage aircraft movements.[17] Within the National Airspace System there are two sets of software: the programmes which process information, and a database known as 'adaption', which holds information about where airports are, what strips are required at any one time in each sector, and so on.[18] Despite the fact that the database contains information which does not vary from day to day, it is updated each month to take account of changes in the air traffic control environment. A routine update on 15 June, which was intended to improve the printing of flight progress strips,[19] triggered a fault in the National Airspace System which had remained latent since 1992, and it was that which caused the System to fail on 17 June.[20]

5. Both the IPMS and NATS told us that failures of very complicated software such as that in the National Airspace System are, to some extent, inevitable.[21] Indeed, relatively minor computer failures have occurred at LATCC on five other occasions this year, causing some delays to air traffic.[22] The magnitude of the problem on 17 June was increased by the fact that the "small fault" in the System's software was first diagnosed as a hardware failure, and specifically a processor fault.[23] Thus engineers did not put in place the correct solution to the problem for some time, which was to revert to the previous version of the software, and instead replaced the System's processors.[24] Therefore, although the failure took place in the early morning, "only by the afternoon did [NATS] start to really understand that it was a software fault".[25] As the Chief Executive of NATS told us, "that was what took us so long and made it such a unique event".[26]

The impacts of computer failures

6. When the National Airspace System fails, as it did on 17 June, controllers are trained to revert to manual methods: if, for example, the Flight Data Processing System cannot generate flight progress strips automatically, they must be written out by hand. Moreover, if the National Airspace System fails to pass details of flights on to adjacent sectors, that information must be passed from one controller to another by telephone.[27] The result is "a considerable increase in workload ... Because of the rapid increase of workload [a controller] cannot continue at the same pace".[28] Steps are therefore taken to reduce the number of aircraft in the system, which, as NATS put it, "can result in significant delays".[29]

7. The delays caused by the failure on 17 June were, in NATS' view, "substantial".[30] The British Air Transport Association, which represents most British airlines, said that the failure "had a disastrous impact on UK civil aviation".[31] It told us that scheduled airlines were forced to make wholesale cancellations, charter flights became subject to lengthy delays, and airline passengers were stranded at airports, whilst NATS proved unable to provide accurate information about when the system would be back on line.[32] British Airways said that the failure was "very damaging to British Airways and its passengers".[33] In his evidence to us, the Chief Executive of NATS said that "17 June was a terrible day for us and for airlines and the customers".[34] The British Air Transport Association put the cost to its members on 17 June, and on the days that followed, at more than £8 million.[35]

8. The degree to which major computer failures like that on 17 June also jeopardise safety is a matter of some debate. The IPMS claimed that "manual methods used as a fallback during system failure are both time­consuming and increase the risk of error".[36] The union pointed out that tools in the computer system which detect potential separation loss and alert controllers that aircraft might be on conflicting courses are lost during periods of computer failure. The increased workload faced by controllers, and the loss of such safety features, the IPMS told us, "increase the likelihood, however small, that an air traffic control error may occur with possibly disastrous consequences":[37] a particularly difficult problem on 17 June, it said, was the fact that the computer no longer displayed aircraft call signs on radar screens, causing confusion, and increased workload.[38] NATS clearly disagrees with the IPMS: it told us that although delays increase during computer failures, "the safety of the system remains uncompromised".[39]

9. We sought further information about newspaper reports that computer failures had caused aircraft proximity ('airproxes') or loss of separation incidents, and that pilots had resorted to flying across England in uncontrolled airspace to avoid delays while systems were not functioning.[40] The IPMS told us that there were no airproxes or loss of separation incidents as a result of the failure on 17 June,[41] but said that "aircraft did leave controlled airspace, as they are allowed to do, and work with other operators, probably the military, to take short cuts to avoid further delays".[42] NATS told us that no airprox incidents have occurred as a result of NATS computer failures this year, but conceded that "the failure of the National Airspace System on 9 June has been cited as a contributory factor in an incident on that day involving the loss of standard separation between two aircraft in the Dover sector".[43] The company also told us that it had no data on the number of aircraft choosing to fly in uncontrolled airspace during periods of computer failure, but said that "the number could be expected to be small".[44]

10. We commend controllers and other NATS staff for their exemplary response to the computer failures this year, and especially to the major failure on 17 June. However, such computer failures are a disappointment. Although their principal effect is increased delays for airlines, it is self-evident that the resultant increased workload for controllers, coupled with a loss of safety-related computer features, undermines safety levels, even if only by a very small degree. Neither delays nor any compromise of safety as a result of computer failure are satisfactory.

