Transport Committee
Oral evidence: NATS: failure in air traffic management systems, HC 897
Wednesday 17 December 2014
Ordered by the House of Commons to be published on Wednesday 17 December 2014.
Members present: Mrs Louise Ellman (Chair); Mr Tom Harris; Karen Lumley; Jason McCartney; Chloe Smith; Graham Stringer; Martin Vickers
Questions 58-167
Witnesses: Richard Deakin, Chief Executive, Martin Rolfe, Managing Director Operations, National Air Traffic Services, and Andrew Haines, Chief Executive, Civil Aviation Authority, gave evidence.
Q58 Chair: Good afternoon and welcome to the Transport Select Committee. Would you give your names and organisations, please?
Martin Rolfe: I am Martin Rolfe, Managing Director of Operations for NATS.
Richard Deakin: I am Richard Deakin, Chief Executive Officer of NATS.
Andrew Haines: I am Andrew Haines, the Chief Executive of the Civil Aviation Authority.
Q59 Chair: Mr Deakin, I understand that you want to make an opening statement. Would you like to do that?
Richard Deakin: Thank you very much, Chair. First of all, thank you for giving us the opportunity to come and talk to you about the 45 minutes of interruption in our systems that we experienced on Friday. I would like to start by reiterating our apology to all of our customers, to the airports and indeed the travelling public for the unfortunate disruption that was caused on Friday evening.
It is worth mentioning that at no time last Friday was airspace closed. We reduced flow to ensure that everyone was kept safe. At no time during the incident was safety compromised. I am pleased to report that the contingency and back-up plans worked as they should do. Out of 6,000 flights that travelled through UK airspace on the day, unfortunately around 120 were cancelled and around 500 flights were delayed an average of 45 minutes.
It is worth remembering that our service is amongst the best of any air navigation service provider in the world. Typically, and using last year’s figures, 99.7% of aircraft flying through UK airspace have no air traffic control delays. Typically, our delays have improved since privatisation from around 120 seconds per flight to 2.5 seconds per flight this year, including the delay on Friday. A lot of that has come about from the significant amount of investment that has been put into the company. That is around £1.3 billion since privatisation and we are looking to spend another £575 million over the next five years. I am very happy to explore those points in more detail.
Q60 Chair: Thank you. How many passengers were affected?
Richard Deakin: We believe it was around 10,000 passengers. Without wanting to minimise the impact on that 10,000, typically on Friday we would have had around a million passengers travelling through UK airspace.
Q61 Chair: Which airports were affected?
Richard Deakin: Mainly Heathrow, Luton and Gatwick, but there were other more limited effects on other airports in the south.
Q62 Chair: Which were the other airports?
Martin Rolfe: There were some very small impacts to City and I believe there was a couple of minutes’ impact to Manchester as well.
Q63 Chair: How did what happened last week compare with the incident in December 2013, in terms of the number of passengers and flights affected?
Richard Deakin: In terms of the delay performance, which is obviously what we measure in terms of the impact on the aircraft, the incident last December caused around 130,000 minutes of delay. The incident on Friday was less than 15,000 minutes of delay. We are currently still looking at the delay figures in some detail because Friday was a difficult day in terms of weather. Of course, the Italian air traffic controllers were on strike as well so there were quite a few factors that came into play in terms of the delays that we experienced in the UK.
Q64 Chair: How significant was it that there is so little spare capacity at Heathrow in relation to resuming flights after the delay?
Richard Deakin: The UK network is fairly capacity constrained in terms of the airports typically. We are very familiar with the figures at Heathrow in terms of how busy it is. It is worth mentioning that the airspace is also very constrained. We are just in the process of redesigning the airspace, in particular over London, with a project called the London airspace management plan, which will free up a fair amount of capacity as well and make the flights into the London area airports smoother. It is worth pointing out that, if there was more capacity on the ground, then, naturally, we would have been able to get aircraft on the ground more quickly and, indeed, depart them more quickly as well. Airport capacity does have a big bearing on the resilience of the network and our ability to be able to recover when we have disruption such as we saw on Friday.
Q65 Chair: On Monday, both NATS and the CAA issued a joint press release announcing what is called an independent inquiry. This is a very curious term. First, it was a joint press release with the regulator and the regulated together issuing a release. That suggests that maybe there is not the separation between the two that there ought to be. It is a so-called independent inquiry. In what sense is it independent when both of you are announcing this and both of you are appointing the people to this inquiry? Where is the independent bit of the inquiry?
Andrew Haines: First of all, I am not aware of any joint press release. It was a CAA press release. We took the decision to do this actively jointly with NATS because there are limited powers in our regulation. Moreover, it is worth stating first of all that the CAA itself is independent both of NATS and of the Government. We then chose to identify an independent person of high reputation, so the current President of the Royal Academy of Engineering, Professor Dame Ann Dowling, to then nominate the Chair. I think that is an exceptional level of independence. We have identified that there will be a majority of independent people on the panel. It is probably almost without precedent in regulatory constructs for that level of independence, so I think it is highly independent. It is certainly much more independent, for example, than the Begg report into Heathrow after the 2010 snow issues there. That was a very comprehensive report, which has resulted in significant benefits to consumers, but which was chaired by a non-executive director of Heathrow itself. It did not stop him from doing a root and branch review of the causes and making far-reaching recommendations which have been implemented. So I think it is a very independent approach.
Q66 Chair: When you use the word “we”, Mr Haines, is that the CAA or the CAA plus NATS?
Andrew Haines: It is we, the CAA, but we took a conscious decision to do this in agreement and in consultation with NATS. That was for a couple of reasons. First, as I have said, our powers to require NATS to do certain things are very limited because of the restrictions on our licence in the statutory framework. Moreover, our experience of the McMillan report last year with Gatwick Airport and previously with the Begg report is that there is limited technical competence outside of the entity. It is important that they are fully involved in, and engaged with, an inquiry. I do not see any conflict in that reaching independent conclusions, particularly if entirely separately we ask someone else to nominate an independent chair and that the majority of panel members are independent.
