Airline software super-bug: Flight loads miscalculated because women using ‘Miss’ were treated as children
Weight blunder led to wrong thrust used on takeoff, says UK watchdog
A programming error in the software used by UK airline TUI to check-in passengers led to miscalculated flight loads on three flights last July, a potentially serious safety issue.
The error occurred, according to a report [PDF] released on Thursday by the UK Air Accidents Investigation Branch (AAIB), because the check-in software treated travelers identified as “Miss” in the passenger list as children, and assigned them a weight of 35 kg (~77 lbs) instead of 69 kg (~152 lbs) for an adult.
The AAIB report attributes the error to cultural differences in how the term Miss is understood.
“The system programming was not carried out in the UK, and in the country where it was performed the title Miss was used for a child, and Ms for an adult female, hence the error,” the report says.
The Register asked TUI where the system programming was done, but the company ignored that question in its response to our inquiry.
“The health and safety of our customers and crew is always our primary concern,” a TUI spokesperson said in an emailed statement. “Following this isolated incident, we corrected a fault identified in our IT system. As stated in the report, the safe operation of the flight was not compromised.”
Potentially fatal math
Flight load miscalculations have the potential to affect aircraft handling and to create serious safety issues: the figures are used for figuring out fuel levels, altitude, takeoff thrust, and so on. The 2018 fatal crash of Cubana de Aviación Flight 972, for example, has been attributed to excessive load, as has the 1997 crash of Fine Air Douglas DC-8 cargo flight.
According to the AAIB, the software issue was first spotted on July 10, 2020, when three adult passengers identified as Miss were checked in as children. Airline personnel caught the discrepancy and proceeded to make adjustments manually.
On July 17, the developer(s) working on the check-in application “adapted a piece of software, which changed the title of any adult female from Miss to Ms automatically.”
Alas, the revised code could only convert honorifics for passengers prior to check-in. Bookings made with the title Miss that had already checked in, including those checking in online 24 hours prior to departure, could not be changed.
“On 20 July, 2020, the programmer was making enhancements to the program to improve its performance,” the report says. “This should not have stopped the program from working, but as this was a ‘fix,’ it could not be known for sure. A combination of the [TUI] teams not working over the weekend [to make manual corrections] and the ‘online’ check-in being open early on Monday 20 July, 24 hours ahead of the flight, meant the incorrectly allocated passenger weights were not corrected.”
On 21 July, 2020, three TUI Airways flights departed from the UK with inaccurate load sheets as a result of the software issue, which would not be fixed until July 24, 2020.
The first of these, and the only one detailed in the report, was TUI Airways flight BY-7226, a Boeing 737-800 with the registration G-TAWG. The plane travelled from Birmingham International Airport in the UK to Palma de Mallorca in Spain, carrying 167 passengers and 6 crew.
The 737-800 departed with a takeoff weight that exceeded the load sheet (the projected weight) by 1,244 kg (~2743 lbs) because the load sheet listed 65 children on board, compared to the 29 children expected from the flight plan – which includes the actual weight. The load sheet also varied from the flight plan due to errant baggage weight calculations.
The result of all this was that the plane used less thrust to take off than it should have – 88.3 per cent instead of 88.9 per cent given its actual takeoff weight and environmental conditions. Fortunately, this was “marginally” more than the minimal regulatory requirements – 88.2 per cent – and the flight made it to its destination safely.
It’s suggested this won’t happen again: “An upgrade of the system producing load sheets was carried out to prevent reoccurrence,” the report concludes. ®
Reported by The Register on 8 April 2021.
Boeing 737 Sriwijaya Flight 182 Crashed in Indonesia Just After Takeoff on 9 January 2021.
Did the downturn of air travel caused by COVID-19 contribute to this crash?
The Sriwijaya 737 aircraft had been in storage for 9 months in Surabaya and was inspected on 14 December 2020 and since 19 December 2020 operated 132 flights.
Storage may have been a factor in the crash, aircraft must be kept operating otherwise they deteriorate. Mothballed planes pose a safety risk.
Pilot Who Hitched a Ride Saved Lion Air 737 Day Before Deadly Crash
Jumpseat rider played critical role in Indonesian cockpit
Pilot actions show multiple errors required to crash 737 Max
That extra pilot, who was seated in the cockpit jumpseat, correctly diagnosed the problem and told the crew how to disable a malfunctioning flight-control system and save the plane, according to two people familiar with Indonesia’s investigation.
The next day, under command of a different crew facing what investigators said was an identical malfunction, the jetliner crashed into the Java Sea killing all 189 aboard.