Business continuity

11. Our witnesses from the airlines were particularly concerned that "NATS' procedures for business continuity are inadequate and need urgent and extensive improvement. Falling back on manual systems [in the event of a computer failure] is no longer an adequate response".[45] The British Air Transport Association estimated that reverting to manual procedures reduces capacity by between 50 and 75 per cent,[46] a view shared by the IPMS.[47] The IPMS said that NATS should review whether the National Airspace System failed too easily, and whether the functions it performs might be separated "so that, in the event of failure of one system, the effect is minimised".[48] It also suggested that autonomous flight data processing systems might be located at the New En Route Centre and at the Scottish centre at Prestwick, providing a contingency service for one another.[49] British Airways argued strongly that systems at NATS to ensure business continuity in the event of major computer failures should be introduced "as a very high priority",[50] and recommended changes including improvements to recovery procedures for both software and hardware, the introduction of back-up computer systems, better procedures within NATS in emergencies, better communication and co-ordination between NATS and others, including airlines and airports, and examining the scope of gaining extra capacity through the use of military or neighbouring air traffic control providers.[51] Similar views about business continuity were expressed by the British Air Transport Association.[52]

12. The British Air Transport Association reported that following a series of meetings with the Civil Aviation Authority and NATS, it would be working closely with NATS "on the development of appropriate business continuity plans".[53] As was rightly pointed out to us, the institution of proper plans to ensure business continuity is required of many major companies, and is of vital importance to NATS given its dependence on so many software systems, and its safety-critical role. We recommend that NATS assess with its customers, staff and others its need for business continuity plans, and report to us the steps it intends to take to improve its ability to respond to events such as major computer failures.


13. Both British Airways and the British Air Transport Association commented in their evidence on the fact that NATS is not currently required to compensate its customers when it is unable to deliver a proper service, such as during the computer failure on 17 June.[54] The Chairman of NATS confirmed that the company did not do so,[55] although he agreed that it was "most unfortunate" that the airlines should have faced financial losses on that day.[56] The British Air Transport Association told us that "this situation is both unfair to airlines and their customers and deprives NATS of the proper financial incentive to develop resilience [in its computer systems] and contingency plans".[57] Like the airlines, we can see little reason why NATS should not compensate its customers when, through its own failings, it does not deliver the service it has undertaken to provide. We recommend that NATS be required in future to provide at least partial compensation in such circumstances.


14. The existing Scottish Area Control Centre at Prestwick is responsible for air traffic in the Scottish Flight Information Region, an area which stretches from Carlisle and Newcastle northwards to the Faroe Islands, taking in Northern Ireland, and the surrounding seas.[58] Proposals to replace the current centre with a New Scottish Centre were first submitted to the Government in 1992, and approval was given in 1993. The original target date for opening the Centre was 2000.[59] In the 1993 Budget, the Government announced that the project would be financed under the Private Finance Initiative (PFI). It was intended that a private contractor would design, build and maintain the new Centre and its equipment and software systems under a 25-year contract, with NATS continuing to manage air traffic as before.[60] Progress in finding a contractor was slow. Invitations to tender were not issued until September 1995, and tenders were received from two bidders, Sky Solutions, a consortium of Bovis and Lockheed Martin, and AyrTec, a consortium of Hughes and Laing, in May 1996.[61] In March 1997 it was announced that Sky Solutions was the preferred bidder. Negotiations continued between the consortium and NATS to find a mutually acceptable contract until December 1998, when a draft PFI agreement was put forward for approval by the Government.[62]

Recent developments

15. NATS made clear from the outset that it was opposed to the proposed PFI.[63] It was concerned that "not having direct control over one of their two major en route centres could lead to problems in introducing new technology at the New Scottish Centre. NATS also had concerns about ensuring compatibility between systems at the two centres".[64] Specifically, NATS told us, "the structural rigidities of the PFI concept are perhaps well suited to the provision of fixed infrastructure but not to the development and maintenance of complex Information Technology systems that require to be changed and modified over their system life cycle".[65] There were also concerns over the PFI's cost: as we concluded in an earlier Report, "the PFI is a relatively expensive way of financing investment".[66]

16. In spite of these concerns, NATS "worked closely with departmental and Treasury officials to try to make a success of the PFI initiative".[67] However, following submission of the draft PFI agreement, it became clear that insufficient commercial risk was to be transferred from NATS to the contractor, and concerns began to emerge about the suitability of the PFI arrangements if NATS was to be subject to a public-private partnership. Consequently, in early 1999, it was announced that the PFI was to be abandoned.[68] Given the clearly expressed opposition of NATS and others to the decision to build and maintain the New Scottish Centre under a PFI contract, and the subsequent decision to abandon those arrangements, we are extremely surprised and disappointed that the Government insisted that the project should go ahead on a PFI basis.