Q67 Chair: How is the Secretary of State going to be involved? When we spoke to him earlier this week he seemed unclear about what his role might be in any of this. Can you help us?
Andrew Haines: He does not have a formal role but we are naturally consulting with stakeholders and we will almost certainly consult with him when we have a recommended chair. We spoke yesterday to Professor Dame Ann Dowling. She has given us a shortlist of names and we are contacting those people over the next few days.
Q68 Chair: Who will be making that appointment?
Andrew Haines: It will be an appointment of the CAA in consultation with NATS. It is quite likely that we will discuss that with the Secretary of State as well.
Q69 Chair: It sounds a little odd. Something has gone wrong and you are appointing a chair to look into what happened, but you are going to have agreement of the people who have created the problem on who that chair is. Doesn’t that sound a little odd?
Andrew Haines: I think I have just demonstrated that it is considerably more independent than two far-reaching and effective reports that have been done, this time last year and in the previous year.
Q70 Chair: That is another question. We are interested in what is happening in this report.
Andrew Haines: This is a much stronger level of independence than those two cases, so I do not think there is a conflict at all.
Q71 Chair: We are looking at what you are doing here now. Who is setting the terms of reference?
Andrew Haines: We have drafted the terms of reference as the CAA. We are consulting NATS on them and we have agreed to publish them. They will be published on our website later this afternoon. We are actively seeking feedback from airports and airlines as the principal customers of NATS. We are consulting the CAA’s consumer panel as well as a proxy for consumer interest to make sure that those terms of reference are acceptable. They will be on our website so they will be available for people, including members of the Committee, to comment on. We are doing that relatively quickly because we want to crack on, but there will be complete transparency over the terms of reference.
Q72 Chair: Mr Haines, you referred to the CAA’s limited powers. You identified this earlier this year, following the problems that occurred a year ago. You said then that there was going to be a review of the licence powers and your enforcement powers. Has anything happened since then?
Andrew Haines: We have been undertaking that review in the second half of 2013. We plan to make recommendations to the Department for Transport early in the new year. It will require primary legislation because the Transport Act 2000 is itself very restrictive. For example, it does not allow us to fine NATS. It does not allow us to take any enforcement action for a breach that is ongoing. The thresholds before we can take enforcement action are very high hurdles. It gives NATS immunity for economic loss to other parties. These are not tools that we would expect to use on a daily basis, but they are core tools of most regulatory regimes, which are not part of our current capability. That is one of the reasons why we think it is better to work collaboratively to get to the root cause of this unfortunate incident.
Q73 Chair: So you are working with NATS because you are not clear of any powers over them.
Andrew Haines: I gave two reasons. One is because we would not have the powers to compel NATS to do it separately but, moreover, they have a great deal of the expertise. It is absolutely right that they are involved in presenting that expertise and ensuring that the chair of any inquiry gets to the bottom of it. I think any inquiry would be severely hampered if they did not have full access and co-operation from NATS. This is one way to absolutely ensure that.
Q74 Chair: Do you think that NATS did in fact breach any terms of its licence or performance standards that were required?
Andrew Haines: I think we ought to wait until the inquiry has concluded to establish that, otherwise there would be little merit in the inquiry. Again, the thresholds in the Act are so tight that it is unlikely that they will have breached, or, even if they did, there is no possibility of us taking any enforcement action because it is a past breach and the law prohibits any action against them.
Q75 Chair: The incident last year appears to have affected more people and flights than this one. Yet at that time you conducted your inquiry and you did not want an independent inquiry. Is there a reason for the change now?
Andrew Haines: We recognise that with two incidents in a year there was an onus to make sure we went beyond what happened last year, not least to establish that all parties had fully taken on board the lessons from the 2013 incident. A natural ratcheting of the level of inquiry seemed appropriate in the circumstance.
Q76 Chair: How old was the system that failed this time?
Martin Rolfe: It is quite a complicated failure scenario, as indeed all of these are when they get to this stage. It is very rare for us to have a failure that affects the public. The system itself has its roots in round about the mid-1990s for this particular piece of the system, so it has worked exceptionally well. It has handled something in the region of 20 million flight plans over that period without failing and has been upgraded significantly over its lifetime. It is worth just elaborating on the fact that a combination of old systems and new systems, as we have, does not necessarily make them ineffective. In fact, a lot of them are extremely reliable. We are on an upgrade programme and we choose how to upgrade our systems based on their resilience, new functions that are required and capacity, and the airspace that is required. All of those go into deciding how and when we upgrade any system.
Q77 Chloe Smith: I have three questions. The first is about your confidence in the system’s ability to deal with the seasonal spike. We are hearing, in simple news, that according to new data passenger numbers will start to swell on Thursday, and the next day, Friday, 400,000 people will fly out of Britain for a holiday abroad. I am quoting from The Telegraph there. Are you prepared to deal with those?
Martin Rolfe: Absolutely, yes. We deal with spikes throughout the year. The Christmas spike is always one that we anticipate and prepare for.
Q78 Chloe Smith: My second question is going back to the system. Thank you very much for just explaining its age and the importance of that. Mr Deakin, on 13 December you said, “All our systems have contingency built in so if a problem occurs it can be identified quickly and resolved.” In a technical sense, that kind of contingency does not sound to me to be the same as resilience.
Richard Deakin: There are a number of points to comment on there. The key one is around safety. All the systems are designed, if they do fail, to fail in a safe mode. The priority for the company is obviously to keep all the traffic and the passengers safe, which we did without any incidents. That is the first thing to say.