The previously undisclosed detail on the earlier Lion Air flight represents a new clue in the mystery of how some 737 Max pilots faced with the malfunction have been able to avert disaster while the others lost control of their planes and crashed. The presence of a third pilot in the cockpit wasn’t contained in Indonesia’s National Transportation Safety Committee’s Nov. 28 report on the crash and hasn’t previously been reported.
By contrast, the crew on the flight that crashed the next day didn’t know how to respond to the malfunction, said one of the people familiar with the plane’s cockpit voice recorder recovered as part of the investigation. They can be heard checking their quick reference handbook, a summary of how to handle unusual or emergency situations, in the minutes before they crashed, Reuters reported, citing people it didn’t name.
Lion Air spokesman Danang Prihantoro declined to comment on the role of a third pilot, saying, “All the data and information that we have on the flight and the aircraft have been submitted to the Indonesian NTSC. We can’t provide additional comment at this stage due the ongoing investigation on the accident.”
The Indonesia safety committee report said the plane had had multiple failures on previous flights and hadn’t been properly repaired.
Airline mechanics tried four times to fix related issues on the plane starting Oct. 26, according to the Indonesia preliminary report. After pilots reported issues with incorrect display of speeds and altitude in the two prior flights, workers in Denspasar, Bali, replaced a key sensor that is used by the Boeing plane to drive down its nose if it senses an emergency.
Flight data shows the sensor, called the “angle of attack” vane, which measures whether air is flowing parallel to the length of the fuselage or at an angle, was providing inaccurate readings after that.
However, the pilots on the harrowing Oct. 28 flight from Bali to Jakarta didn’t mention key issues with the flight after they landed, according to the report.
Their request for maintenance didn’t mention they had been getting a stall warning since about 400 feet after takeoff as a result of the faulty angle-of-attack sensor. It was still giving false readings the next morning on the flight that crashed, according to flight data.
Representatives for Boeing and the Indonesian safety committee declined to comment on the earlier flight. Boeing rose 1.1 percent to $377.59 at 12:03 p.m. in New York. The company’s market value tumbled about $28 billion through Tuesday after the Ethiopian Airlines crash.
The safety system, designed to keep planes from climbing too steeply and stalling, has come under scrutiny by investigators of the crash as well as a subsequent one less than five months later in Ethiopia. A malfunctioning sensor is believed to have tricked the Lion Air plane’s computers into thinking it needed to automatically bring the nose down to avoid a stall.
Boeing’s 737 Max was grounded March 13 by U.S. regulators after similarities to the Oct. 29 Lion Air crash emerged in the investigation of the March 10 crash of Ethiopian Airlines Flight 302. In the wake of the two accidents, questions have emerged about how Boeing’s design of the new 737 model were approved.
The Transportation Department’s inspector general is conducting a review of how the plane was certified to fly and a grand jury under the U.S. Justice Department is also seeking records in a possible criminal probe of the plane’s certification.
The FAA last week said it planned to mandate changes in the system to make it less likely to activate when there is no emergency. The agency and Boeing said they are also going to require additional training and references to it in flight manuals.
“We will fully cooperate in the review in the Department of Transportation’s audit,” Boeing spokesman Charles Bickers said in an email. The company has declined to comment on the criminal probe.
After the Lion Air crash, two U.S. pilots’ unions said the potential risks of the system, known as the Maneuvering Characteristics Augmentation System, or MCAS, hadn’t been sufficiently spelled out in their manuals or training. None of the documentation for the Max aircraft included an explanation, the union leaders said.
“We don’t like that we weren’t notified,’’ Jon Weaks, president of the Southwest Airlines Pilots Association, said in November. “It makes us question, ‘Is that everything, guys?’ I would hope there are no more surprises out there.’’
Following the Lion Air crash, the FAA required Boeing to notify airlines about the system and Boeing sent a bulletin to all customers flying the Max reminding them how to disable it in an emergency.
Authorities have released few details about Ethiopian Airlines Flight 302 other than it flew a “very similar” track as the Lion Air planes and then dove sharply into the ground. There have been no reports of maintenance issues with the Ethiopian Airlines plane before its crash.
If the same issue is also found to have helped bring down Ethiopian Airlines Flight 302, one of the most vexing questions crash investigators and aviation safety consultants are asking is why the pilots on that flight didn’t perform the checklist that disables the system.
“After this horrific Lion Air accident, you’d think that everyone flying this airplane would know that’s how you turn this off,” said Steve Wallace, the former director of the U.S. Federal Aviation Administration’s accident investigation branch.
