History of the Flight
On 3 January 2021, an Airbus A321-251NX (registration G-UZMI) was being prepared for a commercial passenger flight from Bristol to Edinburgh. The originally allocated Airbus A320 had been replaced due to a technical issue, and a crew qualified on the A321-NEO was called from standby. The commander started boarding and received the Loading Form and Certificate (LFC) from the Turnaround Coordinator (TCO) via the Cabin Manager (CM). The co-pilot entered load figures into the Electronic Flight Bag (EFB) and noted that the center of gravity (CG) was towards the forward limit but within computed operational limits. The flight to Edinburgh proceeded normally.
During boarding at Edinburgh for the return sector, the CM noted that passenger seating did not match the LFC. A manual zone count revealed that the passenger distribution on the LFC was based on A320 row boundaries, not the A321-NEO. When the crew entered the manual count into the EFB, the CG was found forward of the permitted operating envelope. The commander instructed passengers to move to correct positions, and the LFC was annotated. The sector to Bristol and subsequent two sectors were flown without incident. Upon return, the commander filed an air safety report.
Investigation
The operator investigated and found that, unknown to the crew, the Bristol-to-Edinburgh sector had been flown outside the operational CG envelope (though not outside certified limits). The aircraft type and registration had been updated in the aircraft management system, but the departure control system did not reflect the change. When the TCO prepared the LFC, he extracted load details from the departure control system, which did not recognize the type change. Consequently, the passenger distribution reflected A320 seating, not A321-NEO.
Further investigation revealed that the discrepancy between systems was due to code errors in the Batch Interaction Layer (BIL), which operates outside original design specifications. The BIL handles data transfer between system elements. An internal validation process runs every five minutes to compare systems, but due to high schedule changes during the COVID-19 environment, the validation was delayed. Manual updates could be made after the type change registered, but in this case the manual change occurred after boarding had started, and the system provided no alert. The aircraft registration in the departure control system is not directly linked to type data, allowing separate changes.
The flight data monitoring showed no certified aircraft limitations were exceeded, and the aircraft manufacturer confirmed the flight was within certified limits. The operator implemented safety actions to strengthen procedures and prevent recurrence, including reviewing IT system interfaces and updating training.
Findings
The serious incident resulted from a combination of operating factors in a complex system interacting in an unintended manner. The final weight and balance calculation relies on accurate loading data; if incorrect, the safety barrier is compromised. The COVID-19 biosecurity measures changed the handover of the LFC from TCO to CM, reducing direct interaction with the flight deck. However, at Edinburgh, the CM’s check identified the error, leading to the safety report that initiated the investigation.
Safety Actions
The operator took safety actions to strengthen procedures and prevent recurrence. These included reviewing IT system interfaces, enhancing training for ground staff, and improving communication protocols for aircraft changes.