In terms of the back-up systems and the resilience, back-up systems are not necessarily designed to switch over seamlessly and provide the 100% service that we had before. Effectively, the system failed in a degraded mode where the controllers did not have all of the tools available to them that they would normally have, which meant that we had to limit the flow through the airspace. That is why we slowed things down. We did not actually close the airspace; we just reduced the flow and the capacity. Resilience is an interesting question and it leads on perhaps to a bigger debate around whether such complex systems as this, operating 24/7, 365, and in very complex capacity-constrained airspace, should never be allowed to fail or have reduced capacity.
Q79 Chloe Smith: What is your view on that very important question?
Richard Deakin: My view is that any complex system will have failures in it. I think it is unrealistic to expect that any system such as NATS never has any reduction in capacity due to those technical failures. They are rare, as my colleague was saying, but, in terms of expectation, we should take into account that occasionally these things do fail, which is why, after all, we have back-up systems in the first place.
Q80 Chloe Smith: If you expect systems failure why do you not, by what I can see from your website, have technology explicitly represented either on your board or your executive?
Richard Deakin: We do have technology very much expressly represented. Martin and myself are both chartered engineers. We have a long background in the engineering industry. On the board we have, for example, the technical review committee which reviews in great detail the investment decisions and the technology in which we are investing. The technology angle is very well represented on the board.
Q81 Chloe Smith: Would you describe any of those roles as a CIO, for example, or the equivalent functions of?
Richard Deakin: Within Martin’s organisation, we do have very significant in-depth engineering capability. I do not know whether Martin would like to comment on the engineering organisation.
Martin Rolfe: Within the En Route operation, we have around 800 engineers. They are all exceptionally well trained. They all have special licences to enable them to work on safety critical systems. That takes care of the system 24/7 and 365 days of the year. In terms of architecture, we have system architects. Those are very specific technical skills that you will find in any company. We also have a chief information officer. The role of the chief information officer in NATS is slightly different from what you might find in a traditional IT company because we obviously have business IT and operational IT. We surround our operational IT with a huge amount of rigour, a huge amount of experience and a huge amount of safety planning and architecture.
Q82 Chloe Smith: Mr Deakin, who did you haul into your office first on the afternoon? Was it yourself or Mr Rolfe or another person?
Richard Deakin: With respect, it was not a matter for hauling people into my office. We have a very well rehearsed crisis management plan which involves a number of steps and which swung into action on Friday when the incident occurred. First of all, we set up the incident centre, which we have down in Swanwick to co-ordinate all the communications in particular. Then we had a bronze, silver and gold structure that was set up. Martin and myself sit on the gold team, which was held at our corporate and technical centre, just a few miles away from Swanwick. At Swanwick, we had the silver and bronze teams dealing with the incident. We deliberately have the gold team in a different location just so that the operations team can get on and deal with the technical issues. The gold team can manage a lot of the communications with customers and the media, as you might imagine.
Q83 Chloe Smith: It is commonplace in large businesses and in industry in general that cyber ought to be discussed at board level nowadays. Is it in yours?
Richard Deakin: Yes, it is. We have a cyber committee that I personally chair. In fact, we had our last meeting this week. It is very much at the top of our agenda in terms of making sure that the systems are protected from those many cyber threats that are increasingly out there.
Q84 Mr Harris: After last Friday’s incident, the Secretary of State referred to it as “unacceptable”. Would you agree with that choice of word?
Richard Deakin: It is extremely unfortunate that we had that level of disruption. The key thing to look at is around how we recovered from it. I have commented on that. The systems were back up and running 45 minutes after they went down. I do come back to the comment that I made around the level of expectation that there should never be any disruption to the systems ever. I guess it depends on where you are coming from. If you think that we should have 100% capacity 100% of the time, then you could be of that view. As I say, these systems do fail occasionally and as a result, occasionally, we do have restrictions on capacity.
Q85 Mr Harris: So do you agree with the Secretary of State who described it as “unacceptable”?
Richard Deakin: For those passengers who got caught up in the events on Friday night, yes, it was unacceptable.
Q86 Mr Harris: Only for those passengers though, and not for you?
Richard Deakin: By implication for us as well, yes.
Q87 Mr Harris: It is a simple question. Was the Secretary of State correct in describing what happened on Friday as “unacceptable”?
Richard Deakin: For the passengers, it was unacceptable. From our point of view, yes, we are not proud of what happened on Friday night. We are proud at how we responded to it.
Q88 Mr Harris: Your evidence so far has given the impression that everything is fine and that you have a great record of 2.5 seconds’ delay per aircraft. I believe at the start you quoted the figure that of 10 million passengers only 15,000 of them were inconvenienced. So everything is fine; what are you doing here?
Richard Deakin: Clearly, everything on Friday was not fine. We need to keep that in perspective, though, against the normal level of service.
Q89 Mr Harris: You sound very complacent.
Richard Deakin: I wouldn’t say that.
Q90 Mr Harris: This Committee, and certainly the travelling public, would probably agree with the Secretary of State that what happened on Friday was “unacceptable”, but you have come across as incredibly complacent. You seem to be suggesting that in fact what happened on Friday was a bit of a nuisance but you are ticking the box; you are taking a couple of hours out of your day to appear in front of us; and after that it is fine.
Richard Deakin: No, not at all. We spend a huge amount of time making sure that the systems are performing to their maximum ability. We spend a huge amount of time looking at the resilience and testing how the systems fail. As I say, we are absolutely not proud of the performance on Friday night at all. It did cause a lot of disruption.
Q91 Mr Harris: The Secretary of State was asked about remuneration of you and your colleagues. I am sure you have seen The Telegraph report a couple of days ago. If the figures here are incorrect, then now is your chance to put them right. Mr Deakin, your remuneration jumped by 46% last year to £1.05 million in the year to March 2014. Is that accurate?
Richard Deakin: Yes.
Q92 Mr Harris: The Secretary of State told us that you would take a 12% cut in your bonus because of what happened last December. Is that right?
Richard Deakin: That is correct.
Q93 Mr Harris: So the performance-related bonus of £272,000 would have been slightly more than that if it weren’t for last December. Is that right?
Richard Deakin: Yes. The bonus was cut as a result of events last December.
