Incident: Incorrect Passenger Weight Calculation Leads to Heavier-Than-Expected Takeoff.

Published Date: 2021-04-09

Postmortem Analysis
Timeline 1. The software failure incident where a Tui flight took off heavier than expected due to a software mistake happened on 21 July 2020 as mentioned in Article [113130].
System 1. Tui's reservation system update that led to the allocation of incorrect weights to passengers [113130] 2. Load sheet generation component of the IT system that produced inaccurate weight calculations for the Boeing 737 [113130]
Responsible Organization 1. The software mistake that caused the Tui flight to take off heavier than expected was attributed to an update in the airline's reservation system during the coronavirus pandemic, which led to the misclassification of female passengers using the title "Miss" as children [113130].
Impacted Organization 1. Female passengers on the Tui flight departing from Birmingham airport to Majorca were impacted by the software failure incident as they were classified as children due to the system error [113130].
Software Causes 1. The software mistake was caused by an update to the airline's reservation system during the coronavirus pandemic, which led to female passengers with the title "Miss" being classified as children instead of adults [113130].
Non-software Causes 1. The update to the airline's reservation system while its planes were grounded due to the coronavirus pandemic led to the allocation of a child's "standard weight" to female passengers using the title "Miss" instead of the adult figure, causing the discrepancy in weight calculations [113130]. 2. The glitch was described as a "simple flaw" in the IT system, which was programmed in an unnamed foreign country where the title "Miss" is used for a child and "Ms" for an adult female [113130]. 3. The system adaptation when the problem was first identified 11 days earlier did not correct the weight entries for the flights on 21 July, indicating a failure in the corrective action taken by the operator [113130].
Impacts 1. The software mistake caused a Tui flight to take off heavier than expected, with 38 passengers allocated a child's weight instead of the adult weight, leading to an incorrect load sheet and the Boeing 737 being more than 1,200kg lighter than it actually was [113130]. 2. The glitch resulted in two other Tui flights also taking off with inaccurate load sheets on the same day [113130]. 3. The system error led to the need for manual checks to ensure adult females were correctly identified as "Ms" on relevant documentation [113130].
Preventions 1. Implementing thorough testing procedures after system updates to catch any unintended consequences like the weight allocation error [113130]. 2. Conducting a comprehensive review of the software system by aviation experts to identify and rectify potential issues related to passenger classification and weight allocation [113130]. 3. Providing adequate training to IT personnel responsible for system updates to ensure they are aware of the potential impact of changes on critical operations like flight load calculations [113130].
Fixes 1. Implement a thorough review and testing process for software updates to catch potential issues before they impact operations [113130]. 2. Ensure that software systems accurately differentiate between titles such as "Miss" for children and "Ms" for adult females to prevent similar weight allocation errors in the future [113130]. 3. Conduct regular audits and checks on critical systems to identify and address any discrepancies or anomalies promptly [113130].
References 1. Air Accidents Investigation Branch (AAIB) [Article 113130] 2. Tui (airline operator) [Article 113130]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident happened again at one_organization: The same fault caused two other Tui flights to take off from the UK with inaccurate load sheets later that day after the initial incident [113130]. (b) The software failure incident happened again at multiple_organization: There is no specific mention in the article about the software failure incident happening again at other organizations.
Phase (Design/Operation) design (a) The software failure incident in the article was related to the design phase. The incident was caused by an update to the airline's reservation system during the coronavirus pandemic, which led to female passengers with the title "Miss" being classified as children instead of adults. This design flaw in the IT system, programmed in a foreign country where "Miss" is used for a child and "Ms" for an adult female, resulted in incorrect weight allocations for passengers on multiple flights [113130].
Boundary (Internal/External) within_system (a) The software failure incident in the article was primarily within_system. The failure was attributed to a software mistake in the airline's reservation system that occurred during an update while the planes were grounded due to the pandemic. This mistake led to female passengers with the title "Miss" being classified as children, resulting in incorrect weight allocations for 38 passengers on a Tui flight departing from Birmingham airport [113130]. The glitch was described as a "simple flaw" in the IT system, indicating an internal software issue. (b) There is no specific mention in the article of contributing factors originating from outside the system that led to the software failure incident.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the Tui flight incident was due to non-human_actions. The failure was caused by a software mistake in the airline's reservation system that classified female passengers using the title "Miss" as children, leading to incorrect weight allocations on the load sheet. This mistake was described as a "simple flaw" in the IT system, which was programmed in an unnamed foreign country where the title "Miss" is used for a child and "Ms" for an adult female. The system error resulted in the Boeing 737 taking off heavier than expected, but fortunately, the safe operation of the aircraft was not compromised [113130]. (b) Human actions were involved in addressing the software failure incident. After the issue was identified, the operator introduced manual checks to ensure that adult females were correctly referred to as "Ms" on relevant documentation. This manual intervention was implemented to prevent similar incidents from occurring in the future, indicating human actions taken to mitigate the software failure [113130].