The combination of factors required to bring down a plane in these circumstances suggests other issues may also have occurred in the Ethiopia crash, said Jeffrey Guzzetti, who also directed accident investigations at FAA and is now a consultant.
“It’s simply implausible that this MCAS deficiency by itself can down a modern jetliner with a trained crew,” Guzzetti said.
MCAS is driven by a single angle-of-attack sensor near the nose even though there are two of the sensors on the plane. Boeing is planning to alter the system to rely on both sensors to reduce the chances of a malfunction.
Reported by Bloomberg on 20 March 2019.
Video footage has emerged of a jumbo jet pilot taking a nap in the cockpit mid-flight.
The pilot is believed to be a senior officer for China Airlines, the national carrier of Taiwan. He is understood to have been flying a Boeing 747.
According to local media, he has been disciplined by China Airlines for breaching flight safety.
The pilot, with almost 20 years’ experience, was caught in the video fast asleep while the aircraft was mid-flight. It is not known when the snooze took place.
He was captured by a co-pilot, who filmed the incident and took photos. The co-pilot has also been disciplined for not waking the pilot up.
Earlier this month, a China Airlines pilot strike forced the cancellation of more than 100 flights, affecting almost 20,000 passengers, in an ongoing row about pilot fatigue.
Reported by Airlive.net on 22 February 2019.
Air India operations director stopped from piloting flight after failing breath tests
A senior pilot who is also director of operations for Air India, and has had responsibility for flight safety and training, said he was told by the carrier he failed two breathalyzer tests on Sunday before a flight to London from New Delhi.
It is the second time Arvind Kathpalia, who is also on the loss-making airline’s board, has been in trouble over alcohol tests. He was suspended for three months in 2017 for allegedly refusing to take breathalyzer tests.
Kathpalia told Reuters in an interview by phone that he would contest the results and claimed they were related to internal feuding within the state-owned company.
According to a description for the operation director’s job when Kathpalia got appointed in June 2017, he is responsible for flight operations, ground operations, and flight safety and training operations.
It is unclear if those remain the job specifications.
Air India declined to comment for this article.
Kathpalia failed two breathalyzer tests on Sunday and was declared unfit to fly, according to a pre-flight medical examination report for alcohol, posted on the website of news portal India Today.
Kathpalia, who denies he had been drinking, corroborated the results of the breathalyzer and said he was tested twice in a span of 20 minutes, adding that the second test’s reading was higher than the first.
“It was 1:30 in the afternoon, only a bloody stark raving alcoholic is bloody drunk at 1:30 in the afternoon,” Kathpalia said. “I am going to contest this.”
He said that at Air India “everyone is fighting with everyone,” and that he has been targeted.
In 2017, Kathpalia was suspended for three months when he had allegedly refused to take breathalyzer tests before and after his flight between Bengaluru and New Delhi and back in January 2017, according to a court document available on law portal Indiakanoon.
In August last year, the Indian Commercial Pilots Association, a trade union representing pilots of the state-owned carrier, filed a court case against Kathpalia requesting stern action against him over the missed breathalyzer tests and some other behavior.
Calls made to union representatives late on Sunday were not answered.
Kathpalia was executive director of flight operations during the earlier incident.
When he was promoted to operations director it was contested by the union in its petition to the court.
The court ordered the New Delhi police to file a first information report (FIR), the first step in India’s legal system that can lead to an investigation, against Kathpalia in August this year, according to reports in major Indian newspapers.
New Delhi police officials could not immediately confirm the status of the case.
The 2017 allegation “was a complete set-up,” said Kathpalia, who said it was the result of a scheduling issue rather than his refusal to take tests.
He claims that he is under attack partly because he is an employee of the original Air India, which was India’s international carrier, while the union is from the erstwhile Indian Airlines, which was a domestic carrier. The two airlines were merged into one in 2007.
“There is a lot of animosity after the merger. The animosity exists till today. They refuse to acknowledge each other,” said Kathpalia.
Reported by Reuter’s Promit Mukherjee; Edited by Martin Howell and Andrea Ricci on 12 November 2018.
Drunk Japanese pilot arrested at Heathrow Airport
A Japanese pilot who was arrested at Heathrow Airport for being drunk has admitted being more than nine times the legal alcohol limit.
Katsutoshi Jitsukawa, 42, who works for Japan Airlines, was arrested on 28 October after failing a breath test.
He was found to have 189mg of alcohol per 100ml of blood in his system – the legal limit for a pilot is 20mg.
The first officer pleaded guilty to exceeding the alcohol limit at Uxbridge Magistrates’ Court on Thursday.