Q94 Mr Harris: Do you expect your bonus to be cut this year because of what happened last week?
Richard Deakin: That is down to the remuneration committee. Certainly the bonuses that we have are very much linked to performance. The incident on Friday will effectively flow through into those calculations, yes.
Q95 Mr Harris: But overall your remuneration went up by 46%, even taking into account what happened last year.
Richard Deakin: The remuneration went up because of a long-term incentive plan maturing. My pay itself went up exactly in line with everyone else’s pay. It was the long-term incentive plan that caused that increase to which you refer.
Q96 Mr Harris: Just one last thing. It happened last year and it happened this year. Can you guarantee that it won’t happen next year? If it does happen again at some point, whether it is a year from now or six months, what happens then? If it happens a third time, obviously there is something fundamentally wrong; isn’t that right? Would heads have to roll or would you just come back and tick the box here again?
Richard Deakin: Four and a half thousand people in NATS wake up every morning determined to do a really good job for all the customers out there. People work very hard to deliver the high level of service that I referred to earlier. In terms of that specific system and the problem that we had, yes, I can guarantee that that will not happen again. We have identified that problem and resolved that. As I say, this is a very complex system. We are looking to upgrade it over the next five years. There are some quite significant changes planned during that time to improve the resilience, but I can’t honestly sit here and say that we will never have a computer glitch again within the complex system that we operate within NATS.
Q97 Jason McCartney: Mr Deakin, what time did you get home from work on Friday?
Richard Deakin: Very late.
Q98 Jason McCartney: What time did you get home from work on Friday?
Richard Deakin: I think it was 11 o’clock or something like that.
Q99 Jason McCartney: What role did you have in sorting all of this out on Saturday? Just talk me through what you were doing on Saturday, please, to sort this out.
Richard Deakin: Yes. I had a busy day on Friday and Saturday. If you want to go into the details about it, obviously, Saturday was a very busy day from a media point of view. I was trying to juggle all the media interviews with my daughter being in hospital over the weekend. I did a lot of press media interviews up in Millbank. I was talking to the team. I had an average of 250 e-mails every day, Saturday and Sunday, not to mention texts and phone calls on top of that, and reports back to the board. It was a pretty busy day.
Q100 Jason McCartney: We have heard a lot about these lines of code in among a few million in this bit of kit dating back to the 1990s. Prior to last Friday, when have you or Mr Rolfe publicly spoken about this old bit of kit? When has this been discussed or been open knowledge that you have had this bit of old kit that could have had this problem?
Martin Rolfe: I am going to try and answer your question correctly here, if I understand it. We have never made any secret about the fact that any large enterprise that does the job that NATS does will have pieces of equipment, code, hardware, software or whatever that spans decades. That is true in any large industry.
Q101 Jason McCartney: Sure, but the question I asked was when you last spoke about this—maybe when you have been talking about investment in technology.
Martin Rolfe: Absolutely. We have a sustainment board. The sustainment board looks at every single piece of kit in the system. It reviews every hardware and software failure. We look at those reports and at trends, and we analyse those. We make investment decisions based on those. We change them based on those. We upgrade them based on those. The whole thing is a balance of risk that we exercise. We report all of that to our technical review committee, which is a sub-committee of the board, and we investigate absolutely any and every incident of any failure across the entire estate.
Q102 Jason McCartney: You made £190 million profit last year. How much did you invest in your technology last year, Mr Deakin?
Richard Deakin: Last year, we invested around £130 million. Typically, it is around £130 million or £140 million a year. Over the next five years, we are investing £575 million. Since privatisation in 2001, we have invested about £1.3 billion.
Q103 Jason McCartney: What changes are you now making to your investment programme to take into account this old bit of kit and this bit of code that went wrong?
Martin Rolfe: We have an ongoing programme of work, which has been consulted on with our customers, with the CAA and the Commission. We are targeted towards something called European Single Sky, which is all about upgrading the air traffic network across Europe. In relation to some of the specific changes we are making, just last week, we upgraded the system that controls the entire 2 million square miles of the North Atlantic. That was one upgrade that we made.
Q104 Jason McCartney: What about this particular bit of kit, though, that let you down on Friday?
Martin Rolfe: This particular piece of kit, which is in operation at Swanwick, is part of a programme which will see the controller work stations and the flight data system upgraded in the next three years.
Q105 Jason McCartney: So it was already part of a programme to update it.
Martin Rolfe: I think it is probably fair to say—
Q106 Jason McCartney: Are you going to bring it forward?
Martin Rolfe: We will obviously wait and see what the report turns out in terms of whether there are any specific recommendations in terms of timing.
Q107 Jason McCartney: Do you need to wait? Do you personally think you need to wait or could you crack on with the—
Martin Rolfe: The one thing I will say is that in a safety critical industry the very worst thing you can do is rush into an upgrade without having thought it through. What we have done is fixed the problem. We know exactly what the problem is. We have fixed that to ensure that will not happen again.
Q108 Jason McCartney: So that particular code problem definitely won’t happen again.
Martin Rolfe: Absolutely.
Q109 Jason McCartney: Absolutely?
Martin Rolfe: Absolutely.
Q110 Jason McCartney: Good. In terms of compensation, have you been able to calculate in the past week how much this has cost the airlines involved in terms of compensation for the delays for their passengers?
Richard Deakin: From our point of view, our interface is obviously into the airlines. Effectively, our compensation is to them through the incentive regime that is imposed on us by the Civil Aviation Authority.
Q111 Jason McCartney: How much have you calculated that as?
Richard Deakin: We have not done those calculations yet because we are looking at the causes of the disruption. As I say, it was a complex picture on Friday with weather delays, delays due to industrial action in Europe and then of course the incident that we had on Friday.
Q112 Jason McCartney: How long does that usually take? Last year, I think the compensation came to £0.97 million. How were those figures calculated and how long did it take you to get to that amount and to be able to work out how much off your bottom line that would cost you?