Dimension (Hardware/Software) software (a) The software failure incident in Article 113130 was not attributed to hardware issues but rather to a software mistake. The incident was caused by a software glitch in the airline's reservation system, specifically related to how female passengers were classified based on their title ("Miss" for children and "Ms" for adult females). This software mistake led to incorrect weight allocations for passengers, resulting in inaccurate load sheets for the flights [113130]. (b) The software failure incident in Article 113130 was clearly attributed to a software mistake. The investigation by the Air Accidents Investigation Branch (AAIB) identified the root cause of the incident as a software flaw in the airline's reservation system. The glitch originated in the IT system, particularly in how titles were interpreted, leading to the incorrect allocation of weights for passengers on the flight [113130].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident in Article 113130 was non-malicious. The incident was caused by a software mistake in the airline's reservation system, specifically related to how female passengers were classified based on their title ("Miss" vs. "Ms"). This mistake led to incorrect weight allocations for passengers on the flight, resulting in inaccurate load sheets being produced for the captain to calculate take-off inputs. The investigation described the glitch as "a simple flaw" in the IT system, indicating that there was no malicious intent behind the error. The airline took corrective actions to address the issue and ensure the safe operation of the flights [113130].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The intent of the software failure incident related to poor_decisions: The software failure incident in the Tui flight incident was not due to poor decisions but rather a mistake in the software system. The incident was attributed to a software mistake that occurred during an update to the airline's reservation system, which led to female passengers with the title "Miss" being classified as children instead of adults. This mistake resulted in incorrect weight allocations for passengers, causing the load sheet to inaccurately state the weight of the aircraft [113130]. (b) The intent of the software failure incident related to accidental_decisions: The software failure incident in the Tui flight incident can be categorized as an accidental decision. The incident was described as a "simple flaw" in the IT system that occurred during an update to the reservation system while the planes were grounded due to the pandemic. The classification of female passengers as children due to the use of the title "Miss" was unintentional and led to the inaccurate weight calculations on the load sheet, causing the aircraft to take off heavier than expected [113130].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in Article 113130 was not attributed to development incompetence. The incident was described as a "simple flaw" in the IT system, which was programmed in an unnamed foreign country where the title "Miss" is used for a child and "Ms" for an adult female. The mistake occurred during an update to the airline's reservation system, which led to female passengers with the title "Miss" being classified as children, resulting in incorrect weight allocations on the load sheet for the flights [113130]. (b) The software failure incident in Article 113130 was categorized as accidental. The error in the software system that classified female passengers as children due to the use of the title "Miss" was unintentional and occurred during an update to the reservation system while the planes were grounded due to the pandemic. The investigation found that the glitch was not intentional but rather a result of the system being programmed in a way that caused the misclassification of passengers [113130].
Duration temporary The software failure incident described in Article 113130 was temporary. The incident was caused by an update to the airline's reservation system during the coronavirus pandemic, which led to the misclassification of female passengers as children. The glitch in the IT system was identified and corrected after the incident occurred, indicating that the failure was not permanent but rather temporary in nature [113130].
Behaviour omission, value, other (a) crash: The software failure incident did not result in a crash as the safe operation of the aircraft was not compromised despite the incorrect weight calculations [113130]. (b) omission: The software failure incident can be categorized as an omission, as the system omitted to correctly classify adult female passengers using the title "Miss" instead of "Ms," leading to incorrect weight allocations on the load sheet [113130]. (c) timing: The software failure incident is not related to timing issues as the thrust used for the departure was only "marginally less" than it should have been, indicating that the system performed its functions correctly in terms of timing [113130]. (d) value: The software failure incident falls under the value category, as the system performed its intended functions incorrectly by allocating child's weight to adult female passengers due to the incorrect classification based on the title "Miss" [113130]. (e) byzantine: The software failure incident is not characterized by byzantine behavior as there is no mention of inconsistent responses or interactions in the articles [113130]. (f) other: The behavior of the software failure incident can be described as a simple flaw in the IT system that led to incorrect weight allocations, which is not explicitly covered by the options provided [113130].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence no_consequence (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The consequence of the software failure incident: The articles do not mention any direct consequences such as death, harm, impact on basic needs, property loss, or non-human entities. The incident was described as a "serious incident" by the Air Accidents Investigation Branch (AAIB), but it was noted that the safe operation of the aircraft was not compromised, and the thrust used for departure was only marginally less than it should have been. The operator corrected the fault identified in the IT system, and manual checks were introduced to prevent similar incidents in the future. Therefore, the incident did not lead to any real observed consequences [113130].
Domain transportation (a) The failed system was related to the transportation industry as it affected the weight calculations for a Tui flight departing from Birmingham airport to Majorca [113130].

Sources

Back to List