UK air traffic system failure triggered by misidentified French Bee flightplan waypoint

Investigators probing the serious UK air traffic control system failure in August last year have detailed the flightplan waypoint confusion which triggered the incident.

Over 700,000 passengers were affected by the failure of UK air navigation service NATS’ flightplan processing system. This forced controllers to revert to manual processing, leading to more than 1,500 flight cancellations and delaying hundreds of services which did operate.

According to an independent panel’s review of the occurrence, the UK’s Swanwick area control centre had received a flightplan from French Bee flight BF371 – operating from Los Angeles to Paris Orly – at around 08:32 on 28 August.

The aircraft’s route took it through US, Canadian and North Atlantic oceanic airspace before passing over the UK and entering France.

Its flightplan had initially been forwarded to pan-European air navigation organisation Eurocontrol for processing. This involved converting the flightplan file to a standard European format, and adding supplementary waypoints, before passing it to relevant air traffic control providers including NATS.

NATS uses a subsystem called FPRSA-R for automated flightplan reception, and one of its tasks is to extract the portion of the flightplan covering UK airspace entry and exit.

The FPRSA-R primary system identified the entry point as waypoint APSOV, which lies on the boundary between Shanwick oceanic airspace and the Scottish flight information region.

But when it attempted to identify the exit waypoint, it initially considered SITET, located over the English Channel at the boundary between London flight information region and the France upper information region.

This waypoint, however, was not contained in the original flightplan and FPRSA-R dismissed it. The system searched for another candidate, selecting ETRAT which lies on the French coast just south of SITET.

ETRAT was similarly rejected because it, too, was not in the original flightplan. Both SITET and ETRAT had been added as supplementary waypoints.

The system opted for a third exit-point candidate, the Deauville navigation beacon located south of ETRAT and identified as DVL.

But this three-letter identifier was coincidentally the same as that allocated to another waypoint near Devil’s Lake regional airport in North Dakota. This identical code, DVL, had been included in the original flightplan as part of the US airspace transit from Los Angeles.

Although FPRSA-R was able to find this waypoint code in the flightplan, the fact that it actually referred to Devil’s Lake rather than Deauville led the system to conclude that the aircraft would reach its UK exit point before its UK entry point. Devil’s Lake and Deauville are some 3,600nm apart.

The system recognised that this was “not credible”, says the independent review panel in its interim findings, and it generated a critical exception error.

This caused the FPRSA-R primary system to disconnect, as designed, to prevent corrupt data being sent to air traffic controllers.

But it also prompted the back-up secondary system to take over. This secondary system encountered the same problem interpreting the flightplan, and this led to the same result – disconnection of the FPRSA-R secondary system.

Just 20s elapsed between the receipt of the flightplan and the shutdown of both FPRSA-R systems, causing all automatic processing of flightplan data to cease and forcing reversion to manual procedures.