Richard Deakin: That is down to the regulatory formula that we have.
Andrew Haines: Last year, NATS were in line for about a £6 million bonus, so the net effect—
Q113 Jason McCartney: There are lots of people getting bonuses here.
Andrew Haines: It is a part of the regime which is supported by the airlines to incentivise good performance. They were in line for £6 million. December is obviously close to the end of the year. That turned into a fraction under £1 million. So there was a £7 million hit last year. My expectation is that there will be no financial penalty for last Friday because of the nature of the regime. It is unlikely to breach a threshold.
Q114 Jason McCartney: So where does the money come from then to compensate the passengers that were delayed? I heard some of the interviews on the radio. Some of them missed family appointments in Europe, holidays and honeymoons. Where does that money come from?
Andrew Haines: That comes from the airlines. As I said, in the Transport Act that set up NATS, they are given immunity from any economic claims for cost recovery from other parties.
Q115 Chair: This is something set out in the Transport Act; it is not in your power to do it as a regulator.
Andrew Haines: Yes.
Q116 Chair: You don’t have powers on that.
Andrew Haines: That is right. There is this express provision in the Transport Act that gives NATS immunity. The En Route part, which is the bit we regulate, has immunity from claims.
Q117 Chair: After the incidents last year, some compensation was paid out and NATS had to forgo over £7 million in revenue and £0.97 million was paid in compensation by airlines. Under what authority was that done?
Andrew Haines: There is a performance regime that Mr Deakin alluded to. It has various different measures. It has a pot of money for the average delay. It has a pot of money weighted for very busy times of day and length of delay. Then there is a pot of money as well for very bad days. Last year, because of the extent of the disruption, it triggered that element of the regime and that is why what would have been a bonus payment through the NATS licence of about £6 million ended up being a penalty of just under £1 million, so a £7 million hit. None of that was going to passengers. It was effectively money that would have had to have been paid out by airlines through the NATS licence that they no longer had to pay.
Q118 Chair: Clarify for us under what authority that was done.
Andrew Haines: That was done under the European performance regime, where we are required to set an incentive regime. That is a regime that is set in consultation with the airlines about how they want to incentivise NATS. That is different from passenger compensation and any claim for money flowing through to passengers.
Q119 Jason McCartney: We have heard about compensation. Mr Deakin, you answered my colleague Tom Harris about your personal bonus. I heard you on Radio 5 Live talking about the fact that there was a remuneration committee. Sometimes, people like yourself, and people like me, as a Member of Parliament, also need to set our own standards in life. How comfortable would you feel, having been involved in the organisation and leading the organisation that caused all this disruption and upset so many people’s travel plans—and you only need to hear the vox pops on the radio to hear the distress it caused people—taking a performance-related bonus when this has happened? How happy would you personally feel about that?
Richard Deakin: If you are asking whether I am taking personal responsibility for the incident on Friday, absolutely I am. That is why I am here today in front of the Committee. In terms of the bonus element, I think we should be waiting until the report to have a look at the causes and I will then consider the position at that point.
Q120 Karen Lumley: Recently, you have lost two contracts—Birmingham and Gatwick.
Richard Deakin: Correct.
Q121 Karen Lumley: Have the competitors that have come in to take those contracts ever experienced any of these glitches themselves?
Richard Deakin: Yes, they have. The performance that we have in the UK is pretty good. If I take the case of Gatwick, which was an overseas competitor DFS—I do not know whether you have the figures to hand, Martin, about DFS delays?
Martin Rolfe: I do not have them to hand. I know that when they introduced one of their recent systems around 1 million minutes of delay were incurred by the airlines. I believe that was last year or the year before.
Q122 Karen Lumley: Are you confident that you will retain the rest of your contracts? Obviously, this level of investment that you are telling us you are going to be putting in will be dependent on keeping and maybe gaining contracts.
Richard Deakin: It is a very interesting question. The airport side of things is quite different from the En Route part of the company. Of course, all of the airports are privatised and the services that are let at the airports are let through any normal commercial means. It is a challenging environment in the UK because, of course, unlike pretty much every other country in Europe, the market in the UK is totally liberalised. Anyone who fancies a go at providing air traffic services can come in and have a go at that.
I have no problem with competition at any of those airports that you have mentioned. My real frustration is that I can’t then go in—for example in the case of DFS—and bid for services at Frankfurt, Munich and Stuttgart. The Germans have just put their prices up by nearly 20% and told their customers to suck it up. From our point of view, I would love to get in there and be able to compete against them, but I cannot, though they can come and compete in the UK to their heart’s content.
Q123 Karen Lumley: Mr Haines, how long do you think this inquiry is going to take?
Andrew Haines: We have asked for a report to be out before the end of March. We very much hope that can be completed. It is quite a challenging scope, but we have yet to appoint a chair, so whether or not it can be done in that time will obviously have to be a matter for the chair as well. It would be unreasonable to say, “You must do it,” if the chair thinks it will take longer, but we have set the target of the end of March to do that.
Q124 Martin Vickers: I would like to clarify one or two points that have emerged from earlier answers. Mr Haines, going back to the point you made about the limited regulation, have you requested from the DFT legislation or stronger regulation? What response have you received?
Andrew Haines: We have indicated that we were reviewing it. We have spent the last few months looking at other regulatory regimes and the limitations of the statute. We are on line to go to them in the new year and they know to expect a proposition from us in the new year. It will require some primary legislation, which is why we have to go through quite a lot of hurdles to make sure it is—
Q125 Martin Vickers: Are DFT content with that? Are they supportive of what you are requesting?
Andrew Haines: We have not had a detailed conversation yet because we have been doing the fact-finding. I have not heard anything that says they would not be. What we are looking for are the normal regulatory tools in most other sectors.
Q126 Martin Vickers: Would you acknowledge that the public are likely to be happier with a regulator that has the full powers he needs? Yes, NATS are co-operating with you, and that is good, but, for the confidence of the travelling public, surely they would want you, and you alone, to be responsible and have the necessary powers.
