This article is more than 1 year old
EasyJet flight loadsheet snafu caused by software 'code errors' says UK safety agency
System 'operating outside of the original design specification' said AAIB
An EasyJet flight to Edinburgh Airport took off with wrongly loaded passengers and baggage because of IT network congestion causing computer systems to interact "in a manner which had neither been designed nor predicted."
Last-minute aircraft changes followed by a critical but slow-running IT system meant the Airbus A321neo took off with a loadsheet intended for a different type of airliner. The loadsheet says where the aircraft's centre of gravity is – a vital safety calculation.
At the heart of the January 2021 cockup were "code errors" in EasyJet's departure control software suite, the UK's Air Accidents Investigation Branch said in a recent report.
"The various elements of the IT system architecture do not 'talk' directly to each other but operate through a variety of interfaces," found the AAIB, adding this "makes errors and inaccuracies more likely."
An alert EasyJet cabin manager spotted the loadsheet discrepancy when passengers began taking seats in places the loadsheet said they shouldn't be sitting. If passengers (and baggage underneath) sit in different areas from what the loadsheet says, during takeoff the airliner might become unbalanced – leading to control difficulties for the pilots, or worse.
The cabin manager flagged up the loadsheet to the captain of the January 2021 flight, scheduled to run between Edinburgh and Bristol. Detailed investigations discovered that EasyJet's departure control software (DCS) had generated a loadsheet for an A320 and not an A321neo, meaning weight-and-balance calculations were wrong for that flight. The older jet had been swapped out for the larger A321neo at the last minute.
"Further investigation by the operator revealed that the discrepancy in information displayed between the aircraft management system and the departure control system was due to code errors in the Batch Interaction Layer operating outside of the original design specification," concluded the AAIB.
Every five minutes, said the AAIB report, the DCS runs an "internal validation process" to refresh its data sources for each flight. These include directly communicating with the aircraft's onboard computers to check that the aeroplane physically present to operate the flight is the same one as the DCS is expecting.
Two factors upset the DCS in this incident: the last-minute aircraft swap and the COVID-19 pandemic, which the AAIB blamed for "a high number of changes to [EasyJet]'s schedule" that day.
With a number (unspecified in the report) of changes being made to the DCS, that five-minute refresh job became slower and slower: "… changes made outside the five-minute window were not detected automatically by the system".
- Airline software super-bug: Flight loads miscalculated because women using 'Miss' were treated as children
- British Airways' latest Total Inability To Support Upwardness of Planes* caused by Amadeus system outage
- Amadeus! Amadeus! Pwn me Amadeus! Airline check-in bug may have exposed all y'all boarding passes to spies
- 'It's like they took a rug and covered it up': Flight booking web app used by scores of airlines still vuln to attack – claim
Although gate staff had updated the DCS manually to input the A321neo, "the process did not consider this scenario and consequently the system had no mechanism to prevent the change of type being manually updated when boarding of the aircraft had started". The DCS used the aircraft registration letters as its validation for the aircraft, even though there was no cross-check linking the registration to the aircraft type.
"A type change registered in the [DCS] would prompt the seating algorithm to alter the [loading] figures, but the registration could match the previous aircraft causing confusion," found the AAIB.
EasyJet spokeswoman Holly Mitchell told The Register: "We are aware of the report and fully assisted the AAIB with its investigation. The safety of our passengers and crew is always our highest priority. We take events of this nature seriously and will always take action to ensure we maintain the highest standards of safety. While there were found to be no safety issues with this flight, we had already taken steps to implement actions to strengthen our procedures to prevent a recurrence."
Software-induced loadsheet dilemmas are not unknown in airlines. Back in April the UK offshoot of German airline TUI discovered it had been miscalculating passenger weights because its check-in software recorded the title "Miss" as belonging to children instead of adult women. Meanwhile in 2018 British Airways' entire fleet was grounded worldwide after travel tech supplier Amadeus suffered an outage of its loadsheet generation software. ®