17. The project has subsequently been proceeded with "on the basis of conventional funding".[69] It was decided, particularly in light of experience of managing the New En Route Centre project, that a competition should be held for an external project manager, and Bechtel Inc. were chosen in June 1999 to undertake such management. NATS and Bechtel have concluded that NATS should contract directly with Lockheed Martin to provide computer systems at the New Scottish Centre, and should re-tender the building contract. It has been estimated that the decision to abandon the PFI and to adopt the proposed new contractual arrangements will save up to £100 million.[70]

18. In February 2000, a new contract was signed with Lockheed Martin to provide an adaptation of the systems already being tested at the New En Route Centre for use at the New Scottish Centre.[71] At the same time a competition was launched to decide on a new design for the Centre: it was announced on 7 November 2000 that Gibb Developments had won the competition, and that construction would begin in early 2001.[72] It is now expected that the new Centre will become operational in the winter of 2007-2008.[73]

'Lock-in' to Lockheed Martin

19. Lockheed Martin has been contracted to install at the New Scottish Centre a modified version of the system it has been developing at the New En Route Centre at Swanwick. In its evidence to previous inquiries NATS has conceded that there are possible disadvantages to having a single supplier of software to both centres.[74] The Arthur D. Little Report, commissioned by the Government to address concerns expressed in our Report into Air Traffic Control published in March 1998,[75] examined the matter in detail.[76]

20. The Arthur D. Little Report identified a number of benefits to NATS of having a single software supplier, including savings on future upgrades of the system, substantial savings on maintenance and support costs, and higher confidence that the New Scottish Centre system will work, given that it will install the by then operational system from the New En Route Centre.[77] The Report also noted a number of risks, including that of 'lock-in' to a single supplier, and the "resultant escalation of costs that this could imply".[78] The strong commercial ties between NATS and Lockheed Martin will result in NATS being financially exposed to one supplier, and risks the company "becoming over dependent upon the ups and downs in their performance of a single supplier over such a long period of time".[79] The Report concluded, however, that the risks had to be seen in a wider context, and that the benefits of having a single software supplier outweighed any possible risks. Moreover, as NATS pointed out to us, the Arthur D. Little Report was published at a time when the PFI arrangement for the New Scottish Centre was still in place, and it concluded that "the potential for 'lock-in' is increased by PFI:[80] NATS told us that "the revised procurement arrangements [for the New Scottish Centre] will significantly reduce the potential for 'lock-in' to a single supplier".[81]

21. Nevertheless, Lockheed Martin will be the sole supplier of software systems at both the New En Route Centre and the New Scottish Centre. Therefore, NATS should continue to be mindful of the recommendations in the Arthur D. Little Report that NATS should ensure that "good commercial arrangements are in place to mitigate the risks associated with having a single system supplier",[82] and that it retains its technical and management competence, so that it can deal intelligently with its suppliers rather than being forced to accept whatever price is quoted for future projects. The Report concluded that NATS should regularly review "its financial exposure and business risk in order to check that it is being managed properly".[83] Although the advantages of having a single systems supplier for both the New En Route Centre and the New Scottish Centre may outweigh the risks, NATS must remain wary of the dangers posed by being so dependent on a single supplier. Therefore, we reiterate the conclusions of the Arthur D. Little Report, and recommend that NATS continue to follow good commercial practice in the management of its contracts, ensure that it retains managerial and technical competence in order to evaluate its relationship with its suppliers intelligently, and regularly review its financial exposure and business risk.

10   See Air Traffic Control, HC (1997-98) 360-I; The Future of National Air Traffic Services, HC (1998-99) 122; and The proposed Public-Private Partnership for National Air Traffic Services Limited, HC (1999-2000) 35. Back

11   As the Transport Act 2000 on Thursday 30 November 2000. Back

12   See HC (1997-98) 360-I, para.7; see also NATS02, para.2.2. Back

13   See HC (1997-98) 360-I, paras.51ff. Back

14   NATS02, para.5.1; see also media coverage, such as Jet data glitch halts airports, Guardian Unlimited, 18 June 2000, and Summer of air traffic chaos looms, Guardian Unlimited, 19 June 2000 (at Back

15   See NATS03, p.3; see also Plea to save Prestwick air traffic plans, The Herald, 17 July 2000. Back

16   See Environment, Transport and Regional Affairs Committee Press Notice No.51 of Session 1999-2000, which can be viewed at Back