Andrew Haines: I think that is right. That is best practice. They can also take confidence from the overall performance record. Safety is on a continuous improvement trend, with significant improvement over the last 10 years, as well as operational performance. But, yes, they would absolutely expect a regulator to be able to intervene in a way that we are not currently able to.
Q127 Martin Vickers: Going back to the computer systems, Mr Rolfe, you mentioned that they had their roots in the 1990s. Can you categorically refute the suggestions and allegations being made through the media—and I heard one on Radio 4 on Saturday morning—saying that they had their roots in the 1960s? Is that definitely wrong?
Martin Rolfe: That is definitely wrong.
Q128 Martin Vickers: With regard to the improvements and investments you have made in the IT since the 1990s, have you got all you wanted? You haven’t been refused anything by your board.
Martin Rolfe: We have not been refused any investment that was requested. I would perhaps point out to this group that the challenge around investment is probably more around the speed at which it could be safety certified to put into operation, trained for and then used by the controllers. There is a natural limit as to how much of any of that you can do in any one year and how much testing has to happen. As an example, the system we are currently using has had about 500 man years of testing. It is a huge amount of testing that goes into every single upgrade.
Q129 Martin Vickers: Mr Deakin, you referred to a system that is operating 24/7 every day of the year and the inevitable pressures on it. You also referred to the back-up systems that you have. Were you suggesting that you need a bit of downtime to get the necessary improvements that are needed, or can you maintain a full service and upgrade at the same time?
Richard Deakin: Our plan is absolutely to maintain a full service. We do have to take parts of the system offline, improve them, upgrade them and then plug them back in. It is quite a challenge. You are effectively trying to maintain and upgrade a formula 1 engine that is racing round the track. To use another example, it is not like the railways at the weekend where you can put everyone on a bus. The engine is turning very quickly and you have to upgrade it in a safety critical sense. That is exactly what we plan to do.
Occasionally, as we saw on Friday, things do not always go according to plan, but our plans are very much focused around delivering at 100% capacity 100% of the time.
Q130 Graham Stringer: Mr Haines, do you regret not having an inquiry last time there was a problem, in December 2013?
Andrew Haines: I think the honest answer to that would be that, if this inquiry identifies things that could have been identified sooner, then I will. I do not at the moment because, ultimately, I think we had a root and branch review with NATS. It was a bit bumpy on occasions and that has been misreported in the media over the weekend, but we had a very systematic review. It was one of the things that contributed to NATS bringing forward major investment. If you were to talk to airlines and airports about NATS’s response this time, they would say it was significantly better on the back of lessons learned. At the moment, I don’t regret it, but I am open enough to say that if this inquiry finds things we could have learned then of course I would regret it.
Q131 Graham Stringer: You talk about the challenging scope of the inquiry. What do you mean by that?
Andrew Haines: We are trying to cover as many of the core issues as we can. What was the root cause? Were the lessons fully embedded and learned from 2013? Is there scope to advance investment? Has there been any impact of operational efficiencies? Is the regulatory regime supportive? It is challenging in the sense of being quite wide. We have tried to cover the range of issues we think are on the table.
Q132 Graham Stringer: We are told that we know exactly what went wrong, which is not always the case when you have inquiries into things that haven’t operated in the way they should. How will this inquiry differ from the regular reviews?
Andrew Haines: First of all, it needs to validate that. I do not doubt for a moment the veracity of what NATS are saying, but we need to absolutely establish, in the interests of transparency, that we really have caught the bottom of it and then ensure that the lessons that can be learned from that are fully identified. Are there transferrable lessons, for example?
Q133 Graham Stringer: I do not think that answers the question. You tell us one moment that there have been regular reviews, which is what you did rather than having an inquiry in 2013. You used slightly different words, but effectively you repeat the same thing as to what this inquiry is going to do. I do not understand what this inquiry will do which is different from what you tell us has been done over the last 12 months.
Andrew Haines: It uses independent experts to validate that and to provide assurance to a broader community that that has been done as rigorously as it might be done. It brings external capability and it gives us a focus. It is a function of having had two of these incidents in a week over 12 months.
Q134 Graham Stringer: What sort of resources will the inquiry have?
Andrew Haines: That is to be discussed with the chair. We do not want to limit that. We have told NATS that they must pay for that. We expect them to draw quite significantly on NATS’s resources. They may want an independent secretariat to the chair. That again would need to be funded. That is still in discussion with the chair and the panel members.
Q135 Graham Stringer: One of the things that worries me is that when Swanwick was behind schedule for 10 or 14 years—depending on when you start counting—I listened to a number of experts coming to this Committee and telling us that the computer system had fundamental flaws in it. I think Computer Weekly were the main people who put that. Now we have had two failures which, in essence, you are saying are not really a problem but just inevitable. Can we be confident in the system and that Computer Weekly and other experts 12 years ago were wrong, and you are right? Are some of the flaws in the system coming to the surface?
Martin Rolfe: Let me try and answer that. There were obviously lots of reports in the mid-1990s or thereabouts around the system.
Q136 Graham Stringer: Sorry, I do not want to interrupt but Computer Weekly and other experts were coming to this Committee in 2002, if I remember. There had been problems from the mid-1990s. They were telling us that the system would never be 100% foolproof.
Martin Rolfe: Since 2002, when the system went operational, we have had 14 years of very good service. There has been something in the region of 2 billion passengers and hundreds of millions of flights. We have had a number of failures over those years.
Q137 Graham Stringer: How many?
Martin Rolfe: It averages around about one or two incidents a year where there is some small delay to airlines—maybe a little less. Big incidents like this one are very rare. Previous to the one last year, I think it was five years before a similar one had occurred. They are exceptionally rare. They are very regrettable when they do occur, but I would disagree that the system is fundamentally flawed. It has performed exceptionally well since it has gone into operation.