Japanese broadcaster NHK reported that police were alerted by the driver of a crew bus who smelled alcohol on the pilot.
He had been due to be part of a crew flying a Japan Airlines (JAL) flight JL44 to Tokyo but failed a breath test 50 minutes before the departure time.
The Boeing 777 aircraft took off after a 69-minute delay.
JAL issued an apology and pledged to “implement immediate actions to prevent any future occurrence”, adding that “safety remains our utmost priority”.
The drink-drive limit in England, Wales and Northern Ireland is 80mg, compared to 20mg for pilots.
Jitsukawa was remanded in custody and will be sentenced at Isleworth Crown Court on 29 November.
In June, British Airways pilot Julian Monaghan was jailed for eight months for being caught on duty with 86mg of alcohol in his system. He had turned up for work at Gatwick Airport after drinking three double vodkas.
Reported by the BBC on 1 November 2018.
SINGAPORE: A Singapore Airlines (SIA) flight from Melbourne to Wellington was cancelled on Saturday morning (Sep 15) after the pilot failed an alcohol test.
Australia’s Civil Aviation Safety Authority had conducted a random drug and alcohol test on all crew members before the flight, and the pilot “did not pass the test due to having higher than suitable blood alcohol limit”, said an SIA spokesperson in response to Channel NewsAsia’s queries.
“The pilot in question has been suspended from all operations until an investigation is undertaken,” SIA added.
Flight SQ247 was scheduled to depart Melbourne at 7am local time on Saturday and arrive in Wellington at 12.20pm.
The return flight SQ248 on Saturday was also cancelled, said SIA.
Some passengers affected by the flight cancellation took to social media to express their frustrations, saying that they were not informed for several hours about alternative arrangements such as booking a new flight.
“Probably my most frustrating experience in an airport … just left the Melbourne airport after 6h waiting,” said one passenger on Twitter.
“We sincerely apologise to those affected by the cancellation of these flights. However, the safety of our customers and crew is our highest priority,” said the SIA spokesperson.
“We are currently working with those customers whose travel has been inconvenienced to find suitable alternate travel arrangements as soon as possible,” SIA added.
Reported by Channel NewsAsia on 15 September 2018.
Stale Cockpit Air May Be Dulling Your Airline Pilot’s Performance
New Harvard study finds pilots fail more tests with higher CO2
Carbon dioxide levels once thought safe are raising concern
That poorly ventilated conference room isn’t the only place with the potential for sick-air syndrome.
Airliner cockpits can also have levels of carbon dioxide elevated enough that in simulations it causes pilots to fail test maneuvers at higher rates than normal, a new Harvard University study has found.
The first-of-its-kind research suggests that current regulations aren’t adequate to assure there’s enough fresh air in airline flight decks and raises questions about whether even moderately elevated carbon dioxide levels could impact safety, said Joseph Allen, an assistant professor at Harvard’s School of Public Health and lead author of the study.
“It’s clear that the air quality in the cockpit can have an impact on performance,” Allen said. “It’s clear we haven’t been thinking about it too deeply in terms of the impact on pilot performance. Now that we know, I think we’re obligated to ask those next sets of questions and really understand it.”
In recent years, studies have shown that even an increase of a few hundred parts per million of carbon dioxide in the air we breath causes people to test lower for cognitive skills. But until the latest study, pilots and airline cockpits hadn’t been examined.
Normal levels in the atmosphere are 400 parts per million. Concentrations of the colorless, tasteless gas can rise in poorly ventilated spaces where people exhale it — such as crowded airliners.
Carbon dioxide levels reached as high as 1,400 parts per million on five percent of airline flights the European Aviation Safety Agency tested, according to data it released last year. The average was 603 parts per million, just slightly higher than levels found in the air.
Airliners replenish oxygen in a plane at high altitudes by pulling in the thin air and pressurizing it, mostly by scooping it from the front end of jet engines.
Because earlier studies showed people performed more poorly on tests of brain function at levels as low as 1,000 parts per million, the researchers thought it would make sense to examine pilot skills and carbon dioxide.
Thirty airline pilots were recruited to fly multiple three-hour segments in a special flight simulator in which carbon dioxide levels could be manipulated. Performance on 21 maneuvers — ranging from making a steep turn to handling an emergency engine fire — decreased as carbon dioxide levels rose, according to the study. Flight examiners certified by the Federal Aviation Administration rated the pilots’ performance.