17   See NATS02, para.5.2. Back

18   See Q.102. Back

19   See NATS02, para.5.4. Back

20   See Q.102. Back

21   See QQ.7 and 103. Back

22   In addition to the major failure on 17 June, there were two other failures in June (see NATS02, para.5.1) - one on 9 June, which resulted from the input of a particularly complicated flight plan (see HC Deb, 22 June 2000, col.246w), and one on 26 June relating to a failure to print flight progress trips correctly, which put the system out of action for only three minutes (see HC Deb, 3 July 2000, col.91w); another failure occurred on 12 August, caused by the rejection of an incorrect flight plan, resulted in the holding of some flights at London airports, and was recovered within an hour and thirteen minutes (see NATS02, para.5.5, and HC Deb, 9 November 2000, col.347w); on 3 November a failure was caused by the rejection of a flight plan, but was recovered in seventeen minutes, resulting in six aircraft being delayed by thirty minutes (see HC Deb, 9 November 2000, col.347w); and on 4 November, again as a result of a failure to print accurate flight progress strips, a fault occurred which was not recovered for two hours and ten minutes, causing delays of up to an hour (see HC Deb, 9 November 2000, col.347w). Back

23   See QQ.106 and 111. Back

24   See Q.112. Back

25   Q.112. Back

26   Q.106. Back

27   See NATS02, para.5.2; see also Q.15. Back

28   Q.15. Back

29   NATS02, para.5.2; see also HC Deb, 19 June 2000, col.21. Back

30   NATS02, para.5.1. Back

31   NATS06, para.5.1. Back

32   See NATS06, para.5.2. Back

33   NATS05, para.11. Back

34   Q.105. Back

35   See NATS06, para.5.3. Back

36   Q.2. Back

37   Q.2. Back

38   See QQ.2 and 14. Back

39   NATS02, para.5.2. Back

40   See The Observer, 29 October 2000. Back

41   See Q.69. Back

42   Q.72. Back

43   NATS02A, p.2. Back

44   NATS02A, p.2. Back

45   NATS05, para.14. Back

46   See NATS06, para.5.3. Back

47   See NATS07A, p.1. Back

48   NATS07A, p.1. Back

49   See NATS07A, p.1. Back

50   NATS05, para.19. Back

51   See NATS05, para.18. Back

52   See NATS06, paras.5.2 to 5.5, and paras.8.1 to 8.5. Back

53   NATS06, para.8.4. Back

54   See NATS06, para.8.3, and NATS05, para.19. Back

55   See Q.194. Back

56   Q.193. Back

57   NATS06, para.8.3. Back

58   See NATS: Scottish and Oceanic Air Traffic Control Centres, NATS Doc. No.26 (1999) p.8. Back

59   See NATS03, p.2. Back

60   See NATS03, p.2; see also NATS02, para.3.1. Back

61   Information given in Air Traffic Control, HC (1997-98) 360-I Back

62   See NATS03, p.2. Back

63   See NATS02, para.3.1; see also NATS03, p.2. Back

64   NATS03, p.2. Back

65   NATS02A, p.4. Back

66   Air Traffic Control, HC (1997-98) 360-I, para.77. Back

67   NATS02, para.3.1. Back

68   See NATS03, p.2. Back

69   NATS02, para.3.2. Back

70   See NATS03, p.2, and NATS02A, p.5. Back

71   See Go-ahead for New Scottish Centre, NATS Press Notice, 14 February 2000. Back

72   See Winning design unveiled for New Scottish ATC centre, NATS Press Notice, 7 November 2000. Back

73   See NATS02, para.3.2. Back

74   See Air Traffic Control, HC (1997-98) 360-I, paras.53 ff. Back

75   Fourth Report from the Environment, Transport and Regional Affairs Committee, HC (1997-98) 360-I. Back

76   Although the Arthur D. Little Report was commissioned by the Government, it was eventually published by the Committee as a Memorandum, HC (1998-99) 586, which can be viewed on the internet, via the Committee's website, at Back

77   See the Arthur D. Little Report, para.6.2.2. Back

78   Arthur D. Little Report, para.6.3.2. Back

79   Arthur D. Little Report, para.6.3.2. Back

80   Arthur D. Little Report, para.6.3.4. Back

81   NATS02A, p.6. Back

82   Arthur D. Little Report, para.6.3.5. Back

83   Arthur D. Little Report, section 6.3, R35. Back

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2001
Prepared 17 January 2001