Q138 Graham Stringer: How many failures are there that do not lead to delays?
Martin Rolfe: With any system of this size, with this many components distributed across the whole of the country, I think we have something in the region of 2,000 hardware failures of one type or another over a year. I would need to check the figures. You could equate that to a technical issue on an aircraft. It does not fundamentally affect the performance of the system. There are back-ups in place to make sure it gets fixed or to make sure it is resolved immediately and an engineer is on standby to go and replace parts as needed. The vast majority of those cause no delays to the travelling public or to airlines.
Q139 Graham Stringer: And how many software failures?
Martin Rolfe: Software failures would be part of that set. I do not have the breakdown of the numbers but it is relatively infrequent. It is certainly in the small numbers.
Q140 Graham Stringer: Mr Deakin, how often do you meet the Secretary of State for Transport?
Richard Deakin: I would say over the past year I have probably met him every six to eight weeks, something along those lines.
Q141 Graham Stringer: What do you discuss?
Richard Deakin: We talk about the performance in the UK; the investment programme that we have going forward; the Single European Sky programme, which, from our point of view of course, is particularly important as we look to join up UK airspace with the rest of Europe. There are some interesting angles there. Of course, the Secretary of State is very interested in the performance of the company as a whole in terms of safety and the operational performance.
Q142 Graham Stringer: Has he at any stage requested that you change how you are doing things? Has he made direct criticisms of NATS?
Richard Deakin: Not that I am aware of, but of course the Secretary of State relies on the regulator to look into the details of how we are run. Certainly the regulator—
Q143 Graham Stringer: But you have direct meetings with him, don’t you?
Richard Deakin: With the Secretary of State, yes, absolutely.
Q144 Graham Stringer: I presume, even though there is a relationship with the regulator, if he is bothering to meet you, he can say, “You are doing a really good job,” or “You could do better,” or “You are doing a terrible job.” I imagine that is part of the discussion.
Richard Deakin: As I was saying earlier, overall throughout the year, the performance is generally pretty good. I accept that Friday was not a great day, but if you look at how we perform compared with other air navigation service providers it is a pretty good track record.
Q145 Graham Stringer: I understand the statistics. What I am trying to get at is whether the Secretary of State, who, while he does not have direct line responsibility, has responsibility for transport in the country, has expressed any views about your performance to you directly.
Richard Deakin: The Secretary of State is very aware of the performance and how we compare with others in Europe.
Q146 Graham Stringer: I know; he told us he was aware. What I am asking is whether he has made any supportive or critical comments to you directly.
Richard Deakin: Clearly, he has a view about Friday and we have already discussed that.
Q147 Graham Stringer: We heard that. You are telling us you have half a dozen meetings or more a year, if you are having meetings once every six weeks to two months. I presume you talk about air traffic control. It is a simple question; it is not a trick question. Does he say that you are doing a great job, or is he critical? What kind of comments does he make?
Richard Deakin: Reflecting on the performance of NATS throughout the year, the performance is very positive, and the feedback is generally pretty positive, yes.
Q148 Graham Stringer: And those are opinions he gives to you. I am sorry, but you are just not answering the question. It really is not a difficult question. You keep coming back with the statistics. I want to know what he says to you.
Richard Deakin: Positive feedback based on the performance to date, yes.
Q149 Graham Stringer: On the metrics that the Secretary of State, NATS and the CAA have given us, it used to be one second per flight delay and now it is 2.5 seconds after Friday. Is that a sensible metric? If I was a minute delayed on every flight I went on, I wouldn’t even notice. Surely a sensible measure of your performance would be how many planes were delayed by more than half an hour or 15 minutes, something significant in a journey time that has been caused by air traffic control. Do you have those statistics?
Richard Deakin: Yes, certainly. It is a good question and the average delay per flight is one that is used across all of the air navigation service providers in Europe as a ready reckoner of the service levels.
Q150 Graham Stringer: It is still a rubbish metric.
Richard Deakin: I think it is a useful indicator of the level of disruption caused across the year. From a NATS point of view, taking into account last year’s figures, 99.7% of aircraft flying through UK airspace were not delayed. Of that 0.3%, I think the average delay was around 26 minutes.
Q151 Graham Stringer: That is a much more interesting figure. Do you publish that figure as well as the averages?
Richard Deakin: I think we do, yes.
Q152 Chair: Mr Haines, as the regulator how are you involved in these sorts of assessments or deciding what measures are appropriate?
Andrew Haines: Under the European regulation, the Single European Sky, we have to set the performance regime. We do that in consultation with airlines as the principal customers. As I mentioned, we have a suite of different measures. There is one for very bad days; there is one for average; and then there is one for what I think Mr Stringer is referring to, which are particular times when it is very busy—so delays in the morning and lengthier delays. There are three different pots and each is incentivised.
Q153 Chair: Who decides what sorts of measures are used? Is that decided by you or someone else?
Andrew Haines: Ultimately, we decide. We do it within the constraints of the European regime. We consult with the airlines, who say to us, “We want a basket. We want average delay because it allows comparison. Equally, we want to have comfort on very bad delays, and if a small number of our customers are experiencing long delays, we want there to be a pot of money targeted at those as well.” Indeed, financially that has the largest weighting. NATS are most heavily incentivised to reduce long delays to individuals. That, again, was from feedback of airlines, who said, “That is what matters most to consumers.” It is a bit like Mr Stringer is suggesting.
Q154 Chair: Have you informed the Department about the inadequacy of the powers of the regulator?
Andrew Haines: We have had those discussions historically. What we have agreed is that we would do this piece of work to do the comparison. We have a piece of work that is coming forward to the Department in January with recommendations on that basis.
Q155 Chair: When did that work start?
Andrew Haines: It was one of our lessons learned from December 2013. It was such a significant incident that we looked again at whether or not we had the right tools.
Q156 Chair: So that work is ongoing and will be published.
