4 comments

  • lukaslueg1 minute ago
    Would be interesting if the report actually got into the details. The curiously specific "approx. 1ms window" sounds like an off-the-shelf memory race condition in combination with a preempting thread, for which 1ms is an absolute eternity and Guaranteed To Happen By Tuesday This Week™. But the "database corruption" sounds like database IDs being generated from timestamps with 1ms granularity.
  • zrail44 minutes ago
    Note: NATS the UK airspace manager, not NATS the pubsub system.
    • verst0 minutes ago
      And here I was surprised they would use NATS in their implementation to assign squawk codes.
  • macguillicuddy24 minutes ago
    Interesting! Looks like a race condition (with a 1ms window) during squawk allocation (the process that gives each aircraft a 4 digit identifier for ATC purposes) caused data corruption. They present that window as being small but 1ms is a decent chunk of time in our work lol
  • fotta37 minutes ago
    link to the report (pdf): <a href="https:&#x2F;&#x2F;www.nats.aero&#x2F;wp-content&#x2F;uploads&#x2F;2026&#x2F;09&#x2F;NATS-Preliminary-Investigation-Report-into-NAS-Incident-on-08-Sept-2026-Issued-16-Sept-2026.pdf" rel="nofollow">https:&#x2F;&#x2F;www.nats.aero&#x2F;wp-content&#x2F;uploads&#x2F;2026&#x2F;09&#x2F;NATS-Prelim...</a>
    • fotta23 minutes ago
      &gt; The incident was triggered by a valid manual request for a squawk code. This manual request was made correctly and there was nothing abnormal or invalid about the associated flight plan.<p>&gt; While this request was being processed, the NAS received a message for a higher priority activity to be undertaken which resulted in the squawk code allocation being paused while the system processed the higher priority message. Switching between different activities in response to prioritised requests is a normal function of the system; however, when the processing of the squawk allocation request resumed, the software defect meant it did not resume correctly and the resulting output was corrupted.<p>&gt; The reason this scenario has not occurred before is because:<p>&gt; 1. The defect existed in a specific subsection of code within a software module, with an exposure window estimated as approximately one millisecond.<p>&gt; 2. For the fault to occur, a higher-priority request had to arrive during that exact millisecond while the original request was part-way through updating a value.<p>&gt; 3. Had the higher-priority request arrived even one millisecond earlier or later, the update would have completed normally.<p>&gt; Post-incident investigation has identified that when processing of the squawk allocation request resumed, the data associated with it had been corrupted and affected some subsequent flight data updates.