At 700 parts per million, pilots were 69 percent more likely to correctly perform the maneuvers compared to when they were breathing carbon dioxide at 2500 parts per million. At 1,500 parts per million, they were 52 percent more likely to pass compared to the higher level.
The study was published Wednesday in the Journal of Exposure Science & Environmental Epidemiology.
Allen, who is also co-director of Harvard’s Center for Climate, Health, and the Global Environment, took pains to say that air travel is extremely safe. There has been only one passenger death on a U.S.-registered airline in more than nine years and there’s never been any evidence linking routine carbon dioxide levels to a crash.
However, several of the few recent fatal accidents that have occurred involved puzzling lapses in pilot performance, according to accident investigation agencies. One example was when a captain on a Colgan Air flight made a series of abrupt maneuvers in 2009 near Buffalo, causing a perfectly good commuter plane to plunge to the ground, killing 50.
One of the maneuvers the pilots in the study were tested on was a simulated engine emergency, which was similar to the real situation on April 17 when debris from a jet on a Southwest Airlines Co. killed a passenger, Allen said.
At the very least, Allen said, regulation agencies like the FAA might want to study the issue and compare the growing research on the effects of carbon dioxide with the existing U.S. regulations on aircraft design.
“The goal is to optimize conditions for a safe flight,” he said, “and the air in the cockpit has to be a part of that conversation.”
Current U.S. regulations governing aircraft air quality allow for concentrations of carbon dioxide were drafted in 1996 before its effects on human performance were known. It allows more than 10 times the levels found in the atmosphere, or 5,000 parts per million.
According to the limited data available, the air in most aircraft is below that ceiling. But there are indications that carbon dioxide can spike. Tests of air in aircraft passenger cabins show carbon dioxide levels typically climb to 2,000-2,500 parts per million during loading and unloading, when a plane’s ventilation system is operating at lower capacity.
“There’s virtually no information on the air quality in the cockpit. It’s the one place where it seems we really would want to know about the most,” Allen said.
Published by Bloomberg on 8 August 2018.
A study is needed on air in the passenger cabin.
Australian Government launches Probe launched into Singapore Airlines ‘tail strike’ flight SQ238
- Melbourne Airport Air traffic controllers warn pilot of smoke or dust coming from the rear of the aircraft on take-off
- Singapore Airlines pilot of the Boeing 777-300, with 282 passengers and crew on board, took the risk to continue to Singapore instead of returning to the airport to check for possible damage
- In the event of a confirmed tail strike, QANTAS policy is to turn the aircraft around
- Singapore Airlines confirmed that an engineers’ inspection of Flight 238 on its arrival in Singapore had revealed a tail strike with contact with the tail skid system. The aircraft is being repaired.
- Australian Transport Safety Bureau is investigating
Australia’s air safety watchdog has launched an investigation into a “tail strike” at Melbourne airport on Sunday where a Singapore Airlines captain flew on to Singapore despite being warned by air traffic controllers of smoke or dust coming from the rear of the aircraft on take-off.
The event has raised debate in the aviation sector about the wisdom of the pilot of the Boeing 777-300, with 282 passengers and crew on board, deciding to not return to the airport to check for possible damage.
A Qantas spokeswoman told The Australian: “In the event of a confirmed tail strike, our policy is to turn the aircraft around.”
A Singapore Airlines spokesman yesterday confirmed that an engineers’ inspection of Flight 238 on its arrival in Singapore had revealed a tail strike, but said it did not risk the integrity of the plane. “The inspection in Singapore confirmed there was no contact with the fuselage, (but) there had been contact with the tail skid system,” he said. “The affected component is being repaired and the aircraft is expected to return to service (today).”
He added: “Safety of our customers is our No 1 priority.”
The Australian Transport Safety Bureau is investigation. The aircraft took off on a day that saw wild winds, and the main runway was closed for 30 minutes as engineers inspected for damage after the accident.
“Following advice from air traffic control that a suspected tail strike had occurred, the captain confirmed there was no aircraft system alert of a tail strike and conducted further checks,” said the Singapore Airlines spokesman. “These checks, undertaken to confirm that all aircraft systems and parameters are normal as according to the tail strike checklist, also showed no indication of a tail strike and as such the decision was made to proceed.”
In 2009 at Melbourne airport, an Emirates Airbus A340-500 struck its tail three times, and sustained $100 million damage as it barely cleared the airport boundary fence before returning to make an emergency landing.
A tail strike led to the deadliest single aircraft accident in history in 1985 when a poorly repaired bulkhead on a Japan Airlines 747SR gave way several years later, leading to the loss of 520 people when it crashed.
Reported by The Australian on 11 October 2016.