Andrew Haines: It is, yes, and there will be a recommendation with the Department for Transport in January.
Q157 Chair: Mr Rolfe, you spoke earlier about changes taking place to do with the Single European Sky. Could it be said that NATS has concentrated more on potential commercial opportunities for the future and perhaps ignored the needs of the present? Is that a fair comment?
Martin Rolfe: Certainly from my perspective, that is a very fair question. The Single European Sky piece is all around the regulated business. None of this is around commercial contracts. For us, it is all around the piece of work that we are doing as part of the work that is overseen by the CAA. All of that £575 million investment that we mentioned earlier and all of the £1 billion that we mentioned before that is non-commercial investment. That is all around improving the regulated business.
Q158 Chair: But there are proposals to become more involved in the market and a more competitive situation. Mr Deakin, can you tell us what NATS is doing in relation to that in the future and whether that is perhaps jeopardising the need to look at what is happening now?
Richard Deakin: Certainly. NATS as a company comprises of two entities: NATS (En Route) Ltd, which is the regulated side—and Martin heads that up—and NATS (Services) Ltd, which is the commercial arm. The regulated side is by far the bigger part of the organisation. We have a turnover there of around £700 million. On the commercial side, we have a turnover of around £220 million. The majority of that is through contracts in the UK with UK airports. We have overseas revenues of around £20 million. Naturally, we are looking at those opportunities. We provide air traffic control services in some countries overseas, consultancy airspace design and advice and so on. Certainly, as the market picks up, it is an area that we are interested in looking at further, but I do not think it impacts in any shape or form on the regulated side of the business in the UK.
Q159 Chair: Mr Haines, do you have any comment on this aspect?
Andrew Haines: It is an issue of which we are very conscious. We are not averse to the commercial arm by any means. There can be learning and value from it. We watch it very closely. It would be fair to say that we have seen no evidence of loss of focus within NATS. I think their general performance is confirmation of that. But it is a tension that is inherent in any regulated organisation which also has an unregulated element. That tension can be positive, but it is one that we need to watch very closely. It is a matter that we keep under close review.
Q160 Chair: Have you made any assessment at this stage about how NATS dealt with the problem once it arose and how they re-established normal flying conditions?
Andrew Haines: We have sought the views of airports and airlines who were there on the ground. The general feedback there is that it was very much better than the previous year. Heathrow was by far the most adversely affected. When you effectively stop movements, and departures in particular, at Heathrow for 15 minutes you end up blocking the stands and therefore the whole airport gets into gridlock. Crews become out of hours. It was probably not until lunchtime Saturday that BA were operating a full and normal operation. All the airlines I have spoken to—and I have spoken personally to several chief executives and airport chief executives—have said that NATS’s handling and communication was considerably better than last time.
Q161 Chair: Have you had any views from the passengers, not just the airlines?
Andrew Haines: What we are making clear in the inquiry is that, while the inquiry is not in a position to deal with passenger handling, the inquiry will take evidence from passengers and will then pass that on to us and other entities as a means of gathering those views.
Q162 Chair: The Business Secretary says that NATS has put profits ahead of investment. Do you agree with that, Mr Deakin?
Richard Deakin: No, absolutely not. The investment side of things has been a very significant part of our journey since privatisation. In fact, it is worth pointing out that since privatisation the investment in the company, depending on the year that you look at, has been between 1.4 and 1.9 times more than it was pre-privatisation. We have spent about £1.3 billion on investment to date and another £575 million over the next five years, in the next regulatory period in particular, to help with the deployment of the Single European Sky programme. Investment has been very much at the fore. It has certainly resulted in some very significant improvements in performance. The average delay per flight is down from 120 seconds per flight to two. There is a safety record that is second to none and a capacity increase during that time as well.
Q163 Jason McCartney: Following on from that, the Business Secretary called some of your kit antiquated or ancient. It was one of those “A” words. What is your response to that?
Richard Deakin: As Mr Rolfe has said, just because technology is old—if you say the 1990s is old kit, I guess it is by today’s technology standards—does not necessarily mean that it is not fit for purpose and does not do the job. We do not change systems out when the next model comes along. If it is doing what it is meant to do, then we will keep it in place for a suitable duration and do a planned change. These things take a lot of time to test and we do not chop and change systems because of the safety critical nature of the service that we deliver.
Q164 Jason McCartney: Where does the issue of cyber security come in the order of priorities that you are dealing with at the moment?
Richard Deakin: It is very high up on the list. Perhaps I can make a comment and then ask my colleague to comment. From my point of view, I chair a number of committees. Obviously, the cyber one is a key one from our point of view. I probably would not want to go into too many details in a public forum. The challenge there is to ensure that we have cyber protection built into the systems in a planned way rather than just a wrapper. We do put a huge amount of work into that. Of course, that is a particular challenge for the European network as well as we look to move everyone on to the next generation of systems. It is absolutely at the top of our priority list. From a design point of view, that is one of the checks before we sign off any systems in implementation.
Q165 Jason McCartney: Obviously the cyber attacks on Sony Pictures are in the news at the moment. Some people might link some of your older technology with a susceptibility or a weakness to cyber attacks. Would that be a fair assessment?
Richard Deakin: Ironically, it is the older technology that is generally more immune to cyber attack. All the modern technology is very much based on internet protocol. A lot of the older technology is not.
Q166 Jason McCartney: So we should all get ZX81s then.
Richard Deakin: Yes; that is an interesting angle. Point well made, I think.
Q167 Jason McCartney: Mr Rolfe, do you have any comments on that area?
Martin Rolfe: All I was going to add was that obviously, as you would expect, we have all the appropriate links into the various services around the country to make sure that we are made aware of any impending threats and anything that has happened in other parts of the critical national infrastructure. We monitor all those very carefully. They all get fed into the cyber review that we do on a monthly basis.
Chair: Thank you very much, gentlemen.
Oral evidence: NATS: failure in air traffic management systems, HC 897 2